Strong internal controls can help minimize losses
INSIGHT ARTICLE |
The multimillion dollar construction project was so large, it had its own accounting department. This system appeared to work until the 18-month project was completed and the owners found that a number of line items had gone over budget. This prompted an internal investigation to understand where things had gone wrong.
Red flags were raised when a thorough examination found that, while invoices had been paid, some checks were missing from the project files. The company’s bank provided copies of the checks, which revealed that a number of double payments had been made. Many of the accounting functions associated with the project were performed by the project controller. The checks—which had been prepared manually—had been altered by the project controller and deposited into his own account.
As outrageous as it sounds, this problem is not uncommon for construction companies. According to a 2016 Association of Certified Fraud Examiners (ACFE) report, billing fraud accounts for nearly 28 percent of reported incidents victimizing construction companies; for the industry, these types of schemes are second only to corruption. Yet many small and midsize construction companies do not have the internal controls in place to prevent, detect and respond to such events.
The result can be catastrophic, especially for companies running on thin margins. The median loss for all cases in the ACFE study was $150,000; nearly one-quarter lost $1 million or more. There are, however, a number of steps that companies can take to help avoid unintended losses that results from error or outright fraud.
Trust but verify
It is not enough to hire trustworthy people. Humans can make mistakes; errors as simple as the misapplication of costs, improper cost tracking or simple omissions can lead to lost profits. Even the most dependable employee—given the right motivation, opportunity and rationale—can be tempted to take funds from an employer.
According to the ACFE, nearly 30 percent of all companies where fraud was discovered had little or no internal controls in place. This is an important finding, as the report notes that only 12 percent of small businesses detected fraud by internal audit and only 8 percent by account reconciliation. Nearly one-third relied on tips to detect fraud at their companies.
In fact, the ACFE noted that companies with strong internal controls reported median losses that were 54 percent lower than peers without those detection tools, while detecting fraudulent activity twice as fast.
The key is to support qualified employees with internal controls that mitigate the risk of error or fraud. For example, any time an offline, manual process is introduced—using a spreadsheet for calculations, for example—errors can occur. This can make companies vulnerable. While automation may not always prevent loss, it can help avoid human error.
On the other hand, a simple adjustment could have prevented the controller in the scenario above from the opportunity to defraud the company. Rather than have one person prepare and send the checks, segregating these duties among more than one person could have prevented the loss of millions of dollars.
What companies can do
Here are some steps that construction companies can take to reduce the impact of error and fraud:
- Establish internal controls: Active controls that seek out fraud can significantly limit the losses incurred through illegal activity. Controls include a range of activities, from surveillance and monitoring to internal audits and management reviews.
- When selecting contractors through a non-competitive bidding process, use an evaluation committee with objective members.
- Segregate duties to ensure that access to sensitive information or the level of approval authority is limited, as appropriate.
- Delegate more oversight to a board audit committee, which can flag and address any potential override activity. Among reported frauds, 20 percent involved overrides of existing internal controls. This can be an especially challenging for small and midsize companies, since fraud typically involves a senior leader with the ability to work around these checkpoints.
- Enforce controls: The most effective way to minimize fraud losses is to prevent them from occurring in the first place. An anti-fraud culture means communicating the importance of prevention, enforcing the procedures, and providing the support and training needed to do so.
- Audit contractors throughout a project: Management should make sure all negotiated costs and contracts include a right-to-audit clause, enabling the construction company to conduct an on-site examination of the vendor’s books and records in case fraud or a violation of policy has occurred. Internal audits should be conducted by experienced members of the internal audit staff or outsourced to auditors with experience in construction audits.
- Set up a hotline: Although a somewhat passive approach, tips gathered through a hotline or similar method can have a substantial impact on fraud detection. While effective, a hotline should only be part of a comprehensive internal controls approach.
- Test the system: When a construction company has implemented its internal control system, management should consider testing it for possible holes. In addition to an external audit of controls and financial reporting, if a company suspects or becomes aware of potential fraudulent activity, management should consider launching an internal investigation or hiring an outside firm to handle the task. Tests should be performed annually and not taken lightly.
Internal controls cannot eliminate errors or fraud entirely; anti-fraud controls significantly lower losses and speed up detection but do not always prevent fraud from occurring. The ACFE study noted, however, that the most prominent organizational weakness contributing to fraudulent activity was the lack of internal controls. And whenever humans are involved, errors will always occur. With financial and reputational risks at stake, construction company stakeholders will want to do everything they can to minimize those risks.