Finance leaders must act against increasing fraud

By David Thorley, Director of Customer Development, FISCAL Technologies

The COVID-19 pandemic has resulted in a whole host of increased pressures on both business and individuals, worsening issues and vulnerabilities that were already present, as well as shining a light on new issues, never witnessed before. With this in mind, retaining and protecting cash has never been more important and therefore the role of accounts payable and the procure-to-pay function are crucial. These functions need to work together and do so proactively in order to succeed in the current climate.

It is also key that AP teams have all the right financial controls in place to minimise errors, maximise visibility of transactions, and streamline processes – especially with so many people now working from home and the various compliance challenges this creates. In essence, it is about taking a more forensic approach to AP activities.

According to fraud experts, each company has around a one in three chance of experiencing internal fraud this year, with enterprise organisations averaging losses of $1⁄2m[1]. These attacks typically claim payments which are under the financial risk review threshold, hiding within the hundreds of small invoice transactions until found by AP Audit software or internal audit routines.

Finance ERP and P2P systems – often described as the heart and lungs of a company – have a complex relationship and are known to have vulnerabilities, opening them to fraud. This is especially true in enterprise organisations where the adoption of artificial intelligence (AI), complex system integration and automation delivers a touchless-AP process, but may lack in the controls of traditional processes.

Additionally, centralisation or de-centralisation of the P2P function and systems, acquisition or mergers also creates a higher vulnerability to duplicates, errors and fraud. When systems are being configured and resources are stretched, errors and omissions occur, processes take time to adapt and this allows sophisticated fraudsters to target these types of transformation projects.

Missed historical data creating risk

As migration projects typically copy only open transactions to the new system – historical transactions seen as being of little value – transaction history can be lost. Spotting irregularities relies on comparing transactions with historical data so that the validation of duplicate payments is hindered.

During ERP migrations the Master Supplier File (MSF) is frequently left untouched and copied in its entirety from the old to the new system. This creates heightened risks as supplier reference changes in the new ERP’s MSF make historical look-ups impossible and the opportunity to remove unused, out-of-date and duplicate suppliers – a hotbed for fraud – is removed.

Particularly at a time like right now, it’s crucial that organisations are able to take action in recovering missed payment errors.

Internal planned attacks

Over the past few years, there has been no shortage of stories about internal company fraud or senior finance professionals being tried in court for finance fraud. While only a small proportion of these incidences become public knowledge, as organisations fight to keep reputational damage at bay, it’s essential that companies place finance fraud high up on the corporate radar in order to protect against these threats.

According to the KPMG Fraud Barometer, there was a six-fold increase in the number of alleged procurement frauds appearing in court in 2019, usually involving fake invoices. Six cases worth over £16 million appeared in court in 2019 compared to £2.9 million in 2018.

The individuals and groups who are deceiving businesses to gain payments, usually gain some inside knowledge of the processes or systems to enable them to set up fraudulent suppliers and divert funds to their accounts. They are sophisticated and plan their attacks.

The biggest risk factor when it comes to ERP fraud is allowing users to access parts of the system that they shouldn’t be able to see, thereby enabling them to commit fraud in a variety of ways.

The most common type is the dummy company fraud, where a user sets up a false supplier, processes fictitious orders and invoices, and pays for goods or services that are never received. This is surprisingly easy to perform for a user with a little too much access. But there are many other forms of deception, including supplier bank account changes, inventory manipulation and unauthorised changes to payroll data. Proper control measures can mitigate these vulnerabilities to a large extent.

Nobody wants to believe that they are at risk of fraud, that their processes, systems and governance cannot safeguard their profits, however, invoice fraud is becoming a lucrative industry. Today’s finance leaders need help to keep ahead of the threat in order to protect and retain cash – the number one priority.

[1] https://www.qsoftware.com/fraud-prevention-and-detection/erp-fraud-prevention-key-measures/