With potentially the entire workforce logging on from home, many organisations will worry about timesheet fraud and consider electronic monitoring solutions. But this could be an own goal. More holistic, behavioural approaches may be a better way to both prevent fraud, and support staff.
I remember when ‘working from home’ was seen as a bit of a jolly, and greeted with wry smiles from colleagues. Now in the wake of COVID-19 it looks set to become the norm, at least for a while. Employers may worry about employees misrepresenting their time, and wonder whether they need to heighten monitoring through computers and smartphones.
There is a place for these kinds of technologies. Certain types of electronic monitoring can be prudent for certain types of work. But for many organisations – especially those new to remote working at scale – this could turn out to be a mistake. There are better ways for organisations to protect productivity and support their teams during crises like this.
Humans, not machines
The fraud triangle, based on the work of Donald Cressey, is so robust we’re still using it 70 years after it first appeared. In this model of dishonest behaviour, a key component of fraud is rationalisation – the way that we make ourselves comfortable with what we want to do.
When I open my casebook of internal fraud investigations, a rationalisation that crops up repeatedly is the perpetrator’s sense that the organisation has wronged them – that the fraud would be retribution, justice, rebalancing the scales.
This is important. If an organisation adopts intrusive methods that leave employees feeling devalued and untrusted, then this can open up the possibility of that rationalisation. Combine that with financial or logistical pressure generated by the COVID-19 crisis (motivation) and the clear opportunity, and the fraud triangle is complete.
Instead, we need to think more broadly about the impact of home-working on fraud, and more carefully about human factors, before we jump to thinking about controls.
Start with a new fraud risk assessment
Sending the workforce home is a major change of circumstances – one big enough to affect your organisation’s internal fraud risk profile. Risks beyond timesheet fraud will be affected. For example:
- What could be the effect on expenses fraud?
- Will the rise in e-mail and online communication heighten vulnerability to cyber, data security, and privacy threats?
- If a health and safety assessment hasn’t been carried out on a person’s home workstation, is there a risk of false claims for which organisations may be unable to defend themselves in some jurisdictions?
It’s time for a new fraud and corruption risk assessment.
Taking a human-centric approach
With the risk assessment providing a clear picture of what could go wrong, there may be places in which technology can help. But there are others in which we need to think about humans.
In a time where our people feel frightened and stretched, it is nurturing, caring leadership that will both support them and help to prevent and detect fraud. It’s not only possible to do both, but vital. Managers are the key controls. In retail, smiling as a customer enters can make them feel welcome – and deter shoplifters by showing they’ve been noticed. The principle is the same here. Good day-to-day remote management of employees leaves them feeling empowered and enabled, but also helps to deter, prevent and detect internal fraud.
For example:
- Train and develop managers in the potentially new task of supportive remote leadership;
- Create nurturing, mutually-problem solving relationships within teams, reducing the likelihood that people will feel the need to hide things (which can help to generate the right conditions for fraud);
- Consider online collaboration platforms. Some have amazing functionality to improve connections between remote workers, which also helps to preserve accountability;
- Provide managers with clear guidance on fraud red flags.
At the corporate level, review HR policies from an anti-fraud perspective. For example, flexible working is also about time, not just location. Business closures means that employees may now have to balance caring for children and the elderly, and seizing sudden opportunities to buy essentials, with their work-day. A flexi-time policy is a great way to prevent employees misrepresenting their work hours. Have an anti-fraud specialist examine your policies.
Meanwhile, with your employees now physically disconnected from the social norms, cues and wider internal culture that helps to regulate their behaviour, re–assess how you will manage internal culture. How will you shape how employees think, feel and act in line with an anti-fraud culture when they’re not in your building? Now might be the time to step up behaviour-shaping online materials, and anti-fraud communication and awareness initiatives.
There are a surprising number of organisations that already embrace remote working, especially in the humanitarian and global development sector. Reach out for advice. How are they managing the risks? What has worked and what hasn’t for them?
Finally, manage your own cognitive errors, biases and heuristics. Fraud and corruption love availability bias, for example, the phenomenon in which we focus on the most visibly present issues and risks. Because fraud hides and masquerades, that bias allows it to shuffle off into the darkness. Don’t let that happen. Fraud is agile and will already be adapting to this new world, you need to think about how your organisational efforts to deter, prevent, detect and respond to it will too.
Towards organisational health
Some employee monitoring solutions – especially those at the leading edge – are exciting, minimally intrusive and potentially very useful. But organisations should take care not to panic-buy. Just as with COVID-19, fighting the virus that is fraud starts with careful, risk-based preparation.
Did you find this article useful? Why not check out Oliver May’s books on tackling fraud and corruption?
Content at Second Marshmallow does not necessarily reflect the views of the author’s employer, clients or others. Check out our Disclaimer for more information.
In these situations, organisations can rely on alternative evidence of the delivery, such as the evidence of the supplies’ transport to, and arrival at, the point of distribution. Distributions can also be recorded with modern technologies such as biometrics, body cameras on the distributors, or even mini-drones which can be deployed to record at a set altitude above a person wearing a transmitter.
In non-emergency activities such as training, incorporating fraud detection into post-event monitoring and evaluation is key. Organisations can randomly select a sample of recipients, contact them for feedback, and verify receipt of the items or service.
Najwa Whistler is a finance director with 18 years of experience working for several international NGOs around the world. Growing up in a small village in Lebanon in poverty during the civil war built her resilience and determination to work in international development. She enjoys cooking and dancing. You can reach her via naj.whistler@gmail.com
It’s a great scene, and we celebrate Maverick’s daring heroics. But let’s be clear, this wasn’t what he was supposed to do. It was dangerous. We only celebrate because Maverick pulled it off. If something had gone wrong, Top Gun wouldn’t be a heartwarming movie about a young pilot’s quest for meaning, love and success. It would be a dark political thriller about a world on the brink of nuclear war following a mid-air collision caused by a reckless American pilot.
Some international NGOs are tempted to break the laws and regulations of their countries of operation, registration, or both. Here we don’t so much mean situations where legal authority is unclear, or regulations and obligations are ill-defined or differently interpreted, or laws which violate human rights. Here we’re focussing on a situation where an NGO wilfully or negligently breaks legitimate, clearly-defined and communicated local laws and regulations. Temptations might include, particularly:
When an incident of fraud takes places in a project where the NGO was working unlawfully, managers may then be incentivised against taking civil or criminal justice action for fear of drawing attention to the project’s own misdemeanours. This may significantly hamper the prospect of redress (getting our money back), and impact upon the available sanctions for a perpetrator. This, in turn, could damage the NGO’s ability to deter fraud and corruption if a potential perpetrator knows that such an outcome is unlikely.
The risk goes even further, however. While international staff may be able to hop on the next plane home if things get too hot with local authorities, local staff can’t press that escape button. They may therefore bear the greatest risk of consequences like prosecution. This outrageous burden is hardly helpful to the positive workplace relationships necessary to help deter corruption and promote whistleblowing.
An area where this ‘do-no-harm’ themed risk is particularly evident is where NGOs procure from the black market, an option that can arise during scenarios such as the recent fuel crises in 
Find out more about the risk that fraud and corruption pose to humanitarian and global development organisations, and how they can better deter, prevent, detect and respond to it, in my book! Click here to get your copy of Fighting Fraud and Corruption in the Humanitarian and Global Development Sector from the 
This presents a very challenging issue for NGOs that work in high-risk areas, and one with significant tensions at its heart. These include the tension between minimising the risk of diversion versus disrupting the delivery of aid, competing obligations on the ground, and the wider balancing act between regulation and enforcement versus guidance and capacity building.
Audit is a helpful process that 
In 
In 2015, the UK government issued guidance describing the risk of a prosecution for a terrorism offence as a result of involvement in humanitarian efforts or conflict resolution as ‘
Implied assurance of non-prosecution is always caveated, is not always made by those with the correct authority, and might not relate to that which is perceived. The British guidance note, for example, does not indicate whether it is referring to placing resources in the hands of terrorists (potentially s15-18 Terrorism Act offences), failing to have sufficient systems to prevent sanctions breaches (potentially a s34 Terrorist Asset Freezing Act offence of neglect), failing to report a suspected funding offence (s19 Terrorism Act), or some of those, or none – and so on. In any event, any decisions would be made on the basis of the prevailing circumstances of the case and it is worth noting that Save the Children International were investigated by the Metropolitan Police for 
management framework – would not have significantly reduced the chances of it happening. An example might be World Vision’s 
Ironically, of course, a driver behind the flawed narrative is a desire to see good stewardship in NGOs. But in the same way that it would not represent good stewardship for a fire department to send firefighters into burning houses without protective clothing, it does not represent good stewardship for charities to move resources around without sufficient protective systems clothing those resources. Although there is, of course, a balance to strike – enormous overhead, administrative and support costs are a red flag – under-investment in prevention, and the infrastructure that makes prevention happen, is a key enabler of fraud and corruption for NGOs.
Second Marshmallow 