The latest insights on fraud from the ACFE
The Association of Certified Fraud Examiners (ACFE) has been sharing the results of its annual survey of fraud practitioners (its members) for many years.
It has now released the 12th edition, Occupational Fraud and Abuse 2022: A Report to the Nations.
As usual, it contains a wealth of useful information.
But it has to be put into context.
How significant is fraud risk?
The ACFE says that CFEs estimate that “organizations lose 5% of revenue to fraud every year”.
Is that credible?
Actually, it is not totally beyond the realms of the possible – although it seems high to me! In the convenience store business, we were willing to accept up to 3% of revenue in store thefts because the cost of bringing it down would be greater than the reduction in losses; but for the business as a whole, including its gas station and oil refining sides, the total losses from fraud were far less. In the technology companies where I was CAE, fraud existed (mostly revenue fraud) but was, again, far less than 3%.
Testing this further…
If we take the ACFE survey results for the Energy Industry, 97 cases were reported with a median loss of $100,000. The median across all industries was $117,000 and the average loss was $1,783,000. If we assume the same ratio between the median and the average applies to Energy, that means that the average loss per case was $147,821,368.
I am going to make the reasonable assumption that each ACFE member reported the more significant case at their company. Another assumption: total losses for each company were about $300,000.
If that represents 5% of revenue, then the average company’s revenue was about $6 billion.
But the energy sector has 105 companies (globally) with more revenue than that, including 3 with revenues greater than $400 billion, and another 12 with revenue greater than $100 billion.
I haven’t been able to find a source for the average company revenue in the sector, but I think it has to be much much more than $6 billion.
I believe 5% is high and the real number (based on my experience) is less than half of that.
What does this mean for the practitioner?
5% (or 2.5%) of revenue is a lot.
But does it represent a critical source of risk?
How worried should we be if the potential for loss from a fraud is $150,000?
How much would it cost to prevent such a loss?
I am pleased that fraud doesn’t often appear in lists of top risks. It shouldn’t.
That’s not to say it should be ignored.
But at the same time, practitioners should make sure that the level of resources they allocate to addressing fraud risk is appropriate to the level of risk.
Does your company have a stated level of tolerance for fraud, as we did on the convenience store business?
What do you think losses from fraud at your company were as a percentage of revenue?
Are practitioners doing too much or too little?
I will let you read and absorb the report as it contains a lot of information, very well presented.
I welcome your thoughts.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
I believe the measure of fraud per this ACFE report is not reliable. If you look at how the data is requested from survey respondents, it is clear it cannot be used to derive fraud loss as a percent of revenue.
I find the report as nice anecdotal information, but not data from which to draw firm conclusions.
Great questions. Upon reflection, this really feels like a potential “apples” and “oranges” discussion. In some industries, you can certainly set a tolerance for losses from employee theft. In others (e.g., banking) you really can’t. Often, the controls that prevent a $1MM loss will also prevent the $10 loss. But a different type of fraud, say, financial fraud – this feels like an entirely different thing. Not sure a tolerance idea would apply in terms of implementing control activities. Since the very nature of different types of fraud will vary greatly, I kind of feel that specifics (and not aggregated data) are more important in many cases.
According to the ACFE report, financial statements have the biggest impact but are far less common. Tolerance should be “less than a reasonable possibility of a material misstatement”.
5% is an average figure – some organisations will lose less and some more. I know of a case here in South Africa where the financial manager defrauded her employer of 8% of their annual revenues over a 3-year period. The losses started small and quickly grew over the 3 years. And take Rita Crudwell who stole for over 20 years from the City of Dixon. She also atarted small and ended up embezzling $5.8 million from a city with an annual budget of $9 million.
From 2012 to 2022, we have almost the same figure.
Around 40% of frauds discovered by tips.
And 15% by internal audit.
This status quo over 10 years is more than suspicious. You think ?
No company learns from fraud incidents they had ?
Nobody improve employee education or their internal controls ?
We know company had improved their whistleblower program over the last 10 years.
Without any IA and ML, I can predict figures for 2023. 🙂
Not suspicious at all – to answer your question “No company learns from fraud incidents they had ?” – no, most don’t and repeat the same frauds over and over again. What we have found is that a victim of fraud will most probably improve controls after the fraud – for a few months – and then they will relax and go back to cruise mode where they control by ‘trust’. I recently had a client who found a R500 000 fraud and we were supposed to do fraud awareness training for them across the group – I was informed “no budget this year, we’ll look at it next year”. How much more are they going to lose in the next 12 months? They have a few companies in the group and I’m sure similar frauds are being perpetrated at the some of the other companies.