This past April, the Association of Certified Fraud Examiners (ACFE) released the 10th edition of its global study on occupational fraud, the Report to the Nations – 2018 Global Study on Occupational Fraud and Abuse (the “ACFE Report”). The ACFE Report summarizes statistics based on 2,690 cases that resulted in over $7 billion in damages. These cases that were reported to the ACFE represent but a tiny fraction of all corruption, asset misappropriation and financial statement fraud committed. Clearly, fraud is big business – but it doesn’t only affect big businesses.
The ACFE Report sheds some light on the differences between the fraud occurring in large and small organizations. (For the purposes of their reporting, large businesses are those that employ 100 or more employees; small businesses employ less than 100.) While many of the large frauds of the not-too-distant past involved large organizations, and garnered the lion’s share of the attention (think: Enron, Tyco, WorldCom and HealthSouth to name a few), the ACFE Report provides some interesting and disturbing commentary regarding small businesses.
To start, the ACFE Report states, “Small businesses lose almost twice as much per scheme to occupational fraud.” In fact, small companies experienced median losses of $200,000 per scheme, while the median loss experienced by large companies was “only” $104,000. Not surprisingly, since small businesses have fewer resources to implement fraud prevention tools, a full 42% of the cases reviewed involved frauds caused by lack of internal controls. At large entities, only 25% of frauds were caused by such deficiencies.
The ACFE Report also analyzed the differences in risk faced by large and small entities by comparing the schemes perpetrated against the victim organizations. While large organizations experienced significantly more fraud stemming from corruption and noncash schemes, small businesses were impacted to a much greater degree by check and payment tampering, billing, skimming and expense reimbursement schemes that might have otherwise been detected with even a few internal controls. Clearly, and as stated in the ACFE Report, small organizations “often require an increased level of trust in employees due to a lower ability to implement robust anti-fraud controls.” For small business owners, the old proverb “trust, but verify” might come to mind.
But therein lies the rub. The ACFE Report also indicates that frauds perpetrated by an owner or executive occurred in 29% of the cases involving small organizations versus in 16% of those occurring in large organizations. Essentially, that same lack of internal controls, along with limited governance, if any, creates an environment where the business owner is more likely to commit the fraud.
As you can see, small businesses are just as at-risk as large businesses and perhaps, even more so. The ACFE Report in some way states the obvious: when it comes to preventing fraud, implementing just a few internal controls is far superior to having none.
Norman A. Kur, CFE, CMA, AM