Paul Greenspan (pgreenspan@bdo.com) is a Managing Director in the Forensic Investigation & Litigation Services practice at BDO in Atlanta, Georgia, USA.
When COVID-19 took the world by storm in early 2020, it brought about unprecedented changes to business operations, including in the areas of corporate compliance and fraud risk. Many commentators at the time noted the pandemic could create the “perfect storm” for fraud due to increased financial pressures on employees and businesses coupled with decreased oversight in remote work environments. The Association of Certified Fraud Examiners conducted a survey in April–May 2020 and reported that 68% of respondents had already seen an uptick in fraud and 93% expected fraud to increase over the coming year.[1] With the pandemic apparently not going away anytime soon, this increased fraud risk is likely to remain elevated for some time. However, there are steps that ethics and compliance professionals can take to mitigate fraud risk.
Review your fraud risk assessment—and then review it again
All good fraud prevention measures start with conducting a robust fraud risk assessment (FRA). However, unless your organization happened to have a regularly scheduled FRA update planned for late March 2020 (you were regularly updating your FRA, right?), chances are at least portions of your FRA were obsolete due to changes brought about by COVID-19. Even if you updated your FRA during the early days of the pandemic (well done!), the dynamic nature of COVID-19 means it is likely that some portions may already be outdated. Ask yourself how your organization has changed due to the pandemic. Do you have:
-
New business lines or products?
-
An entirely new business model?
-
New processes due to remote work or social distancing guidelines?
-
A different geographical footprint?
-
A different employee base?
-
New third parties or business partners?
-
A temporary suspension of any controls?
Take a holistic look at your organization’s current operations and update your FRA accordingly.
During this time of unprecedented change, it may be helpful to think of your FRA as a living, breathing process rather than as a static document that you update periodically. After all, even the most frequently scheduled updates may not keep up with events in your community, industry, or organization. At a minimum, you should increase the frequency with which you revisit your FRA to ensure resources are focused on the highest-risk areas at any given moment in time. Performing continuous, ad hoc revisions to your FRA will prove to be more valuable (and feasible) than the more formal, time-consuming, comprehensive efforts requiring multiple levels of review and revision that you may have used in the past. Plus, the act of continuously revisiting the FRA will force you to think about the ways your organization has changed and brainstorm about how those changes may lead to new fraud risks.
