Before getting into practical advice on what to do if you suspect fraud, how to report charity fraud and the investigation of suspected fraud, I think it’s important to mention the current state of affairs in the charity sector. Statistics from the Fraud Advisory Panel show that fraud within the charity sector is significantly underreported.
Charities appear to be concerned – maybe even scared – about the reputational damage fraud reporting could do to their organisation. A fraud-related prosecution or a case involving a charity with a high-profile may well enter the public domain through the media, and charities are concerned that might have a negative impact on public confidence in their organisation and their work.
This may well be as a result of recent high-profile scandals involving UK charities. While those cases didn’t involve fraud, the potential impact of bad press has been felt by the sector.
Most often, when people give their money to a charity, it’s because they believe in the work that charity does and believe that their money will be put to good use. Charities worry that anything that could dispel that idea in people’s minds could, in turn, lead to a reduction in support and donations received.
This is especially true when fraud is on the inside of a charity.
Fraud could be external to an organisation – for example, someone creating a fake website or page on a site such as Just Giving, pretending to be a charity / collecting on behalf of a charity, then syphoning the funds raised – but the potential for reputational damage in these situations isn’t as high.
The reluctance of charities to report fraud is a huge source of concern. And it should be a source of concern for the Charity Commission and other bodies involved in the charity sector and in fraud prevention.
What should a charity do if it identifies fraud within its organisation?
For me, I think it’s most important for charities to focus on insider fraud – the fraud that occurs within charities.
I think the first thing that charities should do is, as quickly as possible, to lock down all systems and controls. Whoever is responsible for governance and fraud prevention in the charity should press the brakes on everything as soon as possible, especially if fairly large amounts of money are involved.
It’s important to stem the flow quickly, as we know that the longer a fraud goes on for within an organisation, the bigger that fraud becomes. Fraudsters often test the waters. They may start off by syphoning off maybe only a few pounds or a few hundred pounds. Once they realise that there are gaps and weaknesses in the system that they can take advantage of, it emboldens them to think bigger. Stealing £100 then becomes £200 the next time, then £1,000, then £5,000 and so on. Unchecked frauds then grow exponentially.
I’m not suggesting that whole organisations should lock down as soon as they see £100 missing from their accounts. For smaller amounts of money, there may be a very simple explanation – a misunderstanding or an accounting error, for example. But, as soon as you think money may have been defrauded or stolen, that is when you need to quickly review what may be going on.
In the first instance, that means speaking to the responsible people in the organisation. That could be the head of finance, or the bookkeeper or treasurer. At the same time, the systems and controls in place should be checked to ensure they’re working properly. If there’s no clear explanation for missing money, that’s the time to take further decisive action.
Your response should be proportionate to the amount of money involved and to the size of your organisation. The tipping point will likely be different for different charities.
As a charity, the action you’re able to take may depend on the type of charity you are, too. If you’re dispersing funds, you may not be able to put the brakes on everything, because you have people and organisations that depend on you.
What does ‘locking down’ systems and controls involve?
When you suspect a fraud, the key objectives of your response are to identify and close any gaps, bolster any weak areas and mitigate the risk of more money disappearing. Typically, this is about access and authorisation. Access to systems and to finances should be limited to those people who absolutely need it. Authorisation processes can be strengthened simply by adding another level. For example, especially in smaller organisations, moving money might need to be authorised by only 1 person. Adding a second signatory to that process immediately adds another layer of security.
Once the potential risks have been mitigated, an organisation can start putting in place the next part of their response.
Investigation of suspected fraud
To ascertain exactly what has gone on in the case of a suspected charity fraud, you need to carry out a thorough investigation.
Whether you choose to undertake an internal investigation of suspected fraud or bring in external investigators, it’s important to involve people with the right expertise early on. Think about who needs to be involved in the investigation, and what skillsets you need to bring in from external parties. Do you need to bring in forensic accountants? Do you need to bring in economic crime investigators? Do you need to bring in auditors? External experts might be needed only for advice and can help guide the charity to make its determination about how it goes about its own investigation. Alternatively, the whole investigation can be outsourced to an independent external organisation.
The investigation needs to be quick and it needs to be addressed in depth. One reason for this is the obligation to report serious incidents to the Charity Commission. As soon as you’re able to ascertain a 60 or 70% likelihood that the case is fraud, it should be reported to the Charity Commission.
Internally, the investigation team needs to report into someone. In charities, the governance committee is the most likely candidate for this role. Even if there’s suspected involvement in a fraud by the charity’s trustees, the governance committee usually works independently of the charity’s management structure.
The investigation itself is the same for charities as any other organisation. Once the investigation team is in place, the next stage is to determine where the material is that can assist with uncovering what has happened. In a fraud investigation, that means working closely with members of the finance and audit functions within the organisation. Crucially, at this stage, you want to make sure that any information that could assist in the investigation is secured. Ensure that no material is destroyed or deleted (although digital forensics can help with recovering deleted digital files and emails).
When the potential evidence has been secured, you start your process of understanding what’s happened by virtue of interviews, reviewing the material and interrogating the accounts (which is where forensic accountants can add real value).
Prevention is better than the cure
Many UK charities are small bodies with limited resources, which can result in them having few fraud prevention controls in place and a mindset of ‘we haven’t got the money for this’. But it’s often the case that charities really can’t afford not to invest in fraud prevention. The fallout of a fraud case or another type of scandal could spell the end for smaller charities, whereas investing, say, a few thousand pounds in prevention tools could avoid the loss of tens of thousands to fraud down the line.
An area I always look at when conducting investigations is what controls were in place pre-incident and how can those controls and processes be improved to avoid future issues? One side of the investigation is, of course, discovering the truth about the case at hand, but the other side is analysing the preventative risk management elements within an organisation. Whether or not a crime is identified during an investigation, the organisation’s risk controls are left in a stronger position for the future.
Relentless risk management is the best chance an organisation has for preventing fraud.
That means continually undertaking risk reviews, looking at systems and processes. Transparency and accountability at all levels are really, really important.
How to report charity fraud
In relation to reporting charity fraud, trustees should be mindful of their obligations to the Charity Commission. Once it becomes clear that a fraud has been committed, it must be reported.
Another body charities may want to report suspected fraud cases to is Action Fraud, which gathers data about fraud across all sectors.
Finally, if you think a crime has been committed, there’s a decision to be made on whether (and when) to bring in the police.
The bottom line is that charities shouldn’t bury their heads in the sand. Each situation should be considered carefully and a quick decision should be taken on the most effective and proportional way to manage that particular (potential) problem.
Charity fraud: How ESA Risk can help
At ESA Risk, our team includes experienced fraud investigators and risk management experts, meaning we can support charities at every step – from offering advice on fraud prevention to conducting full investigations of suspected frauds.
If you suspect a fraud has been committed in your organisation or you want help to secure your charity against fraud, contact Lloydette Bai-Marrow, Serious Fraud and Economic Crime Consultant at lloydette.bai-marrow@esarisk.com, on +44 (0)343 515 8686 or via our contact form.
This article was published as part of Charity Fraud Awareness Week 2021.
