For accountants working at companies with operations in multiple jurisdictions, it may not be unusual to receive a telephone call from an overseas tax authority. The person on the line explains that your company has unpaid tax for a previous tax year. The situation is complicated, and they spend 30 minutes talking you through it to help you resolve it.
They seem very knowledgeable about your company and its operations. It is only towards the end of the call, when you are close to making a transfer, that you become suspicious that something is not right.
(From left) Peter Tisman, Director of Advocacy and Practice Development, Hong Kong Institute of CPAs, Jack Jia, Partner, Forensic & Integrity Services, EY, Janie Wong, Partner, Addleshaw Goddard, Peter Glanville, Senior Managing Director, FTI Consulting, Guy Norman, Partner, Financial Advisory, Deloitte China, Keith Williamson, Managing Director, Alvarez & Marsal
This scenario is one of many examples of new and more sophisticated money transfer frauds that have emerged recently. Fraudsters have moved on from sending crude phishing emails with bad grammar and spelling mistakes, to hacking into companies’ systems to gain knowledge of their operations, then using these insights to create plausible scenarios for money transfers.
While there are no official figures for Hong Kong, anecdotal evidence – as well as surveys from other jurisdictions – suggest the incidence of fraud has risen during the COVID-19 pandemic, as it typically does during economic downturns. The virus, which has led to full or partial lockdowns in multiple countries, has created both increased opportunities and increased motivation for fraud.
Peter Glanville, Senior Managing Director, FTI Consulting.
Peter Glanville, Senior Managing Director at FTI Consulting, a Hong Kong Institute of CPAs member and a member of the Forensics Interest Group (ForensIG) Management Committee, explains that many employers were not prepared for having their staff work from home. The situation has exposed them to a higher risk of fraud, as staff may not be protected by the same security and firewalls at home as they would be in the office. “I think it has facilitated an increase in phishing,” he says. Home working arrangements also mean internal audit teams have been split up, and it takes time for them to adjust to working collaboratively in different locations, meaning they may be slower and less efficient while they adapt, according to Guy Norman, Partner, Financial Advisory, at Deloitte China, an Institute member and Convenor of the ForensIG Management Committee.
Guy Norman, Partner, Financial Advisory, Deloitte China.
Keith Williamson, Managing Director at Alvarez & Marsal, an Institute member and ForensIG Management Committee member, points out that the financial pressure caused by the pandemic also increases the likelihood of both people and companies committing fraud. “Companies that are trying to stay alive and stave off their shareholders, and bankers and suppliers from calling in payments, may be adjusting their financial statements. Employees may be committing fraud because their personal circumstances are squeezed, and they are only earning a third of their previous pay or not getting bonuses. They may be trying to manipulate their expenses or commit procurement fraud,” he says. “There may be more bribery and corruption as well because, in a very competitive environment, companies are doing everything they can to survive.”
The virus itself has also created new opportunities for fraud. Peter Tisman, the Hong Kong Institute of CPAs’ Director of Advocacy and Practice Development, points out that the financial aid schemes set up by governments to support the corporate sector create opportunities for fraudulent applications to be made.
Janie Wong, Partner at Addleshaw Goddard (Hong Kong) LPP, adds that the need for personal protective equipment (PPE) has also led to fraudsters preying on fear to defraud people, particularly around PPE. “Business compromise email scams are not new, but they are being used in situations of crisis when people may be less vigilant,” she says.
Keith Williamson, Managing Director, Alvarez & Marsal.
Common frauds
One of the key types of fraud that accountants need to be on their guard against is financial statement fraud, particularly in terms of revenue recognition. Norman explains: “In a financial downturn, companies will often be trying to pull forward revenue to meet expectations for prior months. In businesses that may have long or complicated contracts, where it is difficult to determine where revenue should actually be recognized, I think revenue recognition fraud is highly likely to be happening during these times to make companies look better than they are.” He adds that as revenue recognition is one of the most complex areas of accounting, having industry expertise to understand the trends and policies of revenue recognition for other companies in the same sector is important.
“I think revenue recognition fraud is highly likely to be happening during these times to make companies look better than they are.”
Glanville says another area in which accountants need to be vigilant is undisclosed related-party transactions, with payment and ownership structures not always clear for companies in Hong Kong. “A lot of work goes into establishing whether, according to accounting standards, transactions are undertaken with related parties,” he says.
Tisman warns that an issue in Hong Kong is the temptation for companies to engage in insolvent trading. “At the moment it is very difficult to take action against people who continue trading when they know they can’t pay the bills. We as the Institute have been pushing for laws to be introduced against it, along with legislation to facilitate corporate rescue, for a long time,” he says.
Since the pandemic first hit, Wong has also observed an increase in money transfer frauds involving sums of around HK$100,000, which is just above the jurisdictional limit of the Small Claims Tribunal. She explains that in order for companies to try to recoup their money, they need a court judgment, and in Hong Kong an expedited procedure may not be available in fraud cases that are defended. But going to trial is expensive, and companies are unlikely to be able to recoup more than they will spend in legal costs. “It is very frustrating, but the current framework makes it difficult to help compensate victims,” she says.
Jack Jia, Partner, Forensic & Integrity Services, Ernst & Young Advisory Services Limited (EY), and a ForensIG Management Committee member, has seen a rise in cyberattacks with the size of these also increasing. “We are starting to see that the scale is so big, it makes a material impact on companies’ financial statements and the going concern of the company,” he says.
Janie Wong, Partner, Addleshaw Goddard.
Rising challenges
The pandemic has also created new challenges for forensic accountants tasked with detecting fraud. Jia points out that instead of getting original documents from companies, forensic accountants are now being sent scanned copies, making it harder to detect if something has been changed or a page has been substituted. “We had incidents during the peak of COVID-19, when the client only allowed one person from our team to visit their site and that person could only visit it once a week. In the past, we would have three or four people on site full time,” he says.
He adds that during the pandemic many companies have also been accepting scanned signatures on documents. “We spend a lot more time now examining the scanned copies and metadata to see if, potentially, the date and time of the scanned copies were manipulated and how electronic signatures were applied,” he says. “With the originals you can see the ink, but now you have to try to think of equivalent procedures for scanned copies because the client is telling you this is the most original form.”
Glanville agrees that not being able to have staff on the ground at companies during the pandemic has created challenges. He explains that if accountants are investigating suspected revenue recognition fraud, they would engage with a business intelligence team to establish, for example, whether sales of a particular product had really grown substantially. “We would speak to people on the ground and work out whether there was a steep ramp up in those products coming in and out of the warehouse. Having people on the ground is an important supplement to forensic accounting work. It was difficult to ask questions and verify things during the height of the lockdown.” He also points to the value of shortseller reports which, he says, often have a reasonable basis for their accusations. Jia adds that while physical assets can be traced and observed, the business models of companies operating in new and emerging areas, such as fintech and online sales, make investigations more challenging, with forensic accountants needing to work with technology professionals.
Another area in which lockdowns are likely to impact investigations is that employees working from home may be using social media and personal devices to communicate with their colleagues. “In an investigation scenario, how do you get control of personal devices that they have been using for corporate communications?” Wong says. Jia also points out that there is also ambiguity over whether corporate policies apply to personal devices. “Company policy is generally very clear if you are using company assets, whatever you put on them can be discoverable, but if you are buying devices yourself to work from home and the company reimburses you, is that considered corporate property or personal property?” Glanville adds that working from home also generates more data that will need to be gone through during an investigation.
Jack Jia, Partner, Forensic and Integrity Services, EY.
Preventing fraud
With fraud typically increasing during global downturns, it is important that organizations take steps to protect themselves. “Companies should maintain their levels of investment and attention to anti-fraud activity and anti-corruption, and not let their guard down, even if there is pressure on the top line and less revenue,” says Norman. Tisman stresses that risk management and internal control systems also need to be reviewed to ensure they remain up to date and can address any new or emerging risks, and boards need to take responsibility for oversight. During the global financial crisis, it became clear that many boards of financial institutions did not understand their companies’ business risks.
Norman says it is also important that employees feel able to call things out if they encounter something suspicious, such as through whistleblowing hotlines or complaints directed to people charged with governance, and companies should follow through with proper investigations and holding people accountable. He adds that accounting firms have an important role to play in helping to investigate issues internally. Jia agrees: “We definitely promote the integrity agenda, emphasizing trust, doing the right thing and what doing the right thing means, holding awareness training and speak out programmes, and having whistleblower protection.” One concern is that, while listed companies are encouraged to establish whistleblower policies, statutory protection for whistleblowers is limited in Hong Kong.
“The more eyes and checks and balances that there are, the less likely you are to have people colluding together to commit a fraud in the first place.”
Williamson points out that there are two sides to combatting fraud. The first is the behavioural side, which involves having a code of conduct and a strong culture of compliance. At the same time, he says companies need good internal controls with checks and balances in place to make it as difficult as possible to commit fraud. A key aspect of this is maintaining adequate separation of duties, for example, ensuring different people do procurement, invoicing and process payments. “The more eyes and checks and balances that there are, the less likely you are to have people colluding together to commit a fraud in the first place.”
Jia emphasizes the importance of also conducting third-party risk management, looking at whether your vendors and suppliers have the same level of integrity as you, particularly if third parties are holding your customers’ data.
Peter Tisman, Director of Advocacy and Practice Development, Hong Kong Institute of CPAs.
Unsurprisingly, accountants have a significant role to play in helping companies prevent fraud. “As forensic accountants, we advise companies on internal controls and procedures and test their controls and see if they actually work in reality,” Williamson says. “Internal accountants are often the gatekeepers in companies, making sure the controls are used correctly. They have a better understanding of why controls are used in the first place, and they can train others and explain to others why they are important and make sure they adhere to them.”
Tisman points out that not only does accountants’ training make them well-placed to help identify fraud, but accountants also have specific obligations under the provisions in the Code of Ethics for Professional Accountants on Responding to Non-Compliance with Laws and Regulations to report incidents of suspected fraud that they encounter, either within corporations for which they provide services, or in their own firms. “If accountants do turn a blind eye, they could face disciplinary action or, where money laundering is involved, even law enforcement action, themselves,” he says.
Norman suggests accountants and businesses should be more receptive to forensic investigations. “Clearly, if a business or individual hasn’t done anything wrong, they shouldn’t be scared. In most of the cases we go into, the companies are not very welcoming, but it is part of the process of the integrity agenda.”
To help members be on their guard against fraud, the Institute’s ForensIG Management Committee recently issued a new simple guide, Combatting Fraud, available on the Institute’s website. It covers a range of scams that both individuals and corporations may encounter, including fake Internet domain names and phishing scams, and impersonation and product fraud, as well as financial statement fraud, and offers advice on how to avoid falling prey to them. The Institute decided to issue the guide in anticipation of an increase in fraud due to the economic downturn and increase in people working from home.
“We have a lot of expertise on the ForensIG Management Committee and we are trying to raise awareness of the present circumstances in which it was noticed that individual companies and financial institutions were warning people about deception,” Tisman says. He adds that the guide essentially advises people to be more sceptical, and for companies to create more communication channels so that employees can reach out to the experts if they encounter something which they think may not be genuine. “It also encourages people to double-check if they are not sure about something, to go back to the reported source and check that it really is the source. If they are being asked to transfer money, they shouldn’t transfer it without checking with somebody.”
Glanville agrees: “It is about thinking before you act and spreading that message. If someone asks you to disclose some personal information in a telephone call, think before you do it. I say, ‘hurry up and slow down.’”
The Institute’s Forensics Interest Group holds technical seminars and discussion forums on forensics topics to allow participants to learn the latest developments in this area. More details can be found on the Institute’s website.
