As a generalization, our culture tends to respect individualism and prioritize the valuable contributions that each person can make to an organization or society. This “democratic” view of culture, for all its merits, must be balanced with an insight formulated by the audit profession: Tone at the Top.

Tone at the top, in the context of establishing an effective control environment within a business, is best explained by COSO, an organization founded by several professional finance and accounting organizations to provide thought leadership on risk management, internal controls, and fraud prevention. COSO’s Internal Control — Integrated Framework Executive Summary states:

The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct. Management reinforces expectations at the various levels of the organization. The control environment comprises the integrity and ethical values of the organization; the parameters enabling the board of directors to carry out its governance oversight responsibilities; the organizational structure and assignment of authority and responsibility; the process for attracting, developing, and retaining competent individuals; and the rigor around performance measures, incentives, and rewards to drive accountability for performance. The resulting control environment has a pervasive impact on the overall system of internal control (emphasis added).

The best example I saw of “tone at the top” was at a business in which the owners had invested significant effort toward intentionally creating a culture of integrity and value creation. This “tone at the top” was not imposed upon the enterprise and its subsidiaries. Rather, the culture of the organization reflected the vision, values, and ethics that senior management believed and practiced. These leaders understood “tone at the top” and effectively took the lead to guide their organization to success in the marketplace.

What steps did this organization take? There were many facets of the tone at the top and how it was manifested throughout the organization down to the lowest level, but here are just a few that come to mind:

• A clear vision and mission statement, which defined the organization for its customers, employees, partners, investors, and other stakeholders
• A principles-based approach toward leadership within the organization
• A minimalist approach toward detailed rules
• An emphasis on hiring people who would “fit” well into the organization’s culture based on character and skill
• Leadership by clarity of articulation and example by senior management

This deliberate approach to “tone at the top” creates an effective control environment, as compared to a disjointed or even nonexistent plan for establishing organizational culture. Whether senior management acknowledges or ignores the concept of “tone at the top,” the reality is inescapable. Employees hear what senior managers say and, more importantly, see what senior managers do. The example senior managers set, both by formal policies and procedures as well as by daily conduct, sets a tone — whether positive or negative.

Although each individual can play a valuable role within an organization, senior management first and foremost must take its responsibility seriously to nurture a culture of integrity, discipline, and effectiveness. Done properly, the established “tone at the top” can propel an organization on a trajectory toward achieving its goals and objectives.

Soldiers have their battle stories. Athletes recount memories of their on-field exploits. Actors make a living out of drama. So what type of exciting professional adventures would you expect from an accountant? No, we’re not talking about paper cuts, out of control copy machines, or circular references in Excel files. The most exciting shop talk within accounting circles invariably involves uncovering a massive fraud in one of our client’s companies. Off the top of my head, here are some of the most infamous examples I have heard from my fellow accountants:

• When I was in one of my first accounting classes my teacher told a story of a bartender whom she discovered was pocketing money from the bar sales and covering the inventory discrepancy with his own booze brought in from the outside (he was pocketing a nice margin along the way).
• When I was an auditor my boss told me a story about his discovery that a credit union employee falsified records in a failed attempt to cover up theft of the institution’s funds.
• I became familiar with a situation in which an elderly professional client of our accounting firm had a long-time, trusted employee use her employer’s funds to pay her mortgage, provide gifts for her family members, pay her debts, and more. As you might have guessed, our client had not taken upon himself to review the banking information for his business.
• A finance executive friend shared about an employee within his company that he had to fire and evict from a company-owned rental unit because she was stealing funds from the business.
• A forensic accountant at a recent seminar shared her story of discovering a fraudulent CFO’s misdeeds not once, not twice, but three times. When her client (the business owner) refused each time to do anything significant about this problem, she fired her client and discovered not long thereafter that the business had gone under.
• Another story I heard (one of my favorites) involved an inept management team that provided free and open access to all employees to every module within the information system. When the auditors arrived to do their standard year-end work, one of the employees became very inquisitive and showed signs of nervousness. Although they would not have otherwise been inclined to investigate her specifically or to look at detailed payroll data, the auditors decided to take a look at her payroll transactions and discovered that she was getting paid far more than other production workers in the business. As it turned out, before each payroll was run, she took it upon herself to increase her pay rate by $5 per hour. After the payroll run, she would decrease the rate back to normal so that hopefully no one would notice.

Fraud often resembles lightning: It strikes you suddenly, when you are least expecting it, and often when you are comfortable. Experienced risk managers understand that fraudsters don’t fit the popular media stereotype of slimy connivers. Rather, they are often regular people, even trusted long-time employees.

The key to preventing fraud is situational awareness. Know the yellow and red flags such as a rapid and unusual increase in an employee’s living standards, an employee who unnecessarily works long or odd hours and refuses to take vacations (for fear that another person covering the role for a few days could discover the misdeeds), or an employee who noticeably faces financial pressures. Also, be aware of the “fraud triangle”:

• Pressure – an employee or someone else with access to company resources might have a personal financial pressure in life such as uninsured medical bills, a gambling habit, credit card debt, or a divorce. Many savvy employers check credit history for potential new hires to initially screen out employees who might bring unwanted personal pressures into the workplace environment.
• Opportunity – the employee sees a weakness in the company’s systems, whether an open door in a secluded part of the warehouse, an unsecured cash drawer, or in the case of many large frauds, a material internal control weakness that enables an employee to misappropriate funds without getting caught.
• Rationalization – most people understand it is wrong and risky to steal, but if they feel the need and see the opportunity, they can often come up with ways to justify it in their minds. Some employees, especially in times of tight corporate budgets during economic uncertainty, may feel overworked, underpaid, and under-appreciated. Perceptions about unfair treatment and office politics, regardless of whether these notions are justified or mere fabrications in the employee’s mind, can breed resentment and a desire for revenge.

A successful fraud involves all three elements to one degree or another. An employee without some type of pressure to defraud her company — even if she sees an opportunity and might be able to perversely rationalize it in her mind — will probably back off when she considers the potential consequences if she got caught. Likewise, without an opportunity or a way to rationalize a fraud, an employee will probably think better of it.

Business owners can exert the most direct influence over the second point, opportunity. One of my accounting teachers recounted when he tried to suggest sound financial controls for his church finance committee. His pastor did not take kindly to this, assuming that he was “accusing the brethren” within the leadership. However, as my teacher pointed out, there is nothing to be lost from implementing measures to keep honest people honest.

Internal controls are aimed at preventing, detecting, and correcting fraud, whether misappropriation of assets or fraudulent financial reporting. Furthermore, beyond safeguarding physical and intangible assets, controls also should be designed to ensure operational effectiveness. (More on this in future installments.)

The primary preventative internal control is segregation of duties. Specifically, companies are well advised to separate these functions among employees:

• Custody of assets, e.g., inventory and cash
• Authorization of expenditures or disbursements, e.g., cash payments or inventory shipments
• Recording of transactions, e.g., entering payments or inventory transactions into the system
• Reconciliation, e.g., the monthly bank statement reconciliation or the periodic inventory count and reconciliation to inventory records in the accounting system

For example, ideally the same person should not have access to company funds (e.g., to be a signer on the bank account), the ability to authorize spending those funds, the authority to record the transaction, and the responsibility to reconcile the bank statement at the end of the month. Some or all of these duties should be segregated among several employees so that any fraud would require collusion. Even if one employee had the pressure and rationalization to commit fraud, in an environment with segregation of duties, he would have to take the risk of recruiting another employee to cover for him.

The warehouse manager who has physical access to inventory should not have the ability to make inventory adjustments in the accounting system, as this segregation between custody and recording prevents the manager from stealing product and recording adjustments to make the system data match the physical inventory. Rather, inventory shrinkage should show up on reports monitored by inventory accountants who do not have access and authorization to remove product from the warehouse; by segregating these duties, discrepancies should be detected, monitored, and accounted for by the appropriate authorities.

A final word for business owners and CEOs: Especially in this era of automated and integrated accounting systems that allow a small finance staff to handle high transaction volume, many companies do not have adequate staff to properly segregate all duties among finance staff. This means that the business owner or CEO should be involved and situationally aware of risks. Although hiring trustworthy staff members who can be relied upon is one essential component, if there are limited numbers of staff in the finance group (i.e., one or two people), the owner needs to take some time to monitor the activities of this important department. At the very least, take time to check the bank statement each month, look at reconciliations for asset accounts such as inventory, and consider engaging an outside professional for a year-end audit. (As a bonus, an experienced auditor with industry expertise can provide input on enhancing operational and financial effectiveness.) However, do be aware of the limitations of assurance that auditors provide regarding detecting fraud (this is spelled out clearly in auditor engagement letters). If you have a suspicion that fraud might be taking place, consider engaging a fraud examiner or forensic accountant to investigate.