Myth: Audits Uncover Fraud

While independent audits serve an important purpose and may prevent potential fraud, audits rarely detect fraud. Even when an organization conducts an independent audit or review of its financial statements, the auditors do not guarantee that the organization is free from fraud. Independent audits only provide reasonable assurances that the financial statements are free of misrepresentations. To detect fraud, one would have to recognize the deception or misstatement of truth in the nonprofit’s financial statements. Because the auditor has to rely on the nonprofit’s representations about its own financial position, it is actually quite difficult for the independent auditor to detect fraud while conducting an audit. Instead, when you consider ways to reduce the risk of fraud at your nonprofit, think about governance, as explained in this article: Nonprofit Fraud: It's a People Problem so Combat it with Governance (Nonprofit Quarterly)

Did you know?

Audits are not the most effective way to uncover fraud: most frauds are discovered as a result of a tip, according to the Association of Certified Fraud Examiners’ (ACFE). Smaller organizations tend to experience disproportionately higher losses; but overall the majority of organizations studied each year use audits as ONE of several anti-fraud controls. ACFE recommends educating employees to detect fraud as key to preventing and detecting workplace fraud. A strategy to raise awareness about fraud at the workplace is to invite the nonprofit's Directors and Officers liability insurance carrier, bank, or even local law enforcement, to make a presentation at a staff or board meeting to raise awareness about ways fraud is often carried out. Don't forget to let your board members know what the nonprofit is doing to avoid and detect fraud. Consider the following steps that can help raise awareness about fraud among staff and board:

1. Strive to foster a culture that encourages employees to speak openly, without fear of retaliation. Having a ethics hotline increases your chances of discovering a fraud through a tip, and may reduce the ultimate exposure: Organizations with hotlines detected fraud 50% faster than those without hotlines.
2. Adopt a whistleblower policy, and make sure employees and board members are aware of it.
3. Clarify how and to whom employees should raise concerns about financial mismanagement (or other improper conduct). This should be spelled out in the employee manual (along with a copy of the whistleblower policy) and during board orientation. Many organizations designate the Chair of the audit committee as the nonprofit's "ombudsperson" for purposes of receiving and investigating complaints.
4. Senior management can create opportunities for employees to discuss or role-play decision-making arising from hypothetical fraudulent transactions.
5. Help board members and employees become more aware of what types of actions constitute fraud, and demonstrate the cost of fraud to the charitable nonprofit: lost revenues, negative publicity, job loss, and a decrease in productivity and morale.
6. Communicate a zero tolerance policy for fraud. Ask employees to sign a written Code of Conduct that outlines expectations and specifies that the consequence of engaging in fraudulent behavior is termination of employment.
7. Identify the role of board members for responding to or investigating allegations of fraud.
8. Decide in advance that the nonprofit will pursue criminal charges against an employee who engages in fraud. (Check with the nonprofit's insurance professionals because often insurance coverage is dependent upon the nonprofit involving law enforcement in prosecuting criminal behavior.)

The role of internal controls

While an independent audit may not uncover fraud, strong internal controls can help reduce the risk of theft, fraud, and embezzlement. Internal controls sound daunting, but there are numerous very practical steps every nonprofit can take (even those with very few staff members) to put up barriers to theft and embezzlement in the nonprofit workplace. When auditors conduct an independent audit one of their "tests" is usually to determine the strength of a nonprofit's internal control, i.e., are policies in place, followed, and followed consistently? See our page on  internal controls for more information and resources.

Additional Resources

• Are auditors responsible for detecting fraud? (CLA)
• I have a complaint (Nonprofit Risk Management Center)