MGO CPA | Tax, Audit, and Consulting Services

Topic: Best Practices

CFOs and CISOs: Boost Your SEC Cybersecurity Compliance with These 5 Best Practices

Key Takeaways:

  • New SEC cybersecurity rules require public companies to disclose material cybersecurity incidents, risk management processes, and governance.
  • Determining “materiality” of cyber incidents for disclosure is challenging and requires close collaboration between CISOs providing technical context and CFOs/executives making final determinations.
  • To comply, companies should take steps such as designating accountable leadership, adding specialized cybersecurity knowledge, and updating financial processes.

~

For years, chief financial officers (CFOs) could afford to be removed from the daily cybersecurity efforts led by chief information security officers (CISOs). But, with new Securities and Exchange Commission (SEC) cybersecurity rules, those days are gone.

Adopted on July 26, 2023, the SEC’s “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure” rules recognize cyber incidents can significantly impact public companies’ operations, finances, and reputations. The requirements push companies to be more transparent and accountable about cybersecurity.

While compliance with these rules falls squarely on publicly traded organizations, the impact extends to private-owned companies as well. If your company is a vendor or partner to public firms, you can expect inquiries and audits to verify you meet their security standards. Liabilities and risks permeate the entire supply chain.

SEC Cybersecurity Disclosure Requirements

If you are a public company, what do you need to report under the new rules? Here are the main requirements:

Cybersecurity Incident Disclosure

  • Report within four business days of determining the incident is “material”
  • Describe the nature, scope, timing, and impacts (or potential impacts)
  • Note any undetermined details at time of filing
  • Compliance required for SEC registrants as of December 18, 2023; smaller reporting companies (SRCs) have until June 15, 2024, to comply

Annual Risk Management & Strategy Disclosure

  • Outline processes to identify, assess, and manage material cyber risks
  • Explain how these processes integrate with overall risk governance
  • Detail impacts from previous material incidents
  • Disclose use of third-party security consultants/auditors and procedures
  • Compliance required for all registrants (including SRCs) beginning with annual reports for fiscal years ending on or after December 15, 2023

Annual Governance Disclosure

  • Describe board oversight and committee responsibilities for cyber risk
  • Identify management roles accountable for cybersecurity programs
  • Specify escalation protocols to board/committees on cyber issues
  • Compliance required for all registrants for fiscal years ending on or after December 15, 2023

Determining Cybersecurity “Materiality”

A central tenet of the SEC guidelines is the “materiality” concept regarding incident reporting. Essentially, cybersecurity events are considered “material” and require disclosure if they could sway investment decisions or shareholder votes. Think of materiality as anything significant enough to concern your board and executive team.

The tricky part is that materiality determinations do not solely rest with technology and security leaders. Corporate officers and boards make the ultimate call, despite often lacking full context into security event ramifications on financials and operations. Bridging this disconnect through close CISO collaboration is critical to set appropriate disclosure thresholds aligned with your company’s true risk profile. Ideally, final decisions should also be independently verified by an outside, nonbiased service provider.

The SEC final rule also makes extensive (more than 40) references to “third party” impacts. A breach or attack affecting a key vendor could very well represent a material event for your organization that necessitates SEC disclosure. Do not let third-party cybersecurity shortcomings undermine compliance.

Best Practices to Comply with New SEC Cybersecurity Rules

While no one-size-fits all checklist exists, your company and relevant vendors should consider these best practices on the path to cybersecurity rule compliance:

1. Designate Accountable Leadership

Empower specific business leaders as security program owners, not just technical teams. These individuals need to establish clear reporting and communication between security operations and the board/c-suite. Executive working sessions focused on cybersecurity scenario planning are also advised.

2. Add Cybersecurity Knowledge

The rules do not explicitly require it, but it is wise to have dedicated cybersecurity oversight at the board level. Bringing in third-party advisors can help boards understand cyber responsibilities and implement improved processes. This knowledge is often lacking today despite its importance.

3. Update Financial Processes

The speedy 8-K cybersecurity incident reporting necessitates updates to disclosure management procedures. Public companies should already have 8-K drafting processes, so adjusting for cyber specifics presents a modest lift. The key is removing bottlenecks to rapidly describe incident details.

4. Dedicate Compliance Resources

CISOs in many companies oversee skeletal teams lacking the bandwidth for major initiatives like interpreting new regulations, implementing new disclosures processes, conducting risk assessments, and more. Ensure your team has the resources needed to achieve compliance.

5. Build Cybersecurity Culture

Equip your leadership team, board, and financial executives with a comprehensive understanding of cyber risks and disclosure nuances. Implement ongoing education and guidance programs to keep them well-versed in cybersecurity threats, response procedures, and the latest developments in the field.

How MGO Can Expedite Your Compliance Journey

The SEC cybersecurity rules are a wake-up call to take cyber preparedness as seriously as any other existential risk to your organization. Let our team of security, financial, and regulatory professionals guide you toward proactive, comprehensive compliance. Reach out today to discuss your roadmap.

How Pro Athletes Choose Winning Financial Teams

Key Takeaways:

  • Professional athletes need to assemble teams of qualified advisors to properly manage their complex financial affairs, just as successful CEOs build executive teams to run their companies.
  • The business manager or CFO plays the crucial role of quarterbacking the athlete’s daily financial operations — providing advice, serving as a gatekeeper, and coordinating the overall strategy with other advisors.
  • Carefully vetting and selecting a highly qualified, ethical business manager is essential, as many professional athletes have fallen victim to mismanaged finances.

~

As an athlete entering the draft, you are no longer just a player. You are now a professional, paid to play the game you love at the highest level. But along with the title “professional athlete” comes the weight of greater financial responsibility.

The financial profile of a professional athlete more closely resembles a mid-sized, private company than a typical household. While the economics can be exceptional, an alarming number of players lack the support structure necessary to navigate the depth and complexity of their financial requirements.

A professional athlete is the CEO of the brand that bears your name. To ensure the long-term value of that brand, you need to embrace this role and re-imagine your future beyond the playing field.

How to Assemble a Team to Support Your Athletic Career

Six-time NBA champion Michael Jordan once said, “Talent wins games, but teamwork and intelligence win championships.” This is just as true in the business world as it is in the world of professional sports. That’s why the world’s top CEOs make team-building their top priority. The way they approach that process serves as a valuable roadmap for both CEOs and athletes alike.

The Corporate Model

Most businesses share a common structural framework. While details may vary across different industries and global regions, the core elements of the Corporate Model (below) remain consistent. This framework identifies the primary business functions and areas of expertise critical to an organization’s success.

The Corporate Model has been successfully adapted to a wide variety of business categories, evolving as necessary to the unique needs of each organization’s operating environment.

The Hollywood Model

The film and television industry shares many traits with professional sports. The quality of the product is determined largely by the quality of talent in the spotlight — driving significant demand and high salaries for the best actors, directors, writers, etc.

Over the years, Hollywood leaders recognized that many of the same principles of growth and financial governance in the corporate world apply to talent in film and television. This led to the evolution of what we call the Hollywood Model (shown below).

This model identifies the importance of each individual role in the Corporate Model, albeit by different names. For example, the Chief Financial Officer (CFO) becomes the Business Manager, taking the lead on the client’s financial affairs.

The Sports Model

Over the past several decades, the financial lives of professional athletes have become increasingly complex. Salaries, endorsements, appearances, and other sources of income have grown significantly, and so have demands for athletes’ time and attention. However, the average player’s support system has failed to evolve at the same pace. The model below shows how the support team of a typical athlete compares to Corporate Model.

While professional athletes understand the importance of experience, expertise, and teamwork, they often lack a clearly defined model for building their teams off the field. The majority of highly publicized financial failures in professional sports stem from athletes who were either (a) missing key role players on their teams, or (b) trusting important roles to inexperienced or sometimes even unscrupulous acquaintances.

The MGO Model

At MGO, we have been fortunate to work with some of the most successful executives and entrepreneurs in the world — as well as many of the biggest names in sports and entertainment. As a result, we have come to know the traits and practices that drive success across industries.

The MGO Sports Model identifies and defines the roles critical to success — and aligns the work of leading advisors under a common vision. While each role is important, we encourage you to begin with the person who will serve as the quarterback of your daily financial life: your CFO/Business Manager.

Roles and Responsibilities of Your Business Manager

While each member of your team plays a vital role, the CFO/Business Manager is the person with the most tangible daily impact on your financial life. 

Here are four ways your CFO/Business Manager contributes to your team: 

  1. Quarterback – Your business manager leads your financial operation, responsible for hands-on, real-time execution of the financial plan. This includes establishing budgets, paying bills, and monitoring the expenditures of anyone with access to your accounts or credit cards. 
  1. Advisor – Business managers serve as on-call financial advisors, working closely with you on your most important financial decisions — including family estates and trusts, marketing and name, image, likeness (NIL) deals, tax planning (including international tax), major purchases, potential investments, and charitable contributions. 
  1. Gatekeeper – High-profile athletes can be targets of investment scams and unwarranted requests for financial support. When these propositions come from friends, family, and former acquaintances, your business manager can serve an important gatekeeper function. By establishing a recognized first point of contact for all financial requests, most questionable requests can be filtered out before they reach you. 
  1. Strategist – Your business manager works closely with your entire roundtable of advisors, ensuring that everyone is aligned and working together to implement a common strategy. 

Selecting a Trusted Business Manager

Despite the critical role played by CFOs/Business Managers in the financial lives of their clients, most states require no credentials to use the title. As a result, there are people with little or no accounting experience using that title today.

Many of the highly publicized financial challenges in sports and entertainment have stemmed from unqualified and/or unethical advisors serving in the role of business manager for high-profile clients. That’s why we suggest doing your own due diligence before hiring the quarterback of your financial team.

Things to consider when selecting a CFO/Business Manager:

  • Is the business manager a licensed CPA (certified public accountant)?
  • Is the business manager’s firm a licensed CPA firm?
  • What systems and certifications do they have in place to safeguard your money and data privacy?
  • What services will the CFO/Business Manager provide? For example…
    • Financial Planning
    • Bill Pay and Cash Management
    • Tracking Income/Receivables
    • Negotiating/Overseeing Major Purchases
    • Overseeing Insurance/Risk Management
    • Tax Consulting/Preparation
  • What types of reports will you receive? (ask to see samples)
  • How is bill pay managed? How are payment authorizations handled?
  • Do they have a dedicated staff? Do they have experience with similar clients?

Need Help Navigating the Complexities of Your Financial Journey?

MGO’s dedicated Entertainment, Sports, and Media team understands the unique challenges athletes face and provides tailored solutions that align with your goals. Reach out to us today to learn how we can help you achieve financial success beyond the field.

Five Ways Middle Market Manufacturers Can Improve Performance and Profitability

A large majority of manufacturers in the United States are considered small, whether a lower middle-market firm or a true small business. According to the U.S. Census Bureau, in 2015, there were 251,774 firms in the manufacturing sector, with roughly 74% of the firms having 20 or less employees and 98.5% of the firms having less than 500 employees.

Having worked with a significant number of manufacturing, consumer and industrial products and food processing clients over the years, particularly in the middle-market arena, I have identified five key areas that can be better managed and improved to increase business performance and profitability. Participants in the lower middle-market, and larger small businesses, typically reach a threshold where many of these issues, if not properly managed, can significantly reduce profitability and performance.

Additionally, when revenue is increasing, management is less cost sensitive. Further when growth occurs at a fast rate over a short period, inefficiencies can develop and margins can sometimes drop. Following these guidelines can help middle market manufacturers capture more profits and continue sustainable growth.

1. Capturing and tracking all inventory costs at the point of conversion

Inventory in a manufacturing and food processing environment is more than just material costs, it also consists of labor, overhead costs, and storage in many cases. Accurately and effectively capturing all these costs and assigning them to the proper job or product is imperative if an organization wants to accurately account for their inventory assets and cost of goods sold. Properly collecting these costs requires effective processes and a system of internal controls. Correcting this deficiency will improve reporting and lead to better pricing decisions and reduce significant inventory adjustments that affect your cost of goods sold at the end of the fiscal year.

For example, not too long ago I worked with a lighting manufacturer who built specialty, custom lighting products for commercial applications. They lacked formally defined processes for requisitioning parts inventory when building and assembling their finished lighting products. Additionally, they didn’t have a system to effectively capture the usage of the inventoried parts, so much of the usage didn’t make it to the specific job within the accounting system. This allowed for inaccurate part inventory amounts and values that resulted in significant cost of goods sold adjustments at year end. Further, the assembly labor costs were not accurately tracked to the job when the work was being performed. Effectively, jobs that required more labor than was estimated at the time of the Sales Order or quote, were not being tracked and assigned on a direct cost basis.

This may seem like an exaggerated case, but it highlights the importance for structuring and designing a system that captures and tracks labor and inventory usage at the point of conversion. Deficiencies in this area lead to poor pricing decisions, inaccurate inventory and period end adjustments that will routinely reduce financial statement performance.

2. Rework and warranty claims

This is an area that is normally overlooked when costs are not significant. However, rework and warranty claims can easily become significant in a short period of time if the manufacturing process does not have a well-managed and effective Quality Control process that identifies and remediates deficiencies with continuous feedback.

I worked with a technology accessory manufacturer that used a contract manufacturer in Asia to manufacturer their product. Product quality became an issue for the main customer, which was a well-known accessory brand and a recall was eventually required. This significantly impacted the company and their financial position to a point of near catastrophe.

Another example involved an apparel company. They didn’t have a defined process to account for returned and replaced garments Although this was not a major crisis, it did impact their inventory tracking and their financial performance. If management invests early in the product development and quality monitoring cycle, needless costs can be avoided and customer happiness will be increased. Two things all manufacturers can appreciate.

3. Inefficient and excessive use of energy

Energy usage and consumption can be a huge cost driver for many manufacturers. In fact, manufacturers consume more than 30 percent of the nation’s energy. U.S. industrial users consumed 26 quadrillion btu of energy in 2018 and that amount is expected to grow at 31% to 34 quadrillion btu by 2050.

For smaller, mid-market companies, energy management does not always get the attention it deserves. But management programs and improvements can produce real cost savings that can really improve profitability. Lighting, heating and cooling, proper insulation, machine idling, and leaky boiler pipes are just a few examples that can seriously contribute to energy waste, which impacts the bottom line of many businesses. Heating and cooling large facilities alone are a significant cost.

For example, converting from a 34 watt fluorescent tube to an equivalent 16 watt LED tube would save approximately $26 per bulb if operated 24/7 for one year. Take a space that has 200 bulbs and you have an annual savings of $2,600 is operated 12 hours a day or $5,200 if operated 24 hours a day. Grants in some states, such as Maryland are available to manufacturers to improve energy utilization. This is a win-win for manufacturers and the state, as most buyers avoid improvements due to the immediate cost outlay. Consider an energy audit and put a program in place to improve the use of energy consumption throughout your plant, warehouse or office facility.

4. Material waste and theft

It is still surprising to me when I do a walkthrough of a plant and a production line and see significant waste. Waste minimization is a mindset and needs a system of controls to reduce it and ultimately prevent it. In the food processing industry, this can be compounded as once material hits the floor, it cannot be reprocessed/reworked for human consumption. I take the view that anything less than 100% of the raw material converted to the finished product is less than optimal and a loss to the organization.

For example, I once visited a seafood processing plant that produced fish nuggets and patties for commercial and institutional consumption. The fish came into the plant in a partially processed frozen block form (already scaled and deboned). These fish blocks needed to be portioned and breaded. In processing the roughly 20 pound blocks into filets, strips or nuggets, the blocks were cut with a food grade band saw. This process produced a significant amount of “fish dust” or scrap product, just a cutting a piece of wood would produces saw dust. The amount of “fish dust” was at times in excess of 8% of the weight of the fish block. This was astounding as the scrap that was produced had limited usage and value per pound. What was even more astounding was that one of the owners didn’t know how much scrap was being produced from each block.

In my mind, this was a lean Six Sigma project as the amount of waste was unacceptable and very costly. The bottom line is: know your yields and invest in limiting waste and safeguarding your raw material now to save money over the months and years ahead.

5. Ineffective financial reporting

A financial reporting function should provide your organization with accurate, timely and usable information for decision making, in addition to fulfilling compliance requirements. Information that is poorly collected and processed is not reliable, no matter how experienced your management team. Many small organizations don’t fully understand and quantify missed opportunity cost. Obviously, any new software implementation is a cash outlay, but the future savings should be quantified and measured though a net present value calculation.

The old adage “time is money” is certainly true here. An effective financial reporting system, which includes a properly implemented software product, trained users and a system of controls can provide significant value. Not only can your historical performance be measured, your organization can track and improve margins and yields when the manufacturing data is produced in a timely fashion and accurately collected. Not having an effective financial reporting function can be a road block or hurdle for bank and investor financing. If the organization does not have a perpetual inventory system, doesn’t know its gross margin by product/sku, or doesn’t have the ability to allocate and separate costs per products effectively, then improvement and remediation is needed.

If your net present value is positive, then spend the time and invest the money today to properly implement a financial reporting system that addresses your specific needs and can collect information at all the important control points. Don’t let GIGO (garbage in, garbage out) be your financial reporting function’s motto!

Addressing one or more of these areas can have a dramatic impact on your manufacturing firm’s profitability. In many cases, your organization can begin with a relatively simple assessment by an outside professional or internal resource. However, make sure to get the right professional with expertise in that area to assist your organization so you can make the most of the effort and maximize your cost savings or value add.

Cybersecurity Culture: Empowering Your Employees

by Joshua Silberman, IT / Cyber Security Consultant, MGO Technology Group

Are your employees comfortable telling leadership about a potential problem at your company? Now ask yourself, are they comfortable telling leadership about a potential mistake? A large number of today’s cyberbreaches often begin as the result of an innocent mistake by an employee. It might be sharing a password over an unprotected median, a nefarious actor grabbing a picture of an employee’s laptop screen while they are working in public, or as is most common, an employee clicks on an innocuous link from a phishing email. What most employers may not realize is that many employee’s common sense regarding breaches is actually pretty good. At the very least they will suspect that something is amiss, which could be the first step in detecting a potential breach. Empowering your employees to actively look for, and report on, potential breaches goes a long way to helping your organization build a strong cyber security culture.

Creating a positive cyber security culture

The first step is to educate your employees on what to look out for when it comes to cyber and information risk. Many firms employ some form of basic cyber-security training, mostly at the time of on-boarding, but training usually ends there. Cyber security is an ever-shifting landscape where threats are always evolving. This is why it is important for firms to enact a year-round cyber security awareness program based around employee activities. A good employee-based cyber security awareness program will be light on technical jargon and focused on highlighting the vulnerabilities of the processes and systems that all employees use in their day-to-day work, such as instant messaging, answering e-mails, browsing the web, and sending documents through authorized and unauthorized means of file sharing. There is no great need to get into the technical details of how an attack might happen, but rather acknowledge that the danger is out there and focus on what employees can do to look out for potential dangers, such as noticing strange URL’s and suspicious e-mail attachments from unrecognized users. Consistently educating employees on current cyber threats and methods will give them the tools to identify a threat and be proactive in helping your company stop it.

Encouraging active breach and threat reporting

Training employees to spot the dangers is only half the battle. The other half is generating an effective reporting culture. No cyber security strategy is complete without a good cyber security reporting culture that puts a premium on reporting potential breaches. Here are a few suggestions to create a positive culture of reporting:

Have the team that provides your first level IT Support lead awareness/education sessions, as they will mostly likely also be the first point of contact for reporting potential breaches. The sessions can be developed by an outside consultant or an internal cyber security professional, but building a repertoire between those who should be reporting the incident and that first point of contact provides a sense of comfort that your employees are reporting the issue to the right group in the correct way.

In training, the IT support staff should make clear that reporting a threat is NOT a burden and that employees should err on the side of caution. If an employee receives an e-mail they find suspect they should not hesitate to contact their IT department through the designated reporting means.

Everyone from the organization must know and believe that the consequences of reporting a potential mistake will not be dire. Beyond feeling comfortable reporting suspicious activities, employees must also feel comfortable in reporting suspicious behavior that might be a direct result of their own actions. If an employee feels that admitting a mistake will be detrimental to their career they will keep quiet and a potential breach oversight could occur. Admittedly, this strategy carries some risk as you do not want certain behaviors to be consequence-free. However, the scope of consequence must be weighed against the actual action.

For example, an employee need not be officially reprimanded for admitting to clicking on a suspicious link and reporting it, but it would be prudent for the IT support staff to point out what could have been done differently to avoid the infraction. If the employee becomes a repeat offender, then a more official process might be warranted. Until then, simply pointing out of the issue should be enough to change behavior while maintaining a culture where employees are not fearful of bringing an issue forward.

Strong and proactive cyber security culture starts at the top

When setting the company’s cyber security policy, upper management must keep an eye toward baseline employees who perform the day-to-day actions of the company. Clear signals about saying something if you think something is wrong can go a long way toward changing your company culture. Having a strong IT or Cyber Security group is simply not enough when your own staff could unknowingly be your cyber Achilles Heel. There is a saying in cyber security that “every employee is a potential vulnerability.” However, if trained and leveraged correctly, your employees can also act as another safeguard, actively working to protect your information technology environment.

If you have any questions or would like support developing and implementing an effective cyber security program, reach out to the MGO Technology Group for a consultation.

The Real Oversight is NOT Having an Audit Committee

By Jim Godsey, CPA, CGMA, Partner, MGO

Everything changes, except when it doesn’t

Time and time again we’ve seen reactions to various accounting scandals, after which new policies, procedures, and legislation are created and implemented. An example of this is the Sarbanes-Oxley Act (SOX) of 2002, which was a direct result of the accounting scandals at Enron, WorldCom, Global Crossing, Tyco, and Arthur Andersen.

SOX was established to provide additional auditing and financial regulations for publicly held companies to address the failures in corporate governance. Primarily it sets forth a requirement that the governing board, through the use of an audit committee, fulfill its corporate governance and oversight responsibilities for financial reporting by implementing a system that includes internal controls, risk management, and internal and external audit functions.

Governments experience challenges and oversight responsibility similar to those encountered by corporate America. Governance risks can be mitigated by applying the provisions of SOX to the public sector.

Some states and local governments have adopted similar requirements to SOX but, unfortunately, in many cases only after cataclysmic events have already taken place. In California, we only need to look back at the bankruptcy of Orange County and the securities fraud investigation surrounding the City of San Diego as examples of audit committees that were established in response to a breakdown in governance.

Taking your audit committee on the right mission

Governments typically establish audit committees for a number of reasons, which include addressing the risk of fraud, improving audit capabilities, strengthening internal controls, and using it as a tool that increases accountability and transparency. As a result, the mission of the audit committee often includes responsibility for:

  • Oversight of the external audit.
  • Oversight of the internal audit function.
  • Oversight for internal controls and risk management.

Chart(er) your course

Most successful audit committees are created by a formal mandate by the governing board and, in some cases, a voter-approved charter. Mandates establish the mission of the committee and define the responsibilities and activities that the audit committee is expected to accomplish. A wide variety of items can be included in the mandate.

Creating the governing board’s resolution is the first step on the road to your audit committee’s success.

Follow the leader(ship)

In practice we see a combination of these attributes, ranging from the full board acting as the audit committee, committees with one or more independent outsiders appointed by the board, and/or members from management and combinations of all of the above. While there are advantages and disadvantages for all of these approaches, each government needs to evaluate how to work within their own governance structure to best arrive at the most workable solution.

Strike the right balance between cost and risk

The overriding responsibility of the audit committee is to perform its oversight responsibilities related to the significant risks associated with the financial reporting and operational results of the government. This is followed closely by the need to work with management, internal auditors and the external auditors in identifying and implementing the appropriate internal controls that will reduce those risks to an acceptable level. While the cost of establishing and enforcing a level of zero risk tolerance is cost prohibitive, the audit committee should be looking for the proper balance of cost and a reduced level of risk.

Engage your audit committee with regular meetings

Depending on the complexity and activity levels of the government, the audit committee should meet at least three times a year. In larger governments, with robust systems and reporting, it’s a good practice to call for monthly meetings with the ability to add special purpose meetings as needed. These meetings should address the following:

External Auditors

  • Confirmation of the annual financial statement and compliance audit, including scope and timing.
  • Ad hoc reporting on issues where potential fraud or abuse have been identified.
  • Receipt and review of the final financial statements and auditor’s reports
  • Opinion on the financial statements and compliance audit;
  • Internal controls over financial reporting and grants; and
  • Violations of laws and regulations.

Internal Auditors

  • Review of updated risk assessments over identified areas of risk.
  • Review of annual audit plan, including status of the prior year’s efforts.
  • Status reports of ongoing and completed audits.
  • Reporting of the status of corrective action plans, including conditions noted, management’s response, steps taken to correct the conditions, expected time-line for full implementation of the corrective action and planned timing to verify the corrective action plan has been implemented.

Establish resources that are at the ready

Audit committees should be given the resources and authority to acquire additional expertise as and when required. These resources may include, but are not limited to, technical experts in accounting, auditing, operations, debt offerings, securities lending, cybersecurity, and legal services.

Taking extra steps now will save time later

While no system can guarantee breakdowns will not occur, a properly established audit committee will demonstrate for both elected officials and executive management that on behalf of their constituents they have taken the proper steps to reduce these risks to an acceptable tolerance level. History has shown over and over again that breakdowns in governance lead to fraud, waste and abuse. Don’t be deluded into thinking that it will never happen to your organization. Make sure it doesn’t happen on your watch.

Strategies for Mitigating Municipal Employee Fraud

The second article in a series for municipal executives: Avoiding the Headlines

By Scott P. Johnson, CPA, CGMA
Partner, State & Local Government, Advisory Services

As a public official for more than 24 years, I continuously strived to implement best practices, internal controls and policies and procedures to mitigate fraud, waste and abuse. Being a municipal finance officer responsible for literally billions of dollars, there were times when I would wake up in the middle of the night thinking about what could happen or what I may not know that could be occurring that could put the organization at risk. Fortunately throughout my municipal career the organizations I served did not experience headlines due to significant fraud. We had the appropriate “tone at the top” and practiced effective measures throughout the organization to mitigate potential fraud. However, from time-to-time, we would uncover the occasional lapse of an employee’s good judgement and detect inappropriate use of government funds, such as; improper procurement credit card use for personal purposes, time cards reporting that fraudulently claimed hours worked in excess of actual hours worked, and fictitious reimbursement claims for travel.

Employee fraud is a significant problem across industries and is faced by organizations of all types, sizes, locations, and industries. While employee fraud in private organizations rarely merits a mention in the local paper, the same fraud in a government agency will have editors competing to write the splashiest headlines and garner the highest reader traffic. It is critical for such organizations to maintain a positive reputation. Reputational risk can carry long-lasting damage in monetary losses, regulatory issues, and overall risk exposure. Frankly, all types of fraud are on the rise, and municipalities need an effective fraud mitigation strategy in place to protect against reputational and monetary harm.

Just a few recent examples of municipal fraud that have had significant press coverage and put the respective organizations in a challenging position: In 2014 officials in St. Louis County, IL, uncovered a $3.4 million embezzlement that escaped detection for more than six years. According to officials, a County Health Agency Division Manager overcharged for IT computer and technical services (unbeknownst to the County, the Division Manager owned the technology company). Unfortunately, the day after the suspected embezzlement was detected by County officials, the employee committed suicide, according to the County Medical Examiner.

The largest known municipal fraud in US history was uncovered in 2012 at the City of Dixon, IL. This embezzlement scheme of almost $54 million over a 22 year period was perpetrated by its Comptroller, Rita Crundwell, who used the proceeds to finance her quarter horse ranch business and lavish lifestyle. She was convicted and pleaded guilty to the crimes and is currently serving a 20 year sentence. Another recent case of an alleged fraud allegation is currently under trial in the Los Angeles Superior Court in which ex-Pasadena city employee, Danny Wooten and co-defendants are due back in court for arraignment on April 1, 2016, according to the Los Angeles County District Attorney’s Office. The criminal case involves allegations that more than $6 million in city money was embezzled over a decade in which Wooten is suspected of creating false invoices for the underground utility program between 2004 and March 2014.

Many factors can contribute to fraud, but the key factors are the improper segregation of duties, lack of management review, maintaining undocumented procedures, common exception processing, trust without verification and validation, and lack of accountability and monitoring. Employing proper risk assessments of events that could prevent, delay, or increase the costs of achieving organizational objectives and implementing a risk management plan not only ensure compliance, but strategically safeguard on organization against fraud. There are three important steps to earning a good night’s sleep.

1. Fraud Risk Assessment – understanding the organization as a whole and individual business units will lead to the most comprehensive risk management plan. Understand how resources flow as well as internal environments and processes. Conduct interviews, make observations and review all factors. Identify the possible and probable fraud schemes for all resource flows.

2. Prevention – “Tone at the Top” is critical. Inspiring employees to follow ethical standards starts with the tone at the executive level and must trickle down through the management level and ultimately throughout the entire organization. The organization needs to know that unethical practices will not be tolerated and when detected, will be dealt with in a timely and effective manner. One measure to communicate the “tone” is writing a fraud policy in concert with the employee conduct handbook will ensure the message is designed into the orientation, onboarding, and training process. Conduct management reviews, provide whistleblower channels, and communicate often with key business unit leaders, who in turn should communicate with their staff regarding fraud prevention, detection, and correction.

3. Detection – while assessment and prevention will create a strong defense against fraud, it is still important to seek out other measures to detect fraud that may not have been included in the fraud risk assessment plan. Only three percent (3%) of all fraud is discovered by accident or the good luck of the right person in the right place. Only six percent (6%) of fraud is discovered through account reconciliation. Clearly we cannot simply rely on these detection methods. In addition to account reconciliation and keeping your ears open, creating channels for detection are of the utmost importance. Eleven percent (11%) of fraud discoveries are due to an internal audit. Return to step one by assessing and re-assessing fraud risk regularly. Conduct meaningful management reviews on-time. Twelve percent (12%) of fraud detection were the result of properly conducted management reviews. Finally, be sure to enforce an open door policy and a culture of interest in detection and reporting. Fifty-four percent (54%) of all fraud detection comes through insider tips. Ensuring there are proper procedures in place to accept these tips is paramount when designing and especially, implementing the fraud management and detection plan.

Deceitful misconduct among employees significantly damages reputations, negatively affects resources, and limits the ability of any organization to effectively serve the consumer and their community. Following this roadmap on how to respond to and prevent employee fraud will not only protect the organization and its key objectives but will lead to an easier night’s sleep – even in the face of increasing fraud across all industries.

This article is only a small representation of the material presented during MGO’s “Case in Point” presentation at the 2016 CSMFO Conference. Special recognition to Ruthe Holden, Internal Audit Manager at the City of Pasadena for her contribution to the “Case in Point” presentation. Contact Scott Johnson at [email protected] if you have any questions or comments. Comments and opinions expressed in this article are those of the authors and may not reflect the positions, opinions, or beliefs of the CSFMO or MGO and should not be construed or interpreted as such.