Chances are it is one of your staff, but you don't know who or how. What do you do next ... Fraud can cripple a company, as can the inability to handle it when it occurs. Yet few organisations are ready to cope when it happens.
It's probably the manager's worst nightmare. A worried colleague calls one evening after discovering a £20 million-plus gap in your company's trading accounts. He suspects a senior executive is involved, and is in league with a mysterious external third party. There's no trace of the money. Later that night he calls back, saying the missing funds look more like £50 million and could even exceed that. Technically, the company is now insolvent. Within days, you could have the press on your back and market regulators chasing you. How do you deal with such a crisis?
Fraud, with or without personal gain involved, can strike when least expected, and can cripple a business. It erodes confidence in companies and markets, blights careers, and hurts ordinary investors. The global cost of financial crime is estimated at $500 billion a year and is growing.
In Europe alone it costs some $77 billion a year, according to accountants Deloitte & Touche. As trade barriers come down, and as computers speed up cash transfer and trading, so the chances for fraudsters improve. For organised crime, ripping off companies is now as big a business as drug smuggling, and is as big a source of money laundering. It is a growth market for enthusiastic amateurs too: companies' own staff are involved in three-quarters of all known frauds, says Ernst & Young.
The collapse of Barings in February 1995 after its Singapore-based trader Nick Leeson bet £830 million of the bank's own money remains one the juiciest examples of such failure. A former Barings insider says that for years crisis was a permanent feature of the bank's culture in the race to dominate each emerging securities market as it opened its doors to foreign brokers. 'We always tried to be first in, setting up shop in a hotel room with only a phone and fax.
Then, when we were allowed direct access to the local exchange, we would trade like crazy until the inevitable settlement backlog literally forced us to stop. Hit squads would then be jetted in to try to unravel the mess.' He warns: 'This is a very dangerous game to play. Since management attention is focused on firefighting the known problems, there is just not the resource or time to worry about what horrors might be developing.'
1 It could be you - so be prepared
The first thing to remember is that the onus to tackle fraud sits firmly on your shoulders. George Staple, former director of the Serious Fraud Office (SFO), who now heads the fraud investigation group at top City law firm Clifford Chance, says: 'There is a very heavy responsibility on management, handling as they do vast sums of shareholders' money, to ensure that their corporate systems are adequate for preventing foreseeable fraud.' Staple says that for managers to be able to deal with the issue, they must first understand what fraud is - and the risks they face. David Sherwin, head of accountants Ernst & Young's fraud investigation and risk management group, says: 'Management often fails to properly analyse the risks. They might be good at their business, but often don't have a clue when someone just walks off with all their profits.' Sadly in many financial scandals - whether fraud, or mere botch-up - managers' failure to run their business securely is often followed by similar ineptitude in dealing with the ensuing mess.
2 Call in the professionals
Thankfully for managers, outside professional advice is available to help prevent such problems, or to take care of them when they do happen.
International anti-fraud specialists among the 'big six' accountants, and among the top dozen or so firms of solicitors have developed anti-fraud units in order to wage war on fraudsters.
When a fraud hits the business, it is extremely helpful if you already have a plan of action for dealing with a such a crisis, say the experts.
Companies plan for such eventualities as hostile bids or major litigation, and should do so for suspected fraud, too. The plan should ensure all directors are informed of the problem in, say, the first hour of its discovery; a statement can be made after the first few hours; and a full board meeting can be called after the first 24 hours.
John Turnbull, partner heading the widely-renowned fraud investigation group at City law firm Linklaters, says: 'I do think companies should have a contingency plan. Not many do.' The plan needs to allow the immediate setting up of an investigating committee or team, involving key management and outside advisers as soon as a crisis hits the organisation, he says.
Both forensic accountants and lawyers carry out extensive 'fraud audits' for companies. Mark Tantam, partner in charge of fraud management services at Deloitte & Touche, who carried out share fraud audits for the British Energy and Railtrack issues and whose investigations include Polly Peck and Maxwell, says: 'Such audits do sometimes even detect fraud.'
3 Time to investigate (quietly)
The investigating team must be given board authority. Tony Woodcock of City solicitors Stephenson Harwood, which helped investigate Robert Maxwell's pensions theft, says: 'People will be taking decisions throughout the management of the crisis. These are the people to whom the accountants and lawyers report.' Woodcock adds: 'You have to decide the remit of the investigation, its timescale, the sort of team you're to deploy and the advisers you want to appoint. And whether you're going to tell the police.'
Every investigation is different. With some, says Turnbull, the problem is immediately apparent, and is not factually complex, so that the main need is for a speedy reaction, damage limitation and dealing with the consequences. At the other extreme, a problem appears to be emerging, but it may be of enormous size or great complexity. Here, a major exercise may be necessary before the full degree of what faces the company is properly understood. The team required to deal with the investigation needs to be tailored to meet the specific needs of the circumstances. The human resources department should be involved, too. Information about staff could be vital, and people may also need to be suspended.
Non-executive directors have an important role, says Turnbull. Problems exposed by an internal investigation often lead to the need to look at the conduct of senior executives and executive directors. There are occasions when even the actions of the board itself may come under scrutiny. Woodcock says: 'Getting the right balance in the team is important, as your thieves may be in the senior management. It may be that your chief executive is the prime suspect.' You should have a senior executive who can ensure that the practical issues which the investigators have to address are adequately dealt with by staff within the company. This is because investigators are invariably asking staff to do things which will be beyond the usual scope of their jobs, and which they may be reluctant to become involved in. So without some assertive and positive backing from an individual with real authority in the company, investigators can, warns Turnbull, be 'given the run-around'.
This careful balance in the investigating team cannot be overestimated.
For example, both the in-house audit team and compliance departments can be of invaluable help in the investigation. The big 'but' is that they are also the functions which come under the most scrutiny themselves, so keeping their role at arm's length is advisable. This also applies to external auditors, whom you may want to target later with a legal claim for breach of obligations to your company. Nearly every big company fraud, financial scandal, company collapse, and failed acquisition has resulted in such claims. The skills of forensic accountants are essential to the unwinding of complex or large-scale problems and quantifying the damage.
Ernst & Young's Sherwin, whose work has included high-profile cases such as Barings, Codelco (the Chilean state copper producer) and Morgan Grenfell, says: 'What we do is add value to the process, taking the problem away from management and allowing them to continue running their business.' They help protect evidence, and are expert at tracing assets, presenting and analysing large volumes of data. Many investigating teams have developed specialist computer software for the job, says Tantam. 'Using this type of software and good forensic accountancy skills, we can interrogate computer systems, recover deleted files, and rebuild accounts to find out where money and other assets have gone,' he says.
4 Get good lawyers
Good lawyers are essential to manage the investigation. Even document handling, such as collecting evidence and exchanging information between investigators, is essential to get right. Those papers, and your team itself, may be required for a civil or criminal court hearing. Robert Wardle, SFO assistant director in charge of policy, warns that: 'If a person knows, or even suspects, that the police or SFO are investigating - or are likely to investigate - a suspected fraud, but fails to preserve all relevant documents, they are then likely to be committing a criminal offence.' A company in trouble often turns to its in-house lawyers. Whether external lawyers should be involved depends on the nature of the problem and the expertise of the in-house team.
Internal sensitivities may mean that outside lawyers are needed. There will also be numerous other legal issues to deal with, including the preparation of evidence and witness statements.
There are immediate questions over the legal standing of the investigation team's inquiries, and how it goes about interviewing staff, outside third parties, and what degree of information should be given, and when, to staff, clients, the bank, company brokers, insurers, and regulators. 'We advise on how to deal with the Stock Exchange, and with public relations,' says Turnbull. 'We have an input in what is said, which must be accurate, and must not mislead the market.' The investigating team faces its own legal risks. 'You might find yourself very seriously at the end of a defamation writ if you start pointing the finger at people without sufficient evidence,' says Woodcock.
Decisions must be made on how to recover assets, often through aggressive legal actions. This can start with a court order requiring third-party banks to disclose data showing the movement of cash in and out of a suspect's account. It may involve injunctions to freeze suspects' assets, and court orders enabling you to search their premises and seize evidence. It may also involve the use of private detectives. And all this will usually involve an electronic paper chase through different jurisdictions.
Lawyers usually lead investigations, in order to preserve legal privilege.
At its simplest, privilege covers communication between lawyer and client which cannot be used by 'the other side' in court. But privilege can easily be broken - as when something enters the public domain, for example. Without privilege, documents from the investigation can be hauled into court and examined by a third party. That could mean the fraudsters themselves quite legitimately blowing your chances of suing them and recovering your assets.
5 Take press relations very seriously
Managing the information flow is essential. 'The only source of information should be the crisis committee. You have to decide how the situation is going to be portrayed to the outside world,' says Sherwin. Forensic accountants and lawyers usually vet all information flow and can often handle the press adequately. Often, though, they will recommend use of public relations professionals. Some PRs are expert at crisis management. William Clutterbuck of Maitland Consultancy has a track record which includes handling PR for the sheik of Abu Dhabi who, as the majority shareholder in BCCI, was the focus of world media. 'Uninformed press speculation can create a bigger problem: a crisis of confidence in the company, turning an embarrassment into a disaster,' he says. 'The way to deal with the press is to allow them to understand you are trying to help, but that you can't answer every question immediately,' Clutterbuck says.
Such was the problem for Morgan Grenfell Asset Management, after its fund manager Peter Young broke the IMRO rules by piling into unlisted company stocks. A former MGAM insider who helped deal with the crisis says: 'We didn't know if the hole was £1 million or £100 million.
It was crunch time in terms of communication: wild press coverage led to investors pulling out of Young's European funds.' He adds: 'It was such a surprise in the first place. One might have expected problems in a trading division, but not the tightly-run asset management business.'
Informing other interest groups is done on a need-to-know basis. Customers just need to know a problem is being dealt with. But, Clutterbuck warns: 'You must be clear, open, honest, and frank, without winding the whole thing up to a fever pitch.'
You may wish to involve the police if criminal activity is discovered but there is no legal requirement to inform them, says Tantam. Woodcock adds: 'It can be useful to wait until the investigation team has built up a detailed file, as some police forces like to be presented with a ready-made case.' Turnbull says: 'We have got the police involved in some cases very quickly - for stopping people at airports, for example. But there is no legal obligation to tell police, unless you suspect that terrorism or money laundering is also involved.'
Remember that financial crime, like the economy, is cyclical and so different frauds will emerge at different points in the cycle. When stock markets are high in value, frauds accompany the higher volume of takeover bids, says Staple. When the crash comes, the low economic tide exposes much of the wrongdoing. Further into recession, and businessmen resort to stealing shareholders' money in order merely to survive. Adds Staple: 'The big challenge ahead is how financial companies will handle a real sea-change in the stock market, if it occurs. For industry, with all the lessons so painfully learned, the question is whether they have got their anti-fraud systems in good working order.'
FRAUD MANAGEMENT: THE CASE OF UNILEVER
'There are people out there who will target companies like ours'
Corporate giant Unilever takes crisis management seriously. Like all big companies, it has the occasional local problems in its businesses abroad. But sometimes, the threat is more serious. 'We are aware that people have tried to hack into our systems to try to defraud us,' says Steve Williams, general counsel to (and joint secretary of) the Unilever group. Williams' colleagues have developed a corporate risk committee over the last two years to meet, among other dangers, the threat of fraud.
'You have to assume there are people out there who will target companies like ours, particularly through the IT system,' says Williams.
The global nature of Unilever's business brings its own dangers. 'One of the key areas where we have exceptional concerns is where we might be getting into bed with a business partner in certain parts of East Europe, Russia or the Far East. The kind of risks they can import have to be very closely monitored indeed.' Williams admits that Unilever, like many other companies, has had its share of problems: 'We have had two or three cases of significant local control issues which might have had an element of fraud somewhere in them, as well as a lack of local financial controls in the business.'
Unilever's experience supports the view of David Sherwin at Ernst & Young that companies must keep tight control of their non-core operations and subsidiaries overseas, especially when based in local environments which are prone to crime and corruption.
Unilever believes its committee system to be effective, though the need for vigilance is constant. It is largely run under the finance director, with assistance from the chief internal auditor. 'What this committee is designed to do,' says Williams, 'is identify risks ... which could threaten a significant part of our business.' The committee meets quarterly and its work involves a lot of creative thinking about where risk may arise. The next point of contact for the committee is the 12 business groups that make up Unilever, which need positively to assure the committee that all risks have been addressed all the way back up the management chain.