"You've just seen people who are 100 per cent trusted, just complete fraudsters.
"And I've been lied to, to my face by the nicest of people and found out they're completely untruthful.
"You then get a bit jaded about that."
If you think it couldn't happen to your business, think again. Matthew Hammond, senior manager, fraud investigation and dispute services at EY, says some organisations, particularly those handling a lot of cash, are more vulnerable to occupational fraud "but I've not come across an organisation that's been free of fraud completely".
For 18 years Hammond has investigated everything from petty pilfering to global insider trading rings.
Although he is called in to advise firms on strategies for preventing fraud, more often than not his first visit to a company is after a fraud has been uncovered.
"If they're not looking for fraud they're never going to find it and time and time again I hear from organisations 'we've never had a fraud'.
"Well that's not the case.
"What they actually mean is they've never detected fraud because they've never gone looking for it." Toresen agrees, saying fraud is always present in businesses and he's seen no change in more than two decades of fraud detection work.
"The things that we're dealing with today are the same things that we were dealing with 15 years ago.
"The methods haven't changed, the people that we're dealing with haven't changed, nothing has really changed.
"I think that fraud and workplace theft is just a constant.
"Pretty much every business has got a small core of people that are dishonest.
"Very small, but if you give them an opportunity they can rationalise, or they've got a bit of pressure they'll do something, says Toresen.
"I don't think it has skyrocketed over the last couple of years because of the financial crisis or anything, it's all pretty constant really and if you look overseas it's the same."
The pressure and rationalisation Toresen mentions comes from the idea of the "fraud triangle", a theory developed in the 1970s by US criminologist Donald Cressey to explain what causes people to commit occupational fraud.
The three sides of the triangle are opportunity, pressure and rationalisation.
Hammond says opportunity is easy for most businesses to tackle, usually by putting in systems that are nice and tight.
However, that raises a tension, he says, because you may design the perfect fraud-free system, but make it impossible for anyone to do any work.
Pressure is much harder to get a handle on, says Hammond, because it means knowing what is happening in other people's lives - bankruptcy, gambling, divorce, separation, death and grief.
"All these things come into play and change over the course of a person's life, so different pressures come into play at different times until they get to a tipping point where they are thinking about committing a fraud."
Rationalisation, says Hammond, is by far the hardest thing for organisations to deal with, because it takes soft skills to build the right organisational culture.
Hammond once dealt with a senior manager who lost his lease car when funding cuts hit the North London health trust where he worked.
In lieu of the car the aggrieved employee stole £30,000, almost to the penny, on the basis he was "owed" that much for his years of devotion to the health service.
When Hammond has been involved in prosecutions, he has had upset victims asking how someone could sleep at night knowing they'd done these "terrible things".
"They slept perfectly well because they were able to eliminate those feelings of guilt by rationalising," says Hammond.
International advisory firm BDO surveys the non-profit sector every two years about its experience of fraud.
Head of assurance services at BDO, Mark Bewley, says even though the survey's focus is on non-profits, the trends probably reflect what is happening in the business sector.
And with many international surveys light on coverage of New Zealand fraud data, the BDO report is the closest to a snapshot of occupational fraud trends here.
According to the survey, fraudsters are fairly evenly split between men and women, and the age of the fraudsters is creeping up.
The BDO survey found the typical fraudster is a paid employee in a non-accounting role over the age of 50.
Bewley says the increasing age of the average fraudster could be down to middle-aged people coming under financial stress at a time when career options are becoming more limited.
The survey pointed to a growth in financial pressure and the desire to maintain a lifestyle as a key motivator for fraud between 2010 and 2014.
But Hammond says, based on purely anecdotal evidence over the course of his career, there is no change in the volume of fraud over different economic cycles.
"The mechanism for fraud and the motivation for fraud change, but the level of fraud is broadly consistent."
Before the global financial crisis, everyone was "making a tonne of money" and controls became more relaxed, or there was a feeling compliance teams would get in the way of a business making money, he says.
The effect was to open up more avenues for the unscrupulous.
When the economy turned, the pressure came on employees to supplement an income they no longer had, or on executives and directors to inflate company performance and boost share prices, Hammond says.
Often the biggest frauds are perpetrated by men - the BDO survey of the non-profit sector found fraud by men was usually double the value of that committed by women - but Hammond says that is "putting the cart before the horse".
"It's the roles that people fill that determine how big the fraud is rather than a function of being in that role, so if you're the chief financial officer you can wreak far more havoc than someone sitting on a till in a bank, for example," he says.
And more often than not, those senior positions are held by men, skewing the gender statistics on the bigger frauds.
The news headlines always talk about the trusted employee who took their, often longstanding, employer for a ride. In turn, that employer is distressed to have been taken in so badly.
"You're never going to be defrauded by someone you don't trust," says Hammond.
"These are people who are trusted and usually liked within an organisation."
They are, says Toresen, the people you'd least suspect; diligent, hardworking and helpful.
These supposedly "amazing employees" need to be in at work to keep a lid on their fraud, he says.
Hammond also suggests keeping an eye out for a bully within an organisation; someone who is controlling the flow of information and stopping reports or suspicions being passed on.
BDO found that in organisations it surveyed which had been hit by a fraud, the fraudster had been stealing for an average of 14 months.
The American-based Association of Certified Fraud Examiners put that figure at 18 months in its latest global fraud study.
Bewley describes it as the superman syndrome: try for a first time, get away with it, so keep going back for more.
Very rarely are people scamming their employers in one hit, he says. "This thing becomes a routine."
Hammond says getting in quickly and narrowing the time between the fraud starting and its discovery will reduce the financial damage.
"The actual dollar amount that gets stolen really is the tip of the iceberg because underneath that you're engaging with investigators, forensic experts, you're engaging lawyers, you've got a human resources process to go through as well.
"You may end up having to spend time in court dealing with the matter; you may end up in front of an employment tribunal if you haven't got your HR process spot on when you're removing these individuals from an organisation.
"There are large costs associated with dealing with the fraud, irrespective of whether the fraud is a few thousand or a few million dollars."
Hammond says one problem with getting good data on fraud levels is that businesses don't want to air their dirty laundry in public, in full view of shareholders, clients and suppliers.
"There is a real commercial pressure to not deal with this publicly.
"Ethically, the correct position is if you have a crime in your organisation you prosecute it, but the commercial reality is the consequences of that could be disastrous.
"I think they're overplayed," he says of those fears. Your share price may take a hit for 48 hours or so, says Hammond, but it will bounce back.
A bigger commercial concern is if slack systems expose your intellectual property and that of any joint venture partners, says Hammond.
In the non-profit sector, Bewley says you're better off front-footing it with funders, by explaining what went wrong and what you've done to ensure it won't happen again.
"If they find out second hand you've had a fraud and you never told them, good luck."
Things can get messy when fraud is uncovered, and Hammond recommends having a response plan ready.
Without a plan there is the potential for an investigation to turn into chaos, at the end of which you can't fire the person because you've not followed the correct employment law procedures, he says.
And because fraudsters don't think about what will happen when they're caught, they often try to commit suicide, adds Bewley.
When a major fraud is uncovered it can come up on the radar of the Serious Fraud Office.
Julie Read, new director of the Serious Fraud Office. Photo / Dean Purcell
"We don't actually have a specific monetary threshold," says SFO chief executive Julie Read.
"Probably we'd think a million dollars is where we'd start but it's very hard to have a threshold of any kind because the matter can go either way."
What starts out looking small could potentially balloon, while a case that initially appears to involve multi-million dollar amounts could upon investigation be $500,000, she says.
"The criteria for us is serious or complex.
"So complex may not be huge, but it may be we're the people with the right resources to pursue it." Read says the SFO is happy to hear from anyone who thinks they've lost a serious amount of money, and will refer matters on to other agencies if appropriate.
Most frauds are picked up by tip-offs - from staff, suppliers or customers.
"That shouldn't be the case," says Hammond. "It should be that organisations are looking for this stuff and finding it themselves and not waiting for the whistle-blower."
Toresen says while there is a lot of benefit in being proactive about fraud control, it's a hard sell.
He says many of the large fraud cases he has dealt with don't even come to the attention of the police.
Companies don't have a prosecution focus and are more interested in recovering the money and getting the person out the door.
He says the perception is that penalties are light and are only imposed after waiting several years to get a case to court.
Toresen has had cases where there has been an investigation, an admission of guilt, the money has been recovered and three years later a call has come from police with the file.
"That is absolutely ridiculous and it's a matter of staffing and priorities.
"There is just literally no staff available to fully investigate quickly any of these cases.
"There are massive delays at Auckland Fraud Squad and files just aren't being worked on."
All the investigators agree that trust is the weakest form of control.
"If we go through life not trusting people we'll be bitter and twisted and die lonely people but you can't rely on trust, it's too hard," says Bewley.
Does Hammond trust anyone?
"I trust my wife; my kids, mostly. I trust my staff. Yep, that's pretty much it. I'd like to be more trusting.
"We all like to think that we're all good judges of character but I stopped doing that because I used to do a lot more interviewing for criminal prosecutions than I do now and I've met some spectacular liars, people who I'm absolutely convinced were telling me the truth, who turned out not to be."
And even though he trusts his staff, Hammond will still review their expenses claims.
He says for many bosses it's a matter of pride to not look over the shoulders of their staff and trust they won't be betrayed.
"And look, 99 times out of 100 that is right; 99 times out of 100 you're okay to trust your staff and the people you work with and your vendors and your suppliers and everybody else.
"I don't care about the 99 per cent, it's that 1 per cent that cause you the problem and it's that 1 per cent that means you have to check everyone's expenses."
Tactics to cut the chance of fraud
Mark Bewley. Photo / Lynda Feringa
The last thing BDO's head of assurance services, Mark Bewley, wants to find on a client audit is fraud.
He would rather show clients what to do to help reduce fraud in their business - generally a mix of prevention and detection.
Like bank robbers casing a bank, fraudsters rely on routine to provide an opportunity. "If you're doing unexpected things then it's very hard for somebody to commit a crime," says Bewley.
Randomly check the account numbers for suppliers and question where the bank account details come from, or put an extra $40 in the till, he suggests.
Start thinking like a fraudster and ask where someone could steal money from the business and how you could stop it, says Bewley.
Even though internal controls and tip-offs catch out most fraudsters, he says only around 18 per cent of clients have procedures to manage tip-offs.
"When you think about it, one of the most obvious ways that fraud will be picked up in your business is not being managed." And don't let trust override controls, such as basic employment background checks, he says.
Fraud investigator Daniel Toresen says businesses need to take steps to segregate duties, rather than put complete trust in one person to manage invoicing, debtors, creditors and banking.
He says many New Zealand businesses started out as small family operations, but 20 years down the track are very large global companies.
"But sometimes some of the controls you'd expect with a global business just don't exist because of the trust.
"People have been in the business for so, so long there is just a massive trust factor in it."
EY's fraud investigation and dispute service head Matthew Hammond says there are cheap, cost-effective ways businesses can detect fraud.
He recommends checking for matches between payroll data and supplier data.
A supplier bank account number that matches an employee could be a red flag.
Or it could be 10 staff on the payroll with the same address.
In each case there could be a perfectly logical reason but it does raise questions, he says.
"Be brave and look for fraud issues in your organisation because they're there," says Hammond.
"Don't wait for it to be a tip-off." And do the ethical thing and prosecute any fraud you find, he adds.
Firm close to closing after worker's theft
Whangarei screenprinter Hot Printz was on its financial knees before it discovered trusted staff member Shane Hiroa, not a downturn in business, was the cause of its money woes.
Just two weeks away from closing the doors on Hot Printz, owner Bill Armitt uncovered by "sheer fluke" that 45-year-old Hiroa - someone he'd treated as a member of the family - had been ripping him off.
"What we thought was the impact of the global recession was actually the deception, manipulation and avarice of a lying, selfish man," said Armitt at Hiroa's sentencing in the Whangarei District Court, as reported by the Northern Advocate last month.
Police said Hiroa took almost $129,000, though Judge Greg Davis said the victims estimated close to $250,000 had been stolen over four years.
Hiroa got the money by false invoicing and credit notes, plus cash or bank deposits customers paid directly to him.
Hiroa had frittered the money away on a lifestyle that included overseas trips.
It was only after Armitt rang customers, chasing what he thought were unpaid debts, that he discovered the fraud.
Hiroa's stealing cost three staff their jobs and forced Armitt to take out a $250,000 loan to keep his 22-year-old business afloat.
"His ways of stealing were many and varied. He deceived us, he deceived our customers and the impact and flow-on have been more significant than his selfishness will ever let him understand.
"Shane watched me on his last day. My head in my hands, distraught at not knowing how I would pay my staff, and keep the business afloat.
He went home on his last day with his pockets full of cash that belonged to the business and the honest people who work for it,"
Armitt told the court as Hiroa was sentenced to three years in prison and payment of $10,000 in reparation, after admitting four charges of theft by a person in a special relationship.
Fraud facts
• 83% of respondents believe their organisation has a low risk of fraud.
• 54% of the largest frauds reported in 2014 were attributed to payroll fraud.
• 54% of fraud victims did not report the fraud to police.
• 63% of respondents terminated the perpetrator's employment.
• 53% of organisations that suffered fraud did not recover any funds from the perpetrator.
•Financial pressure and maintaining a lifestyle were the most common motivators for the largest frauds identified; gambling was the motive for 54% of the total value of frauds and had the highest average fraud.
•Tip-offs (35%) and internal controls (30%) were the most effective ways of discovering fraud.
•Only 18% of respondents have implemented a whistle-blower policy, despite tip-offs being identified as one of the most effective ways to discover fraud.
