saarni jenna.word

8/19/2019 Saarni Jenna.word

1/79


2/79

•

•••••••• HAAGA-HELIAUniversity of Applied Sciences

Financial Fraud - Importance of an Internal Control System

Jenna Saarni

• • • Degree programme in International ••

• Bachelor's ThesisBusiness2!2


3/79

•••• •

••• HAAGA-HELIA

"#stract

University of Applied Sciences $ %o& 2!2

International Business

"uthor

Jenna Saarni

roup or year of

entry

loB(S

Title of report

Financial Fraud - Importance of an Internal Control System %um#er of pag-

es and appen-

dices

)$ + )Teacher*s+ or super&isor*s+

J ari ,uomaosi. J aana /elamies. 0li1a#eth San/iguel. Teppo arttala

This thesis tacles the pro#lem of financial fraud. and the goal of the research has #een to

in&estigate the importance and the efficiency of internal control systems3 The precise

research pro#lem is4 ho5 to pre&ent accountants and managers from conducting financial

fraud - importance of ha&ing an internal control system6 The thesis has #een commissioned

#y 7"""-70,I" 8ni&ersity of "pplied Sciences. 5hich e9pects to recei&e &alua#le

research concerning ethics in financial accounting3

To approach the pro#lem. first some theory #ehind fraud. ris management and internal

control 5ill #e looed at3 The t5o of the most famous financial fraud cases. 0nron and the

,ehman Brothers. 5ill #e shortly presented3 These. and an o&er&ie5 of a research on

fraudulent financial reporting in 83S3 pu#lic companies. 5ill gi&e the reader an insight of

the seriousness of the topic3

The research has #een focused on consultants. as e9perts of the topic. representing the Big

Four auditing companies3 In addition to these. a recent fraud case in Company : has #een

e9amined3 The data collection has #een conducted 5ith the use of a ;e#ropol sur&ey and

inter&ie5s3 The research process has taen place during late spring and early autumn 2!23

The collected data has #een analysed 5ith comparison to the theory frame5or3 The C


4/79

Table of contents

! Introduction 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 !

!3! Thesis topic 3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 2

!32 =esearch pro#lem and in&estigati&e ?uestions 33333333333333333333333333333333333333333333333333333333332!3@ Demarcation 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 @

!3A >ey concepts 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333A

!3$ Commissioning company 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333$

2 Theory frame5or 3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333)

23! Fraud 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 )

232 Financial fraud 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333

23@ 7ighlights in financial reports 33333333333333333333333333333333333333333333333333333333333333333333333333333333333(23A Company cases on fraudulent accounting 333333333333333333333333333333333333333333333333333333333333333!@

23A3! 0nron 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333!@

23A32 ,ehman Brothers 7oldings Inc3 3333333333333333333333333333333333333333333333333333333333333333333!$

23A3@ Fraudulent financial reporting in 83S3 pu#lic companies 3333333333333333333333333333!)

23$ Internal control 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333!

23$3! Internal control frame5or #y C/ 33333333333333333333333333333333333333333333333333333333332@@ =esearch methodology 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333332(

@3! =esearch design 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333332(

@32 =esearch process 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333@

@323! Sur&ey 3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 @

@3232 Inter&ie5s 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333@

A Data collection 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333@2

A3! Sur&ey 3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 @2A3!3! =oles. responsi#ilities and decision-maing 333333333333333333333333333333333333333333333333@2

A3!32 Controlling the company - Current internal control system 333333333333333333333333@@

A3!3@ Board meetings and relationships 3333333333333333333333333333333333333333333333333333333333333333@)

A3!3A Fraud 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333@

A32 Inter&ie5s 3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333@

A323! =is management 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333A


5/79

A3232 Internal control 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333A!

A323@ Fraud 333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333A)

$ Data =esults and "nalysis 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333A(

$3! /anagers' &ie5s on internal control 333333333333333333333333333333333333333333333333333333333333333333333333A(

$32 0ffecti&eness of an internal control system 3333333333333333333333333333333333333333333333333333333333333$

$323! "nalysis according to the eight pillars of C


6/79

1 Introduction

"s long as humans ha&e e9isted. fraud and #etrayal ha&e as 5ell3 For some reason. itseems also as though greed for money and success are part of human nature3 During the

past years numerous amounts of corporate accounting scandals ha&e #een in the

headlines. pro#a#ly the most no5n ones ha&e #een the 0nron case in 2! and in 2

the ,ehman Brothers case3

0nron and their accounting firm "rthur "nderson systematically produced fraudulent

financial reports and engaged in unethical accounting #y misrepresenting earnings and

hiding lia#ilities and de#ts *=oger 2!+3 ;hen the depth of the deception came out to the

pu#lic. in&estors and creditors retreated. forcing the company into #anruptcy in Decem#er

2!3 The scandal that happened 5ith ,ehman Brothers 5as similar3 ,ehman Brothers 5as

the fourth largest in&estment #an in the 8S. and the #anruptcy it had to file 5as the

largest e&er made in 8S history3 The company regularly used accounting gimmics at the

end of each ?uarter to mae its finances appear less shay than they really 5ere3 "fter the

fall of ,ehman Brothers. other #ans follo5ed and this is #elie&ed to #e the #eginning of the2 starting glo#al financial crisis3 *Bloom#erg Business ;ee 2( 3+

/. 0rnst & Goung and Deloitte Touche Tohmatsu *;iipedia

2!2+3 This rises up ?uestions on ho5 it has #een possi#le to scam the ones 5ho should #e

there to reassure the relia#ility of the records3


7/79

Thomas & Su5ardy 2!!. 2@)+3 If all of three corners of the triangle e9ist a high

possi#ility for a person to commit fraud e9ists3

The thesis 5ill tae a loo at internal control procedures. in theory and in practice3 In order

to get a #etter picture on the topic. the thesis 5ill #egin 5ith fraudulent accounting cases

and continue 5ith theory on internal control 5ith different concepts and models3 =esearch

on 5hat no5 is happening in consulting companies 5ill #e made #y a sur&ey and

inter&ie5s3 The final goal is to find out 5hether implementing an internal control system

can actually pre&ent fraud3

1.1 Thesis topic

"s the name of the report. Fraudulent "ccounting - Importance of an Internal Control

System. suggests the thesis 5ill #e #ased on ethical issues related to accounting. 5hich

include the compliance 5ith international accounting standards. local la5s and regulations.

and the importance of ha&ing an internal control system3 Fraudulent accounting and internal

control fall under the phenomenon of ris and management accounting. 5hich should

no5adays #e a part of all enterprises3 0ffecti&e ris management includes ris assessment.

ris e&aluation. ris treatment. and ris reporting *Collier. Berry & Bure 2. !+3 The

thesis 5ill tae a loo at the importance of internal control and the different possi#ilities of

ho5 companies are a#le to Hcoo the #oosH and in 5hich 5ay this ind of #eha&ior can #e

pre&ented3

The goal is to find out ho5 accountants and managers should #e controlled and or

moti&ated to conduct ethical #eha&iour in financial accounting. so that companies 5ould

produce truthful and relia#le financial records3 The interest is also in 5hy does fraud

happen and ho5 can it #e pre&ented already in the &ery initial stages3

1.2 Research problem and investigative questions

The research pro#lem for the thesis is

7o5 to pre&ent accountants and managers from conducting financial fraud - im-

portance of ha&ing an internal control system6

2


8/79

The in&estigati&e ?uestions are *hereinafter IE's+

IE! ;hat are managers' &ie5s on internal control generally and in their company6

09ample of real practice current internal control system3

IE2 7o5 efficiently does an internal control system pre&ent fraud6

IE@ 7o5 to pre&ent fraud in the &ery initial stages6 "nd 5hat are the de&elopment

ideas and suggestions to impro&e internal control6

In addition to researching the in&estigati&e ?uestions. the theoretical #acground 5ill

include research on challenges and pro#lems concerning ethics in accounting and internal

control. as 5ell as Hfailure pointsH on 5hat ha&e happened in the past #y presenting

e9amples of ,ehman Brothers and 0nron3 By doing the #acground and the empirical

research. the final results of the thesis should represent a thorough ans5er for the

research pro#lem3

The o&erlay matri9 includes all the essential information on 5hat the thesis and research at

hand includes *attachment !+3 Starting from the research pro#lem. and then #reaing it

do5n to the in&estigati&e ?uestions. the o&erlay matri9 presents the theoretical frame5or.

measurement ?uestions used and finally the results3 0ach of the mentioned applied

separately for each in&estigati&e ?uestion3

1.3 Demarcation

This is a #usiness management pro#lem in the field of finance. and more specifically in

accounting and consultation companies3 The focus is on daily 5or. related to control and

moti&ation from the management to the employees3 The focus is #et5een three parties

manager. accountant and outside auditor. #ut this thesis 5ill mainly focus on the

management's point of &ie53 The aspect of control 5ill #e discussed from a company's

internal aspect. and there 5ill #e no focus on e9ternal control presented3

@


9/79

%eed for an internal control system

I

;hat is controlled6 ;hy is controlled6 7o5 is controlled6

Figure !3 Demarcation ?uestions

The three ?uestions presented a#o&e 5ill #e the core for the thesis and the ans5ers to these

?uestions 5ill #e deeply discussed *figure 1 ). Similarly ?uestions related to fraud 5ill need

to #e ans5ered3 Conceptuali1ing the research pro#lem to

7o5 to pre&ent accountants and managers from conducting unethical #eha&ior in

financial accounting - importance of ha&ing an internal control system6

"nd

;hat recommendations can #e gi&en #ased on the research findings6

1.4 Ke concepts

This chapter presents the definitions of the ey concepts used throughout the thesis3 The

concepts 5ill #e discussed in more detail in chapter 2. the theory frame5or3

!raud" /isrepresentation of facts. purpose of persuading another party to act in a 5ay

that causes inury or damage to that party *7arrison et al3 2!!. 2@@+3

Internal #ontrol" " system of procedures implemented #y company management3 It is

designed to follo5 o#ecti&es as safeguard assets. encourage employees to follo5company policy. promote operational efficiency. ensure accurate. relia#le accounting

records and comply 5ith legal re?uirements3 *7arrison et al3 2!!. 2@3+ Ris$

management" The process of understanding and managing the riss that the organisation

is ine&ita#ly su#ect to in attempting to achie&e its corporate o#ecti&es *Collier et al3

2. !+3

4


10/79

The %ig !our" =efers to the four currently #iggest auditing and consultancy com-

panies >/. 0rnst & Goung. Deloitte Touche Tohmatsu and 5C *rice5ater-

houseCoopers+ *Financial Times ,e9icon 2!2+3

1.& #ommissioning compan

The thesis has #een commissioned #y 7"""-70,I" 8ni&ersity of "pplied Sciences3 "

part of the Degree rogramme in International Business is to educate and guide students to

#ecome ethical thiners. 5ho act in a social responsi#le 5ay *7"""-70,I" 2!2a+3 The

ethical issues related to finance and financial accounting discussed so far during the actual

courses. are ?uite limited3 Therefore. the thesis and research presented here #ring added

&alue to the degree program and pro&ide ne5 insight to fello5 students3

7"""-70,I" 8ni&ersity of "pplied Sciences is part of the Finnish pu#lic educational

system. 5hich is run pri&ately #ut steered and co-funded #y the Finnish /inistry of

0ducation and Culture3 The uni&ersity has around ! $ students and employees. 5ho

#ase their acti&ities on highly ad&anced national and international e9pertise3 The school

pro&ides education on #usiness. hotel. restaurant and tourism management. information

technology. ournalism. management assistant training. sports management and &ocational

teacher education3 *7"""-70,I" 2!2#3+ The author and researcher of this thesis has

studied international #usiness and specialised in finance3

By commissioning this thesis. 7"""-70,I" e9pects the research to pro&ide &alua#le

findings on ethical issues related to finance in an international conte9t3 By lining

theoretical concepts to actual real life practices. the topic of financial fraud 5ill #ecome

more e9plicit for future students and graduates3 Therefore pro&ide added &alue for the

degree program as 5ell as future students3

$


11/79

2 Theor frame'or$

First as theoretical #acground on the topic. the #asic concepts related to fraudulentaccounting and the theory around e9isting internal control systems needs to #e e9plained3

This part of the report 5ill mainly ans5er to t5o ?uestions

! ;hat are the challenges and pro#lems concerning ethics in accounting and internal

control6

2 ;hat has happened in the past - Hfailure pointsH of case e9amples ,ehman

Brothers and 0nron3

2.1 !raud

Fraud is one of the top concerns for corporate e9ecuti&es3 During the recent years many

organi1ations ha&e faced corporate scandals due to fraud. maing the e9ecuti&es face the

conse?uences of large fines and prison time *0rnst & Goung 2(+3 The term. fraud. can #e

defined as the misrepresentation of facts. purpose of persuading another party to act in a

5ay that causes inury or damage to that party *7arrison et al3 2!!. 2@@+3 " model. the

Fraud Triangle. created #y criminologist Donald =3 Cressey. represents the three factors that

push an ordinary person to commit fraud *figure 2+3

Opportunity

Motivation

Figure 23 The Fraud Triangle *8C/erced 2!2+

If a person has all the three ingredients. moti&ation. opportunity and rationali1ation. a high

possi#ility to commit fraud e9ists *7arrison et al3 2!!. 2@A+3

)


12/79

From these three factors. moti&ation and opportunity are something the organisation can

ha&e an effect on3 These t5o are directly influenced #y the corporate en&ironment and

further more #y management3 The opportunity can arise #y the lac of control and security5ithin the company3 The moti&ation. or pressure *as referred #y 0rnst & Goung+. can #e

created #y demands of higher earnings. or it can also arise from the top of the company3 "

tone that places an impropriate emphasis on financial results or stoc price may send the

message that cutting corners is accepta#le3 *0rnst & Goung 2(. !3+ =ationalisation is

more of a psychological factor. 5hich arises from 5ithin the indi&idual person3 By

rationalising the fraudulent #eha&iour. the person committing the fraud assures him or

herself that it is accepta#le to #e doing so3 *7arrison et al3 2!!. 2@A3+ To gi&e an e9ample. a person could rationalise stealing money. as HI ha&e al5ays 5ored so hard. therefore I

deser&e itH. this 5ay a person maes the act feel as if it 5as ustified3

The common types of corporate fraud are misappropriation of assets. fraudulent financial

reporting and corruption3 From these the first one mentioned is the most common one3

"ccording to the 2 "CF0 =eport to the %ation on


13/79

0&en though fraudulent financial reporting seems to #e the least fre?uent form of fraud. it

is #y far the most e9pensi&e. in terms of #oth money and long-term damage3 "ccording to

the same "CF0 report mentioned #efore. the median loss of a fraudulent statement incident5as L2 million. compared 5ith L@$. for corruption and L!$. for asset

misappropriation3 In addition to the monetary losses. the company loses its in&estor

confidents. its reputation is damaged and on top of all high fines and criminal actions are at

hand3 *0rnst & Goung 2(. 23+

The "ssociation of Certified Fraud 09aminers has de&eloped a list of common accounting

fraud schemes and associated red flags. on 5hich managers should #e a5are of3 These

schemes and related red flags mostly happen 5ith o&erstating re&enues. understating

e9penses or improper asset &aluation3 The follo5ing paragraphs 5ill descri#e these and the

related red flags in more detail3

(verstating revenues or incorrectly recogni1ing re&enues are one of the most common

types of fraud on financial statements3 The schemes include recording gross re&enue.

instead of net4 recording re&enues of other companies 5hen acting as a HmiddlemanH4

recording sales that ha&e not happened4 recording future sales in the current period and4

recording sales of products that are out on consignment3 The red flags in these inds of

situations are increased re&enues. 5ithout a corresponding increase in cash flo54 unusual

or highly comple9 transactions. especially ones closed near the end of a financial period4 in

recei&a#les the unusual e9pansion of days' sales4 or high re&enue gro5th 5hen competitors

are e9periencing 5ea sales3 *0rnst & Goung 2(. 23+


14/79

S*@.4pS 2.(

!.!$

)@( $).! !.$$

A!A A!A

).2M !$.$(

).( !.)

*))+ $.$!2

S*2.)+ S $.!

and others that are shrining in percentage terms or are other5ise out of line 5ith the

companies from the same industry3 *0rnst & Goung 2(. @3+

Improper asset valuation is also a type of fraud used3 The schemes used are manipulating

reser&es. changing the useful li&es of assets. not maing a 5rite do5n 5hen needed. and

manipulating the fair &alue of assets3 The red flags related to these include repeating

negati&e cash flo5s. #ut reporting of earnings4 noticea#le decrease in customer demand and

increasing #usiness failure in the industry or the economy4 or estimates on assets. lia#ilities.

re&enues and e9penses are #ased on su#ecti&e su#ects and high uncertainties3

Some other schemes related to fraudulent financial reporting can also relate to so called

smoothing of re&enues. so o&erestimating lia#ilities during HgoodH periods. and storing

a5ay funds for future use4 reporting information improperly. especially 5hen it comes to

issues related to HpartyH -transactions and loans to management4 or e9ecuting highly

comple9 transactions3 *0rnst & Goung 2(. A3+

"ccording to the same "CF0's 2 report. as mentioned #efore. ))K of occupational fraud

5as detected #y tips or #y accident3 The sur&ey re&ealed that tips 5ere the most fre?uentlyreported source of initial detection *A)K+. follo5ed #y accident *2K+3 !(K of fraud 5as

unco&ered #y internal audit and 2@K 5as unco&ered #y internal controls3 0&en though the

ad&ancements in technology and the highly regulated climate. it seems that the leading

source of fraud detection is still #y tip or #y accident3 *0rnst & Goung 2(. A3+

2.3 *ighlights in financial reports

This chapter 5ill &isualise the financial reports and pinpoint the specific lines 5ere the

most common types of fraud on financial statements ha&e occurred3 To tae an e9ample.

the chapter 5ill e9amine reports presented #y ,ehman Brothers 7oldings Inc3 deli&ered to

the 8S Securities and 09change Commission the same year the company filed for

#anruptcy3 First to o#ser&e are some e9amples from the ,ehman Brothers ?uarterly

income statement 2. #efore the #anruptcy *figure @+3

(

,07/"% B=


15/79

!.2$ 2.

!.2( !.!

!.A$ !(.)A

$@ (

!.)! 2(.@M

!$.! !.!$

2.@( !.$$(

M.!)) $.2)

)!2 $$@

$M @($

@@ 2(

!( 2!

!$ !M

2@$ !2

2.( !.$

).2)@ ).(!

*@.A2A+ @.$

*!.!@(+ !.!$(

S*2.2$+ S 2.A!(

S*2.M+ S 2.@$

S *A3@@+ S M3M2

S *A3@@+ S M3!

S 3@M S 3@2.@2$ 2.!

@( 2

2$2 2!

! !$2

! !2

!

$$

(!$

@.A!( @.)@@

*A.+ !.(

*!.@!@+ ))

S*2.M

S !.2@

S*2.@

S !.2$)

%on-Interest 09penses

Compensation and #enefits

Technology and communications Broerage.

clearance and distri#ution fees


16/79

%usinessdsrclogrnenr

Total non-personnel e9penses

Total non-interest e9penses

Income #efore ta9es

ro&ision for income ta9es• .et income

%et income applica#le co common stoc

0arnings per common share

Basic

Diluted

Di&idends paid per common share

S

*$3!A+

S

*$3!A+

S 3!

S 23@@ S

232! S

3!$

Sec %otes to Consolidated Financial StatementsN

Figure @3 ,ehman Brothers consolidated income statement *8nited States Securities and

09change Commission 2. A+

"s discussed in the pre&ious chapter. o&erstating re&enues or incorrectly recogni1ing

re&enues are one of the most common types of fraud affecting financial statements3 This can

#e seen in the income statement under different headings. as highlighted in figure @3 "s you

5ill read in the upcoming chapter *23A32+. one of the gimmics used #y

,ehman Brothers 5as to incorrectly recogni1e re&enues3 8nderstating e9penses can also

#e used in maing the operating income and o&erall net income seem higher3 In the %otes

to the statements. ,ehman Brothers descri#es their re&enue recognition policies. under

rincipal transactions. as follo5s

!


17/79

23

=eali1ed and unreali1ed gains or losses from Financial instruments and other in&entory

positions o5ned and Financial instruments and other in&entory positions sold #ut not yet

purchased. as 5ell as the gains or losses from certain short- and long-term #orro5ing

o#ligations. principally certain hy#rid financial instruments. and certain deposit lia #ilities at

#ans that the Company measures at fair &alue are reflected in rincipal transactions in the

Consolidated Statement of Income3 *8nited States Securities and 09change Commission2. !!3+

"ccording to this. it can #e interpreted that many complicated financial instruments and

transactions ha&e #een used #y the company. and therefore. in this case. it has #een a#le to

disguise something that should ha&e #een reported as #orro5ings. under

re&enues3

Similarly. the #alance sheet can #e presented in a fraudulent manner3 "s discussed in the

pre&ious chapter. improper asset &aluation is also a type of fraud companies ha&e used3

The possi#le fraudulent procedures can include manipulating reser&es. changing the useful

li&es of assets. not reporting do5n 5hen needed. and manipulating the fair &alue of assets3

Figure A presents some of these points highlighted3 To gi&e an e9ample. ,ehman Brothers'

%otes on ho5 the long-li&ed assets ha&e #een &alued are as follo5s

roperty. e?uipment and leasehold impro&ements are recorded at historical cost. net of

accumulated depreciation and amorti1ation3 Depreciation is recogni1ed using the straight-

line method o&er the estimated useful li&es of the assets3 Buildings are depreci ated up to a

ma9imum of A years3 ,easehold impro&ements are amorti1ed o&er the lesser of their useful

li&es or the terms of the underlying leases. 5hich range up to @ years3 0?uipment. furniture

and fi9tures are depreciated o&er periods of up to ! years3 Internal-use soft5are that

?ualifies for capitali1ation under "I C" Statement of osition (-!. "ccounting for the

Costs of Computer Soft5are De&eloped or


18/79

!2A.CA2Securities #orro5ed

=ecei&a#les

Broers. dealers and clearing o3rgani1ations !).B!

Customers 2.BCA


19/79

0&en though in ,ehman's case. there hadn't #een any improper asset &aluation. the #alance

sheet and the %otes present an e9ample of 5here fraudulent reporting could tae place3 "s

the %otes e9plain. the property. e?uipment and leasehold impro&ements are &alued athistorical cost. 5hich for e9ample could mean that the inflation or other economic factors

affecting the &alues ha&e not #een taen into consideration3 "s a more detailed e9ample. it

mentions that #uildings are depreciated up to a ma9imum of A years3


20/79

5ith the same products and ser&ices3 "s the operations of 0nron e9panded. so did their

performance in the stoc maret3 *alepu & 7ealy 2@. @-$3+

Through years. as 0nron's operations gre5 into different le&els. its #usiness model turned

more comple93 This lead to difficulties 5ith the financial reporting. maing the company

face the limits of accounting3 T5o issues 5here specifically pro#lematic3 First of all. the

trading side of the #usiness in&ol&ed comple9 long-term contracts3 0nron used an approach

called mar-to-maret accounting to recognise income3 This meant that the management 5as

maing forecasts of energy prices and interest rates 5ell into the future. 5hereas current

accounting rules re?uire the use of present &alue calculations3 Secondly. 0nron hea&ily reliedon structured finance transactions. 5hich in&ol&ed setting up special purpose entities3 These

transactions included shared cash flo5s and riss 5ith outside in&estors and lenders3

Traditional accounting faced difficulties in reporting these transactions. and created

differences #et5een economic reality and actual accounting num#ers3 *alepu & 7ealy

2@. !-!!3+

The mar-to-maret accounting used #y the company meant that once a long-term

contract 5as signed. the present &alue of the future cash inflo5s 5ere recognised as

re&enues and the present &alue of the e9pected costs 5ere accounted as e9penses3

8nrealised gains and losses of these long-term contracts that 5ere not hedged 5ere. 5hen

they occurred. then reported as part of the annual earning3 The main pro#lem 5as in

estimating the real maret &alue of the contracts3 Income 5as estimated as the present

&alue of net future cash flo5s. e&en though the related costs and &ia#ility of the contracts

5ere often &ery uncertain3 *alepu & 7ealy 2@. !!3+

Special purpose entities 5ere used to fund or manage riss. 5hich 5ere related to specific

assets3 These special purpose entities are shell companies created #y sponsors and funded #y

e?uity in&estors and de#t financing3 By 2!. 0nron had used hundreds of these entities3

Se&eral of these entities 5ere used to a&oid some essential accounting principles3 For

e9ample. 0nron 5as a#le to a&oid consolidating these special purpose entities to its financial

reports. 5hich resulted in 0nron's #alance sheet to understate its lia#ilities and o&erstate its

e?uity and earnings3 In 2!. 0nron announced that to!A


21/79

correct its financial statements through the four year period *from !(( to 2+ it 5ould

reduce its earnings #y L)!@ million *2@K of reported profits+. increase its lia#ilities #y L)2

million *)K of lia#ilities and $3$K of e?uity+ and reduce its e?uity #y L!32 #illion *!K+3 Dueto 0nron's high pu#lic de#t and loss of in&estor confidence. in Decem#er 2! 0nron finally

filed for #anruptcy3 *alepu & 7ealy 2@. !2-!A3+

0nron's auditors. "rthur "ndersen. recei&ed most of the #lame for not recognising the

pro#lems 0nron had in its accounting system3 "rthur "ndersen 5as in charge of re&ie5ing

0nron's compliance 5ith the 8S "" and the company's internal

controls3 Instead. "rthur "ndersen 5as accused of ha&ing shay standards in their 0nronaudits. mainly #ecause it 5as recei&ing significant income on consulting and auditing fees.

therefore ha&ing a conflict of interest3 For e9ample. in 2 "rthur "ndersen earned around

L$2 million from auditing and consulting 0nron3 Finally 5hen the in&estigations of 0nron

came pu#lic. "ndersen attempted to co&er up their in&ol&ement #y shredding up e&idence of

supporting documents3 *alepu & 7ealy 2@. !-!(3+ In 22 "rthur "ndersen 5as con&icted

of o#structing ustice and the company is no longer functioning *Freifeld & Sandler 2!+3

2.4.2 ,ehman %rothers *oldings Inc.

,ehman Brothers 5as founded in !$ in the 8S3 "fter the 8S Ci&il ;ar the company mo&ed

into %e5 Gor and soon gre5 into one of ;all Street's in&estment giants3 In Septem#er 2

,ehman Brothers filed for the largest #anruptcy e&er made in 8S history3 The collapse sent

glo#al financial marets into a panic. pushing the glo#al credit marets close to the edge3 In

2!. the accounting firm 0rnst & Goung 5as sued for helping ,ehman Brothers to Hengage in

a massi&e accounting fraudH3 *The %e5Gor Times 2!23+

It is said that the difficulties for ,ehman Brothers #egan in 2. as the mortgage maret

crisis around su#prime and prime mortgages unfolded3 In 2!. a chairman of the la5 firm

Jenner & Bloc and a former federal prosecutor. "nton =3 aluas. pu#lished an e9aminer

report on the #an3 "ccording to the in&estigations. ,ehman Brothers had #een using

accounting gimmic to hide its true financial position3 The!$


22/79

company 5as a#le to temporarily shuffle L$ #illion of trou#led assets off its #oos a fe5

months #efore its collapse in 23 This 5as to conceal its dependence on le&erage. or

#orro5ed money3 "ccording to aluas. the company's e9ecuti&es and its accountants at0rnst O Goung 5ere a5are of these transactions3 *The %e5Gor Times 2!23+ In the end of

2!. %e5 Gor "ttorney eneral. "ndre5 Cuomo. sued 0rnst O Goung for helping ,ehman

Brothers in a Hmaor accounting fraudH *Freifeld O Sandler 2!+3

"ccording to Cuomo and aluas. ,ehman Brothers decei&ed in&estors and the pu#lic a#out

its financials #y using so called H=epo !$H transactions3 These transactions are sale and

repurchase agreements. or in other 5ords. a form of short-term financing3 ,ehman used these

to temporary mo&e lia#ilities *in total as much as L $ #illion+ off its #alance sheet to sho5

that it 5as not carrying too much de#t3 Cuomo re&eals that the =epo !$ transactions 5ere

initially reported as #orro5ings. #ut then in 2! according to ne5 accounting rules #y 0rnst

O Goung they 5ere portrayed as sales3 These of course ga&e a fraudulent impression on the

company's le&erage ratios and mislead its in&estors3 *Freifeld O Sandler 2!3+

0rnst O Goung. as the company's accountants. should ha&e ensured that the financial

statements complied 5ith "" and 5ere not misleading the pu#lic3 Instead. according to

Cuomo. 0OG no5ingly helped ,ehman Brothers to Hmanage #alance sheet metricsH3

%e&ertheless. the final responsi#ility should ha&e #een 5ith the company's management. as

e&en though financial reports may not #e &iolating the 8S "" they can still #e

materially misleading3 *Freifeld O Sandler 2!3+ The in&estment #an faced a lot of

la5suits3 For e9ample. in "ugust 2!!. former officials of ,ehman Brothers agreed to pay

L( million to settle a la5suit accusing them of misleading in&estors a#out the company's

financial situation in the months leading up to its fall3 *The %e5Gor Times 2!23+

2.4.3 !raudulent financial reporting in -.. public companies

Fraudulent Financial =eporting !((-2 -"n "nalysis on 83S3 u#lic Companies 5as a

comprehensi&e study. commissioned #y the Committee of Sponsoring!)


23/79


24/79

committed fraudulent reporting 5ere audited #y the Big Four auditing firms3 *Beasley et al3

2!. @-$3+

"fter the 0nron and ,ehman Brother cases. in 22 as a mean to pre&ent fraudulent

financial reporting a ne5 8S legislation. called the Sar#anes-


25/79

The Committee of Sponsoring


26/79

During recent years. the concern o&er fraud and the focus on ris management ha&e highly

increased3 C


27/79

Figure $3 C


28/79

+vent Identification - Internal and e9ternal e&ents affecting achie&ement of o#ecti&es

need to #e identified. and determined as riss and opportunities3


29/79

do e9ist3 "s the operators of the system are merely human. mistaes and errors are

naturally a part of so called human failures3 *C


30/79

its system control en&ironment. identification and e&aluation of riss and control

o#ecti&es. control acti&ities. information and communication processes. and processes

for monitoring the effecti&eness of the system of internal control3 Figure ) #elo5represents the fi&e different components mentioned. 5ith the #oard as the centre of

all3 *>/ !(((. !(-2!3+

The fi&e common components of control

Figure )3 The fi&e components of control *>/ !(((. 22+

7o5e&er. it is not enough only to ha&e all the components present. it is also important to

understand the nature and the conte9t of the control3 First of all. as control should #e capa#le

of responding ?uicly to e&ol&ing riss. it is important to get the control as close to the ris

as possi#le3 The company needs to ha&e the capacity to respond and adapt to une9pected

riss and situations. and to mae decisions despite ha&ing all the information3 This is 5hy

the control needs to #e close to the associated riss - the shorter the chain. the ?uicer the

reaction3 *>/ !(((. 223+

Secondly. the costs of the control need to #e in #alance against the #enefit of controlling

the ris3 "s it may happen that the cost of additional control #ecomes greater than the

actual #enefit arising from the controlling of the ris3 Thirdly. the control system needs to

include reporting procedures. 5hich communicate immediately to the right management

le&els of any significant control failings or 5eanesses that are identified3 The reporting

should include also details of the actions #eing undertaen3 This also means that the

philosophy of control should come from 2A


31/79

@3

the top of the company. 5ith an emphasis on continual learning. instead of a #laming

culture3

0&en though control can minimi1e errors and riss. it cannot for sure pro&ide a#solute

assurance that they 5ill not happen3 %e&ertheless. it 5ould #e important to #lend the control

system in the company's operations and ha&e it as a part of the company's corporate culture3

"s a company is run #y indi&iduals. the control system is affected #y people throughout the

company3 By maing these indi&iduals. so all the people in the company accounta#le. the

lielihood of an effecti&e control system is increased3 *>/ !(((. 22-2A3+

>/ has de&eloped a =is /anagement Diagnostic. to help organisations follo5

5hether all of the necessary components for an efficiently 5oring internal control system

e9ist *figure +3 The diagnostic has #een &isualised as a triangle. representing se&en

components. and rele&ant ?uestions under e&ery title for managers to consider3

2$

hilosophy and policy

Is your organisations ris management philosophy and policy clearly defined. communicated and endorsed

#y the #oard6

"re there clearly defined roles and responsi#ilities for the identification. management and reporting of ris6

Beha&iour

"re those responsi#le for ris pro&ided 5ith appropriate formal training6

Does the organisation learn from the ris e&ents 5hen things go 5rong rather than see retri#ution6

=oles and responsi#ilities

Is the responsi#ility for reporting clearly defined6

"re responsi#ilities 5ritten into all rele&ant employee o# descriptions6

Demonstration of performance and ris effecti&eness

Is the #oard pro&ided 5ith a clear picture of performance6 "re

>l's clearly defined and measured6

Con&erting strategy to #usiness o#ecti&es 3bllosoe5hamd polic

Do #usiness o#ecti&es reflect strategy6

"re #usiness o#ecti&es clearly communicated6

erformance appetite

Is your organisation's ris appetite e9plicitly and

clearly defines6

"re action plans de&eloped to mo&e the organ-

isation to a more desired ris profile6

=is to deli&ering performance

Does the ris information assist man-

tored for the riss6


32/79

agement in identifying accumulations

and dependencies6

"re management actions and

controls identified and moni-

Figure 3 =is /anagement Diagnostic *>/ !(((. 2$+

In addition to the =is /anagement Diagnostic. the triangle a#o&e represents the

frame5or companies should use to assess the effecti&eness of their internal control

system3 >/ #elie&es that for any control model to 5or effecti&ely and #e rele&ant to

the performance of the #usiness. it must contain these ey components3

2)


33/79

Starting from the tip of the triangle. hilosoph and polic6 represents ho5 the #oard should

mae the ris management e9pectations e9plicit3 0mployees need to no5 5hat is e9pected

from them and 5hat is not3 Roles and responsibilities represent the importance of maingall the roles and responsi#ilities of the ey performers e9plicit3 #onverting strateg to

business o#ecti&es includes the idea of maing strategic and #usiness o#ecti&es e9plicit3

This 5ay the lielihood of o&erlooing significant riss 5ill #e reduced. as the lin #et5een

strategy and #usiness planning is a critical ris management process3 Ris$ to delivering

performance refers to ho5 the significant #usiness riss should #e formally identified #y the

#oard and this 5ay sho5 that they are a5are of the possi#le riss3 In the left #ottom of the

pyramid >/ has erformance appetite. This means that the pro#a#ility of the ris ofoccurring and of the impact of that ris should #e analysed3 The cost and #enefit relations

need to #e analysed as 5ell3 Demonstration of performance and ris$ effectiveness refers

to ho5 performance should #e monitored against targets4 an assessment of the effecti&eness

of the control should periodically #e pro&ided to the #oard3 This process has some circularity.

as monitoring may lead to re-e&aluating the company's o#ecti&es or control3 Finally. the

triangle has %ehaviour6 5hich represents shared ethical &alues3 These &alues. including

integrity. authority. responsi#ility and accounta#ility. should #e esta#lished. communicatedand practiced around the 5hole organisation3 *>/ !(((. )-)3+

Some of the most common 5eanesses in organisations happen 5ith *>/ !(((. 2)+

hilosoph - it is understood. #ut not 5ritten. so it is open for misinterpretation Roles

and responsibilities - the responsi#ilities are not clear throughout the organisation

#onverting strateg to business ob/ectives - strategic o#ecti&es are not directly

#usiness o#ecti&es

Ris$ to delivering performance - a form of ris profiling. #ut often differs from the

reality of doing #usiness

2


34/79

erformance appetite - missing the understanding of the organisation's ris

appetite

erformance and ris$ effectiveness - #oards do not recei&e the right

information. so either too little or too much

%ehaviour - disincenti&es e9ist 5hich lead employees to #eha&e in a non-functional

manner3

28


35/79

3 Research methodolog

/ostly ?ualitati&e research has #een done3 7istorical data has #een collected #y doingdestop research. as there are a lot of different sources discussing the topic of internal

control3 The field research that 5as done for the report included a sur&ey and inter&ie5s3

3.1 Research design

The research definitely needed to #egin 5ith researching the #acground. different theories

and earlier studies3 This helped to formulate clearly 5hat needs to #e found out from the

sur&ey and inter&ie5s. and therefore ena#led creating the sur&ey and the inter&ie5

frame5or3 First. the ;e#ro#ol sur&ey 5as de&eloped3 The sample selection. so for 5hom

the ?uestionnaire 5ould #e sent to. 5as collected #y contacting the Big Four auditing

companies #y email. and simply asing for suita#le employees' contact information3 It 5as

determined that the respondents should ha&e relati&e no5ledge on internal control. in order

to gi&e insightful ans5ers to the sur&ey3 "fter going through the ?uestionnaire ans5ers and

doing an initial analysis. the research process could continue to the inter&ie5s3 The same four

auditing companies 5ere contacted. after 5hich specific dates 5ith the companies and the

inter&ie5ees could #e agreed upon3 The ne9t step 5as to collect the rele&ant data from the

inter&ie5 records and analy1e it3 Finally conclusions can #e made and a discussion on some

possi#le de&elopment suggestions *figure 3+

Figure 3 Image of research design

2(


36/79

3.2 Research process

The research process is di&ided into t5o main parts. #eginning 5ith the sur&ey and then

proceeding to the inter&ie5s3 The actual research process #egan during spring 2!2 and

continued to the #eginning of 2!2 autumn3 The follo5ing chapters 5ill descri#e the

processes in more detail3

3.2.1 urve

The sur&ey on internal control and fraud 5as sent to !( persons 5oring in the Big Four

auditing companies >/. 0rnst & Goung. Deloitte and rice5aterhouseCoopers3 The

sample group represents managers and employees. 5ho ha&e a relati&ely high no5ledge

on internal control3 "nd therefore. should #e a#le to ans5er the sur&ey 5ith deeper

understanding and no5ledge3 The sample selection too place #y first contacting each

company #y email. and in?uiring for possi#le candidates to respond to the sur&ey3 The

initial contact persons from the companies 5ere found from the organisations' Finnish

5e#-pages. and selected #ased on their positions either employees or managers 5oring

5ith ris management and or internal auditing3 The four organisations each pro&ided one

to fi&e possi#le respondents to ans5er the sur&ey3

The sur&ey 5as pu#lished on the !th of /ay 2!2 and sent to the sample group &ia

;e#ropol. 5hich uses emails pro&iding a lin to the sur&ey *attachment !+3 During a one-

month period. despite fi&e reminder emails. only si9 replies for the sur&ey 5ere recei&ed3

7alf of the respondents 5ere senior managers and the rest included a pu#lic accountant.

director and an o5nerpartner3 Due to the lo5 ans5er rate. no &alid conclusions or

generali1ations can #e made only #ased on the sur&ey3 7o5e&er. the ans5ers do gi&e some

direction for the research. and a good source of #acground information for the inter&ie5s

discussed in the ne9t chapter3

3.2.2 Intervie's

The inter&ie5 frame5or 5as de&eloped after collecting the data from the sur&ey ans5ers.

in the late "ugust 2!23 The inter&ie5 ?uestions 5ere de&eloped to gi&e more@


37/79

depth and detail to the research. #y eeping the sur&ey results as a #aseline. 5ere could #e

#uilt on3 During Septem#er 2!2 three face-to-face inter&ie5s 5ere conducted3 Due to

pri&acy reasons. the inter&ie5ees 5ill stay anonymous and from here on5ards referred to asInter&ie5ee !. Inter&ie5ee 2. and Inter&ie5ee @3

The most appropriate approach 5as to conduct thematic inter&ie5s3 " thematic inter&ie5.

according to 7irsar&i & 7urme *2. A+. includes ?uestions. determined #y the

inter&ie5er. 5hich ha&e #een formulated prior to the inter&ie53 7o5e&er. the actual

inter&ie5 is freer and more fluent than a structured inter&ie54 as the ?uestions do not need

to follo5 a certain order. and the ans5ers cannot really #e strictly categori1ed into any predetermined options. and therefore the inter&ie5 resem#les a con&ersation3 " thematic

inter&ie5 taes into consideration &ery essential issues. such as the inter&ie5ee's 5ay of

interpreting topics and the focus that they #ring to the different issues3 It can #e said that

the thematic inter&ie5 approach gi&es the inter&ie5ee a &oice3 *7irsar&i & 7urme 2.

A3+

The initial plan 5as that the inter&ie5ees 5ould only include representati&es from the same

Big Four auditing and consulting companies. 5ho had responded to the sur&ey3 7o5e&er. a

good e9ample of a recent fraud case came across. and an opportunity to inter&ie5 the

company's financial manager a#out it3 Therefore the inter&ie5s 5ere conducted as follo5s

t5o inter&ie5s 5ith representati&es from the Big Four and a third inter&ie5. 5hich 5as to

represent a company case of e9perienced financial fraud3 The same inter&ie5 frame5or

5as used in all of the inter&ie5s *attachment 2+3 "ll of the inter&ie5s too place in the

companies' 7elsini offices. and their durations &aried from @ to $ minutes3

@!


38/79

4 Data collection

The primary data has #een collected #y a sur&ey and inter&ie5s3 " ;e#ropol sur&ey and athematic inter&ie5 frame5or ha&e #een the tools used for collecting the data3 "s an

addition to the sur&ey. the inter&ie5s gi&e a deeper insight and personal ans5ers. and

therefore pro&ide rele&ant findings concerning the topic3

4.1 urve

To ha&e some structure. the sur&ey 5as di&ided into four sections. #eginning 5ith a fe5

?uestions on the #acground of the ans5erers3 "ll of the respondents ha&e more than fi&e

years of e9periences in the field of financial auditing and fi&e out of the si9 had ten or more

years of e9perience3 8sing a ,iert scale from one to fi&e. one representing poor and fi&e

e9cellent. the respondents graded their o5n no5ledge on internal control 5ith an a&erage

of A3$3 Based on the a#o&e information. it can #e said that the data collected from the

sur&ey is ans5ered 5ith e9perience and therefore is relia#le3

4.1.1 Roles6 responsibilities and decisionma$ing

The actual first part of the sur&ey included ?uestions on roles. responsi#ilities and decision-

maing3 "ll of the respondents 5ere 5ell or &ery 5ell a5are of their o5n role and

responsi#ilities in their company3 7o5e&er. it seems that in most of the cases. no concrete

responsi#ilities are 5ritten to the employees' o# descriptions3 0ither they ha&e #een 5ritten

in general le&el or then there e9ists only proect specific 5ritten o#ecti&es and tass3 ;hen

asing a#out. ho5 often does the respondents' responsi#ilities re?uire only their decision-

maing. it is clear that most of the respondents are higher-le&el managers. as this le&el

decision-maing is re?uired often or e&en daily3 0&en though it seems o#&ious that the

leader. or the person in the position of a manager. is re?uired and e9pected to mae

decisions solely. in terms of internal control it can. ho5e&er. #e ?uestiona#le3

32


39/79

4.1.2 #ontrolling the compan #urrent internal control sstem

The timing of implementing internal control systems differs among the four companies. #ut

it seems that policies and guidelines defining aspects of internal control ha&e e9isted from

the start3 "ccording to one of the respondents. the most recent methodology they apply is

a#out 2-@ years old3 "nd as according to most of the guidelines on internal control. this is

under continuous de&elopment to ensure that they also apply the rele&ant guiding principles

in an efficient and effecti&e manner3 "nother respondent ans5ered that their company

implemented their system in 23 These t5o ans5ers 5ould suggest that in the past fe5

years the topic of internal control has #een #rought up again3

To ha&e an effecti&e internal control *IC+ system. the o#ecti&es of the system need to #e

clear and specified3 From the sur&ey 5e can see ho5 companies' IC o#ecti&es &ary from

general to more specific3 "ccording to respondents. their IC o#ecti&es include

compliance. reputational ris management. integrity. financial reporting ensure

compliance 5ith internal policies and procedures. ensure that #rand reputation

is not harmed

1. reaching of o#ecti&es and maing sure strategy is implemented. 23 management of

riss related to the #usiness. @3 securing that la5s and regulations are complied 5ith

protect the firm and its #rand from the riss that arise in its professional practice to

assure that the riss relating lia#ilities are systematically and 5ell managed ensuring

achie&ement of o#ecti&es and 5ith regards to client 5or that the ?uality and integrity

in e&erything 5e do is not compromised and that 5e apply ethical considerations in all

our decisions and actions3

Based on these &ery thorough ans5ers to this ?uestion. it seems the o#ecti&es of the

internal control are clearly defined and understood #y the respondents3

@@


40/79

"ccording to the theory. ris management and internal control should #e directed.

coordinated and monitored #y the #oard3 Euestions nine and ten 5here to find out. 5ho in

practice is in charge of these ris management and internal control operations3 0&enthough the ?uestions are ased separately. the ans5ers seem to repeat their sel&es3 "s a

summary. management and the Board of Directors seem to #e the ones ultimately in

charge3 They are the ones responsi#le for implementing a proper system of internal

control. and the management is then more in charge of ensuring that the system is put into

effect3 7o5e&er. in #oth cases one respondent adds that Hall personnelH is in charge3 This

of course is something that one should also #ear in mind that e&en though the instructions

come from the top. e&eryone is personally in charge of their o5n #eha&ior3

"ll of the respondents 5ere a5are of the nature and e9tent of the riss facing their

organi1ation3 This. according to the guidelines represented #y >/. is one of the first

points that mae an internal control system effecti&e3 This ?uestion and e9amples of riss

5ere also ased during the inter&ie5s. so this 5ill later on #e discussed in more detail3

The o#ecti&ity of an internal controller plays a significant role 5hen it comes to monitoring

and assessing the effecti&eness of the controls *lader. 73 2A "pr 2!2+3 Therefore.

?uestion !2 from the sur&ey ass specifically a#out the internal controller. and 5hom he or

she 5ors for. i3e3 is he an employee from the organi1ations payroll or hired out-side the

company3 The ans5ers &aried a lot3 Three responded 5ith not ha&ing such a specific role at

all. t5o said that the person is hired internally and one responded #y ha&ing #oth3


41/79

Internal audits. according to @ $ of the respondents. are held annually3


42/79

"s discussed in chapter 23! people conducting fraud can #e o#ser&ed or analy1ed through

the fraud triangle3 For an ordinary person to commit fraud. there needs to #e the three

elements of moti&ation. rationali1ation and opportunity in place3 The internal control

system should #e the procedures. 5hich e9ist in order to pre&ent the element of opportunity

to tae place in this e?uation3 Therefore it 5as rele&ant to add this ?uestion in the sur&ey3

"ccording to the respondents. it seems the opportunities to conduct fraud are the same for

managers and employees3 %one of the respondents ans5ered that no opportunities 5ould

e9ist3 7o5e&er. $K replied that for #oth cases. management and employee. the

opportunities for committing fraud are #elo5 moderate3 This suggests that fraud is

something that can #e done4 ho5e&er the systems are controlled in such that not many

opportunities e9ist3

4.1.3 %oard meetings and relationships

"ccording to most of the respondents. the #oard re&ie5s their company's ris management

and ris analysis annually3 7o5e&er. for 5hat it comes to the actual internal control

system. most of the respondents *))K+ 5ere not a5are of ho5 often this is done3


43/79

#ased statement concerning the employee's no5ledge on the rele&ant guiding

principles related to client and staeholder relationships3 "ccording to the same

respondent. all employees ha&e the responsi#ility to apply related principles 5hendealing 5ith clients and other staeholders3


44/79

Ta#le 23


45/79

Intervie'ed • client riss • continuous re&ie5s and honestfor client engagements • often starts small

• monitoring from In- and escalatesdia • e9ample situation

•follo5ing internal money trou#le +control processes a opportunity "

part of employee re- fraud

muneration

• ris and reputa- • code of ethics. ethical • 5ored 5ith fraudtion manage- instructions & inde- cases

ment pendency regulations • more damage &s3

• &alue control • regular reporting to #enefitIntervie'ee • client riss glo#al group • cases mostly relat-

• employees trained and ed to monetary2 tested on no5ledge transactions

• internal audits e&ery • companies don'tthree years. include realise the riss

?uestion #atteries re- • e9ample situationlated to the glo#al re- cost friendly loan

?uirements decisions for friend

• different ap- • a&oiding dangerous • personal e9peri- proach. as part 5oring com#inations ence of colleague

of the #usiness • controls in IT pro- committing fraudis to tae riss grams. e3g3 user ID's • fraudulent financial

•categorisation

•internal controller & transactions from

under three ti- e9ternal auditors. the company's ac-

Intervie'ee

tles4 operati&e. conduct audits pro- count to personal

reputation. and cesses & financial account

@ strategic riss statements • led to changes in

• #oard meetings & control processescontinuous de&elop- • after5ards loss ofment @ $ retrie&ed

• reporting on Hnear#yH • left colleagues 5ithsituations feelings of #etrayal

• #laming culture slo5- and disappoint-

ing the de&elopment ment

@(


46/79


47/79

4.2.1 Ris$ management

"ll of the inter&ie5ees emphasi1ed on the comprehensi&eness of their ris management3

The auditing companies #oth had reputational and ?uality issues in high importance. as

they referred to Hcomprehensi&e ?uality ris managementH and Hris and reputationH

management4 5here the ?uality or reputation is already included in their internal

terminology3 This of course seemed to #e #ecause of their delicate #usinesses. and the

re?uirements that ha&e #een set forth #y the companies' glo#al groups3 Both Inter&ie5ee !

and 2 e9plained that most of the ris management aspects are related to so-called client

riss3 The selection of customers seems to #e in #oth of these companies highly regulated

and monitored3 The companies emphasi1e in #ringing &alue to the customers. #ut at the

same time the customers should #e trust5orthy. for e9ample. 5hat if comes to financials

and the a#ility to perform payments3 8ltimately. the #rand and reputation need to #e

protected and ept in high ?uality3

The Inter&ie5ee @ had a ?uite different approach. as the #usiness differs ?uite highly from

the auditing companies3


48/79

outside assistance3 This is yet another reason 5hy riss are not only do5nsides. #ut also

opportunities3

Some #usiness le&el riss are mostly related to regulations. 5hich arise mainly from the

0uropean commission or other regulatory #odies3


49/79

independent person from the auditing company. so a person 5ho has not #een

engaged in that specific proect3

"ccording to Inter&ie5ee 2. centrali1ed instructions and guidelines on reputation and ris

management come from the group. and need to #e follo5ed 5orld 5idely in all of the

international offices3 These instructions include the code of ethics. ethical instructions. and

independence issues3 "ll of these issues need to #e reported to the higher organ regularly.

the independence 5hen 5oring 5ith customers in this #usiness is of high concern3 The

regulations also include topics on anti-corruption and money laundering3 In the

inter&ie5ees o5n unit. employees are trained to the topics mentioned a#o&e. and regularlytested on their no5ledge3

Inter&ie5ee @ loos at the topic from the operati&e riss point of &ie5. and finds that

a&oiding dangerous 5oring com#inations is one of their main tools used 5hen it comes to

internal control3 This in practice could mean. for e9ample. regulations on 5ho has the right

to accept different matters3 This can often #e part of the IT programs. for e9ample. the user

identification codes *ID's+ can #e determined so that different employees can access only

selected information3 The user ID's also allo5 the management to follo5 logs. 5here one

can see 5hat a certain employee has #een doing3 "ccording to the CF


50/79

engagements are also locally reported on. as reports concerning the status of ?uality and

ris management procedures are o#ligatory3 Inter&ie5ee 2 e9plains ho5 their internal

audits are done e&ery three years3 These audits include ?uestionnaire #atteries related tothe glo#al instructions3 The strictness of the compliancy 5ith the glo#al guidelines is

e&ery time higher. meaning that the company is e9pected to ha&e impro&ed for e&ery

audit3 "fter half a year from the audit. the audited company needs to report its

impro&ements regarding the compliancy 5ith the regulations3

Inter&ie5ee @ e9plains their internal audits as follo5s3 The company has a designated

internal controller. 5ho is independent and 5ors under the C0


51/79

%one of the three inter&ie5ed. can straightfor5ard pinpoint any possi#le failure points in

their internal control systems3 7o5e&er. an essential part of the systems is continuous

de&elopment and impro&ement3 /ore and more practical processes and automation ha&e #een included3 "nd as the &alue of the controls is understood. there is less resistance3 It

seems that in the past fe5 years a lot of companies ha&e taen #ig leaps in impro&ing their

control systems3

,egally. none of the companies are o#ligated to report on their internal control in specific3

%e&ertheless. all of these three companies do report on it in one 5ay or another3 "ccording

to Inter&ie5ee !. they are re?uired to report to their India office. 5hich taes care ofmonitoring their processes3 7o5e&er. he adds they could #e more transparent a#out their

internal control procedures. as especially clients often as a#out ho5 riss are managed

5ithin their organisation3 Inter&ie5ee 2 can only say a#out the Sar#anes-/

*!(((. 2$+. the communication and philosophy on ris management as 5ell as internal

control should come from the #oard3 Therefore the inter&ie5s also touched the topics of

communication and organisational philosophy as 5ell as culture3 "ccording to Inter&ie5ee

!. their ?uality ris management *E=/+ co&ers the communication and reasoning on 5hy

certain procedures are done and 5hy they are important4 this is done #y pro&iding a lot of

training material to the employees3 Inter&ie5ee 2 e9plains ho5 a part of their

communication methods includes an 44


52/79

annually conducted 5e#-#ased sur&ey regarding the independency of engagements. plus

some compulsory e-learning on ethical issues is re?uired3 The depth of the independency

?uestionnaire and the re?uired learning &ary #ased on the employee's position4 there arehigher re?uirements for the management3 These ans5ers are then reported to the head of

the glo#al organisation3 For 5hat it comes to attitudes. many seem to consider the sur&eys

?uite hea&y and long. #ut understand the importance of them3

In Inter&ie5ee @'s company a ris management plan is updated and pu#lished e&ery year3

/ore detailed ris management education is gi&en for all the super&isors. 5ho should thencommunicate it and the philosophy #ehind it to the rest of the employees3 Currently an

issues under discussion. is 5hich ind of realised riss near#y situations. should #e

reported on. and to 5hom and until 5hat le&el3 The aim 5ould #e that e&erything should #e

reported on. in order to discuss and impro&e the control processes3 The difficulty seems to

come 5ith the optimi1ation. as not e&erything can #e determined in money it maes it hard

to descri#e 5hat ind of issues are rele&ant to report on3 For e9ample. it is difficult to gi&e

monetary &alue for reputation. #ut the riss related to it can create tremendous loss3

For 5hat it comes to the general &ie5 on internal control among the employees. the

inter&ie5ees had ?uite similar ans5ers3 eople are 5ell a5are of the importance and

understand 5hy things are done as they are3 Some negati&e factors relate to the

#ureaucracy often re?uired to fulfil the processes3 Inter&ie5ee ! #rings an interesting fact

a#out their processes related to internal control a part of their remuneration program

in&ol&es the fact of ho5 5ell the ?uality and ris management ha&e #een carried out3 In

other 5ords. follo5ing and reporting on the E=/ is a re?uirement for a #onus4 if not

doing 5ell in these aspects. the employee does not recei&e a #onus3 Inter&ie5ee @ refers to

their corporate culture as careful and responsi#le3 The #ureaucracy and stiffness comes

across 5ith some IT programs and systems3 0mployees sometimes feel these different

controlling methods are often not easy to operate 5ith and they can slo5 do5n the

processes3

A$


53/79

The final ?uestion of the inter&ie5s 5as is there a need for an internal control system in

e&ery company. and or could there #e any negati&e factors of ha&ing an internal control

system6 "ll of the inter&ie5ees agreed that an internal control system should #e a part ofe&ery company's ris management3 7o5e&er. the e9tent of the control system should suit

the organisational culture and #e in proportion 5ith the si1e of the company3 For e9ample.

#oth Inter&ie5ee ! and 2 5ould consider the 8S S


54/79

Inter&ie5ee @ told in detail a#out a fraud situation his company had e9perienced recently3

The fraud 5as one of the most common types of corporate fraud misappropriation of

assets3 The misappropriation of assets continued for one year. 5ith #uilding to a monetary&alue of around @ $ in total3 The employee 5as a#le to transfer money. intended for

paying the company's #ills. to her o5n account and also to some other account registered

under a Hho##y clu#H3 /onthly the transferred money 5as only around one thousand to up

to fi&e thousand 0uros at a time3 The employee had 5ored in the company for @ years.

#ut something happened during the last year3 There might ha&e #een some personal issues

in the #acground. as according to the inter&ie5ee. the employee had acted strangely for the

last one year. #efore gotten caught3 During that specific year. the actual team leader. under5hom the employee 5ho conducted the fraud had 5ored for. 5as on her maternity lea&e3

This team leader noticed the fraudulent transactions. after she came #ac from her lea&e4

she first 5ondered 5hy some transactions had #een made dou#le. and 5hy some of the

records seemed unclear3 The employee 5as a#le to go around and e9plain some of the

records. #ut finally the person got caught of the 5rongdoings 5hen a customer called and

ased a#out a missing payment that had #een due3 This led to deeper in&estigations. 5hich

re&ealed that the employee indeed had fiddled 5ith the systems and changed some of thecustomers' the #an account information to her o5n account3

The employee got caught on a Tuesday and finally. after 5aterproof e&idence. fired 5ithin

a 5ee3 The final criminal &erdict is yet to #e announced. #ut the monetary losses ha&e

#een retrie&ed3 "s a conse?uence after this case there ha&e #een a lot of changes in the

company's IT processes. settings ha&e especially #een changed so that the person 5ho is

a#le to change the account num#ers. is a different person 5ho fillsin the actual monetary

transactions3 In other 5ords. more #ureaucracy and controls ha&e #een added to the

processes3

In addition to 5hat ha&e #een mentioned. the 5hole situation had a huge effect on the other

employees as 5ell. as it #rought up feelings of disappointment. #etrayal and shoc.

especially as the person had #een a long-lime trusted employee3 To tacle all the4%


55/79

personal issues among the colleagues. the company organised a group discussion. plus

personal discussions 5ith a psychiatrist. in order for people to get past the shoc and

continue 5or3 %e&ertheless. the fraud case seemed to #ring dou#t and distrust among therest of the employees3

%one of the inter&ie5ees 5ere a#le to pinpoint some clear reason for people to commit

financial fraud3 "ccording to Inter&ie5ee ! the so-called fraudulent #eha&iour often starts

small and then later on gro5s3 The specific employee might #e e9periencing financial

trou#le and then if an opportunity comes along. the moti&e and reasoning comes easily as

5ell3 Inter&ie5ee 2 ga&e an e9ample of a situation 5here the person committing the fraud.did not actually #enefit anything. instead he 5as ust helping a friend3 In this e9ample of

fraud. the employee 5ored in the financial sector and due to his position. he 5as a#le to

gi&e cost friendly loan decisions for friends. meaning e3g3 longer payment periods3

Inter&ie5ee @ put it simple. #y saying that Hnoone can really #e trustedH3 ossi#le reasons

often seem to come from personal issues. 5hich are ne&er too easily categorised3

A


56/79

& Data Results and 0nalsis

To analyse the data. collected from the ?uestionnaire and inter&ie5s. this chapter 5illdiscuss the findings related to the three in&estigati&e ?uestions3 The purpose of this analysis

is to compare the theory #ehind internal control 5ith the actual reality and practical

processes companies' use3 By doing this. some possi#le failure points might #e detected.

from 5here suggestions on ho5 to pre&ent fraud should arise3 The suggestions and possi#le

de&elopment ideas 5ill #e represented in the final part of this chapter3

&.1 anagers7 vie's on internal control

To tacle the research pro#lem. the first in&estigati&e ?uestion that needed to #e ans5ered

5as to find out 5hat are managers' &ie5s on internal control in general and in their

company3 Starting the analysis already from the ?uestionnaire ans5ers. it seems as

managers in consulting companies ha&e a good or e9cellent no5ledge in internal control3

Interpreting the ans5ers concerning the o#ecti&es of internal control. all of the respondents

had ?uite a thorough ans5er to present. gi&ing an impression that the o#ecti&es definitely

are something. 5hich are discussed and considered 5ithin the organisations3 The managers

understand the importance and necessity of the controls. as said #y Inter&ie5ee 1 the

internal control system ensures that the company o#ecti&es are reached3 Therefore it can #e

said that ha&ing an internal control system seems to #e a natural part. and some5hat a

necessity. of the organisations' operations3 The topic on o#ecti&e 5ill still #e discussed in

more detail in the follo5ing chapter. as o#ecti&e setting is also one of the ey components

5hen #uilding an effecti&e internal control system3

"ccording to a definition represented #y lader. a consultant from BD<


57/79

eeps employees sharp 5ith internal acti&ities3 In addition. the different control acti&ities

mae accurate. rele&ant and timely reporting possi#le3 7o5e&er. as #rought up #y the

inter&ie5ees. the e9tent of the control system should suit the organisational culture and #ein proportion 5ith the si1e of the company3 For e9ample. the use of the 8S S


58/79

The internal en&ironment in Inter&ie5ee @'s company still seems to need impro&ements3

The tone that comes from the management and upper le&el super&isors is clearly something

affecting the 5hole internal en&ironment. 5hich currently is not as open as it could #e3 "sreferred #y Inter&ie5ee @. the #laming culture is something that needs to #e o&ercome. in

order to open up the atmosphere3 By doing this. meaning maing the en&ironment more

open. possi#le riss 5ill #e easier to detect and the o&erall control processes could #e #etter

de&eloped and impro&ed3 %o5. as the communication channels seem to #e e9periencing

#locages. the ris management #oard might #e lacing crucial information. 5hich as a

result slo5s do5n the flo5 of continuous de&elopment3 The phenomenon of a #laming

organisational culture can #e detected from one of the most common 5eanesses inorganisations represented #y the >/'s =is /anagement Diagnostic *chapter 23$32+3 The

aspect of #eha&iour fails. 5hen disincenti&es e9ist 5hich lead employees to #eha&e in a

non-functional manner *>/ !(((. 2)+3 /oreo&er. the philosophy and setting an e9ample

should come from the #oard. management and super&isors3


59/79

clearly a#le to categorise the riss into internal and e9ternal3 "s discussed in chapter A323!

the riss &ary from economic do5nturn to employee no5-ho53 Inter&ie5ee @ categorised

their riss under operati&e. reputation and strategic riss3 The operational riss can further #e di&ided into e9ternal and internal3 The e9ternal riss include maret riss. credit riss and

li?uidity riss. 5hich can arise from client and counter party relations3 The internal riss

5ere more discussed in relation to the internal control. 5hich moreo&er include in-house

procedures and processes3 In all off these researched company cases. it seems that the riss

are 5ell no5n3 7o5e&er. as discussed 5ith Inter&ie5ee @ * chapter A323@+ the topic of fraud

and controls came more e9plicit after the misappropriation of assets - incident. 5hich their

department e9perienced3 This incident lead to tightening of the controls. #ut it seems that theatmosphere of openness should still #e impro&ed. in order to de&elop the procedures to #e

more efficient3 Theoretically this can #e again assessed as one of the 5eanesses under

performance and ris effecti&eness. 5here the #oard does not recei&e the right information

*chapter 23$32+ *>/ !(((. 2)+3

The ne9t t5o components represented #y C


60/79

Inter&ie5ee 2's case. ethical and independence issues are of most importance3 The

procedures represented #y Inter&ie5ee @ mainly include the a&oidance of dangerous

5oring com#inations3 In practice this has #een implemented for e9ample in the IT programs. #y ha&ing personal user ID's. 5ith personal settings for different employees3


61/79

Ta#le @3


62/79

rather than #laming cul-

ture - aspect of #eha&iour

(b/ective etting

resent and functioning3 • Consistency 5ith ris ap-

petite and mission

/ostly functioning. #ut • Impro&ements for per-impro&ements needed3 formance and ris effec-

ti&eness - lac of rele&ant

+vent Identification communication to the

#oard

• P not all possi#le rissare detected

Ris$ 0ssessment %" • Deeper analysis on lieli-hood and impact of riss

resent and functioning3 • ;hen to a&oid. accept.Ris$ Response reduce or share riss6

• Cost of control &s3 #enefitresent and functioning3 • Careful consideration of

all internal riss

#ontrol 0ctivities

• Balance #et5een too in-

tense controls and 5hat is

necessary- e3g3 propor-

tion 5ith the company

si1e

Information and /ostly functioning. #ut • Information flo5 should#ommunication impro&ements needed3 go across. up and do5n

/ostly functioning. #ut • Importance of local moni-onitoring open for interpretation3 to ring6


63/79

7o5e&er. as mentioned in chapter 23$3!. the eight components do not function identically in

all organisations3 In smaller organisations they may #e less structured and more informal.

#ut still effecti&e3 "ccording to the analysis presented in the pre&ious chapter. it seems as if

the consulting companies set an e9ample to other companies3 The theoretical components

re?uired for an effecti&e system of internal controls seemed more or less to #e in place3 The

company. represented #y Inter&ie5ee @. on the$$


64/79

other hand 5ould need impro&ements to its internal en&ironment. and possi#ly to its

control procedures3 ositi&ely it can #e seen that the topic of implementing. de&eloping

and updating internal control systems is currently discussed in many organisations3

To ans5er ho5 effecti&ely do the internal control systems pre&ent fraud. 5e can reflect on

5hat 5as ans5ered in the sur&eys and 5hat other conclusions can #e made #ased on the

presented data3 "s suggested in chapter A3!32. internal control plays a high role in

pre&enting fraud ho5e&er it cannot fully pre&ent it3 "lready C


65/79

4.&.

the top of the company3


66/79

Figure (3 Interrelation of components

To tae as an e9ample the company case presented #y Inter&ie5ee @. it could #e

concluded that the information and communication as 5ell as the e&ent identification

components 5ould function #etter if the internal en&ironment 5ould #e more open. and

ha&e a more accessi#le atmosphere3 ;ith an open and functioning internal en&ironment.

the information flo5 5ould #ecome more efficient. and the

communication channels could operate in all necessary directions3 The component of

e&ent identification 5ould function #etter. as if the communication channels 5ere

open. the information 5ould flo5 fluently3 Therefore help the #oard to identify e&ents.

5hich affect the achie&ements of o#ecti&es. and determine these e&ents as riss and

opportunities3

The component of monitoring seems to #e an aspect possi#ly also in need of deeper

consideration3 0&en though. the research findings do not suggest that there are any negati&e

aspects in monitoring happening across #orders. companies should definitely consider the

effecti&eness and relia#ility of distant monitoring3 %o5adays. as the 5orld is full of

international organisations operating in multiple continents. a le&el of monitoring

happening across #orders is ine&ita#le3 Therefore. companies should$


67/79

carefully consider the implementation of internal control. and determine the organ that is

ultimately in charge of implementing and carrying-out the processes of their internal control

system3 In addition to 5hat the head?uarters. or the parent company monitors. localmonitoring of control procedures is in place3

&)


68/79

: #onclusions

Fraud and deception seem to #e o&erall something that a 5illing and determined person5ill find a 5ay to commit3 Therefore. it is not &alid to say that a corporate internal control

system 5ould pre&ent fraud3 %e&ertheless. internal control is something that minimi1es the

opportunity and in such it is a necessity for all companies to ha&e3 This final chapter

presents the &alidity and usefulness of the discussed results. possi#le recommendations for

future research. and finally the researcher's personal e9perience on professional

de&elopment and learning during the thesis process3

:.1 ;alidit and usefulness of results

The &alidity of the research can #e e9amined through the e9isting data on earlier research

* chapters 232 and 23A+. done #y C


69/79

Further research on the topic could include in&estigating the co-operation #et5een

managers. the #oard and the e9ternal auditors3 "s can #e seen in the cases of 0nron and the

,ehman Brothers. the e9ternal auditors 5ere present. #ut still they did not detect thefraudulent reporting. or if they did. they did not act on it3 0&en though the employee le&el

procedures seem to #e highly emphasised in the theoretical models of internal control. could

or should there #e something similar pro&ided for the top of the company6

The research also pro&ides ne5 and interesting learning for fello5 students and educators3

,ining ethical issues 5ith finance #rings out important factors. 5hich too often are left outof the curriculum3 The topic of financial fraud is not easy to tacle. #ut creating a5areness

of the conse?uences and the seriousness of it. can in the long run reduce fraud incidents. and

may#e e&en create a more trust5orthy #usiness society3 Corporate social responsi#ility and

ethical #usiness #eha&iour are something e9pected from all 7"""-70,I" international

#usiness graduates3 This thesis pro&ides good insights in regarding to the mentioned.

especially for students specialising in finance3

)32 ('n professional development and learning

During the thesis process I ha&e learned a multiple different things3 The 5hole process has

taen a #it o&er a year. and for me this has #een the longest period of time I ha&e e&er

focused on 5riting one piece of te9t3 /erely this has re?uired patience and a lot of thining

through3 During the 5hole process. the most difficult thing has #een to stic 5ith the

demarcated topic3 For e9ample e&ery time I ha&e 5ritten something I ha&e had to remind

myself not to go too far. despite interesting findings and facts3 But. I am grateful I started

researching this topic. as throughout the process I ha&e ept my moti&ation. and I am also

glad that I can actually present some findings on it3

Some set#acs that I e9perienced happened firstly 5ith the ;e#ropol - sur&ey. as I had

some minor technical difficulties 5ith it. and therefore pro#a#ly lost a fe5 of the

respondents' ans5ers3 In total I sent the sur&ey fi&e times. ho5e&er only si9 out of !(

people replied3 Successfully. the inter&ie5s compensated this. and I 5as a#le to get)!


70/79

interesting ans5ers3 The highest learning pro#a#ly happened 5ith contacting the

different companies and conducting the inter&ie5s3

62


71/79

References

"altola. J3 & alli. =3 2!3 Iunoita tutimusmetodeihin II3 %aoulmia aloittele&alle

tutialle tutimusen teoreettisiin lahtoohtiin a analyysimenetelmiin3 S-ustanus3

Jy&asyla3

Beasley. /3. Carcello.J3. 7ermanson. D3 & %eal. T3 2!3 Fraudulent Financial =eporting

!((-23 "n "nalysis on 83S3 u#lic Companies3 8=,

http 5553coso3org documents C


72/79

Freifeld. >3 & Sandler. ,3 22 Decem#er 2!3 Bloom#erg %e5s3 Cuomo Sues 0rnst &

Goung for "ssisting ,ehman Brothers in H=epo !$' Fraud3 8=,

http 5553#loom#erg3com ne5s2!-!2-2! ne5-yor-s-cuomo-said-to-planfraud-

suit-against-lehman-s-accounting-firm3html3 "ccessed 2( Jan 2!23

lader. 73 2A "pr 2!23 Sisa

saarni jenna.word

Documents