One of my oft-framed queries goes something like this:
“You know, we have all of these lessons-learned from the back-end of the fraud investigative process. After the event occurs, management teams take on this persona of portraying ACTION, are suddenly willing to pay whatever it takes
Would we then:
- re-frame the risk assessment with updated information,
- change the audit approach,
- revise the expectations (of management at all levels…remember “tips” and the known business process experts(?),
- communicate those expectations,
- become proactive, and,
- go looking for problems up-front, because everyone knows they exist?
The answer comes back, “It costs too much, and management is reactive; they won’t act until the (fraud) event occurs anyway. And then “you know what” hits the fan. It just doesn’t happen that way.”
I think they’re wrong.
My suspicion is that “management gets it” and there are things going on in leadership companies which have long been minimizing fraud risk. What’s that old saying, “…there are three kinds of companies: those that make things happen; those that watch what happens; and those that wonder what happened?”
One way this is going on comes from a couple of my own lessons-learned: if you go looking for fraud, you may always not find it, but you will most likely find ineffective business processes. And quite frankly, proactive efforts do find low-hanging fruit…but you’ve got to initiate those efforts. I will date myself here, but Satchel Paige once said, “don’t look back, cuz someone’s gaining on you.” So, whether you call it “continuous improvement” or “inquisitiveness” or just plain old “skepticism,” you have to keep requiring the business process experts to be self-critical, to task them with improvement, to benchmark, to challenge. They are the experts, but people can become complacent and miss the smoke, the small flame, and then the firestorm happens, and no one is happy. Or, we can raise expectations, go looking for “the smoke,” find the low-hanging fruit, and simply prevent the stupidity, and waste, and maintain competitiveness…and then not have to “pay the piper” at all.
Communicate that you’re checking wind direction, looking for those smoldering, festering problems, and that you expect others to keep their antennae (and nostrils) into the wind as well.