With potentially the entire workforce logging on from home, many organisations will worry about timesheet fraud and consider electronic monitoring solutions. But this could be an own goal. More holistic, behavioural approaches may be a better way to both prevent fraud, and support staff.
I remember when ‘working from home’ was seen as a bit of a jolly, and greeted with wry smiles from colleagues. Now in the wake of COVID-19 it looks set to become the norm, at least for a while. Employers may worry about employees misrepresenting their time, and wonder whether they need to heighten monitoring through computers and smartphones.
There is a place for these kinds of technologies. Certain types of electronic monitoring can be prudent for certain types of work. But for many organisations – especially those new to remote working at scale – this could turn out to be a mistake. There are better ways for organisations to protect productivity and support their teams during crises like this.
Humans, not machines
The fraud triangle, based on the work of Donald Cressey, is so robust we’re still using it 70 years after it first appeared. In this model of dishonest behaviour, a key component of fraud is rationalisation – the way that we make ourselves comfortable with what we want to do.
When I open my casebook of internal fraud investigations, a rationalisation that crops up repeatedly is the perpetrator’s sense that the organisation has wronged them – that the fraud would be retribution, justice, rebalancing the scales.
This is important. If an organisation adopts intrusive methods that leave employees feeling devalued and untrusted, then this can open up the possibility of that rationalisation. Combine that with financial or logistical pressure generated by the COVID-19 crisis (motivation) and the clear opportunity, and the fraud triangle is complete.
Instead, we need to think more broadly about the impact of home-working on fraud, and more carefully about human factors, before we jump to thinking about controls.
Start with a new fraud risk assessment
Sending the workforce home is a major change of circumstances – one big enough to affect your organisation’s internal fraud risk profile. Risks beyond timesheet fraud will be affected. For example:
- What could be the effect on expenses fraud?
- Will the rise in e-mail and online communication heighten vulnerability to cyber, data security, and privacy threats?
- If a health and safety assessment hasn’t been carried out on a person’s home workstation, is there a risk of false claims for which organisations may be unable to defend themselves in some jurisdictions?
It’s time for a new fraud and corruption risk assessment.
Taking a human-centric approach
With the risk assessment providing a clear picture of what could go wrong, there may be places in which technology can help. But there are others in which we need to think about humans.
In a time where our people feel frightened and stretched, it is nurturing, caring leadership that will both support them and help to prevent and detect fraud. It’s not only possible to do both, but vital. Managers are the key controls. In retail, smiling as a customer enters can make them feel welcome – and deter shoplifters by showing they’ve been noticed. The principle is the same here. Good day-to-day remote management of employees leaves them feeling empowered and enabled, but also helps to deter, prevent and detect internal fraud.
For example:
- Train and develop managers in the potentially new task of supportive remote leadership;
- Create nurturing, mutually-problem solving relationships within teams, reducing the likelihood that people will feel the need to hide things (which can help to generate the right conditions for fraud);
- Consider online collaboration platforms. Some have amazing functionality to improve connections between remote workers, which also helps to preserve accountability;
- Provide managers with clear guidance on fraud red flags.
At the corporate level, review HR policies from an anti-fraud perspective. For example, flexible working is also about time, not just location. Business closures means that employees may now have to balance caring for children and the elderly, and seizing sudden opportunities to buy essentials, with their work-day. A flexi-time policy is a great way to prevent employees misrepresenting their work hours. Have an anti-fraud specialist examine your policies.
Meanwhile, with your employees now physically disconnected from the social norms, cues and wider internal culture that helps to regulate their behaviour, re–assess how you will manage internal culture. How will you shape how employees think, feel and act in line with an anti-fraud culture when they’re not in your building? Now might be the time to step up behaviour-shaping online materials, and anti-fraud communication and awareness initiatives.
There are a surprising number of organisations that already embrace remote working, especially in the humanitarian and global development sector. Reach out for advice. How are they managing the risks? What has worked and what hasn’t for them?
Finally, manage your own cognitive errors, biases and heuristics. Fraud and corruption love availability bias, for example, the phenomenon in which we focus on the most visibly present issues and risks. Because fraud hides and masquerades, that bias allows it to shuffle off into the darkness. Don’t let that happen. Fraud is agile and will already be adapting to this new world, you need to think about how your organisational efforts to deter, prevent, detect and respond to it will too.
Towards organisational health
Some employee monitoring solutions – especially those at the leading edge – are exciting, minimally intrusive and potentially very useful. But organisations should take care not to panic-buy. Just as with COVID-19, fighting the virus that is fraud starts with careful, risk-based preparation.
Did you find this article useful? Why not check out Oliver May’s books on tackling fraud and corruption?
Content at Second Marshmallow does not necessarily reflect the views of the author’s employer, clients or others. Check out our Disclaimer for more information.
Fraud and corruption has, historically, not been well understood in this sector. Your Board may have a low or rudimentary understanding of the risk and how to respond to it. This means starting at a basic level, making no assumptions, taking the time to address myths and misconceptions and playing a longer game. ‘Educate as you go,’ Willie Oelofse from Deloitte Kenya told NGOs at 
Civil society is under attack the world over, and the issue of their fraud and corruption exposure can be something that sends Board members running for their shields and helmets – especially if it is perceived to come from an 
People make decisions differently and on the basis of different values. For example, I am a big fan of the 
Fraud and corruption, especially at a strategic level, can be abstract concepts. Help the Board to connect by painting a picture of the risk with case studies. If you don’t have any in your own organisation, then perhaps partners, donors or other organisations have some they will let you use? If not, then find cases in the public space affecting comparable organisations. If you’re really struggling, consider using fictional examples – but remember to state that they’re fictional!
NGO Boards are often allergic to anything with a whiff of extra expense, especially if it is 
NGO Boards manage a lot of risks, only some of which materialize. Using evidence helps them to appreciate how fraud and corruption sits, whether that evidence is perception-based, representative sampled, or from other diverse sources. Cast the evidence net wide – consider staff surveys (especially anonymous surveys), risk assessments, project and programme evaluations, audit reports, security reports, academic research and open source. This may mean that you need to start by 
Just as is the case with private and public sector organisations, the counter-fraud agenda needs to directly support the organisation’s mission. This needs to be clearly elucidated so that Boards can see that counter-fraud is a mainstream activity, rather than a distraction.
In March’s 
A ten-minute agenda item at a Board meeting is not enough to ensure that a Board truly embraces counter-fraud and corruption. Obtain regular meetings with each member to explore their own position and build their buy-in – especially before key decisions are to be made. Similarly, the counter-fraud agenda needs to align not just to the organisation’s mission but to the agendas of those individual Board members. How does countering fraud help, not hinder, the aims of the person in front of you?
Second Marshmallow 