Get the facts on fraud prevention and detection

CLP: What about fortifying internal controls?

Clearly, internal controls need to be very strong. Fraud occurs through the “fraud triangle” – opportunity, pressure and rationalisation. An individual may be under financial pressure and if there's an opportunity to defraud and make money, he or she may consider it. The rationalisation comes in when he or she tells themselves the fraud isn't a big thing. The point of internal controls is to reduce the window of opportunity where fraud can be carried out.

A company should carry out a full risk assessment to determine where the risk areas are. It should investigate related party interests, how the various departments are doing business, through what intermediaries and middlemen. Internally, there are risks relating to how the business is managed: are employees properly trained? Are there a lot of new hires? New hires increase risk. It should look at operational risks as well, particularly in high-risk areas like procurement. Here, somebody senior should oversee the decision-making as to which suppliers to take on board and ensure proper due diligence is conducted before committing to a supplier.

CLP: How important is whistleblowing in fraud detection?

By far the most crucial fraud detection tool is whistleblowing. Based upon historical data, more than 40% of frauds are discovered from whistleblower tips, whereas only 5% is detected through external audits. Having procedures in place for anonymous whistleblowers to inform the company through appropriate channels is paramount. The company should implement follow-up procedures internally to investigate the veracity of any allegations because not all of them are true. Someone may have a grudge or competitors may make spurious allegations.

For example, if someone within the company receives a call or email from a whistleblower, his or her approach in dealing with the situation is very important. Sometimes it's too delicate a situation to immediately and directly confront the whistleblower. Companies are finding out now that often it's better to bring in an external party to follow up on the whistleblower as people are much more willing to talk to external consultants. They are likely to open up as they would have less concerns about their careers being affected.

CLP: How should a company react if fraud allegations arises?

Some of the Chinese companies that recently faced difficulties were not experienced in dealing with investor relations. Some of the allegations made against them had no substance and they suffered more than they had to because they didn't respond in the correct way.

Companies should be upfront, saying that allegations have been made, but that they are investigating internally and have brought in external specialists to review the situation. This demonstrates the company's willingness to explain the situation instead of leaving people to guess what may be happening.

CLP: Where does the burden of preventing and detecting fraud rest?

The responsibility for preventing and detecting fraud rests with the management of the company. This is made quite clear in auditing standards. Management is required to put procedures in place to detect fraud. The team on the ground can't just have policies in place, but must go a step further and make sure these are implemented and tested properly.

Ultimately, the onus falls on investors to make sure they're actually investing in what they think they're investing in. In the past, investors may have just taken a 'tick the box' approach and done the minimum needed to meet regulatory requirements without conducting in-depth investigative due diligence. But now, they are much more aware that their reputation is at risk if something goes wrong, so are more likely to go beyond desktop research. With new regulatory requirements and heightened scrutiny on backdoor listings, the Chinese authorities are closing a gap in the hope that companies will be much more responsible.

CLP: You mentioned the increased scrutiny on reverse mergers. From your perspective, is this still a recommended route for Chinese companies?

I think it can be more cost-effective, certainly, but what will happen is that there will be a greater emphasis by regulators on the advisers who are actually assisting those going through the backdoor listing process. These advisers are likely to be required to conduct in-depth reputation focused due diligence to make sure the company is a suitable applicant to be listed. There's obligations now on these intermediary advisers to make sure the owners of the company understand what their responsibilities are going forward, how the company should be run, what regulators expect, and what disclosures have to be made.