5 Ways to Combat Hotel Fraud
Nearly $4,000,000,000,000 (trillion) dollars were lost from businesses around the world due to fraud in 2016. The typical organization loses 5 percent of revenue each year to fraud (see source*).
How much is 5 percent of your company's revenue? I bet it's not a small amount.
This article examines 5 ways to combat hotel fraud, and how you can get started with putting a fraud awareness program in place. The 5 ways include:
- Collaboration
- Communication
- Training
- "Tone at the top"
- Investigation protocols
The Tangible and Intangible Costs of Hotel Fraud
Fraud has both directly and indirectly measurable costs.
Theft of assets (tangible or intangible) and their associated costs of investigation can be reasonably determined. However, the collateral costs associated with fraud and abuse that are more difficult to assess are:
- Loss of business
- Reputational damage
- Eradication of employee morale and trust
#1 - Collaboration
Collaboration is working with others to do a task and achieve shared goals.
What better way to manage the risk of fraud than working together?
Everyone knows fraud is bad and everyone wants to help to minimize its adverse consequences.
The key here is to create an internal collaboration to avoid fraud in which open and honest dialogue is encouraged and welcomed. Fraud can no longer be the "dirty little secret" that no one talks about. Standing still and accepting the status quo is inviting potential abuse.
The "tone at the top" is discussed below, but it's important to note here that leadership must firmly and effectively support open dialogue. Talking about fraud in a proactive manner can be a substantial paradigm shift for some and make others uncomfortable, so leaders must model that collaborative behavior.
#2 - Communication
Corporate leaders understand that effective communication is one of the most important cornerstones of a successful business.
Research shows that a proactive approach to fraud awareness will not only minimize the loss of theft, both in dollars and opportunity, but also provide earlier detection.
I like comparing hotel fraud awareness and corporate ethical behavior to movie background music. I think we all agree that movies would probably be just okay without music, but music undoubtedly adds to the experience. An effective communication plan can be the ethical background music that employees stream.
The goal is to create effective messaging that is relevant, timely, practical and notable. Message frequency is sometimes art and sometimes science. The key is to not overexpose fraud awareness to such a level that employees tune it out. We don't want messaging to devolve to "junk mail" or TV commercial status!
Fraud protection starts with awareness, collaborate with your communications department, human resources and other disciplines that interact with employees on a regular basis.
Once the communication program is up and running, think about ways to measure its effectiveness. Determine if you can assess touch points such as clicks on emails, hits on the company's website, attendees at presentations and other KPIs that you feel are important. Then, identify ways to report results to leadership.
Having said that, there is no better way to communicate fraud awareness than in person. Connecting the message to the messenger is invaluable. Employees are very busy and, at times, at distant locations with limited real-time access to "corporate."
Communicating ethics and fraud awareness via impersonal methods such as email, slides, texts, etc., may diminish the desired impact and result in indifference. It's about trust and transparency.
Enable employees to recognize possible wrongdoing and make sure they understand how and where to report it. The means by which employees can report matters must be prominently communicated, advertised and distributed in posters, emails, newsletters, envelope stuffers, webinars or any other media that best gets the message out.
Be prepared to advise employees about matters that they may deem to be "too small." An effective reply is to advise employees that if they believe they have seen an impropriety, they should report it, even if it is simply to their superior.
An effective communications program will go a long way in establishing or enhancing an important cornerstone for a successful business.
#3 - Training
The importance of fraud training cannot be understated.
Employees are the best asset to combat the fight against fraud, and educated employees enhance the return.
We accountants are notorious for wanting more review, additional levels of approval and multiple signatures, yet such recommendations need to be balanced against head count, payroll costs and the like.
Just think of the positive impact your hotel will enjoy by having many more pairs of eyes supporting its need to minimize the business risk of fraud.
It's a win-win: additional control with little incremental cost.
This is not to suggest that training will arm employees to be fraud investigators, but it can enable them to identify a possible issue and then have the wherewithal to properly report it.
A word of caution: The training needs to make clear that should an employee witness a possible violation of law or policy, they cannot act on it other than to report it. Too often, I have been involved in investigations in which the proper reporting protocols were not followed, which led to evidence spoilage, interference and other complications.
No single training platform can apply to any one company. Designing an effective program must be the result of an exhaustive, collaborative process that considers management goals and objectives, culture (corporate and geographic), risk, vulnerabilities, cost benefit and so on.
The American Institute of CPAs (AICPA), the Institute of Internal Auditors (IIA) and the ACFE have developed a guidance paper called Managing the Business Risk of Fraud: A Practical Guide, which provides general recommendations around establishing an environment to effectively manage an organization's fraud risk. The guide has tools, outlines and other information for developing effective fraud risk mitigation processes.
When it comes to training, the adage "what gets written gets done" is spot-on. Fraud and ethics training should be included as part of overall corporate training and tailored to address roles and responsibilities. This achieves a couple of objectives: it advises employees about the investment the hotel is making into doing the right thing and it reinforces the "tone at the top."
A change in employee status should include training to reflect her or his new duties. Including fraud and ethics training as part of employee annual goal setting is another effective measure.
You should also require employees take a post-session quiz or questionnaire and achieve a "passing" score to measure desired comprehension.
Fraud/ethics training must be required for new hires.
Other elements of new-hire training should include code of conduct, policies and procedures, their role within the internal control framework, fraud prevention and detection, whistleblower policy, etc. Part B, Chapter 8 of the U.S. Sentencing Guidelines outlines prescriptive steps that an organization must consider to prevent and detect criminal conduct.
One such step is (in part): The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program by conducting effective training programs and otherwise disseminating information appropriate to such individuals respective roles and responsibilities.
Accordingly, in many corporations, an effective training program in not only a good idea, but required.
#4 - Tone at the Top
"Tone at the top" is an organization's general ethical climate as established by its board of
directors, audit committee and senior management.
Effective action by leaders will create the depth and breadth needed to enhance the quality and character of their words. Without such actions, the words will ring hollow, employees will lose faith in leadership and the corporate values could begin to fray.
Also, be sure to consider trust. If employees lose trust, they may turn a blind eye toward fraud.
Leadership must exhibit clear and unequivocal support through both words and actions. All of this presumes, however, that the right people are in place to set the tone and they display the proper attitudes for ethical behavior. If there is theft of assets by a manager, for example, even if it is just a minor case, this is setting a bad example to hotel employees.
The board of directors should ensure it is governing properly and the company's hiring, training, job descriptions and expectations for senior leadership are proper.
Logical and consistent discipline is important.
Extreme care must be exercised when considering whether or not to share the results of disciplinary actions. Please make sure all internal resources are consulted, including, but not limited to, legal and human resources.
Having said that, when an investigation is ongoing, employees know something is going on.
When employees see these kinds of actions taken by leadership, they see the "tone at the top" in action.
How many of us have heard a commentator say the following during a football game: "Did you hear the hit the linebacker put on the running back? He is sending a message and setting the tone for the rest of the game!" Wouldn't it be wonderful if employees hear the same "hit" (tone, quality and character of sound) from leadership and carry out that message?
#5 - Investigative Protocols
The common thread of the four elements above is that they are all proactive measures at combating hotel fraud, and the ways hotels can minimize the risk of fraud.
I like to compare these proactive measures to emergency evacuation plans we see posted near elevators. They generally say something to the effect of "In case of emergency, do not take the elevators and go to the nearest marked exit" along with a schematic with arrows to instruct where to go.
These measures should achieve the same; when an employee, customer, vendor identifies a possible violation, there should exist protocols that instruct what to do "in case of emergency."
Effective investigative protocols stress that the superior report it to his or her superior, so that it reaches the proper level of stakeholder involvement. This achieves many things:
- it creates a data point that can be captured and merged with other data to possibly identify previously unknown vulnerabilities
- it permits the properly trained resources to assess the seriousness of the matter
- it reinforces effective collaboration and communication and it supports the tone at the top
It is equally important that employees do not do their own fraud investigation. Leave it to the pros! After a matter has been reported and it is determined an investigation is needed, an investigative team should be created.
Some companies have standing committee and others are ad hoc.
The team members should be as independent as possible from the matter and be properly trained so that a prompt, competent and confidential investigation is performed.
Based on the complexity of the matter, consideration should be given to engage outside counsel and/or other third party resources.
The Internet is stocked with investigative programs that can address just about any kind of fraud, from cash theft of assets to books and records, corruption, bribery, etc.
Depending upon the age, formality, sophistication and resources of the investigative discipline, there will be varying levels of internal, historical information that can be leveraged as well.
Whether you are pulling something from the Internet, using prior work papers or some combination of both, it is important to take the time to modify the current program to reflect the uniqueness of the investigation. It also helps to have a plan in place for proper reporting protocols after fraud has occurred.
No two investigations are the same. Investigations are iterative: the more we learn, the more we do not know. It is vitally important to continually test and retest hypotheses and a well-documented work plan will greatly assist in that task.
In addition to work plans, it helps to create a timeline of events and persons linked to those events in a chart. Generally, I will include time on the Y-axis, the person on the X-axis and the event in the grid.
Filtering information is also important, because it comes fast and furious and in many different forms such as interviews, email reviews, internet searches, data analytics, etc. This information is captured in silos and filtering helps reorganize it in a different manner.
It is very important to "park" information so that it is readily available. Something originally deemed insignificant could possibly be an important fact later.
Mixing and matching information from the filter and timeline will uncover trends and relationships and provide an effective way to cross-reference investigative findings.
Report to the Nations Facts
- nearly 40 percent of frauds are identified from tips — and nearly 50 percent of those tips come from employees; 33 percent come from outside parties
- Median duration of a typical fraud - 16 months
- Most common schemes - asset misappropriation. Median loss $114,000
- Small businesses lose almost twice as much per scheme to fraud (consider some hotel internal control structures may reflect attributes found in small businesses -i.e. limited segregation of duties, etc.)
- Internal control weaknesses were responsible for nearly half of all frauds
- Fraudsters who had been with their company longer stole twice as much
- For fear of bad publicity, referral for prosecution has declined 16% over the last 10 years
- Internal audits are responsible for uncovering 15 percent of fraud, followed by management review (13 percent), accident (7 percent), account reconciliation (5 percent), document examination (4 percent), and external audit (4 percent). (It's interesting to note that the survey found it is nearly twice as likely for a company to identify fraud by accident than by external audit.)
Final Thoughts
Starting an effective fraud awareness program will take time and needs patience. The process will take twists and turns, and the approach will need adjustment and reassessment.
Your employees are your best resource to surface fraud. Having effective and proactive collaboration, communication, training and tone at the top will go a long way to minimize a hotel's risk of fraud. Effective investigative protocols help lash these four elements together.
It is not an overstatement that organizations prefer to avoid internal investigations. Investigations are a drain on resources, they disrupt business at hand, create commotion and disturbance in the workplace and so on.
However, investigations can and will happen, and having effective processes in place will help minimize their adverse consequences. As the ACFE report found, employees surface almost one-half of frauds; your employees are your biggest asset!
To avoid reactive measures to fraud, the proactive measures of collaboration, communication, training and tone at the top can go a long way to keeping your hotel's revenue in its own pocket.
"Reprinted with permission from the Virginia Society of CPAs."
