…but that’s how things are done here

An article by David Mathuva

Working in any corporation may lead people to adopt repetitive patterns of behavior as was my experience once with an investigation I was involved in:

“… but I found my predecessors not ticking each and every bank reconciliation item when reviewing them!”

This is an assertive remark I got from a top finance manager in what would be classified as a blue chip company in our country. The remark emanated from a flurry of interview questions levelled on this finance manager, who, as he had indicated, “was in a hurry to attend other important business”. Being a registered CPA of Kenya with “over 15 years” of “relevant” experience in Accounting and Finance, this finance manager did not perceive the danger posed by such a practice. To cut the long story short, as a result of this “experienced” finance manager not checking each and every reconciling item on the bank reconciliations, the poor company was defrauded slightly over Kshs. 60 million over a two-year period. Only heavens know whether the company had lost more money in other years – but for the period under scope, Kshs. 60 million was gone.

I have written articles on bank reconciliations and warned that these can be used to perpetrate fraud by concealing it. Without a great deal of attention in reviewing bank reconciliations, hell can break loose after having caused massive damage over an extended period of time. However, this is not the focus of this article right now, in case you want to read more on bank reconciliation fraud, visit my blog on: http://dmathuva2012.blogspot.com/2013/08/the-fading-role-of-bank-reconciliation.html.

Back to the key issue under focus: this culture, this rite…this ritual, has cost companies dearly. Talk of sloppiness in adhering to policies and procedures in the name of culture, to committing fraud – again, in the name of culture! Do not blame [wrong] tone at the top, No.  This is one culture type that must be weeded out since it is disastrous. It demonstrates unwillingness by staff, not only to evade doing what should be done, but it may also signify a lack of willingness to take initiative or be innovative. Corporate leaders must be wary of elements within the company who have this cultural orientation and “align them” early before things get worse. This is because, this culture is infectious and very tempting as it more of a “short-cut” way of doing things as opposed to the “hard” formal way.

I do not want to sound philosophical but, come to think of it, when corporate leaders talk about change, they usually have a desired result in mind: gains in performance, a better a better approach to customers, the solution to a formidable challenge as Schwartz, Gaito & Lennick (2011) put it. With this kind of a culture, all this becomes “a wish” which is either not realized or partially realized. Never realized if all employees are entrenched in this culture and partially realized if there are a few elements who are into this addiction. The former is rarely experienced in corporations. The latter is often than not found is nearly 70% of the corporations.

I am not writing off employees who are entrenched in this culture: No. As Schwartz, Gaito & Lennick (2011) view it, being forced at work to try something new can trigger fear and anger (sometimes called the “amygdala hijack”), the urge to flee, or exhaustion disproportionate to the actual provocation. And this is justifiable. You can ask yourself, “this company has introduced a million +1 procedures and policies just recently”, and all along we have been operating with only the 1 policy +1 procedure called “Just do it”. Why now are we being subjected to the million+1 policies and procedures? What has changed now that we did not see change 5 years ago? This is often the unconscious rationalization employees entrenched in this culture have. And it is this rationalization that leads to the worst…. sloppy controls and thereby creating an enabling environment for fraud to happen.

Corporations, both in public and private sectors, let us put an end to this venomous culture, embrace discipline in adhering to policies and procedures! Most importantly, let us strive to weed out those elements stuck in this lethal culture, not forgetting that compliance comes before performance!

David Mathuva is a Forensic Investigator based in Nairobi.

He holds a Bachelor’s degree in commerce and a Masters in Forensic Accounting from Strathmore University. David is also a CPA.

You can read his articles on http://dmathuva2012.blogspot.com

Reference: Schwartz J., Gaito P. & Lennick D. (2011). “That’s the Way We (Used to) Do Things Around Here”. Strategy & Leadership, Issue 62 (Spring 2011).

Trust is not an internal control...

In the recent past I have investigated a number of irregularities whose root cause has been lapse internal controls and lack of enforcement. Over the last few years many firms have crafted internal controls, some even appreciating that a risk department should be established. Many of the these firms have spent huge amounts of money crafting what I would call wonderful documents in as far as identifying risks and how to control/manage them.

I always appreciate the efforts that companies make to ensure that they documented controls. However, the implementation of such controls is wanting in most cases. And this is where the whole risk management process fails. In the anti-fraud profession we have come to appreciate that if a fraudster knows that he will not be detected, then internal controls fail. Fear of detection is what prevents fraud and misconduct. Think about your organization, do you think the internal controls would deter a potential fraudster. Detection entails: having the right internal controls, resources in your risk department, committed management that sets an example, being tough on non-compliance and ensuring that there is right communication to staff.

I have come across organizations particularly small NGOs and family run businesses where internal controls are non-existence.

It always saddens me as an owner of a business or a director of an NGO narrates how, they have always trusted person X to handle their accounts for the last ten years and he has always performed, only for them to find out that the trusted fellow was running a separate organization. Some of these cases have resulted in consequences that would have never been anticipated: Freezing of funding from donors, tax claims from the tax authorities or closure of the organization.

However much you trust your employees, ensure you review their work or have an independent person do it. Have a questioning mind especially for long serving employees in certain positions…trust cannot be an internal control. I have seen instances where family members who have been placed in positions of trust turning out to be real fraudsters. I have also investigated a case where a receipting clerk defrauded his organization about Kshs 200 million in a period of two years – he had served in the position for over ten years.