Mr. Goldmann

Security & Safety

Prevent Fraud by Enforcing Strict Anti-fraud Policies

By Peter Goldmann, President, FraudAware Hospitality

And-now is a good time to start getting serious about fighting fraud, because, according to the Association of Certified Fraud Examiners (ACFE), internal fraud alone (not counting such crimes as credit card fraud by guests and vendor scams that don't involve a hotel employee) robs up to 6% of gross revenue every year.

A special challenge for hotel industry security managers is the fact that hospitality properties generate enormous amounts of cash. Whether it's guests paying cash for rooms or restaurant and bar patrons paying for meals with cash, without strict controls on how that cash is handled...and by whom...there's no question that a significant chunk of it is going to end up in employees' pockets.

First Things First

Whether it's cash embezzlement... theft of inventory... an employee accepting vendor kickbacks or some other profit-draining fraud, there is no getting around the fact that formulating and enforcing an employee anti-fraud policy is step one in the challenge of preventing fraud.

After all, you can't expect dishonest employees to be deterred from stealing if the company doesn't take a "zero-tolerance" position toward employee theft.

According to accountant, Andrew Durant of BDO Stoy Hayward in London, "The aim of a corporate [anti-fraud] policy is to demonstrate to both employees and the outside world that the company is taking the threat of dishonesty, fraud, and theft seriously.

"By issuing a detailed policy, the company clearly sets out what is considered to be dishonest and warns any potential wrongdoers that the consequences of being caught will be serious.

"The effect therefore will be to deter potential wrongdoers, thus resulting in reduced losses from any wrongdoing and reduced costs in respect of investigating any wrongdoing."

Of course, virtually every organization, especially hotels whose turnover rates are exceptionally high, will at one point or another be hit by an employee who is fundamentally dishonest and will look for opportunities to steal, no matter how well written the fraud policy is and how tight the company's internal financial controls are. More aggressive pre-employment background checking is the best way to mitigate this risk.

The great benefit of implementing an anti-fraud policy is in deterring the large percentage of employees who are basically honest, but who might cross the dishonesty line if the right opportunity comes up. A well-written policy...linked with serious and consistently enforced consequences for violations will keep many, if not most of those employees on the right side of the law.

Internal Controls

It may sound obvious, but your anti-fraud policy will not be worth the paper (or disk space) it's written on if you don't have the necessary internal controls in place to begin with.

Reason: The primary purpose of an anti-fraud policy is to ensure that your employees follow the rules. If there are, for example, no rules requiring manager authorization of credits for disputed charges to a guest's credit card, there's a chance that a cashier or accounts receivable staffer might put that credit on his or her own credit card.

The Bottom Line: Before you start drafting a corporate anti-fraud policy, be sure that the internal controls needed to prevent fraud are in place so that they can be referred to in the policy. This is easier said than done, but an experienced auditor or controller can perform a risk assessment and use the results to formulate the necessary controls.

Policy Essentials

According to BDO's Durant, "There should be a general policy statement on ethics and the company's attitude to dishonesty, fraud, and theft." Other key components include...

• Definition of fraud. The policy should include a clear list of what is regarded as fraud or theft. The following list, compiled by the ACFE may be a useful guideline for hospitality companies... Forgery or alteration of a check, bank draft, or any other financial document
  
  Misappropriation of funds, securities, supplies, or other assets
  
  Impropriety in the handling or reporting of money or financial transactions
  
  Profiteering as a result of insider knowledge of company activities
  
  Disclosing confidential and proprietary information to outside parties
  
  Accepting or seeking anything of material value from contractors, vendors or persons providing services/materials to the Company. Exception: Gifts less than $50 in value.

In addition, the policy should quantify what constitutes fraud or dishonesty. (For example, an overstatement of expenses by $1 might not be considered to be fraud, but continuously over-claiming expenses by $1 might be considered dishonest.):

• Specific language regarding financial statement fraud... including a description of state and federal laws governing the company's auditing and filing procedures.
  
• Standards and expectations for adhering to internal controls. The policy should clearly state that employees who have access to company funds are required to follow all prescribed procedures for recording, handling, and protecting money as detailed in internal control manuals or other explanatory materials.
  
• Description of illegal conflicts of interest. Here is some sample policy language from the American Institute of Certified Public Accountants (AICPA): "The Organization expects that employees will perform their duties conscientiously, honestly, and in accordance with the best interests of the Organization. Employees must not use their position or the knowledge gained as a result of their position for private or personal advantage. Regardless of the circumstances, if employees sense that a course of action they have pursued, are presently pursuing, or are contemplating pursuing may involve them in a conflict of interest with their employer, they should immediately communicate all the facts to their superior."
  
• Whistleblowing policy. Under new federal law, employees who blow the whistle on financial misconduct are protected against retribution and retaliation. Employees must be thoroughly informed about this and about the company's procedures for reporting illegal financial activity. This should involve maintaining a confidential and anonymous fraud hotline, and the policy should include thorough instructions for using the hotline.
  
• Investigation and resolution policy. Your anti-fraud policy should specify who will investigate reported incidents of fraud...how the investigation will be conducted...and how the results of the investigation will be used to determine appropriate consequences.

Enforcing Your Policy

Martin Biegelman, Group Manager of the Financial Integrity Unit at Microsoft Corp. said, "A detailed anti-fraud policy is great for improving integrity. But -we all know that integrity starts at the top. The CEO and other top management are responsible for setting the corporate tone and leading by example. It's too late to establish a culture of honesty and integrity when your CEO is doing the "perp walk" with federal agents.

This message has been repeated frequently in recent years as headlines about major corporate frauds perpetrated by some of the country's most powerful senior executives have proliferated.

The challenge: It's one thing to declare in your company's annual report or employee manual that management maintains the highest standards of ethical behavior. It's quite another to prove that you mean it.

The key is to build a culture of "doing the right thing"- by not only setting the tone at the top...but also making all employees accountable for following the rules and not defrauding their employers. To do that, you must back up your anti-fraud policy with stringent policies outlining the consequences of violating the policy or willfully disregarding the company's internal financial controls.

Terminating a guilty employee is often the preferred outcome of a successful internal fraud investigation. It is also the best way to send the message to the company's workforce that there is a "zero-tolerance" standard regarding employee fraud. Here is sample language from one hotel company's anti-fraud policy...

"When there is sufficient evidence that specific federal or state laws have been violated, the offender will be prosecuted to the fullest extent of the law. Employees who are guilty of fraudulent activity will be terminated immediately."

**Accountability**** **

The real secret of successful fraud prevention is making everyone in the company accountable for detecting and reporting illegal or suspicious behavior. It should be a requirement that all employees report incidents that are or could be fraudulent either to their immediate supervisor...or to the company's anonymous fraud hotline.. As mentioned, the fraud policy must include the specific steps to take when reporting fraud.

To make this work, thorough fraud awareness training must be provided to all employees. Everyone must be informed about the specific kinds of fraud that threaten their department and how to recognize the red flags of such illegal activity. You can even require employees to take a quiz to measure their understanding of the kinds of fraudulent activity they should be alert to.

But your company can go a step further: To increase the likelihood that illegal activity will get reported, consider instituting a policy requiring disciplinary consequences for not reporting fraud or suspicious behavior. If, for example, an employee is caught stealing by the security department, but no one in the employee's department reported the illegal activity, the department head could be required to review the training material with his or her employees and potentially require them to re-take the test or quiz.

If after such training and testing, incidents of fraud continue to go unnoticed within a particular department in the hotel, top management can hold the department head responsible and apply appropriate disciplinary action, ranging from a warning to demotion....even to termination.

While some of these steps may sound draconian, hospitality executives must determine their level of tolerance for fraud losses. If the "bleeding" is too serious, tough action may be the only way to stop it.

Peter Goldmann is the Developer of FraudAware/Hospitality, the first on-line fraud awareness training course for hospitality managers, supervisors and line employees. He is is the publisher of the monthly newsletters, White-Collar Crime Fighter and Cyber-Crime Fighter. His company, White-Collar Crime 101 LLC also is the developer of FraudAware/Hospitality, a customizable Web-based fraud awareness training course for managers, supervisors and line employees. He is a member of the Association of Certified Fraud Examiners, and The International Association of Financial Crimes Investigators. Mr. Goldmann can be contacted at 203-431-7657 or pgoldmann@wccfighter.com Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.