Some of you may remember former US Secretary of Defense Donald Rumsfeld’s speech about “known unknowns and unknown unknowns.” It was widely parodied but stuck with me. Managing many integrity risks falls into this gap.
During a project earlier this year, someone said (paraphrasing), “We get reports on emerging money laundering and consumer fraud scams, even cyber. Why don’t we get the same for corruption and other fraud areas?” That’s a gap we may look at plugging. But first, let’s take a step back and look at where the intelligence for those reports comes from:
Prevention: 🚦 Lateral thought (e.g. ‘red teaming’ and penetration testing) 🚦 Threat models and predictions 🚦 External collabs (the collective intelligence in fraud is high) 🚦 Lateral thinking (e.g. using pre-mortem analysis) 🚦 AI and machine learning predictive analysis
Detection: 🚦 Automated monitoring systems (e.g., analytics) 🚦 Testing (audits, transaction tests, etc.) 🚦 Speak-up channels and attentive staff 🚦 Culture & behavioural analytics (much overlooked) 🚦 Good old ‘four eyes’ and management review
Response: 🚦 Lessons from others (see re: Macy’s below) 🚦 Near misses root cause analysis 🚦 Alerts from external parties (customers, cops, etc.) 🚦 Crisis management simulations and training 🚦 Continuous improvement
These lists are not exhaustive, and not all are accessible to every in-house risk, compliance, or legal team. However, some will be. By doing this, we move away from the depressing picture seen in our Fraud Prevention Scorecard data, where no one feels their “organisation’s ability to adapt fraud prevention measures to new threats” is adaptable or highly adaptable.
As we start to move unknowns unknowns to known unknowns, they can, more quickly, become known (and then managed, transferred, mitigated, or avoided). The crucial bit is what I discussed last week: we need to communicate about fraud threats and risks. We must move fraud from “unknown don’t care” to “known and care” with our colleagues and broader stakeholders.
Which prevent, detect, and respond methods work for you? Which ones do you not understand (yet)? If you want to discuss them, you know where to find me.
Macy’s Fraud
If you’re looking for another example to demonstrate to resistant colleagues that fraud is not always “small” or impossible to prevent (a common cop-out), enter Macy’s.
The department store chain, which also operates Bloomingdale’s and Bluemercury cosmetics chain, “identified an issue related to delivery expenses in one of its accrual accounts earlier this month. An independent investigation and forensic analysis found that a single employee with responsibility for small package delivery expense accounting intentionally made erroneous accounting accrual entries to hide roughly $132 million to $154 million of expenses from the fourth quarter of 2021 through the fiscal quarter.”
Let’s reiterate.
🤦🏻♂️ One employee 🤦🏻♂️ Not an exec with high “sign-off authority” 🤦🏻♂️ One accounting process 🤦🏻♂️ Undetected for 3 years 🤦🏻♂️ Maybe $132m or maybe $22m more
But it’s okay, “the person behind the conduct is no longer an employee, and the investigation didn’t identify involvement by any other worker.” Is that latter bit meant to be reassuring?
Luckily, the Chairman and CEO assured investors, “At Macy’s Inc., we promote a culture of ethical conduct.“ The market was less convinced. In afternoon trading Monday, shares fell 3.3%, or 53 cents, to $15.77.
“Promoting a culture of ethical conduct” is meaningless if you’re not identifying and educating people on fraud. Part of that communication and training needs to assert that fraud is a sin of commission AND omission.