Awareness and activity in the fight against financial reporting fraud are as strong as ever, thanks in part to proactive efforts like the Anti-Fraud Collaboration. But let's face it—fraud happens, and, sadly, given human nature it always will.
So when a company identifies or suspects the existence of fraud, what steps should management and the board of directors take? What are key factors of which to be aware?
The Anti-Fraud Collaboration recently held a webcast to address these questions. This event, which I was pleased to moderate, brought together top experts from the regulatory, audit committee, auditing, and legal communities. It generated insights, such as the ones below, that should be valuable for anyone in the financial reporting supply chain.
A first observation is that dealing with fraud—particularly if it entails an investigation by government authorities—is usually not a walk in the park. "It's going to be stressful," said webcast participant Rodney Chase, who currently serves on the board at Tesoro Corporation and Hess Corporation, and who previously chaired the boards of Genel Energy, plc and Computer Sciences Corporation. Mr. Chase added that for a company's independent directors, "this is likely to metamorphose into something that's pretty close to full-time."
Be Aware of Government Programs around Cooperation
If the fraud rises to the level of government involvement, it's important to have awareness of programs in the fraud area, especially regarding cooperation and self-reporting.
In the United States, for example, the Division of Enforcement of the Securities and Exchange Commission (SEC) has an Enforcement Cooperation Program in place. It includes various measures designed to encourage individuals and companies to provide assistance to SEC investigators. Depending on the level of cooperation, benefits may accrue to those who are proactive.
To assess that proactivity, the SEC program uses a framework that is essentially:
During the webcast, panelist Kara Novaco Brockmeyer, Chief of the SEC's Foreign Corrupt Practices Act Unit, provided some color on the notion of "cooperation" and getting credit. She outlined cooperation examples, including:
- providing regulators with downloads of important documents or other information from the company's own internal investigation;
- providing access to potential witnesses who are overseas or otherwise difficult to reach; and
- translating documents that are in foreign languages (which can help speed up investigations).
Understand the Meaning of "Voluntary"
It might sound obvious, but when it comes to cooperation with regulators, it's important to distinguish between taking voluntary action and simply doing what the government asks. Panelist Fiona Philip, a Partner with law firm Sidley Austin LLP, observed that "oftentimes you hear clients say, 'but we brought in a number of witnesses for testimony,' or 'we produced millions of pages of documents.'" Yet if those individuals or documents were already subpoenaed by the authorities, she explained, that is not considered "cooperation" for the purposes of getting credit.
Think Carefully About the Right Time to Self-Report
When it comes to getting credit for self-reporting fraud, what is the best timing? Ms. Brockmeyer noted that, in order to get the most credit, a company needs to self-report before the SEC has discovered the potential fraud.
That's not to say, however, that self-reporting should happen at the very outset either. Ms. Philip noted that a good scenario for self-reporting is when she has at least a solid preliminary grasp of what may have occurred. "I have a sense of who the key players are," she said. "I can speak to the SEC about what the potential violations are…and what our roadmap is for the internal investigation that we will conduct."
Get the Board Engaged
The decision to self-report, said Ms. Philip, "should involve the board of directors being actively engaged." Mr. Chase agreed. "This is an issue which needs to move to the desks of the independent board members," he said, "and they need to think about how they're going to organize themselves."
Yet while it's vital for the board to be engaged, there are limits to that engagement. Panelist Timothy Hedley, a Partner at KPMG LLP, emphasized the board has an oversight role—not an investigative one. "I've seen audit committees attempt to do the investigations themselves," he said. "I don't think that's necessarily appropriate."
Notify Your External Auditor Immediately
In the event of a potential fraud, Mr. Hedley also stressed the importance of a company notifying its independent auditor in a timely manner. "Under no circumstance would [the auditor] direct the investigations," he said, "but we would certainly want to be cooperative in the investigation and fully informed of it." The Ms. Brockmeyer added that the auditor has an obligation under US federal law to notify the SEC of wrongdoing, should management or the board of directors fail to handle the wrongdoing appropriately.
Prioritize Independence, Even If It Takes Some "Triage"
Getting to the bottom of a fraud, in most cases, often requires bringing in an independent entity, such as an outside law or accounting firm. "Moving to a truly independent investigative capability is absolutely the right thing to do," said panelist Chase. "It may take a few weeks to get to that point, but it's the right way forward."
Mr. Hedley agreed, noting that a company may "start the initial triage" of a problem with its retained or preferred outside law firm. Then, it will bring in a separate firm to enhance independence. "In investigations, you have to be fluid," added Ms. Philip. "Just because you start with a certain investigation plan, that doesn't mean that's the plan through the entirety of the investigation."
Communicate and Work to Build Trust
As with so many issues related to financial reporting, communication is essential when fraud strikes. "One of the key things for cooperation that works best," said Ms. Brockmeyer "is establishing trust early on between a company's outside counsel and the government."
Full and frank communication is vital to this trust, she added, and it also can help streamline or expedite investigations. Why? In some instances, an issue that may appear serious to a company may actually not be of much interest to the regulator. On the flip side, sometimes what looks like a minor issue for a company is a big deal for investigators. Said Ms. Brockmeyer: "If you have developed a relationship with trust—which I know sounds odd when you're under investigation—you can talk through those issues."
Do you have insights to share on steps to take and things to keep in mind when fraud or suspicion of fraud surfaces? I welcome your thoughts in the comments. And be sure to visit www.antifraudcollaboration.org for videos, reports, and articles on fighting fraud.