FRAUD PREVENTION Flashcards
corporations and other organisations may also be held liable for the criminal acts of their employees if
those acts are done in the course and scope of their employment and for the ostensible purpose of benefiting the corporation
An employee’s acts are considered to be
in the course and scope of employment if
the employee has actual authority or apparent authority to engage in those acts
Apparent authority means that
a third-party would reasonably believe the employee is authorised to perform the act on behalf of the company.
legal principle of “conscious avoidance”
establishes liability by showing
that the employer knew there was a high probability the fact existed and consciously avoided confirming the fact
A company cannot seek to avoid vicarious liability for the acts of its employees by simply claiming that it did not know what was going on.
Legally speaking, an organisation is deemed to have knowledge of all facts known by its officers and employees
if the government can prove that an officer or employee knew of conduct that raised a question as to the company’s liability, and the government can show that the company wilfully failed to act to correct the situation
then the company may be held liable, even if senior management had no knowledge or suspicion of the wrongdoing.
The corporation can be held criminally responsible even
if those in management had no knowledge or participation in the underlying criminal events and even if there were specific policies or instructions prohibiting the activity undertaken by the employees.
In fact, a corporation can be criminally responsible for the collective knowledge of several of its employees even
if no single employee intended to commit an offence
The Treadway Commission made several major recommendations that, in combination with other measures, are designed to reduce the probability of fraud in financial reports:
- A mandatory independent audit committee made up of outside directors.
- A written charter that sets forth the duties and responsibilities of the audit committee.
- The audit committee should have adequate resources and authority to carry out its responsibilities.
- The audit committee should be informed, vigilant, and effective.
The COSO report recommended that public companies’ management reports include
an
acknowledgment for responsibility for internal controls and an assessment of effectiveness in meeting those responsibilities
Internal Control is (The COSO report)
a broadly defined process … designed to provide reasonable assurance regarding the
achievement of objectives in the following categories:
− Reliability of financial reporting
− Effectiveness and efficiency of operations
− Compliance with applicable laws and regulations
Control Environment (The COSO report)
The control environment sets the moral tone of an organisation, influencing the control
consciousness of the organisation and providing a foundation for all other control
components.
There are several actions that management can take to establish the proper control environment for an organisation. (The COSO report)
- The establishment of a code of ethics for the organisation.
- Careful screening of job applicants.
- Proper assignment of authority and responsibility.
- Effective disciplinary measures.
According to COSO, risk assessment is a three-step process:
- Set objectives for the organisation.
- Analyse potential risks of violations
- Develop a strategy to manage risks.
COSO divides risks into two categories:
external risks and internal risks.
External risks include things like
increased competition, changes in
technology, shifting economic conditions, and new legislation.
Internal risks are factors such as
personnel changes, availability of funds for organisational projects, new operating systems, and the development of new products
Control activities are (The COSO report)
the policies and procedures that enforce management’s directives
Information and Communication (The COSO report)
This component relates to the exchange of information in a way that allows employees to carry out their responsibilities
A proper information system will
accomplish the following:
- Assimilate important financial, operational, and compliance information.
- Pass on pertinent information to those who need it.
- Provide for upstream communication
Monitoring is (The COSO report)
the process that assesses the quality of a control environment over time
Corporate Sentencing Guidelines provide for the substantial reduction of fines for corporations that
have vigorous fraud prevention programs
Corporations in the U.S. that wish to take advantage of the mitigation provisions of the
guidelines must
implement a “corporate compliance program.”
As provided by the Guidelines, to have an “effective compliance and ethics program,” the organisation shall:
- Exercise due diligence to prevent and detect criminal conduct; and
- Otherwise promote an organisational culture that encourages ethical conduct and a commitment to compliance with the law.
In designing “effective compliance and ethics program,”, certain factors must be considered by each organisation:
- Applicable industry size and practice – An organisation’s failure to incorporate and
follow industry practice or the standards called for by any applicable government
regulation weighs against a finding that the program is effective. - Size of the organisation – Large organisations are expected to devote more formal operations and greater resources to meeting the requirements than are small
organisations. For example, smaller organisations may use available personnel rather than employ separate staff to carry out ethics and compliance. - Recurrence of similar misconduct – The recurrence of a similar event creates doubt as to
whether the organisation took reasonable steps to meet the requirements.
To meet the two requirements of due diligence and promotion of an ethical culture, section 8B2.1 (b) sets forth the seven factors that are minimally required for such a program to be
considered effective:
- The organisation must have established standards and procedures to prevent and detect criminal conduct.
- Item 2 has three specific subparts:
a. The organisation’s governing authority shall be knowledgeable about the content and
operation of the compliance and ethics program and shall exercise reasonable
oversight with respect to implementation and effectiveness of the compliance and
ethics program.
b. High-level personnel shall ensure that the organisation has an effective compliance
and ethics program, and specific individual(s) within the organisation shall be
assigned overall responsibility for the compliance and ethics program.
c. Specific individual(s) within the organisation shall be delegated day-to-day
operational responsibility for the compliance and ethics program. These individuals shall report periodically to high-level personnel and, as appropriate, to the governing
authority (or a subgroup thereof) on the effectiveness of the program. It is also
required that these specific individuals be given adequate resources and authority to
accomplish their responsibilities and be given direct access to the governing
authority. - The organisation shall use reasonable efforts not to include within the substantial
authority personnel any individual whom the organisation knew, or should have known,
has engaged in illegal activities or other conducts inconsistent with an effective
compliance and ethics program. - Item 4 has two subparts:
a. The organisation shall take reasonable steps to communicate periodically and in a
practical manner its standards and procedures, and other aspects of the compliance and ethics program, to the individuals referred to in subpart (b) below by conducting effective training programs and otherwise disseminating information appropriate to such individuals’ respective roles and responsibilities.
b. The individuals referred to in subpart (a) above are the 1) members of the governing
authority, 2) high-level personnel, 3) substantial authority personnel, 4) the
organisation’s employees, and as appropriate, the 5) organisation’s agents. - The organisation shall take reasonable steps to accomplish the following:
a. Ensure that the organisation’s compliance and ethics program is followed, including
monitoring and auditing to detect criminal conduct;
b. Evaluate periodically the effectiveness of the organisation’s compliance and ethics
program; and
c. Have and publicize a system, which may include mechanisms that allow for
anonymity or confidentiality, whereby the organisation’s employees and agents may
report or seek guidance regarding potential or actual criminal conduct without fear of
retaliation. - The organisation’s compliance and ethics program shall be promoted and enforced consistently throughout the organisation through (a) appropriate incentives to perform in accordance with the program; and (b) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.
- After criminal conduct has been detected, the organisation shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organisation’s compliance and ethics program.