Affecting nearly every organization, T&E fraud occurs more frequently and costs more money than ever before, according to the Association of Certified Fraud Examiners.
From the traveler who eats a $5 meal at McDonald's yet files an expense report for a fictional $200 dinner at Morton's, to Tyco chief Dennis Kozlowski's infamous $6,000 shower curtain (reportedly purchased with company funds and filed on an expense report), T&E fraud is alive, well and—despite a climate that would warrant more vigilance against such corporate ills—growing.
"We've seen the overall cost of fraud grow by 50 percent since our previous report," said ACFE president Toby Bishop. Released late last year, ACFE's most recent report on corporate fraud abuses—which examines everything from skimming and cash larceny to corruption schemes—found that occurrences of expense reporting fraud comprised 12 percent of all corporate fraud cases, up from 7 percent in 1996, when the previous ACFE report was issued. Likewise, the cost of T&E fraud has grown 200 percent, exceeding the growth of other types of corporate fraud. In 1996, the average cost to a company of an expense reimbursement scheme was $20,000. The average expense reimbursement scheme now costs a company $60,000, lasting on average two years before detection.
"Companies have downsized in recent years, as a result of which most supervision and review has been almost eliminated," Bishop said. "That increases the opportunity for employees to commit fraud actions. This is not being matched by an increase in fraud prevention measures."
High profile fraud cases à la Enron and Tyco that typically would spur companies to look inward became public during a down economy—a time when companies were reluctant to add such extra personnel as fraud examiners or internal auditors.
In response to the wave of corporate scandals that permeated the media, the federal government in July 2002 passed the Sarbanes-Oxley Act, echoing Bishop's sentiment that corporate internal review has waned. The act sets higher standards for internal controls and auditing practices for publicly traded American corporations.
Among other implications of the legislation, expense report approvers will have more liability for fraudulent expenses that are approved, as the legislation provides "criminal penalties if an officer certifies reports that he or she knows to be untrue," said A. G. Lambert, senior director of product marketing at Geac, the parent company of expense reporting provider Extensity.
The act also states that public companies must certify the adequacy of internal controls for financial reporting.
"Sarbanes-Oxley will require financial management solutions that can provide greater visibility, communication, control and fraud prevention," said John Van Decker, vice president at Meta Group, an IT research and strategic consulting firm.
Thomson Corp. said Sarbanes-Oxley also will affect the way the company processes electronic expense reimbursements—something for which the finance department has been gearing up. "You need to have controls around payments and the controls that Sarbanes-Oxley is requiring also feeds into T&E processes," said Maggie Lagana, director of U.S. cash management at Thomson. "The release and approval of the Automated Clearing House files—direct deposit— needs to follow tighter release procedures. The controls need to be similar to any type of treasury transaction."
The initial deadline for corporate compliance with certain aspects of the Sarbanes-Oxley Act was slated for Dec. 31 but has been pushed back a year.
Detecting the problem
In its report on expense reporting fraud, ACFE stated that the two most common means by which a company catches frauds is either through tips from employees or by accidentally stumbling upon fraudulent behavior. While these means of discovering fraud rely on a bit of luck and largely are out of a company's control, there are controls that organizations can implement to reduce fraud.
"Organizations with fraud hotlines cut their fraud losses by approximately 50 percent per scheme," Bishop said.
He added that most Fortune 500 companies already have implemented help lines—a phone line through which employees can anonymously leave tips to catch fraudsters or consult with operators on ethical guidelines—or other reporting mechanisms to which employees can take their tips. Under the Sarbanes-Oxley Act, companies are required to have some type of reporting mechanism. "All public companies are implementing them, if they haven't already," Bishop said. "Internal audits, external audits and background checks also significantly reduce fraud losses."
Of the 663 occupational fraud cases covered in the ACFE report, 34 percent were detected through either internal controls or an internal audit.
While audits have been effective in catching fraud after it happens, companies have taken several approaches to how often they audit. Some companies randomly audit reports, while others audit every single one. However, there's a catch-22 when it comes to auditing too much. "The results have shown that if you audit more than 10 percent, it costs you more to audit than you will recover from the fraud or accidentals," said Dave Rotman, Gelco vice president of product management.
Meanwhile, setting internal controls and providing detailed back-end reporting have been strong selling points among expense vendors.
"Process automation provides an important framework that integrates approval and workflow processes, enabling a far greater level of visibility and control than exists in manual environments and if not already automated, should be high on the enterprise list of future IT projects," Meta Group's Van Decker said.
Vendors agreed.
In response to the Sarbanes-Oxley legislation, Redmond, Wash.-based Concur Technologies and Emeryville, Calif.-based Extensity recently began touting redesigned applications that claim greater visibility into fraudulent travel spend.
Concur recently launched Concur Compliance Solutions, a set of software and services addressing the need for more stringent corporate controls for spend visibility, T&E fraud and compliance. The new functionality was designed to work in conjunction with Concur's Corporate Expense Management products.
Extensity last month held an educational Web seminar to help customers grapple with how the legislation will affect internal practices, and this fall plans to launch its latest version, with reporting and analytical software that directly looks at controlling fraud.
Gelco is not marketing its offerings as the fast track to compliance with the Sarbanes-Oxley Act, but said the legislation will give buyers more reason to seek solutions that offer greater control. Karen Beckwith, Gelco president and CEO, said that as companies look at the legislation, they might be more likely to move to an automated solution or add on such services as auditing or analytical back-end reporting.
"At this point, companies are continuing to evaluate how Sarbanes-Oxley is going to impact them, but I think it does heighten the awareness of what an automated expense solution can do for them," Beckwith said.
While vendors have exuded confidence that their expense processes hinder cases of expense fraud, others are not so certain that they have cut back on the fraudulent actions of delinquent corporate citizens.
"Automated expense reporting systems can help to monitor expenses and detect fraud but also can facilitate fraud, particularly because a level of personal review may be much less, which creates a greater incidence of employees charging expenses that they expect will fall just under the radar," Bishop said.
Several travel managers told Business Travel News that automated expense reporting mechanisms in some cases have made fraud easier to commit. One said, "This could still happen with paper but it has proliferated with automation" since some approvers were blindly rubber-stamping fraudulent reports—assuming that the controls engrained into the system would perform the detection.
Another factor that has contributed to less internal control over fraud is that companies often reduce headcount when they employ automation.
"One of the reasons that companies buy the expense management system is to take people out of the equation," said Earl Foster, president and COO of Partnership Travel Consulting.
While installing an expense reporting system provides an opportunity to reduce headcount, some companies become too reliant on the automation, viewing it as a panacea for all things expense-related.
According to Carol Salcito, president of consultancy Management Alternatives, when putting in place an electronic expense reporting system, companies should remain vigilant against fraud and use the system to work with internal controls and personnel instead of replacing them.
"It could happen without automation, of course," said Colleen Guhin, global travel manager at On Semiconductor, which uses Oracle's expense reporting application. "Whether an approver looks at it electronically or on paper, it comes down to the effectiveness of that approver."
However companies choose to handle fraud or what controls they put in place, the effects of such corporate abuses are staggering: "It is estimated that 6 percent of revenues will be lost in 2002 as a result of occupational fraud and abuse," ACFE said of the overall impact of corporate fraud. "Applied to the U.S. Gross Domestic Product, this translates to losses of approximately $600 billion, or about $4,500 per employee."