How can Internal Audit assist with responding to Fraud and Corruption?

By Melissa Bailey
IIA NZ Board Member

The foundations of a good fraud and integrity programme are prevention and detection programmes. But even with the best organisational culture, and the correct safeguards in place, at some point allegations of fraud or corruption will surface.

At this point, your response framework should kick into action.

Larger organisations in New Zealand have the luxury of dedicated internal audit, integrity or fraud investigation teams. For those organisations without dedicated resources, a suspected fraud or corruption incident can be venturing into the unknown.

Questions that management should be asking are: Do you have a response framework in place? What skills and expertise is available within your organisation? Who should know about the allegations and when should they be escalated? At what point do you need to inform your Board, your customers, or other affected parties?

Much like business continuity and disaster recovery planning, integrity issues present a ‘not if but when’ scenario. Being unprepared when suspicions are raised can result in a delayed response, or worse – an outcome that will not hold up under scrutiny.

Internal Audit teams can provide guidance in developing a response framework. For those who want to really understand the steps, and why a response framework is important, consider running a case study workshop, where the steps are worked through from allegation to investigation to conclusion.

Your internal audit or fraud team can create a scenario where a suspected integrity issue has been identified. The case study will raise number of questions for senior management to discuss. Who would be in charge? What would the roles be? Where can you find evidence? Is external assistance required?

Then there are the legal considerations. When it comes to whistleblowing legislation, employment law and the Privacy Act what can and can’t you do as an organisation? At what point do you involve other agencies (NZ Police, Serious Fraud Office)?

Being prepared for such an event helps raise awareness across senior management and facilitates discussion on an uncomfortable topic. Even highly competent management and Boards will face challenges when there is alleged deception within a company. Talking through the process of an investigation can be eye opening.

Like all significant issues, being unprepared can result in management and the Board blindsided. Spending a few hours working with your internal audit team to delve into a scenario can give you confidence in how to respond to this type of event.