The multifaceted nature of organisational fraud makes it a lurking menace for all corporations. Whether it emerges from a cyber-attack, an email scam, or deception by a seemingly ‘faithful’ employee, the aftermath can have dire consequences. Many fall into the trap of believing fraud is beyond an organisation’s control, thus exempting directors or officers from bearing any responsibility. However, this misconception can lead to personal liability for losses incurred by the organisation due to inadequate fraud risk mitigation.
Assessing the Impact of Fraud on Organisations
Fraud doesn’t merely drain a company’s financial resources, including the funds lost to fraudulent activities, forensic investigation costs, remediation expenses, and fallout management costs. The impact goes deeper, eroding a company’s reputation, employee morale, and potential business opportunities. Given the severity of these repercussions, it’s crucial to understand where responsibility lies and the potential implications for directors and officers.
Duty Calls
A director’s responsibilities stem from a mixture of common law and legislation, most notably the Corporations Act 2001 (Cth) (the Act). Following a fraud incident, the focus often shifts to the responsibilities of the directors and officers. Primarily, two duties under the Act come to the forefront:
- The duty to operate with the care and diligence that a reasonable individual in a similar position would exercise.
- The obligation to act in the corporation’s best interests, demonstrating good faith and a proper purpose.
These duties extend to ‘officers’ within a corporation, including secretaries and those involved in impactful decision-making or capable of influencing the corporation’s financial standing.
Practical Implications of these Duties
The duties of directors and officers translate into an obligation to establish adequate systems, processes, and policies to mitigate fraud risk and foster a culture of compliance. For instance, a lack of enforcement for a policy requiring higher-level authorisation for significant expenses could indicate negligence in care and diligence.
As fraud risks evolve with technological advancements, the spotlight is increasingly on the role of directors and officers. While they aren’t expected to be tech wizards, understanding the threats posed by cyberattacks is crucial. An alarming survey revealed that only 54% of Australian board members felt their board comprehended the risks presented by cyber threats.
Risk Management & Fraud Control
A robust risk management framework focusing on fraud can help combat these challenges. Conducting an inclusive analysis of internal and external fraud risks—covering physical, financial, and cyber security—is essential. For assistance, consider the Fraud and Corruption Control AS 8001:2001, which provides excellent guidance for risk assessment.
No ‘One Size Fits All’ Approach to Duties
The standards of care and diligence vary according to the individual’s position, their responsibilities, and the corporation’s circumstances. Nevertheless, a minimum standard exists, requiring directors and officers to take a “diligent and intelligent interest” in information relevant to fraud risks and existing systems and processes. Any deficiencies in policies dealing with fraud risks or failure to ensure compliance could potentially expose directors and officers to charges of negligence.
Making Risk Management Routine
To fulfill their duties, directors and officers should regularly discuss risk at meetings, understanding the various aspects of risk, the effectiveness of current controls, and whether the risk level remains acceptable post-implementation of controls. Creating a risk matrix can be beneficial, and remember, organisational fraud risk must be included.
Preventing Organisational Fraud: Proactive Steps for Directors and Officers
It’s vital for directors and officers to routinely review and update processes, policies, controls, and compliance systems to ensure they adequately address organisational fraud risks. This is particularly true in the face of new emerging threats. Reflecting on past incidents of fraud can also reveal valuable lessons and improve future risk management.
Furthermore, regular reviews of the board and senior officer composition can help identify gaps in knowledge or skills that can be addressed through training. It’s also wise to review your organisation’s insurance policies for coverage of organisational fraud and potential weak points that could lead to denied claims.
Remember, preventing organisational fraud is a dynamic process, requiring constant vigilance, adaptation, and proactive steps.
Stay informed, stay prepared, and stay ahead of the risks.
