Although it might not be possible to predict all frauds and financial irregularities, it is not true to say that businesses cannot plan for them. This article co-authored by Kaley Crossthwaite and Richard Shave provides businesses with a user friendly guide of proactive steps to take and how to plan for a crisis. It also reflects on what could be called the perfect year for a fraudster.
Could 2020 have been the perfect year for a fraudster? Quite possibly. Financial irregularities and fraud can happen at any time, but the wide-scale changes made to the way we work, driven by the COVID-19 pandemic, has led to a whole new breed of fraud risks, as well as the re-emergence of some old scams, as the fraudsters adapt to a world of new opportunities.
2020 has been a boom period for fraud as corporates all over the world make rapid and often dramatic changes to their normal working practices. It has become clear that in the rush to adapt their operational procedures, many businesses may have inadvertently cut corners and created new fraud vulnerabilities. The unfortunate reality for some businesses was that despite a long, hard fight to stay operational and solvent during the pandemic, the thing that bought them down was not the lack of trade or liquidity, but fraud.
In these times of economic stress and heightened fraud risk, now more than ever, businesses need extra vigilance to prevent and detect fraud issues. Sadly, history has shown us time and again that no matter what controls and procedures are put in place, fraudsters can often find a way to bypass those systems, so the need for companies to have a clear crisis management strategy remains critically important. Only by doing this will they be prepared and ready to take decisive action when a fraud crisis hits them. Indeed, the way the pandemic crisis has impacted the world, seemingly coming out of nowhere, has been the catalyst for some businesses to take a step back and consider crisis planning in a new light.
A well-thought-out crisis management plan should be a staple part of any organisation’s broader contingency planning process. It is important there is a framework in place to guide an organisation through the process, ensuring that when a problem arises, the response can be swift and sure-footed. A good crisis management plan will empower a business to manage their response effectively and can have a dramatic influence on a company’s chances of successfully navigating a crisis.
It is worth reminding the reader that an effective crisis management plan will be one that is regularly reviewed and updated, rather than one that is drafted and left in the cupboard as “job done”.
In this article, we consider the explosion of fraud cases that arose during 2020, before considering some core elements of a sound crisis management plan.
Back to top
The 2020 Fraud Boom
The speed at which businesses have forced through change during 2020 has been unprecedented.
As the FT¹ put it in May 2020: “New laptops for Indian remote-workers? Done, “overnight”, according to Unilever. Company-wide wellbeing software? BP sealed a contract in 10 days that would usually take six weeks. New staff to plug gaps? Serco, the outsourcer, has cut its hiring process from five weeks to less than three.”
This was a period when businesses were looking to cut through red tape, bypass outdated policies and make proactive changes to their operational, structural and technological frameworks. Big decisions were made over short time scales in a volatile business environment.
Whilst the various Government stimulus schemes provided a vital funding lifeline to many businesses, the speed at which the schemes were devised and the light touch claims-authorisation process led to concerns about the levels of fraudulent claims submitted. This effectively came down to a speed versus accuracy trade-off for the Government who, on one hand wanted to quickly make funding available to businesses, but on the other hand needed to make the process as watertight as possible to detract fraudsters. This speed versus accuracy dynamic was mirrored in everyday business decisions made by businesses all over the world, with some placing more weight on fraud risk than others.
So, whilst some businesses gave careful consideration to associated fraud risks, the level of urgency required to stay afloat and drive through change ultimately meant some decisions were not fully thought through before implementation.
Had the new systems been properly tested? What were the new risks associated with home working and these new systems? Was there still sufficient segregation of duties in place? Had staff been properly trained? How well do we really know these new suppliers and/or recruits? These and other questions were not always fully answered and, as a result, a host of opportunities arose for fraud. Common examples of resultant frauds suffered by businesses during the pandemic include the following:
- Cyber-attacks. The level of cyber-attacks on businesses has reached new highs in 2020 and a host of issues such as new government funding schemes and tax rules means the fraudsters have plenty of opportunity to develop new hooks to tempt recipients to click on bogus email links. Corporate victims of this type of fraud often find that an employee’s user identity has been compromised, leading to the scammers gaining access to the business’s systems.
- Spear phishing. With millions of employees now working at home, companies face a higher risk of being defrauded by people from outside their operations as it is harder to verify identities. Entities have found that formerly face-to-face business is now being conducted by telephone or video call and so are vulnerable to impersonation, or “spear phishing” or “whaling” frauds. These frauds typically target or impersonate the C-suite and typically involved emails purporting to be from senior executives authorising fund transfers or requesting financial information.
- Bank mandate fraud. A rash of frauds arose, preying on companies struggling to pay their bills as the COVID-19 lockdown hit income. An old favourite of fraudsters has long been posing as genuine suppliers and providing new, fraudulent bank account details, with common recent examples including bogus landlords purporting to offer rent discounts or deferrals in exchange for down payments. Other common frauds also involve bogus new suppliers of in-demand equipment, from protective masks to testing kits and temperature gauges.
- Supply chain disruption. With large numbers of suppliers going bust, new business relationships often need to be forged at pace in order to maintain supply chains. Frauds have arisen after insufficient due diligence was conducted on these new suppliers, some of which ultimately turned out to be bogus. There have been a range of common frauds from incorrect/low-quality goods being supplied, to the receipt of far fewer goods than were ordered and counterfeit goods.
- Insider fraud. Although many employees were laid off or furloughed during 2020, there are some areas of expertise that are very much in demand, for example IT. With home working becoming commonplace during lockdown, many businesses had an urgent need to strengthen their IT teams in order to support the remote working platforms that staff were now using. This need to capture these specialist resources quickly, often in a competitive environment, led to some businesses not undertaking sufficient due diligence on the candidates. As a result, some businesses became victims of fraud after inadvertently hiring fraudsters into their teams who then acted as insiders to facilitate fraud. We predict that there will be many more insider frauds that have yet to be detected – some may take years to come to light without robust internal controls and reviews.
- IT-related fraud. During the lockdown, many remote working employees are more reliant than ever on IT teams (either internal or external) and many frauds resulted from employees dropping their usual level of scepticism and providing a bogus IT support member with sufficient personal information for them to access their corporate accounts.
- Increased home working also resulted in businesses’ data often not being as well-protected as it normally was. During the lockdown period, cybersecurity company ThreatAware estimated that up to 55 per cent of business PCs may have been vulnerable to cyber-attack as they were now connected to home networks that lack sophisticated protection. Zoom quickly became the business communication tool of choice in the early part of the lockdown before reportedly experiencing a decrease in its clientele as a result of concerns over security breaches by fraudsters targeting users’ personal data. Many businesses were quick to switch platforms as reputation for safety and good robust working practices remained important to maintain trust from investors, clients and suppliers.
The huge spike in corporate fraud in 2020 has had a big impact not only on the businesses themselves but also those behind the corporate structures, from creditors to those who have lost their livelihoods, such as employees and investors.
Back to top
Well-organised businesses have spent time and resources reassessing their core fraud risks in the new working environment, implementing training and new fraud awareness programmes, and amending procedures and controls to suit the new ways of working. Many businesses have also been re-assessing their crisis management approach. The unforeseen arrival of the pandemic and the dramatic impact it has had on the corporate world has led to a renewed energy among some businesses to ensure they are properly prepared for the next crisis, whatever that crisis may be. We set out below a guide to some of the core issues being considered.
Crisis management – a user-friendly guide
Plan for the crisis
Although it might not be possible to predict a crisis, it is not true to say that you cannot plan for it. The last thing that an organisation has capacity for during a crisis is finding and engaging external advisors, so at the very least an organisation can meet and agree terms with lawyers, forensic accountants, PR agencies and other specialist external advisors. Additionally, the organisation should establish a crisis committee, agree communication methods with members of that committee and put in place contingency plans in the event that certain members of the committee are not available, or able to assist. A crisis management plan should be clearly documented and communicated to the necessary people, but it should be flexible and able to change depending on the nature of the crisis.
The immediate priorities
The first challenge for the organisation is to identify the issue. This sounds so simple, but it is often the most difficult thing to do. It is so important to do this in order for the organisation to ensure it has the right people with the best skills and experience to help it to navigate its way through the crisis. Also, until the issue is identified, it is impossible for the organisation to appoint the correct chairperson of the crisis committee. Experience has taught us that the stakeholders want and need to hear from the top, but it has also told us that the most senior member of the organisation is not always best placed to lead the investigation and communication.
Once the organisation has identified the issue, it should ensure that it preserves all the relevant information and data and considers whether it needs to maintain privilege. The best rule of thumb is to always assume that privilege should be maintained, so organisations should speak to their lawyers at an early stage.
Depending on the nature of the crisis, there might be a need to suspend employees or relations with external third parties immediately. However, it is important to remember that any action taken by an organisation in this regard might have an impact on contractual relationships and these must be considered as early as possible.
Stakeholder management and communications
It is important to recognise that the organisation needs to communicate well both internally and externally in order to avoid adding to the crisis. There is an understandable temptation to say nothing until the issues are clear and a certain amount of investigative work has been done. However, this can be problematic as stakeholders will often create their own narrative in the absence of a clear narrative from the organisation. Consider issuing immediate holding communications to both internal and external stakeholders in order for the organisation to keep control over the information. It is also vital that the organisation monitors and attempts to control social media when in the middle of a crisis.
PR and communication must be part of any crisis management plan. The last thing the organisation wants is to be distracted by interviewing PR agencies when it is in the middle of a crisis, so it is a good idea to already have a PR agency vetted and ready to go. The organisation can then activate its crisis management plan and instruct its external advisors immediately.
One thing not to forget is for the organisation to communicate regularly, and accurately. This can be very challenging when the issues are still being investigated and the organisation does not have a set of complete facts. It is also vital to remember that any statements that are issued will be read in the context of what else is going on with the world. It is important to judge the tone of any communications correctly. A general rule of thumb is that silence is not an option.
Remaining flexible and nimble is key for any organisation in crisis. Take time to reflect on the objectives that have been set and change them if necessary.
Importance of resilience and self-care
It is also important to remember that the members of the crisis management team are only human. One of the things about the COVID-19 pandemic is that it has affected everyone – the senior management, workers, advisors and stakeholders.
Taking regular breaks and recognising the impact that the crisis is having on the individuals dealing with the issues day to day is vital. Crises lead to stress and anxiety on levels that not even the most accomplished CEO will have experienced before and it is important to acknowledge this.
One of the lessons that COVID-19 has taught us all is that if well-being is not part of the crisis plan, then poor decisions can be made by over-tired and stressed members of the team. Everyone remembers the Tony Hayward comment: “I’d like my life back,” following the BP Deepwater Horizon oil spill that killed 11 people. This was widely acknowledged to be a PR disaster.
Crises for corporates can be on different levels and can go on for several months, or even longer, as the pandemic has shown us. It is essential that the organisation does not remain in “crisis mode” but can resume normal business. Moving from crisis mode to “normal” business requires detailed planning and excellent communication. As the pandemic as shown us, scenario planning for a “new normal”, listening to workers and stakeholders, is vital for businesses to look forward to the future.
Learning from the crisis
Of course, the pandemic was the cause of the main crisis for individuals and businesses alike. However, as we have set out, many corporates have already experienced a second crisis by way of a fraud. Many frauds that resulted from the pandemic will not have been identified yet.
Once all internal investigations have finished and the root causes of the fraud have been identified, the most tempting thing to do is to go back to “business as usual”. However, lots of invaluable lessons can be learned from surviving a crisis. The organisation must ensure that it can take these positives and implement changes to ensure that events are not repeated. Events that led up to the fraud and the causes of the fraud should remain on the agenda for discussion at the top level of management so that the organisation can learn from the problem and monitor change.
It is also critical that the organisation can demonstrate that it has implemented changes to prevent the crisis and fraud from occurring again. The pandemic has been referred to as a “black swan”, or an event that takes us by surprise, has a major effect and is inappropriately rationalised afterwards with the benefit of hindsight. However, good planning helps to respond to all unexpected events and to minimise the risk of knock-on damage such as fraud. Stakeholders will not be forgiving if the same issues arise again.
Back to top
The scale and unexpected nature of COVID-19 has very much put crisis management at the top of the agenda for most businesses. The pandemic has highlighted the striking reality that the way a business prepares for a crisis can have such a huge impact on that business’s chances of riding out the next unexpected challenge. Whilst it is not possible to predict everything and some crises may never be foreseen, fraud is an ever-present risk for all businesses and needs to remain at the forefront of businesses’ controlling minds.