Author: Paul C. Zarecki

More than ever, organizations of all sizes need to assess, manage and monitor risk. According to the Association of Certified Fraud Examiners’ (ACFE) 2016 Global Study on Fraud, a typical organization loses 5% of revenues in any given year as a result of theft. The longer a fraud lasted, the greater the loss to the organization. Large frauds have led to the downfall of entire organizations, significant legal costs and erosion of customer confidence in your organization. The challenge of an organization is to detect and mitigate the fraud. Therefore, an effective risk assessment program is increasingly important to promote the success of any business.

Why do you need a risk assessment?

A risk assessment is a mechanism for identifying areas of vulnerability and opportunities for improvement within an organization. A risk assessment will provide management with valuable information that:

• reduces the potential of fraud within the organization;
• create efficiencies and cost savings in financial operations;
• provides reasonable assurance to management, ownership, vendors looking to do work with the organization, or potential buyers of the organization about the entity’s risks and vulnerabilities; and
• provide additional assurance to customers, government regulators, and rating agencies, i.e. insurance companies.

Only through diligent and ongoing efforts can an organization protect itself against significant acts of fraud. The ACFE, The American Institute of Certified Public Accountants and The Institute of Internal Auditors have laid out the key principles for proactively establishing an environment to effectively manage an organization’s fraud risk.  Those principles include:

Principle 1: As part of an organization’s governance structure, a fraud risk management program should be in place, including a written policy (or policies) to convey the expectations of the board of directors and senior management regarding managing fraud risk.

Principle 2: Fraud risk exposure should be assessed periodically by the organization to identify specific potential schemes and events that the organization needs to mitigate.

Principle 3: Prevention techniques to avoid potential key fraud risk events should be established, where feasible, to mitigate possible impacts on the organization.

Principle 4: Detection techniques should be established to uncover fraud events when preventive measures fail or unmitigated risks are realized.

Principle 5: A reporting process should be in place to solicit input on potential fraud, and a coordinated approach to investigation and corrective action should be used to help ensure potential fraud is addressed appropriately and timely.

Who is responsible for minimizing risk?

Management is ultimately responsible for effectively managing organizational risk and ensuring identifiable areas of vulnerability are adequately addressed.  In the event problems emerge, governing bodies, regulators, and even law enforcement will look to see what proactive measures were taken by management to assess, control and mitigate the risk inherent in the problem area.   Whether it is setting tone at the top, adequately training staff, or establishing effective internal controls, management is ultimately responsible and accountable.

Why use an outside professional?

During tough economic times, organizations tend to eliminate or downsize internal audit and internal control functions, despite the fact that organizational risks historically increase when pressures to succeed intensify. In response to this dilemma, more and more organizations are outsourcing various aspects of internal controls and risk assessment. In addition to realizing cost-savings, outsourcing provides management with a professional, independent, and objective appraisal of the organization’s risks and vulnerabilities.  In addition, “best practice” recommendations for mitigating risks are part of the assessment.

Professionals work with management throughout the risk assessment process by:

• gaining an understanding of the organization’s business mission, goals, objectives and control environment;
• performing a rigorous vulnerability risk assessment tailored to the organization’s specific accounting  and business systems and identifying events that could adversely affect these systems;
• providing feedback on the risks identified and recommending reasonable, cost-effective remediation measures based on industry “best practices”; and
• assisting in the implementation and follow-up assessment of the suggested remediation measures.

Organizations tend to not talk about fraud.  The reality is that most organizations experience fraud to some degree. Keep in mind that a proactive approach to managing fraud risk is one of the best steps organizations can take to mitigate exposure to fraudulent activities. The combination of effective fraud risk governance, a thorough fraud risk assessment, strong fraud prevention and detection (including specific antifraud control processes), as well as coordinated and timely investigations and corrective actions, can significantly mitigate fraud risks. Organizations that vigorously interpret and act on the results of their risk assessment are better positioned to capitalize on future opportunities and direct the business toward measurable success.

Every year individuals look forward to a potential refund to use for that summer vacation, new car purchase or just to pay off those overdue bills. However, not everyone will be getting that refund right away. Why? Because when you filed your return, you received a notice from the Internal Revenue Service (IRS) that your filing has been rejected.

Wait…How can that be? The reason is a return has already been filed using your social security number – you are a victim of tax fraud and identity theft.

This is an experience of far too many individuals and the IRS estimates that in 2016, they issued $4.1 billion in fraudulent tax refunds to identity thieves. The IRS is looking to reduce tax fraud and has set up the Identity Theft Tax Refund Information Sharing and Analysis Center (ISAC) to help combat it. The ISAC launched in 2017 but was not fully implemented for this filing season. What should you do if you are a victim?

The following steps should immediately occur:

• If you are unable to e-file, file your return by paper to avoid potential penalties. Also, be sure to pay any taxes you may owe.
• Complete IRS Form 14039, Identity Theft Affidavit which you can get from the IRS website. You can include this with your paper tax return or follow the form’s instructions to send it separately. You may need prior year tax information to complete this form.
• When the IRS receives your Form 14039 and paper tax return and you are ultimately confirmed as a victim of ID Theft, you may be issued a separate and unique six-digit number known as an Identity Protection PIN (IP PIN). To ensure the integrity of your return, the IRS will send you a letter each year containing a new IP PIN.

The IRS states it usually takes an average of 180 days for the case to be resolved; however, if all goes as it should, most taxpayers should be able to receive their refund after that period of time.

Keep in mind that a tax return fraud is also identity fraud, so it is a good idea to also file a complaint with the Federal Trade Commission and to contact credit reporting agencies to place a freeze on your credit reports. It’s unfortunate, but now that you’re aware that someone has your personal identifiable information, you must be extra vigilant about your credit and accounts going forward. Identity thieves may choose to sit on your information before using it, or may sell it to a multitude of buyers who can continue to try and use it for years to come.

Finally, one of the best things you can do to minimize your odds of this fraud is to file your tax return as quickly as possible. In that way, if the fraudulent return is filed after you’ve already filed the real one, the fraudster’s is more likely to be rejected.

Also, keep in mind scams and what the IRS would or would not do. The IRS posted this on their website:

The IRS does not send unsolicited email, text messages or use social media to discuss your personal tax issues. If you receive a telephone call from someone claiming to be an IRS employee and demanding money, you should consult the IRS Tax Scams/Consumer Alerts webpage: http://www.irs.gov/uac/Tax-Scams-Consumer-Alerts. If you know you don’t owe taxes or have no reason to believe that you do, report the incident to the Treasury Inspector General for Tax Administration (TIGTA) at 1.800.366.4484 or at www.tigta.gov.

For those of you in New York State, here is what they recommend, per the New York State Department of Tax and Finance website:

If you are a victim or potential victim of identity theft, please send New York State the following:

1. Form DTF-275, Identity Theft Declaration;
2. a statement explaining why you believe you’re a victim of identity theft;
3. a copy of the notice you received from our department (if you received one);
4. a utility bill, lease agreement, or bank statement from the year in question to verify your address; and
5. a photocopy of your government-issued ID, such as a driver’s license, US passport, or US military ID card.

You may fax or mail your documents to their identity verification unit, or call them with your concerns. Their contact information and further instructions will be with the form, which can be found on New York State’s website.

After you contact them, they will review your complaint promptly and, where appropriate, take corrective action. New York State may:

• remove any fraudulent returns from your record;
• cancel any bills you were issued as a result of the fraud;
• allow any refunds or overpayments due to you;
• put an identity theft indicator on your tax account for three years; and
• manually review any returns filed under your identification number for three years, which may cause a delay in the processing of your returns.

Good luck meeting your tax deadlines if you have not filed already.

I came across an interesting article in Fraud Magazine pertaining to bank account fraud and how an organizations employees were incentivized to commit the fraudulent activity. To read more, please click on the link here.