While we would like to think that fraud doesn't happen as often in the nonprofit community as in the business community, it simply is not true. I still remember the story of the national religious organization whose Treasurer walked off (for a period of time) with $2 million dollars. While speaking to someone who knew the story I asked "How could that have happened?" The response was that the Treasurer had buried the Board in paperwork, creating confusion and a subterfuge to mask her thievery.
In my own experience, I caught an attempt at fraud by an employee who had given her resignation. She had lifted at least one check and might have cashed it had I not discovered the check was missing. Could she have done major damage? Not really, but it was a lesson for me to do better at checking potential employees' backgrounds. Seems she had done the same thing on more than one occasion at her previous job. The following article by Dr. Eugene Fram and Dr. Bruce Oliver provides excellent advice on what you need to do in order to protect your nonprofit against fraud. Enjoy! Bunnie
Want to Avoid Fraud? Look to Your Board:
 |
| Dr. Eugene Fram |
Here’s a guide board members can use to keep fraud away from your door.
By Eugene H. Fram & Bruce L. Oliver
The board of the Association for Underprivileged Children is meeting in the aftermath of a dreadful situation. The police report summarizes what happened:
Over $50,000 designated for camping scholarships for the Association for Underprivileged Children has been stolen. The perpetrators are John Roe, the Association’s chief financial officer and his wife, Nancy, the camp director. The couple pilfered assets over a three year period. Nancy requested camp expenses, such as athletic equipment, for nonexistent campers. John then approved payment to a shell company operated by Nancy. Both are currently thought to be in South America. The organization doesn’t have fraud insurance. Funding for the current camping program is in jeopardy.
 |
| Dr. Bruce Oliver |
While the above scenario is fictional, it approximates an alarmingly common occurrence. One estimate, by Harvard University’s Houser Center for Nonprofit Organizations, suggests that fraud losses among U.S. nonprofits are approximately $40 billion a year.
How can nonprofits avoid such traumatic situations? The first step is to make certain that board members have the knowledge necessary to keep fraud at bay. Here are some suggestions for doing just that:
Be sure your board has the following committees:
(1) A finance committee charged with these tasks:
• Review the overall results of a yearly independent audit, conducted by an outside auditor.
• Oversee executive compensation, pension benefits, and other finance activities.
(2) A separate dedicated audit committee containing only independent board members. (Since nonprofit board members aren’t compensated by the organization, all directors are, by definition, independent. However, some directors may have strong social, family, or political links to management personnel. It’s prudent to exclude such people from serving on the audit committee.) The board members on this committee should be reasonably financially competent, with at least one having a strong finance background who is able to overview audit issues in detail. In particular, the committee should do the following:
- Conduct a yearly review of conflict-of-interest policies.
- Make certain that all employees and board members sign a conflict-of- interest statement.
- Assure that new hires are vetted for honesty.
- Meet every four to six months. (In times of organizational emergency or stress, meetings may be required more frequently.)
- Be sure that a certified audit is completed at least every two years – once a year if at all possible.
Hire an external auditing firm
In the past, it was common for managers to select the external auditing firm with “rubber stamp” approval by the board. In today’s more vigilant environment, the board must be more involved. Hiring an auditing firm should be a partnership effort between management and board. The task is as serious as hiring a CEO and should be given the same amount of time and care.
The board audit committee should review the following information when hiring the auditing firm:
- the nonprofit audit experience of those who will be performing the audit
- the history and client list of the auditing firm
- the proportion of the firm’s clients that are nonprofits
- the size of the firm and whether it has the ability to serve a new client well
- the estimated costs for each audit
- the firm’s suggestion for a financial consulting firm if your organization needs such counseling. (It’s a conflict of interest for an auditing firm to do both auditing and financial consulting.)
Meet with external auditors
When your board’s audit committee meets with the external auditors, the organization’s CFO and other key financial personnel will be present. At some point in each meeting, however, board members need to meet with the auditors in executive session without the CFO, CEO, and other managers. At these private sessions, board members need to ask the auditors, “Do you have anything to tell the board without management present?” This gives auditors a chance to report any concerns that need board consideration, such as unusual travel, entertainment, or other expenses or any transactions that raise red flags. Audit committee members also have an opportunity to raise questions about the professional competence of the organization's internal financial personnel.
Some larger organizations may employ one or more internal auditors. The audit committee should meet with these people several times a year.
Unless specified in the audit agreement, fraud detection is a secondary purpose of the external audit. The main purpose is to assure that information in financial statements is a fair representation of financial activities. However, auditors can -- and often do -- uncover indications of fraud during a routine audit, and it’s their duty to report it.
Develop a conversation with external auditors
In the typical nonprofit, only one or two audit committee members will be able to formulate detailed technical questions for the external auditors. However, to help uncover fraud, every board member should be familiar with six audit- related topics and be able to pose questions about these six topics:
(1) Are internal controls adequate? The organization’s control system needs to be divided into operating functions. Then, each operating function must be performed by someone different so that each person checks the others’ work. For example, a sales associate completes a retail sale, but a sales audit person deposits the cash to the bank account. In addition, all financial people need to take scheduled vacations so that another employee is responsible for the vacationer’s work for at least two consecutive weeks a year. (In the fraud case that begins this article, the transactions between husband and wife shouldn’t have been allowed. At the very least, the transactions should have been reviewed in detail by a qualified independent third party. Proper internal controls would have brought the fraudulent situation to light.)
(2) Are financial records accurate? External auditors must certify that the following records are in proper form: financial statements, management contracts, sales of major assets, bonus payments, and long term lease agreements.
(3) Are activities and expenditures properly authorized? For example, have any extensive changes in plans been approved by the board? Have major expenses been properly budgeted? Have travel costs over a prescribed level been approved by a senior officer? Depending on the size of the organization, do all expenditures over a certain amount require two signatures from senior officers?
(4) Do all reported assets actually exist? This question is especially important to answer if the organization holds any physical assets at a distance from its main offices.
(5) Is the organization performing any activities that might endanger its tax-exempt status? Smaller nonprofits sometimes let licenses or even tax-exempt certificates lapse. It’s vital to certify that such documents are up to date and that taxable income and charitable donations are reported separately.
(6) Is the organization paying its payroll taxes, sales taxes, and license fees on time? Does the organization file its financial reports, like the IRS 990 report, on time? Many fraudulent cases involve failure to report and pay employee withholding taxes.
Trust but verify
Since fraud is such a pervasive cancer in the nonprofit environment, it needs intense board attention. Cases of nonprofit fraud undermine the good work of the organization and the nonprofit sector.
Every board member should know enough about finance to spot suspicious activity when it occurs. Everyone involved in the organization should be alerted to the fact that board members are giving serious attention to the fraud issue. That knowledge, in itself, may deter someone from trying to steal.
Prime Reading for Your Board
Be sure all board members have read the following Nonprofit World articles (available at www.snpo.org/members):
How to Have an Audit without Breaking the Bank (Vol. 20, No. 4)
New Internal Control Guidance (Vol. 28, No. 1)
Nonprofits without Audit Committees Risk Disaster (Vol. 22, No. 2)
Fraud: How to Prevent It in Your Organization (Vol. 26, No. 3)
Make Good Use of the Treasurer and Finance Committee (Vol. 27, No. 2)
Protecting Your Organization against Financial Misuse (Vol. 17, No. 4)
The Audit Committee: Why You Need one, How to Form One (Vol. 6, No. 6)
Setting Up a Control System for Your Organization (Vol. 16, No. 3)
New IRS Employment Tax Initiative: What Does It Mean for Nonprofits? (Vol. 28, No. 2)
Conflict of Interest in the Board Room (Vol. 17, No. 2)
How to Find the Perfect Auditor (Vol. 22, No. 3)
Dr. Eugene Fram (eugenefram@yahoo.com) is professor emeritus, E. Philip Saunders College of Business, Rochester Institute of Technology (RIT). He is the author of Policy vs. Paper Clips, which describes a nonprofit governance model that has been adopted by thousands of nonprofit organizations. Dr. Bruce Oliver (blobbu@rit.edu) is professor of accounting and director of the Saunders Institute for Business Ethics and Corporate Social Responsibility at RIT.
A virus that hit Facebook hard in 2009 is unfortunately back: the Koobface virus. Koobface, (an anagram of 'Facebook') infected computers will send a message to the user's Facebook friends suggesting a video or website to click on. Once clicked, the virus infects that computer and sends itself to that user's Facebook friend list. To make matters worse, Koobface is also now turning up on Twitter.
Also in 2009, many Facebook users were sent messages containing links to an application which would reveal who their top Facebook friends were. Rumors quickly spread that the application was a virus, dubbed the “Facebook Fan Check Virus”. Shortly after, numerous fixes and virus removal tools cropped up that allegedly removed the Fan Check virus. After an investigation by Facebook, it was determined that the Fan Check application was not a virus, but almost all of the applications to remove it were.
