With potentially the entire workforce logging on from home, many organisations will worry about timesheet fraud and consider electronic monitoring solutions. But this could be an own goal. More holistic, behavioural approaches may be a better way to both prevent fraud, and support staff.
I remember when ‘working from home’ was seen as a bit of a jolly, and greeted with wry smiles from colleagues. Now in the wake of COVID-19 it looks set to become the norm, at least for a while. Employers may worry about employees misrepresenting their time, and wonder whether they need to heighten monitoring through computers and smartphones.
There is a place for these kinds of technologies. Certain types of electronic monitoring can be prudent for certain types of work. But for many organisations – especially those new to remote working at scale – this could turn out to be a mistake. There are better ways for organisations to protect productivity and support their teams during crises like this.
Humans, not machines
The fraud triangle, based on the work of Donald Cressey, is so robust we’re still using it 70 years after it first appeared. In this model of dishonest behaviour, a key component of fraud is rationalisation – the way that we make ourselves comfortable with what we want to do.
When I open my casebook of internal fraud investigations, a rationalisation that crops up repeatedly is the perpetrator’s sense that the organisation has wronged them – that the fraud would be retribution, justice, rebalancing the scales.
This is important. If an organisation adopts intrusive methods that leave employees feeling devalued and untrusted, then this can open up the possibility of that rationalisation. Combine that with financial or logistical pressure generated by the COVID-19 crisis (motivation) and the clear opportunity, and the fraud triangle is complete.
Instead, we need to think more broadly about the impact of home-working on fraud, and more carefully about human factors, before we jump to thinking about controls.
Start with a new fraud risk assessment
Sending the workforce home is a major change of circumstances – one big enough to affect your organisation’s internal fraud risk profile. Risks beyond timesheet fraud will be affected. For example:
- What could be the effect on expenses fraud?
- Will the rise in e-mail and online communication heighten vulnerability to cyber, data security, and privacy threats?
- If a health and safety assessment hasn’t been carried out on a person’s home workstation, is there a risk of false claims for which organisations may be unable to defend themselves in some jurisdictions?
It’s time for a new fraud and corruption risk assessment.
Taking a human-centric approach
With the risk assessment providing a clear picture of what could go wrong, there may be places in which technology can help. But there are others in which we need to think about humans.
In a time where our people feel frightened and stretched, it is nurturing, caring leadership that will both support them and help to prevent and detect fraud. It’s not only possible to do both, but vital. Managers are the key controls. In retail, smiling as a customer enters can make them feel welcome – and deter shoplifters by showing they’ve been noticed. The principle is the same here. Good day-to-day remote management of employees leaves them feeling empowered and enabled, but also helps to deter, prevent and detect internal fraud.
For example:
- Train and develop managers in the potentially new task of supportive remote leadership;
- Create nurturing, mutually-problem solving relationships within teams, reducing the likelihood that people will feel the need to hide things (which can help to generate the right conditions for fraud);
- Consider online collaboration platforms. Some have amazing functionality to improve connections between remote workers, which also helps to preserve accountability;
- Provide managers with clear guidance on fraud red flags.
At the corporate level, review HR policies from an anti-fraud perspective. For example, flexible working is also about time, not just location. Business closures means that employees may now have to balance caring for children and the elderly, and seizing sudden opportunities to buy essentials, with their work-day. A flexi-time policy is a great way to prevent employees misrepresenting their work hours. Have an anti-fraud specialist examine your policies.
Meanwhile, with your employees now physically disconnected from the social norms, cues and wider internal culture that helps to regulate their behaviour, re–assess how you will manage internal culture. How will you shape how employees think, feel and act in line with an anti-fraud culture when they’re not in your building? Now might be the time to step up behaviour-shaping online materials, and anti-fraud communication and awareness initiatives.
There are a surprising number of organisations that already embrace remote working, especially in the humanitarian and global development sector. Reach out for advice. How are they managing the risks? What has worked and what hasn’t for them?
Finally, manage your own cognitive errors, biases and heuristics. Fraud and corruption love availability bias, for example, the phenomenon in which we focus on the most visibly present issues and risks. Because fraud hides and masquerades, that bias allows it to shuffle off into the darkness. Don’t let that happen. Fraud is agile and will already be adapting to this new world, you need to think about how your organisational efforts to deter, prevent, detect and respond to it will too.
Towards organisational health
Some employee monitoring solutions – especially those at the leading edge – are exciting, minimally intrusive and potentially very useful. But organisations should take care not to panic-buy. Just as with COVID-19, fighting the virus that is fraud starts with careful, risk-based preparation.
Did you find this article useful? Why not check out Oliver May’s books on tackling fraud and corruption?
Content at Second Marshmallow does not necessarily reflect the views of the author’s employer, clients or others. Check out our Disclaimer for more information.
If a humanitarian or global development organisation gets serious about tackling fraud and corruption, then it will detect cases – possibly in significant numbers. As my organisation invested in counter-fraud efforts, for example, we saw recorded suspicions in its global operations 
The job does not finish with the dismissal or conviction of the suspect(s). These incidents have long tails – there is work still to be done to rehabilitate the project or business unit in which the incident took place. An incident represents a severe breach of trust; workers may feel abused and betrayed. The ripples can spread wide.
Hopefully, the organisational response included a lessons-learned exercise, generating changes to implement. This should look beyond the internal controls, also into enabling factors such as culture, communication and awareness.
Now is also a good time to do some contingency planning. Is the incident serious enough that it could result in regulatory interest, onerous remedial controls applied by institutional donors, or put future funding at risk, for example? We can prepare for these.
Team members will respond to the matter differently. While some may be relatively unaffected, others may not. It is important to note that where staff have made a commitment to an organisation on the basis of their values – perhaps more common for charities, nonprofits and NGOs than for private sector organisations – a breach of trust could be more impactive. Perhaps there could even be a grief reaction for some team members.
Look out for, and respond to, the traditional symptoms of stress, low morale and anxiety. These might include absenteeism, disciplinary issues, a rise in complaints, and disillusionment. An incident can impact upon personal and professional confidence, and colleagues may feel fear, shame or embarrassment. Will the incident create a funding crisis, putting their jobs at risk? Will staff have to justify themselves to an angry public? Consider access to staff support systems, and formal interventions such as counselling and facilitated debriefing.
Clear communication. Rebuilding trust requires the open communication of reliable content. Low information creates anxiety, more information helps manage our ‘fight or flight’ crisis response. Concealing the matter from the team is, therefore, more likely to sow suspicion and fear than peace and confidence. Be as open as you can about what has happened, and what will now happen, within the boundaries of policy, employment law and data protection legislation. As you describe the future, avoid over-promising – employees need clear and consistent messaging from management. If you cannot make promises, don’t; recognise uncertainty and explain what is being done to reduce it.
Foster trusting relationships. Ensure that teams meet as regularly as possible, in person or via teleconferencing. Consider holding team-building events, reflective away days and/or ‘how are we doing’ agenda items in meetings. These measures can improve understanding, interaction and trust between team members.
Lead by example. We know that employees look to the behaviour of their managers to determine their own. So be present; you cannot role-model behaviours and attitudes if you cannot be seen by anyone. Be positive and show how you treat what has happened constructively, managing risk, avoiding blame, taking care of your colleagues (and yourself), and using the incident to make the business unit stronger in the future. As one casualty of a fraud or corruption incident is honesty, ensure that you are (and are seen to be) authentic. So, for example, if you feel hurt, vulnerable or confused, consider sharing those feelings with the team. This helps to normalise these emotions.
Reaching project milestones or completing tasks puts clear blue water between the incident and the present, assisting both staff and stakeholders to move on. It also, of course, ensures the progress of the project or business unit. Embed, as rapidly and effectively as possible, any changes to processes to reduce the risk of a recurrence.
To read more about how to deter, prevent, detect and respond to fraud and corruption in humanitarian and global development work, make sure you pick up a copy of my book, 
Trust is very important in the workplace. We know that ’empowerment’ is probably a key factor in 
Firstly, fraud and corruption are designed to hide and masquerade, like chameleons, stonefish or those 
Don’t just seek two employment references – after all, what self-respecting fraudster volunteers damaging referees? Consider:
Having a culture of trust does not mean having no, or inadequate, controls. Neither, of course, does it mean an onerous filing cabinet’s worth of policies, procedures and systems (in fact evidence suggests that too many, or too demanding, controls reduces compliance). It means having just enough to manage the risks – an ongoing cycle of design, implementation and review of proportionate internal controls. It also, of course, means having an effective organisational counter-fraud and corruption framework.
Instead, to feel safe, secure and successful, we all need to know where the boundaries are, and we all need feedback on our performance. After all, if we are mission-oriented, then ‘oversight’ is about colleagues working together to maximise our effectiveness and efficiency in delivering that mission, right?
One of the things we can do to reduce the perception that having and following rules represents a failure to trust, is to re-frame activities like due diligence and monitoring. We need to be clear with managers and staff about our expectations, and explain that following policies, procedures and systems is about:
Second Marshmallow 