A focus on COVID-19 is leaving charities susceptible to fraud

The global pandemic has not affected charities in anything like a consistent manner. From my experience, almost every charity I work with has experienced an impact on their ability to provide services to their beneficiaries.

However, the impact on their cashflow has been far less consistent.  Some charities have seen income rise, as government, trusts and foundations look to support the sector. Others have been able to control their costs to protect their cashflow. However, some are experiencing significant financial difficulties.

So, whilst the impact felt has been erratic, where there has been uniformity is that every charity has had to do things differently, make decisions quickly, modify the way they provide services and work remotely.

All of these factors put pressure on those working for charities, including the senior leadership and finance teams.

Whenever there is rapid change, the risk of fraud increases as people are operating in different ways, with less time, and changing processes.

So, a health pandemic has caused financial hardship for many charities, whilst at the same time as leaving them more susceptible to fraud.

Fraudsters will always look to exploit change as this can often lead to weaknesses in the application of internal controls.

With most frauds that I have seen, if the internal controls had been correctly applied then the fraud would have been prevented – with human error being the main system weakness.

As workforces move from the office to home almost overnight, ensuring that the control environment is just as robust when you do not meet with your colleagues, you do not have physical documents, and you may not have such up to date IT, has proven to be a challenge, and the risk of human error has increased.

Focussing on financial controls may seem mundane with everything else that is going on, but it should be a priority.

Some things to consider and ask yourself include:

• Accept that there is an increased risk of fraud in this period, and it is very likely to happen. Being “switched on” to the possibility of fraud naturally increases vigilance and scrutiny, which is very necessary in these times when staff resources are both stretched and operating differently.
• Make sure management teams and boards / audit committees alike discuss and are aware of the increased potential for fraud (and examples of how this might be perpetrated) to increase general scepticism.
• The aim is to prevent fraud in the primary instance, but also then to detect it if it does unfortunately slip through. Have a combination of preventative measures (separation of duties, formal approval by someone not involved in process, as well as increased scrutiny as above) and detective measures (again, heightened scrutiny over financial transactions and performance, challenge anything that doesn’t seem to fit).
• Consider the potential exposure to fraud due to possible reduced segregation of duties with staff off sick. You may need to put new controls in place, or increase “second line” review and approval processes.
• If you need to take on temporary staff to cover absences, ensure they have minimal access to your finance system.
• Financial fraud generally will be a heightened risk area during a period of crisis so be alert for phishing and other scams, especially if untrained staff are supporting the finance team.
• Ensure all IT control procedures continue, including proper authorisation for new users or increases in existing user access “to cover staff shortages”.
• Be vigilant and avoid basic mistakes if possible. Strong financial controls are essential and where teams are pushed for capacity the temptation is to relax controls, when the situation requires a heightened need for maintaining them. Weaknesses can often be those who can override controls.
• Overall, make sure that you are able to maintain visibility over what is happening across the organisation, and that this is a “visible visibility” – i.e. staff are still aware that the monitoring and approval processes should still operate as they did before, which should promote a positive culture, with staff feeling supported and connected as a result, rather than isolated. 

Effective risk management and good governance have never been more critical to the success of the sector, but there needs to be a balanced approach.

Senior leaders and Trustees need to ensure all risks are considered, and that strong financial governance is maintained to protect against the growing risk of fraud – unfortunately, charities have more to worry about than just COVID-19.

If you need support with your risk management or governance best practice, please contact a member of Bishop Fleming’s Charity & NFP team, who would be more than happy to help.