Guide to Preventing Workplace Fraud - Chubb Group of Insurance ...

Trusted employees are often allowed to bypass internal controls to “assist”
others. However, these trusted employees can take advantage of controls they
are routinely allowed to circumvent. Circumvention of existing internal
controls, even by exception, is a common theme in employee fraud.
Assessment of fraud risk needs to address not only the question of whether
internal controls have been properly developed and designed but also that
such controls have been effectively implemented and are consistently
applied. If exceptions to existing controls are allowed, alternate controls need
to exist.
Computer-Related Fraud
Computer-related crimes may be committed by persons with or without
authorized access, including user and/or physical access. Of particular
concern is the potential risk associated with disgruntled employees,
contractors, or other insiders who may have high-level computer system
access, authority, knowledge, and/or familiarity.
Computers can serve as the target of criminal activity, but more often they
serve as a “tool,” or the means, to accomplish a crime. Two basic examples:
■
Cash diversion—Computerized systems may be used to skim funds
from customer accounts or to embezzle company funds and to hide
that activity.
■
False documentation—Computers may be used to produce
fraudulent documentation.
Effective protection for computer systems includes formulating and
implementing a computer fraud risk management plan. Some components
to consider:
■
Identify internal and external risks to system security, data
confidentiality, and data integrity.
43