According to an October 26, 2013 Washington Post report, between 2008 and 2012 more than a thousand not-for-profit organizations acknowledged losses of a quarter million dollars or more — losses stemming from theft, investment fraud, embezzlement or other unauthorized use of funds. These are just the acknowledged losses by organizations willing to self-report. The actual fraud-related losses suffered by not-for-profits is likely far greater, according to analysts.

While many not-for-profits lost money in the infamous Bernie Madoff Ponzi scheme, there were a lot of large losses from a variety of scams, both large and small. Many, if not most, scams were perpetrated by insiders: trusted executives, employees, suppliers or long-time volunteers.

Trust is the essence of a not-for-profit's philosophy. Not-for-profits are fundamentally based on the charity, faith and goodwill of fellow citizens. Yet trust is partially what makes these organizations vulnerable to fraud.

Since not-for-profits aim to create a culture of honesty they often lack the same level of controls employed at for-profit companies. Pressure on the board of directors and senior management to allocate budgets to areas where the funds do the most good — namely the specific charitable purpose that drives the organization, and activities that raise additional funds to support that charitable purpose — leaves little or no resources for internal controls.

Uncovering Fraud

Analysts suggest that it takes an average of two years for fraud to be detected – ample time for an organization to suffer a significant loss. The misdeeds are usually discovered in response to a tip or by accident, rather than through audits or internal controls. Greater vigilance is necessary in order to detect fraud in its early stages.

When it comes to fraud committed by employees, these perpetrators share several key characteristics:

• Trusted and longtime employees of the organization
• A member of senior or middle management
• Dominant or controlling personalities
• Refuse to delegate work
• Maintain inadequate accounting records

Common Red Flags

Organizations must identify and watch for common signs of fraud. Here are some examples:

Little or no segregation of duties
Duties such as the handling of cash, authorization of invoice payments and the custody of physical assets are handled by one or few individuals.

Inadequate physical security
Failure to provide proper levels of physical security for premises during and after work hours; access to sensitive areas by all employees.

Insufficient IT security
Failure to provide an adequate level of security for an organization's IT network, including network servers, computers, and all telecommunication systems.

Unusual cash transactions
Cash transactions that appear unusual and lack proper authorization; and transactions that lack supporting documentation.

Unexplained increase in expenses
Unusual or unsupported increases in expenses compared to financial budgets and industry norms.

Questionable documents
Documents that lack authentic characteristics and appear altered or duplicative.

Steps to Minimize Your Organization's Exposure to Fraud

Ensure a strong commitment from senior management
Senior management has a responsibility to set the tone when it comes to fraud, and create a culture of ethical behavior. Without it, employees will feel that fraud is effectively condoned by the organization.

Written policy concerning fraud and ethics
All not-for-profits should have a formal written policy concerning fraud and ethics. All newly hired employees should be required to review and sign a copy of the policy.

Ensure proper oversight
A committee or individual(s), depending on the size of the organization, should be tasked with ensuring that all aspects of a written policy concerning fraud and ethics are followed.

Implement strong internal controls
Analyses of frauds committed at not-for-profits usually point to the same cause - poor internal controls. Many organizations lack the proper segregation of duties, especially when it comes to the flow of money. Strong internal controls and proper segregation of duties lower the risk of fraud.

Create a comprehensive vendor policy
The majority of frauds committed by employees of not-for-profits involve some variation of vendor fraud. An employee can create a fictitious company and submit invoices for services never performed or inflate invoices for goods and services. Many times an employee will collude with an individual outside of the company. A strong policy that scrutinizes vendors is recommended. It should use data analytics in highlighting similarities among questionable vendor invoices. Look for identical or similar tax identification numbers, addresses, and vendor names.

Implement an expense reimbursement policy
Schemes involving expense reports submitted by employees often involve inflated expenses, expenses incurred for personal reasons, or expenses that an employee never incurred. A written policy should outline the types of reimbursable expenses, as well as the documentation required to support a reimbursement request. Further, a not-for-profit that issues purchase cards or company credit cards to its employees must be extra vigilant in monitoring the use of the cards. Often employees abuse the cards by using them for personal reasons or for purposes unrelated to their official duties.

Require annual training
In order to increase the awareness of potential fraud and ethical issues employees should receive mandatory, annual training. Organizations committed to preventing fraud and creating a culture of ethical behavior must rely on their employees to accomplish this goal. Without buy-in from their employees, organizations will fail to attain the desired ethical environment.

Establish a hotline
The vast majority of fraudulent schemes are discovered as a result of a tip. Employees who have knowledge of a fraudulent scheme or unethical behavior are reluctant to get involved due to fear of losing their job, peer pressure, or retribution from the company or fellow employees. A program built on confidentiality which protects all employees will encourage them to report these matters to senior management. Protecting the identity of the reporting employee is paramount to any successful program.

Conduct a risk-based audit
If senior management suspects fraud or abuse is being committed it may be prudent to hire an independent forensic accountant to conduct a risk-based audit. Many times management relies on audits conducted by their internal or outside auditors. These audits often fail to uncover evidence of wrongdoing. A professional trained in forensic accounting is better equipped with the skills to uncover evidence of fraud in a timely and cost-effective manner.

Regularly review written policies
Each year an organization should undergo a review of its written policies to ensure they properly address the risks associated with a not-for-profit organization. Such a review allows the organization to assess the strengths and weaknesses of existing policies and make any needed changes.

Questions?

Fraud is rampant in the business world and not-for-profit organizations are not immune. Limit the risk of fraud in your organization by taking measures to protect your assets and reputation. For more information on preventing fraud at your organization, contact your local CBIZ office.

Copyright © 2013, CBIZ, Inc. All rights reserved. Contents of this publication may not be reproduced without the express written consent of CBIZ. To ensure compliance with requirements imposed by the IRS, we inform you that-unless specifically indicated otherwise-any tax advice in this communication is not written with the intent that it be used, and in fact it cannot be used, to avoid penalties under the Internal Revenue Code, or to promote, market, or recommend to another person any tax related matter. This publication is distributed with the understanding that CBIZ is not rendering legal, accounting or other professional advice. The reader is advised to contact a tax professional prior to taking any action based upon this information. CBIZ assumes no liability whatsoever in connection with the use of this information and assumes no obligation to inform the reader of any changes in tax laws or other factors that could affect the information contained herein.

CBIZ MHM is the brand name for CBIZ MHM, LLC, a national professional services company providing tax, financial advisory and consulting services to individuals, tax-exempt organizations and a wide range of publicly-traded and privately-held companies. CBIZ MHM, LLC is a fully owned subsidiary of CBIZ, Inc. (NYSE: CBZ).