Anti-fraud pros are best-suited to assess organizational cultures

Anti-fraud professionals are uniquely positioned to diagnose sick occupational cultures. Here are answers about workplace cultures that can help head off fraud before it occurs.

In 1997, at the height of the fallout from the largest fiscal bankruptcy ever suffered by a county in U.S. history, caused by reckless investment speculation, the Orange County (California) Board of Supervisors requested that the internal audit department develop and lead interactive workshops, known in the profession as “control self-assessments” (CSA).

The supervisors wanted to promote transparency and integrity in decisions, exchanges and disclosures, and embed a fiscally conservative, customer-centric and cost-effective culture across all county departments. They viewed these workshops as primary sources of information in determining how close or far away the attitudes and behaviors were to the newly desired values and vision for the county. The board also knew that one benefit could be a reduction in fraud, waste and abuse and, ideally, the avoidance of a repeat of the kind of breakdown in oversight and mismanagement that triggered the bankruptcy.

The most frequently self-diagnosed shortcomings in cultural attitudes and practices included such dysfunctions as:

• Inadequate supervision and training
• Favoritism in internal promotions. 
• Lack of transparency and oversight in decision making. 
• Deviations from rules and policies. 
• Inconsistent treatment of employees. 
• Failure or reluctance to elevate bad news to upper management and/or the board. 
• And, on some accounts, retaliation against employees for raising concerns about possible or actual unethical behavior.

The revitalized board and management implemented immediate and long-range fixes in response to input from blue-ribbon task forces, external auditors and consultants, CSA workshops, and financial and performance audits. The board appointed a new treasurer and tax collector, John Moorlach, CPA (who’d repeatedly tried to warn the board of the risky nature of the investments held by the county), and later welcomed the newly elected auditor-controller, David Sundstrom, CPA.

The board established an independent treasury oversight committee. The internal audit department now reported directly to the board instead of the controller. The board later created a leadership academy for managers that stressed integrity and transparency in government. The curriculum included a session on ethics taught jointly by the manager of the countywide fraud hotline program and the director of internal audit.

The board, led by newly elected supervisors Todd Spitzer, Tom Wilson and Jim Silva, encouraged and funded more training for management and staff and provided closer scrutiny over hiring and promotional decisions plus additional staff and support for the countywide fraud hotline program, and resulting investigations. These cultural assessment workshops immediately became the most popular and valued service the internal audit department provided, according to workshop participants. And given their success, the auditors devoted as much as 25% of the department’s budget each year to these anti-fraud activities.

Over the years, the internal audit department conducted more than 115 workshops for more than 1,500 employees that resulted in more than 3,000 culturally transformative changes in attitudes and practices that streamlined business processes, cut costs, enhanced morale and improved transparency and oversight throughout the county. All of this played a part in enabling the county to pay off its billion-dollar bankruptcy debt years ahead of schedule.

During the years we conducted these CAS workshops, participants increasingly showed they had a greater awareness of their ethical obligations and accountability plus a higher level of comfort in their ability to report suspicions of misconduct without fear of retaliation, all of which are critical components of effective anti-fraud programs. For the 15 years I administered the workshops, I saw encouraging improvements in the culture of Orange County all ushered in by a positive tone at the top, to the extent that it emerged from bankruptcy to became a role model in fiscal accountability for local governmental entities.

Questions about organizational cultures

Throughout my career as a chief audit executive for five different entities, audit committee members have asked me to explain organizational cultures, their importance, and why they should be audited and by whom. In this article, I give some of the questions and answers with the hope of sparking an industry-wide discussion.

We could begin a forum to refine and calibrate how anti-fraud professionals — fraud examiners, auditors, accountants, investigators, compliance directors and others — are helping shape their organizations’ cultures to prevent and deter fraud, and how they might contribute even further. Ultimately, our collective insights will better advance the services that anti-fraud professionals can and should provide our clients to help shape their cultures.

Experienced anti-fraud practitioners can readily spot the genuine from feigned cultures that read well in glossy flyers but often fall far short of the impressive prose.

Anti-fraud professionals are uniquely positioned to observe how tone-at-the-top principles are molding the behavior of entities’ managers and staff. Boards of directors or trustees often only give to internal auditors and fraud examiners unrestricted access to all personnel, books and records — along with required cooperation by all affected — as they conduct their audits, fraud examinations, analyses, evaluations, assessments and reviews. Couple this unparalleled access and mandated cooperation with the wide range of coverage that traverses all organizational boundaries and you have groups of professionals who possess an unrivaled set of companywide reference points for comparing best practices plus attitudes and expectations that shape cultures.

Also, experienced anti-fraud practitioners can readily spot genuine from feigned cultures that read well in glossy flyers but often fall far short of the impressive prose.

Anti-fraud professionals know how to translate stated values into tangibles, and they know the difference between platitudes and practices. Managers can’t mask from them dysfunction that’s the byproduct of unhealthy cultures.

What are the vitals of a healthy culture and the symptoms of a sick one?

“Culture” refers to the real attitudes, workplace behaviors, incentives and goals that organizational employees embrace, exhibit and act upon. Anti-fraud professionals can readily spot the telltale elements of healthy and sick cultures in observable behavior, products and processes. They note these signs in the level of respect displayed among staff members in their interactions; the degree of process integrity in organizations’ controls, tasks and assignments; and the consideration and concern exhibited toward internal and external clients and customers.

True customer-centric services and commitment to the integrity of the business process are undeniable. They permeate every aspect of operations in responses to requested information and the forthrightness in management’s explanations, the usefulness of procedural manuals, office civility and the inclusiveness of staff in decision making.

Is culture important to an organization?

Healthy cultures are integral to the vitality and viability of all organizations — big or small, governmental entity or corporate enterprise. The factors associated with healthy or unhealthy cultures are the exact ingredients that determine organizations’ quality of goods and services.

A seasoned anti-fraud professional can accurately predict the quality of goods or services produced from careful observation and assessment of either the presence or absence of key cultural components.

The tone at the top as expressed in mission and value statements is a hollow promise to employees, investors and consumers unless organizations implement key policies, procedures and practices that ensure such aspirations are predictably achieved.

Wells Fargo found this out in 2016 after it discovered that thousands of its employees had been creating millions of phony or dummy accounts without their customers’ consent so they could charge them service fees to meet aggressive sales quotas and remain employed.

Wells Fargo didn’t intend for such abuses to occur, but the company set itself up for fraud by creating unrealistic quotas that drove predictable behavior from vulnerable employees who wanted to keep their jobs. Employees’ deviations from Wells Fargo’s desired culture didn’t happen by accident; it grew out of ill-conceived “incentives” and the failure to provide effective oversight to detect and prevent such predictable abuses of an aggressive sales program. (See Wells Fargo Fined $185 Million For Opening Accounts Without Customers’ Knowledge, by Maggie McGrath, Forbes, Sept. 8, 2016.)

Anti-fraud professionals have learned in their investigations to look for these clear indicators of organizational dysfunctionality that predictably degrades the quality of the product or services the business is providing to its clients:

• Outdated policies and procedures. 
• Poorly constructed workflows. 
• Unmanageably large ratio of staff to managers.
• Unrealistic production goals. 
• Shortcuts that compromise the quality of the services and products.
• Imbalance in work assignments. 
• Inadequate supervision and oversight.

Anti-fraud professionals who discover these issues know that quality doesn’t happen by accident; it flows from deliberate design and commitment to integrity from all. As such, they’re a ready resource to management in conducting unbiased cultural assessments.

How does an organization create its culture?

A culture is never an afterthought. It’s the soul of an activity or business unit that’s deliberate, articulated and always at the forethought of every decision by every employee. Every component and aspect of a workplace molds and shapes the culture by shaping the attitudes and the behaviors of the employees.

Here are some of the structural components that shape attitudes and work behavior, which comprise an organization’s culture:

• The quality and focus of the recruiting, screening and selection process. 
• Minimum job-qualifying requirements, realistic quotas, production goals and retention criteria. 
• Thoroughness and timeliness of an orientation and acculturation process for new employees. 
• Compensation plans and range of benefits. 
• Relevance of performance-evaluation criteria. 
• Content and frequency of all training, including training on ethical expectations.
• Ratio of managers and supervisors to employees. 
• Division of labor and workload expectations. 
• Supervisory support. 
• Conducive work environments. 
• Level of receptiveness and support for innovation and change. 
• Support and protection for whistleblowers. 
• In-house job transfer opportunities. 
• Degree of transparency and openness. 
• Prominence of a customer-centric focus. 
• Inclusiveness in decision-making.

Why should an organization assess its culture?

It’s critical to independently test whether your management and staff are walking the talk they broadcast as your organization’s values for the same reasons you independently audit the integrity of financial statements. The assessment of an organization’s culture is as valuable as an internal management tool as audited financial statements are to the investment community.

Wells Fargo’s employees’ cultural drift from desirable workplace behavior to the abuse of loyal customers underscores the importance of periodic cultural assessments. The cost of such an assessment is a fraction of the cost of a company’s reputation for integrity and certainly less than the $185 million fine Wells Fargo paid to federal regulators for the cultural drift of some of its employees. (See the Forbes article by Maggie McGrath.)

Can fiscal, compliance, control and performance audits also be audits of a culture?

Many managers and chief audit executives view routine audits of internal controls and investigations as evidence of attitudes and commitment toward a culture of fiscal integrity.

From this perspective, every audit and investigation — and subsequent follow-up reviews to verify that management has implemented corrective action — are assessments of management’s and staff’s attitudes and efforts to establish and maintain sound internal controls and to ensure compliance in the daily behavior of everyone in an organization. Certainly, any successes are reflective of a healthy culture and a reliable measure of a favorable tone at the top. The best cultural assessments include the attitudes and behaviors of micro units and macro activities.

Authorities in the auditing profession say that internal auditors and investigators are increasingly including cultural assessments in routine audits by asking employees questions directly or by including surveys in their audits about their attitudes and behaviors toward organizational objectives. (See Best Practices: Evaluating the Corporate Culture, by James Roth, 2010, The Institute of Internal Auditors Research Foundation.)

Here are some possible questions:

• Does management encourage risk-taking?
• What happens when people succeed or fail?
• How and who makes decisions?
• What behavior does management reward and punish?
• Does management welcome or discourage input in decision-making?
• What causes conflict, and how is it resolved?

Internal auditors and investigators who use these surveys to assess attitudes and behavior toward compliance with rules and regulations can and are providing management with a useful gauge of the cultural drift from the desired values.

How are hotlines and whistleblower programs components of organizational cultures?

A hotline program is among the most important pieces of any organization’s culture. Regardless of the industry, hotlines are critical barometers of the tone at the top about the levels of the commitment boards and CEOs have to integrity, transparency, honesty and good corporate behavior.

According to the 2020 ACFE Report to the Nations (RTTN), 43% of schemes were detected by a tip, and half of those tips came from employees. (In the study, only 4% of the frauds were uncovered through an external audit.)

The 2020 RTTN found that whistleblowers used telephone hotlines and emails in 33% of the cases. Hotlines increased by 13% as a targeted anti-fraud control in the last decade. Median losses nearly doubled at organizations without hotlines: $100,000 with hotlines; $198,000 without hotlines. Training increases the likelihood of detection by tips: 40% of cases detected by tips with training; 36% of cases detected by tips without training.

Organizations with hotlines detected fraud by tips more often: 49% of cases detected by tips; 31% of cases detected by tips with no hotlines. And those with hotlines detect frauds more quickly than those without hotlines: 12 months with hotlines; 18 months without hotlines.

Every component and aspect of a workplace molds and shapes the culture by shaping the attitudes and the behaviors of the employees.

The absence of hotlines — or effective ones — discourages reporting of possible misconduct and announces executives’ disinterest in such complaints. Support, funding and optimal placement in organizational hierarchies shows employees that C-suiters and boards want their employees to act with integrity, and they care about them and want to know about behaviors that might be unethical or illegal.

The board and CEO of any organization — public or private — should ensure a formal process to solicit and obtain information about possible unethical or illegal activities and behaviors of its employees and vendors.

Elements essential to the integrity and effectiveness of any hotline program include: 1) the ability to make anonymous complaints 24/7 via phones or websites 2) tracking of complaints 3) determination if the organization initiated investigations 4) establishment of criteria for prioritizing formal investigations 5) timeliness and turnaround times of completed investigations 6) the board’s support for investigators’ independence and professionalism 7) tracking and reporting of results to the board and any associated discipline of employees in substantiated cases 8) a clear code of ethics and related training.

As surfaced in U.S. Congressional testimony, if Enron had had such a well-defined, independent and designed program with board-level accountability, the C-suiters’ financial gimmickry that triggered its 2002 collapse probably wouldn’t have taken root to the point of bankrupting the fifth-largest company in the Fortune 500 listing. (See ENRON’S MANY STRANDS: THE WEEK THAT WAS; Congress Begins an Investigation, Raising New Questions, and Silence, by John Schwartz, The New York Times, Feb. 10, 2002, and Wal-Mart Tops Fortune 500; Enron Rises to Fifth Place, by Matt Moore, Los Angeles Times, Associated Press.)

In the summer of 2002, the U.S. Securities and Exchange Commission signaled to the entire investment community it meant business on this point by underscoring the importance of an effective hotline program and adopting a rule to implement Section 301 of the 2002 Sarbanes-Oxley Act that mandated the implementation of whistleblower hotlines in all registered corporations.

Why should hotlines be assessed?

Organizations should periodically assess the functionality and professionalism of their hotlines — and C-suite executives’ support — because of their critical function in supporting cultures that embrace integrity as their hallmarks.

Surveys can ask employees to rate the ease of reporting suspected misconduct; their or their peers’ experience and observations of management’s support for, and protection of, whistleblowers; their personal comfort level that the organization won’t retaliate against whistleblowers; and their confidence that the organization will take appropriate corrective action against offending employees if it substantiates the complaints.

Organizations should be worried about falling prey to the disastrous consequences that can occur when whistleblower or fraud hotline programs are underfunded, and poorly promoted and designed.

A hotline that employees don’t trust and isn’t robustly managed runs the risk of misleading key decision-makers into thinking they don’t have allegations because there are none to report, i.e., they have a healthy culture.

The corporate graveyard is littered with predictable debacles stemming from either an underused hotline because of distrust or one that lacked integrity to properly elevate and investigate allegations.

When the general public reads about a scandal and asks the question, “How could this have happened, and no one knew about it?” they’re indicting a hotline’s effectiveness and tone at the top for these failures. And most post-scandal investigations center on answering these same questions for boards, as was evident in Orange County in the 1990s, or Wells Fargo, Volkswagen, Enron, Michigan State University and the University of Southern California.

Thus, we see the value of regular pre-scandal versus post-scandal assessments of an organization’s culture and its hotline program to ensure integrity and effectiveness.

Can the suppression of complaints undermine the core decision-making process?

Suppression of honest complaints can subtly and incrementally corrupt the integrity of an organization’s core decision-making function. The No. 1 indicator that an organization is serious about setting the right tone at the top is when it creates and fosters an environment that supports and protects people for speaking up when they see suspected misconduct or waste, fraud and abuse. An organization-wide survey that reveals a sizable number of respondents who are afraid to speak up about suspected misconduct is a red flag of oppression or suppression of desired ethical impulses. This aberration could be localized in just one small unit or activity, or worse, institutionalized throughout an entire organization. Such breakdowns in an organization’s ethical credo can corrupt all aspects of an activity’s decision-making process and, even worse, its decision-makers.

Numerous investigations into causes for scandalous deviations from corporate ethics often discover that a pervasive undercurrent of cynicism and self-interest stemming from inattentiveness or open dismissal of the company’s stated values triggered them. Surveys often reveal that organizations give a green light to condone misconduct when employees watch whistleblowers suffer retaliation while the guilty are protected. 

Anti-fraud pros well-equipped to take culture temperatures

It’s a fact: Healthy organizational cultures are composed of satisfied employees who supply customers and clients with quality products, goods and services. Sick cultures, filled with unhappy employees, can become breeding grounds for all types of fraud. Trained anti-fraud professionals are in the right positions to take the temperatures of organizational cultures and determine where they need medicine and treatment to deter and prevent fraud.

Peter M. Hughes, Ph.D., CFE, CPA, is the assistant auditor controller for the Los Angeles County Department of Auditor-Controller. Contact him at phughes@auditor.lacounty.gov. He thanks Michael Dean, CIA, CPA, senior internal audit manager for Orange County, who was the lead project manager and facilitator for all the CSA workshops.

Some of this article’s material from the author is also contained in the article, “10 Questions on Culture,” by Peter Hughes, Robert Campbell and John Lerias with contributions from Ken Pun, Internal Auditor, April/May 2020. – ed.