Controlling preventable risks...

 

Organisational fraud is an increasingly significant economic problem in Australia. In a recent KPMG survey it was found that fifty-three per cent of all respondents had reported incidences of fraud in their organisations. Australian organisations need to be aware of and learn from previous incidences of fraud and the magnitude of fraud, and how they may be allowing their organisations to be at risk.

The fraud risk factors listed in the case are just a few of the characteristics you may come across in an organisation susceptible to fraud.  There are many factors not mentioned on this list however, including; 

• Low staff loyalty
• Lack of recognition
• Repressive or hostile work environment
• Unreasonable budget expectations
• Short-term focus of organisation
• Poor management
• Poor systems controls

Two factors listed in the case in particular which struck a note with me is the risk factors associated with an organisations perceptions of fraud risk and their ability to attract suitably qualified staff with affordable remuneration. In one of my previous workplaces little emphasis was placed on the importance of fraud and this was reflected in the organisations lack of provision for IT related costs.  For this reason IT staff were not provided with competitive remuneration making it near impossible to attract and keep qualified IT professionals on staff. For these reasons the organisation lacked suitable IT infrastructure which left them susceptible to fraud. 

One of the most important factors to consider within an organisation, where fraud is concerned, is the provision of an effective fraud control system.  This can be facilitated by ensuring there is a sufficient Corporate Governance framework and IT infrastructure in place.  It is integral that controls monitoring and evaluation processes are put in place to ensure the smooth running of systems and detection of fraud risk.  Prevention is also important and can be facilitated through regular fraud risk assessments, development of code of ethics and specific selection of staff. Most importantly however it is essential within an organisation to educate and increase the awareness of employees about fraud. 

Filtering out the bad bits..

On 15 December 2009 the Federal Government announced their intention to introduce mandatory filtering for Australian Internet Service Providers (ISPs) for certain types of content largely relating to Refused Classification (RC) material otherwise known as rated content.  At the end of 2012 however the Federal government did a back flip abandoning their controversial internet filtering plans.  The government instead has struck a deal with Australia’s ISPs to block approximately 1400 sites that are on an Interpol blacklist.

For more one this..

Australian ISPs should not be forced to filter internet content. The filtering of internet content by ISPs can be seen as threatening a citizen’s rights to freedom of information.  I do believe, however, that more needs to be done to protect Australians, specifically children, from certain restricted content available on the internet. 

There are many issues relating to the governments planned filtering and blocking of offensive websites.  One of these issues is the effect on law enforcement.  The blocking of these websites in effect blocks the efforts of law enforcement and lessens their ability to track offenders through techniques such as computer forensics.   ISP filtering also threatens free speech, and could potentially blacklist innocent sites as well as offensive sites. 

The blocking or filtering of certain websites also works to give parents a false sense of security.  The government simply can not guarantee that they can successfully block every offending website. As technology continues to advance it will be an uphill battle to try and keep up with the steadily increasing number of offensive sites in cyber space. 

                                                                                                                      

The planned filtering of ISPs or blocking of offensive websites alone is not enough to ensure the protection of vulnerable parties from certain content available on the internet.  It is important that further restriction and laws are put in place in hand with tougher sentencing for perpetrators to deter the sharing of RC material online. 

The hidden meaning..

A disclaimer is a legal statement intended to specify or delimit the scope of rights and obligations that may be exercised and enforced by parties in a legally recognized relationship.  Disclaimers are commonly used as a marketing technique in advertising as an easy way to make a concise statement without disclosing significant detail of a particular offering.  The use of disclaimers gives rise to a number of inherent risks for consumers where an organization’s use of a disclaimer is ineffective or fails to draw the attention of the consumer to the qualifying statement.  According to the ACCC disclaimers should:

• be bold, precise and compelling;
• be accurate, clear and in precise terms;
• not contradict the main message of the ad; and
• be introduced at the same time as the representations they qualify

One example of a past case where a disclaimer was deemed legally ineffective was in the case against Office Link (Aust) Pty Ltd, a mobile phone provider.  In this case the phone company was found to have used the disclaimer to limit transparency of additional costs and conditions associated with their product.  

For more on Office Link...

One example of a more recent disclaimer which has some similarities to the Office Link case is the Dodo Voip advertisement.  Whilst this ad makes reference to the additional costs involved in purchasing the product, and the term of the plan, the additional information in the disclaimer works to contradict the main message of the ad, that being that the phone and voicebox are free. The disclaimer is also in fine print which goes against the requirements of the ACCC that it should be bold and compelling.  The disclaimer in this case however is introduced at the same time as the advertisement and is clear and concise in its statement.  I believe, however, that the Dodo advertisement has vast similarities to the Office Link case and based on this precedent it may not be judged as a legally effective disclaimer.  

For more on Dodo...

Creations of the mind...

Intellectual property (IP) refers to the property of your mind or intellect for which exclusive rights are recognised.   Intellectual property law grants owners exclusive rights to a variety of intangible assets; these may include words, phrases, scents, inventions, designs, symbols etc.  There are seven types of Intellectual Property rights available, these include;

• Patents
• Trademarks
• Design
• Copyright
• Circuit layout rights
• Plant breeder’s rights
• Confidentiality/trade secrets

Intellectual property is a vital asset to organisations, especially in today’s knowledge economy where ideas equal revenue.  It is essential that organisations take measures to protect their intellectual property assets from competitors who may try to replicate their ideas.  There are a number of measures businesses can take to protect their IP, these include:

• Registration of intellectual property, in the form of patents or trademarks, to ensure the organisation maintains exclusive rights to the asset. 
• Keeping an organisations property within a restricted group of people
• Demonstration of ownership of IP, this can be aided by organisations taking simple steps such as documenting their product.

Today intellectual property rights can be bought, sold and licensed to third parties often causing confusion as to who actually has exclusive rights to certain assets. It is the organization’s job to monitor the market to ensure that their IP rights are not being infringed.  In these ever advancing technological times where organisations compete largely online it is important to be a step ahead and put in place strategies to deal with infringement of IP before it occurs.  

It is essential that organisations understand the ownership relationship as confusion can lead to loss of assets or infringement of laws put in place to protect these rights.  If organisations do not take steps to protect their IP they may risk losing this property to competitors who can then replicate their ideas in their own products.  This could result in significant revenue loss for organizations that do not protect their IP. 

Pirates ahoy...

The illegal downloading of music and films in Australia is an increasing phenomenon. As technology advances it is only becoming easier for the public to access free version of works in the public domain.  People in Australia should not be able to download music and films from the internet without paying for them.  The Copyright Act 1968 (Cth), introduced to balance the rights of the creator (copyright owner) with the needs and the rights of the public to use these works, is currently insufficient.   In Australia copyright is automatic; there is no registration process involved. 

The illegal downloading of music and films has various negative impacts for the creator, such as loss of revenue and loss of recognition.  Without the rewards provided from the sale of their works artists will not be able to afford to keep creating new work.  The larger scale impacts of illegal downloading threaten the very existence of Australia’s, already low budgeted creative enterprises, including our film, television and music industries.   The loss of precious revenue from illegal downloading impacts upon their capacity to continue providing work free-to-air and threatens their ability to compete on a global scale.   Illegal downloading also threatens the livelihood of ‘regular’ people with many retail and hospitality jobs lost due to the increasingly digitalized nature of the industry and subsequent disappearance of cinemas, and traditional DVD and music store fronts. 

Not enough is currently being done to protect the interests of the creator of works.  Research shows that the main driver of illegal downloading is the mistaken belief that content is free.  The first step in curbing illegal downloading is the education of the public through campaigns publicizing the effects of illegal downloading on the already suffering Australian creative industries.  More stringent copyright laws also need to be introduced in Australia with more severe penalties for infringements.  The introduction of more affordable download and pay schemes like Itunes is also required to encourage the Australian public to do the right thing. 

Contractual arrangements...

As of the 1^st January 2011, the Trade Practices Amendment (Australian Consumer Law) Act (No.1) 2010 introduced new laws dealing largely with unfair terms in consumer contracts.  This amendment provides additional protection to consumers, by giving courts the power to find that a term is unfair and as such void. 

In February 2009 social networking website Facebook made changes to their terms of use which went unnoticed until one user complained about them on a blog.  The change in terms gave Facebook perpetual and irrevocable ownership of user information.  It is difficult for me to comprehend how websites have gotten away with this for so long; this case is especially shocking as the website could have made economic gains from the sale or use of user’s private content in advertising.

More on Facebook change of terms and conditions...  

But just how much notice should websites be required to provide their users?  In the case of Joe Douglas vs. United States District Court (More here) it was held that simply posting a revised contract on a website suffices. Whilst it may not be practical to require a website operator with often thousands of users to personally alert each user to these changes it is important to consider the rights of both parties. The practicality issues faced by website operators can be balanced to also meet the needs of users through such requirements as a public notice on the home page of websites, or perhaps the sending out of a generic automated email advice to all users. 

Download that...

MegaUpload, a company incorporated in Hong Kong with operations all over the world, allowed the public to share illegal copies of films and music etc. US authorities have made a number of overseas arrests based on accusations of facilitating and profiting from copyright infringement under Californian/US law. 

The digital age allows businesses to trade globally at a rapid rate which generates a number of issues when applying traditional laws.  Traditionally jurisdiction laws have extended to activities that take place within a country; they have not encompassed illegal activities on foreign soil. The MegaUpload case has seen the United States moving to re-define the boundaries of state jurisdiction, where US laws apply simply because a transaction occurs on a server based in the United States. 

More about the Megaupload case..  

The outcomes of this case can only cause confusion and stress for businesses using these facilities.  The possible precedents set in the MegaUpload case are terrifying for major business and could have far reaching consequences for international users of US-based cloud computing services.  Businesses could stand to lose large amounts of company data inturn causing significant economic loss. 

Current laws need to catch up with the times in order to properly protect the data stored in these facilities.  A new approach to needs to be introduced which balances the needs of public demand as well as the interest of the owners of works.  Mechanisms should be put in place to monitor what users are sharing.  If this means a small flow on cost to users it is a small price to pay. 

Risky business...

In the case of Boutique Technology the following aspects, with relevance to COBIT 4.1, resulted in fraudulent behavior:

1. Poor governance over processes:

• Alan’s (CEO) complete disregard for policy and procedure - may filter down to staff and affect morale
• No formal procedures for recruitment – no contracts to state pay rates, start and end dates etc
• Only three staff looking after accounting, finance and human resource functions – lack of segregation of duties

2. Lack of IT architecture and controls –

• No direct supervisor for the software development team – leaves team fairly much to their own devices
• The company uses software created by the employees/software produced trialed internally – employees could manipulate the programs

3. Lack of monitoring and evaluation – No mention of monitoring of staff/processes or internal audit and definite lack of supervisory positions.   

This case reflects some issues relating to fraud present in a workplace I was involved in.  Lack of governance, specifically policy and procedure relating to payroll meant there was no approvals process, resulting in a lack of segregation of duties.   Employees therefore had unlimited access to the system and a number of ‘ghost’ employees were created resulting in money being siphoned from the organization. 

In smaller organizations there are limits on what processes can be utilized to overcome fraud.  It is not necessarily practical for organizations of this size to have IT architecture boards or internal audit committees.  I would recommend the following practical solutions to the CEO of Boutique Technology:

• Governance:
• Development of a clear business strategy
• Formal recruitment procedures and approval processes for accounting, finance and human resources functions. 
• IT:
• Align IT objectives with business strategy through the introduction of an IT governance framework
• Monitoring/Evaluation:
• Hire qualified IT executives and provide direct supervision for the software development team
• Monitoring processes and internal audit team to assess risk

No business too small....

WhizBiz Pty Ltd is a small online trading company, which currently lacks IT governance framework.  The Director believes based on the size of the company that COBIT 4.1 is irrelevant to the organization. 

COBIT 4.1, however, and other similar frameworks, are essential in an organization as they help to bridge the gaps between business risks, technical issues, control needs and performance measurement requirements through the implementation of a solid IT structure.  IT Governance assists an organization through the domains of: Planning & Organization, Acquisition & Implementation, Delivery & Support and Monitoring. 

 

 It confuses me how a company that trades online and utilizes considerable amounts of IT data can consider the need for a CIO irrelevant to their business.  Employing qualified staff is essential in achieving strategic objectives, especially where complex systems are involved.  Given the nature of the organization and their reliance on IT facilities it is essential that the organization has a CIO to oversee the IT function. 

COBIT 4.1 is meant simply as a starting point for organizations but may be manipulated to suit different business models.  Whilst such frameworks can be costly to put in place the benefits generally exceed the costs. It is essential that organizations put in place proper IT governance frameworks to support their businesses and provide security for their intellectual property.  Without such guidelines businesses risk the occurrence of fraudulent activities and the potential loss of valuable business information. 

WhizBiz should engage the services of consultants to put in place suitable IT guidelines based on COBIT 4.1 or similar framework. Whizbiz also need to employ suitable professionals whose expertise would help to support the proper functioning of the new IT guidelines. 

The secrets behind an effective Corporate Plan..

To have an effective Corporate Plan an organization relies on three key elements to assist in achieving its strategic objectives; the people, the IT system and finance. 

• People: It is integral that the people involved in an organization are educated in and support the Corporate Plan and the policies and procedures that underpin it.
• IT System: The implementation of IT objectives that are aligned with business strategy and facilitated by necessary controls is integral for the security of information
• Finance: It is important that organizations have the financing to put in place proper governance, controls and employ qualified workers to support the organization in achieving strategic objectives.    

One example of where all three of these key elements were not working effectively is the Queensland Health debacle. The IT systems failed firstly with the payroll system, which caused a general feeling of disillusionment amongst employees. Then based on already poor morale and lack of IT controls present the ‘Tahitian Prince’ took advantage and siphoned millions from the organization.  

For more on the Queensland Health Debacle

The overall cause, however, of these events was the organization’s lack of IT governance, such as the COBIT framework.  The implementation of such a framework is integral to the success of an organization.  Whilst COBIT may not be practical for every business, it is a starting point for organizations.