Christopher Bauer's Ethics Nexus

Associaton of Certified Fraud Examiners Releases 2012 Global Fraud Study

The Association of Certified Fraud Examiners (ACFE) had released its 2012 "Report to the Nations on Occupational Fraud and Abuse". As all ACFE studies, it is a trove of interesting and useful, if sometimes alarming, data.

The current study analyzes data from 1,388 verified fraud cases from around the world and these data were reported via an online survey of ACFE members between October and December of 2011. To be included in this study, the investigation of these cases must have been completed at some point between January 2010 and the time of the survey.

Among the many compelling findings found in their executive summary are the following:

• On average, survey participants estimated that typical organizations are losing approximately 5% of revenues each year to fraud and abuse. (This corresponds closely to the figure frequently cited for major corporations in the U.S. So, these findings suggest that this estimate is both worldwide and probably, in fact, unrelated to the size of the organization.)

• The median fraud loss in this sample was $140,000 but more than a fifth of the cases resulted in losses of greater than $1,000,000. (Here again, theses figures correspond relatively closely with domestic U.S. studies from the last several years.)

• Occupational fraud reported in this study was far more likely to have been discovered by a coworker than through formal oversight and audit programs. (This is why effective ethics and compliance training must help employees learn to recognize danger signs for fraud and abuse as well as how best to respond to them. After all, they are the folks most likely to actually notice something is amiss. Obviously, formal oversight and auditing process are critically important; just don't fool yourself into thinking that they are any more effective than they actually are.)

• A significant majority of the perpetrators in this study (87%) had neither been charged or convicted of a fraud-related offense or punished/terminated by a previous employer for fraud. (This provides stil more data supporting the already-large pool of evidence that, despite our stereotypes, only a fraction of fraud and fiscal abuse is perpetrated by the 'criminaly-minded', reagrdless of one's definition of 'criminal-mindedness'.)

It is interesting that, as has often been the case with ACFE studies, these findings are based on 'worst case' reports of informants. (In other words, informants were asked to report on the worst case they had seen during the study period.) Although in theory that should skew these data significantly in the direction of overly liberal estimates, the findings are far more similar than different to those of other studies not using a 'worst case' data set. It's tough to know exactly what that means but my money is on the likelihood that patterns of fraud and abuse are so similar across cases that the range from best case to worst case, once the amount is large enough to be both reported and material, is actually smaller than one might imagine.

Much, much more is reported in this current ACFE report and giving it more than a passing glance is highly recommended.

 

Three Often Overlooked Sources of Electronic Data Breaches

Regardless of whether customer and employee data is legally protected in your country or industry, we all have an ethical obligation to protect others' personal information as well as our own organizations' proprietary information. Doing otherwise is an open invitation for that information to be used in malicious ways ranging from identity theft to corporate espionage. At the very least, it's simply common courtesy to protect others' privacy!

 

Even in companies with elaborate data-protection systems, here are three sources of electronic data breaches that I see all the time:

• The most common breach has perhaps always been - and will perhaps always be - computer monitors left on and exposed so that passers-by can read the screen. (Plus, if that machine is 'live' and unattended, what's to stop someone from using it to forage for still more information?). Have a reasonable and enforceable policy to prevent each of these things from happening.

• Redeploying computers. Most companies seem to be getting better about removing hard drives from old computers they are trashing or selling off. (And if you aren't doing that, you need to! Those drives can easily be accessed by the new owners to retrieve whatever is on there. Remember, that is true even if you've used many of the programs designed to mask that data.) What about redeploying computers to new parts of your business, though? Are you sure that the new user needs access to the information gathered by the former user? If not, get that data off the machine before it goes where it ought not be going!

• People change their electronic technology more often than their underwear these days and all those machines and gadgets are a huge source of potential data breaches. While cell phones are especially likely to have your and others' private information on them, remember that there are memory chips or drives in pretty much everything these days and some are surprisingly large. Things like copy machines and fax machines are prone to have a ton of data on them that needs to be protected. Be sure that their memories are wiped clean before you get rid of them.

Like with so many things ethical, electronic data security is often seen as someone else's job. Also like so many things ethical, however, we have not fulfilled our ethical obligation if we don't do everything in our power to assure that the proper thing is being done. If you see any of these potential data breaches occurring in your organization, make it a point to bring the problem to whomever has the authority to correct the problem.

Where Do You Draw The Ethical Line?

Every now and then I encounter an ethics article that covers a topic in a both thorough and refreshingly easily-digested manner - too many are either or neither of those... Just read a great piece by Vadim Liberman in the Conference Board Review called "Workers Behaving Badly". It falls squarely into the if-you-just-read-one-piece-on-business-ethics-this-month-make-it-this-one category.

As a 'teaser', here's a part of the lead-in to the article:

"The executive who expenses a few kinda-sorta-but-probably-not-really work-related dinners or cab rides, the colleague who comes in a bit late every morning, the employee who charges a hotel-room movie to the company, the worker who expenses a new stapler and takes it home, the manager who knows he needs a receipt for a reimbursement of $25 but since he doesn’t have one decides to submit two requests for $12.50 . . . the question isn’t whether these individuals are acting unethically. They probably are. The real question is: Should a company care? Should organizations concern themselves with all of their workers’ ethical infractions? Or just specific bad behavior? Or just specific workers? Or just at specific times? Where do you draw the line?"

Liberman, along with a number of guest contributors, do a better job than most in then trying to answer those questions. Can it actually be done? Of course not! That's why these simple-sounding illustrations are so vexing - they sound easy and obvious when, of course, they really aren't. BUT, this piece does a terrific job of talking through how you might go about deciding how you want to answer them for yourself and your company. 

Among other things, it's great to hear/see someone dare say out loud that where one draws the line on ethics issues, especially those not affecting anyone outside the company, is often really a matter of choice and not something iron-clad. Though I happen to be a proponent of drawing a fairly conservative line - for exactly the range of reasons given in the article - I'm certainly conscious of the fact that one can reasonably argue for drawing the line in any number of places. As I say so often in my programs, what frequently matters most has less to do with the decision you make (about where you draw the ethical line) and more to do with your rationale, the message your decision sends, and the degree to which your decision will be both sensible and enforceable for everyone in the organization.

Agree or not, it's a very nicely done article and highly recommended. 

And, er, where do you and your company draw the line?

Ethics in 2009: Extraordinary or Simply Ordinary With A Little Extra?

2009 has been a year of extraordinarily big splashes in ethics of all kinds. We've had the ethics questions permeating both the global economic crisis and the U.S. economic meltdown in particular - especially issues related to the sub-prime mess,TARP, and more, the medical prescribing ethics questions surrounding Michael Jackson's death, the almost unimaginably gigantic fraud scheme of Bernie Madoff and many other 'merely' huge financial scandals, and we've had the relationship ethics questions flowing from Steve McNair up the Appalachian Trail to Mark Sanford and then on to Tiger Woods. Each has been huge in its own way and has led 2009 to being well on its way to being labeled by the history books as a year of infamy in the annals of ethics of all kinds. It has certainly felt that way all year long.

But is that really what we've been seeing? The more I review the year in my mind, the more I start to see it differently. Call me a hopeless glass-half-full kinda guy if you like - it certainly wouldn't be the first time - but I'm rapidly changing my tune on 2009; I think it might have actually been a pretty ordinary year in far more ways than not. Here's my thinking...

In the corporate world? In 2009, we've seen evidence of a variety of improvements in ethics as well as other data suggesting the status quo or worse. Sound familiar from other years? It certainly does to me.

Otherwise, with few exceptions, the 'big splashes' of 2009 made the headlines because of coming to their end in 2009 - maybe we ought to be adjusting our collective ratio of celebrating to moping with a hefty increase in the former. Bernie Madoff and his cronies had been scamming for decades and the lax oversight that allowed him to do so had to have been happening for equally as long to allow it. The financial meltdown was the product of problems that had been developing for years and years; sub-prime mortgages, for example, weren't some new product heaved onto the shelves in 2008 or 2009 nor were any of the shaky investment structures supporting them. Michael Jackson didn't start having problems in 2009, he finally died from them - and here again, the prescribing issues allowing his death were hardly either new or unique to him. And, of course, serial philandering is hardly a new concept for '09 - we simply saw several more-interesting-than-usual people get caught in more interesting-than-usual ways.

So, was it a bad year in ethics? It was terrible! Was it a worse year than usual? I really don't know. It seems to me that each of the above examples has largely to do with splashy, high-profile cases that actually came to their respective ends in 2009. In other words, maybe we need to nurture a bit 'o thanks for the uncovering or resolution of some of these problems during the year rather than misunderstanding them as examples of 2009-generated new lows in ethics of so many kinds. (True, some remain highly problematic but I'd like to think that their higher exposure will allow us to keep a search for their solution more easily in mind.)

Was 2009 an extraordinary year in ethics? The more I think about it, the less I think it probably was. In either case, though, here's to our collective hopes for a faaaaaaaar better 2010!

Great Research (And Some Good News) From The Ethics Resource Center

The Ethics Resource Center has released this year's study of ethics in the workplace. It is no surprise that, as usual, it appears to have been an extremely well done piece of research. It is a surprise, and a pleasant one, that their findings show some unexpected positive progress in workplace ethics in the last year or two.

As usual, they mine their data well and their commentary deserves close attention. (In other words, the summary I'll provide here is really just the tip of an iceberg well worth exploring in depth if you have an interest in the state of corporate ethics in the U.S.) That said, here are some of the key findings, primarily as summarized in their executive summary...

Based on 2009 interviews with 2852 employees in the U.S. private sector, changes observed over the last two years include:

1. Seven percent fewer employees observed misconduct in the workplace.

2. Five percent more employees reported misconduct once observed.

3. Two percent fewer employees felt pressure to engage in misconduct.

4. (The one significant negative finding.) Three precent more employees perceived that they were retaliated against in some manner because of their having reported misconduct.

Again, these are simply a summary of their key findings and a thorough reading of the study provides a great deal more depth. 

Among their warnings? That these findings may well represent a transient improvement and that companies need to pay close attention to passive or active pressures to return to 'business as usual' (i.e. a reversal - or worse - of the current findings.)

Among my warnings? It's great that these overall improvements have been reported. However, let's all remember that the above findings are relative to past findings and that many of the numbers, outside of that context, remain dismal at best. For example, in the ERC's sample, only 26% of employees perceived their top management's transparency to be "strongly open and informative", only 41% felt that all management levels in their organization were "strongly accountable", and in the ERC's extensive list of specific forms of misconduct observed by percentages of the workforce, few significant changes appear to have been made in the last two years. (Although, thankfully, most of the changes were in a positive direction, all but a few were only one or two percentage points different and it is not clear whether or not those changes, however positive looking, are actually statistically significant.) 

As always, the ERC is to be commended on their great work of which these reports are but one component. Also as always, however, we need to stay well aware that even the positive changes shown by the current study are less heartening than we might like and that they may be entirely transient if we don't continue to work to improve both private and public sector sector ethics, not just in the U.S. but worldwide.

Is Your E-Discovery Strategy Modeled After Ostrich Behavior?

In preparing for an upcoming edition of my Weekly Ethics Thought on electronic records and communications essentials, I talked with several executives about their e-discovery strategies, policies, and procedures. While I wasn't surprised to hear that they are getting ever-changing and often-contradictory information about how best to develop relevant and appropriate policies and procedures, I was surprised to hear how many of them have no clear strategy at all simply because they felt that the case law hasn't yet clarified enough of the relevant issues. This strikes me as extremely dangerous. As always, sticking one's head in the sand is neither legally nor ethically defensible.

At the absolute very least, even the experts who are at war on everything else seem to agree on some essential basics so those can be a starting point for any set of policies and procedures:

• If you wouldn't write it, sign it, or initial it on paper, don't write, sign, or initial it electronically. Even though it's true that case law continues to emerge in this area, the trend clearly points the way towards all electronic communications carrying the same responsibilities as hard copies have.

• If you wouldn't throw out a paper version, don't delete the electronic version.

• Assure that electronic communications can be safely stored for as long as required by current mandates and good judgment, the latter sometimes supporting the case for longer retention than the former. 

• Develop systems allowing both easy and effective searches of your electronic data so that accurate and complete data can be located quickly, confidently, and securely.

• Makes sure that everyone with access to electronic communications is fully trained in your policies and procedures pertaining to those communications. (I know that probably sounds obvious but, as is true with so many other kinds of training, many companies seemingly arbitrarily decide who will get essential training and who won't...)

Will your policies and procedures need to change as ethical and legal mandates become more clear? No doubt, just as they will need to continue to evolve as electronic communication and related technologies continue to evolve. If your company is waiting for either one of those to slow down before developing a strategy, though, you'll never have one - and that spells all kinds of trouble down the line.

Ethics Training: Are We Expecting Too Much From It or Too Little?

One of Chris MacDonald's ever-thought provoking blog posts ("What's More Important: 'Social Responsibility' or Basic Honesty?") quoted and led me to Peter Foster's recent post ("Trading Honesty for 'Social Responsibility"). Though admittedly not the central idea of Foster's post, the quote that caught my eye was this:

"It is surely also intriguing that the current financial crisis should have come after an explosion in the business ethics industry and the steady rise of the corporate social responsibility movement up the corporate hierarchy. You would be pushed to find any financial institution involved in the current debacle who was not dedicated to the very latest in independently monitored and internationally benchmarked governance practices, complete with high-sounding “codes” and commitments to carbon neutrality and fighting child poverty. And wasn’t the regulatory side of corporate governance meant to have been rendered cast iron by Sarbanes-Oxley? "

Of course there is plenty to ponder in this comment - as well as the rest of the article - but what stuck out to me was the recently-familiar implication that ethics and compliance training programs are simply not an effective piece of the response to the ever-rampant ethics problems to which we seem to see no end.

I think we all know by now that Enron had what could reasonably be called a model ethics code and that Sarbanes-Oxley hasn't miraculously made corporate fraud a thing of the past. Okay. But does that really tell us anything about whether we are expecting too much from ethics programs? I don't think so...

So, are we expecting too much from ethics training programs? Absolutely - if you think that these programs are supposed to somehow keep criminally-minded fraudsters from plying their trade. No ethics training program I know would have kept Bernie Madoff from being Bernie Madoff any more than they would have kept Al Capone from being Al Capone. However:

1. I know of no credible ethics training program that claims to magically convert the criminally-minded into the saintly. (And if you know of one, I'd suggest that their own ethics need some serious adjusting...)

2. A well-conceived and appropriately implemented ethics training program ought to help those wishing to do the right thing to be more easily and persistently able to do so.

3. Such a well-developed ethics training program ought to also help those honest folks more easily recognize and respond to the inappropriate actions of others, thereby reducing the potential impact of wrong-doers, whether or not that wrong-doing was intentional or a matter or either poor training or bad judgment..

4. The how-can-a-company-attending-to-ethics-still-have-Enron-like-problems question doesn't really wash in the fist place. Why? Because research shows repeatedly that the percentage of ethical problems caused by truly criminally-minded folks is barely even a blip on the statistical screen. A number of those folks will always be out there and, true, ethics training or a "high-sounding code" is unlikely to do a lot about them. However, for the overwhelming majority out there who really want to do the right thing, an appropriately conceived and delivered ethics training program can be extremely beneficial. Don't buy it? Look at the research from the Association of Certified Fraud Examiners, the Ethics Resource Center, and others showing - over and over again - that companies with ethics programs sustain dramatically lower fraud loss costs, etc. Quibble if you like that most of the data are correlational but I don't believe that significantly dampens the findings - it still makes the case that attending to ethics is related to improved employee behavior.

So, are we expecting too much from ethics training? Sure, if you want it to do more than it reasonably can. However, I think the far bigger problem is companies who merely give it lip-service or, perhaps, a half-hearted effort at implementation because they see it as either irrelevant or probably ineffective. With that attitude going in, any program's effectiveness will be hobbled right from the start. Once organizations see the the huge ROI of programs that are actually well designed, appropriately targeted, and fully implemented, I think they often come to see that they've actually previously been expecting far too little from ethics training.

Your thoughts?

GREAT Ethics Video Clip From The Los Angeles Schools!

It's gotta be tough figuring out how to make a commentary video on the importance of ethics education actually be cute, let alone cute and effective at the same time. However, the Los Angeles Unified School District has made it happen. I gather that this has been out for a while but I just stumbled onto it now.

Give it a look... Great stuff, I thought!

Ethics Training for Social Workers, Counselors, Case Managers, and Psychologists

Happy New Year!

As some of you may know, my background is in clinical psychology and, outside of my work in business ethics and values, I have maintained an on-going involvement in the world of mental and behavioral health. As one part of that, I have long-provided ethics training programs for behavioral health providers and administrators. Until now, those programs have been provided solely as in-house seminars and at professional conferences. Starting in '09, I'll also be providing these programs to the behavioral health professionals' community at large. (Or, perhaps more plainly stated, I'll be providing public seminars as well...)

Know anyone who might have an interest? These programs will be directly applicable to those in the fields of social work, mental and behavioral health counseling, rehabilitation counseling, mental health and rehabilitation case management, and clinical psychology. Information is available here!

Meanwhile, back at the business ethics ranch, the end of '08 has - sadly - given us plenty of new material to fuss and be fearful over. Our friend, Mr. Madoff may have scored the highest points for sheer personal gain - even while using one of the oldest and simplest fraud schemes even devised - but ethical and legal scandals of all shapes and sizes continue to populate virtually every news publication I see. 

May 2009 bring us all a world that is more peaceful and less dominated by the seemingly omnipresent legal and ethical scandals of the recent past.

Greenwashing - Whitewashing - Hogwash: What Are You Doing About Them?

In writing up a forthcoming edition of my Weekly Ethics Thought, it occurred to me that I was really writing more commentary than anything (read: blog material...) so I decided to post it here instead. Here 'tis:

Last year, TerraChoice Environmental Marketing published an interesting study of ways in which companies suggest that products are environmentally safe when, in fact, they are not. The study is called "The Six Sins of Greenwashing".

Among the things I found fascinating about their study is how the types of greenwashing they discuss are really no different than the ways in which individuals and organizations whitewash things all day long when the picture isn't as pretty as they'd like others to imagine. Here are the six greenwashing techniques listed by TerraChoice with my interpretation of what they mean in everyday whitewashing terms:

• Hidden Trade-Offs - Using the exception to prove the rule or using 'selective' statistics to make a point that the full range of data can't really support.

• No Proof -  Your point may or may not be correct but even if right, there aren't actually data to support it. (Of course, there is never anything wrong with making unsubstantiated statements - just be sure that they are clearly labeled as opinions and not facts!)

• Vaugueness - Maybe if you just make things a little less clear, others will assume that your bewildering arguments and behavior are okay when they aren't. Sins of willful information omission probably fit in here as well.

• Irrelevance - Give 'em something that looks or sounds really meaningful and hope they don't realize that what you've given them isn't actually at all relevant to the issue at hand. Magicians, fraudsters, and politicians all seem to be good at this. (Now that I see those three categories in print, side-by-side, it's kind of a scary-looking trio!)

• Lesser of Two Evils - Find a way to label something in a more positive light - or, at the very least, in a less negative light - and it will start to look much better by contrast against other similar, bad ideas, products, or behavior. (Here, I'd suggest the slightly different lot of marketers, fraudsters, and politicians as the most adept practitioners.)

• Fibbing - Here, the kindhearted folks at TerraChoice were far more delicate with their wording than am I. I believe that the somewhat more blunt term for this type of behavior is lying!

The original study is extremely interesting and is certainly recommended reading. However, whether you read it or not, my point is that we all need to think about whether we are engaging, or allowing others around us to engage, in these types of deceptive, evasive practices. If so, ethics demand that that we take every reasonable step to confront those actions. After all, if we see greenwashing, whitewashing, or just plain old hogwash being handed out to believing customers and don't credibly try to stop it, that automatically makes us one of the liars, too.