Businesses are unprepared to handle fraud

Respondents view their organization’s internal controls as equally sufficient compared to 2021. When asked to rank the sufficiency of these internal controls on a ten-point scale, respondents rated their internal controls favourably at an average of 7.0. Almost a fifth (17%) ranked their fraud preparedness between nine and 10 and more than half (53%) self-assessed their internal controls between seven and eight.

However, one in five businesses were not able to identify procedures in place within their organization as part of their business' preparation against financial fraud. An alarming 95 percent of respondents did not identify segregation of duty as part of their business' preparation in the fight against financial fraud, although this is a well-known control.

Consistent with previous results from the survey, individuals with longer tenures and older respondents were more likely to believe their internal controls are sufficient.

“A high number of respondents self-assessed sufficient internal controls in their companies,” says Gaudreau. “However, the results from the survey show that many respondents were not able to provide details on what measures their business has in place to prevent financial fraud. If we couple that with the lack of understanding about the true fraud risks they are facing, this overconfidence may lead many to believe that the controls they have in place are sufficient. However, there might be gaps and vulnerabilities in reality.”

Misalignment of measures and best practices

Survey responses indicate that businesses have fewer fraud detection measures and techniques in place in 2024 than in 2021. This decline in fraud detection measures is concerning, as it suggests that businesses may be deprioritizing fraud prevention — potentially due to economic pressures like inflation and rising costs.

Frequent financial reviews and/or frequent reconciliations of accounts, the implementation of IT security measures, and pre-employment checks are the top three fraud detection measures reported in this survey.

However, the use of pre-employment checks significantly declined — falling from 65 percent in 2021 to 53 percent in 2024. According to the responses to the 2024 survey, employee recruitment was the top concern of Quebec business owners. This could indicate that companies are making less effort to verify the background of potential employees in favour of hiring new talent quickly.

“Another MNP study showed that 16 percent of fraudsters who were in a position of trust were repeat offenders. A background check prior to hiring could have identified this issue,” adds Bloom.

Fifty-five percent of respondents reported that their business performs frequent financial reviews and/or frequent reconciliations of accounts. IT security measures and pre-employment checks are used by 53 percent and 52 percent of businesses, respectively.

Making the rotation of positions or functions mandatory, as well as enforcing mandatory vacation time and leaves of absence, is a simple yet effective measure to protect against financial fraud. However, it was the measure least adopted by businesses. Additionally, while 79 percent of survey respondents were familiar with fraud risks assessments, less than a third reported using a fraud risk assessment in their business.

Based on responses to the survey, businesses appear to rely heavily on an established code of conduct and an established set of accounting procedures to reduce the risk of fraud. However, many respondents may be unaware of the fraud risks their business is truly facing without a proper fraud assessment — leading them to rate their internal controls more favourably.

Each of these measures can help prevent fraud. However, these controls alone are not enough to reliably detect, prevent, and respond to incidences of fraud. The ACFE report reveals that document reviews only account for six percent of detected frauds and account reconciliation accounts for a mere five percent.

Additionally, the ACFE’s report reveals that many businesses had some measures in place when fraud occurred. These measures include a code of conduct (85%), external audits of financial statements (84%), and internal audit departments (80%).

Tips played a much greater role in detecting fraud, and the ACFE study states that more than two in five (43%) incidents of fraud are detected through tips. However, only 16 percent of respondents had a reporting system in place to receive tips from whistleblowers.

“The number of businesses with a system set up to receive tips is concerningly low,” says Bloom. “Appropriate reporting mechanisms, when properly implemented, provide the anonymity many employees need to feel safe to come forward and report their concerns. Businesses are missing out on a valuable method of detecting fraud without a system in place to empower whistleblowers.”

Lack of frequent anti-fraud training

Employee training is crucial to prevent, detect, and respond to incidents of fraud within a business. The ACFE reports that organizations that did not provide fraud awareness training lost nearly two times more to financial fraud than businesses that did provide fraud awareness training. However, a quarter of respondents never provided anti-fraud training to their employees.

About half of respondents reported providing anti-fraud training to employees within the past year, which closely aligns with the results from the 2021 survey. However, more respondents reported providing training that occurred more than one year ago but less than three years ago. This means a few businesses provided anti-fraud training to their employees during the last survey cycle.

“It is encouraging to see that many employees received anti-fraud training more recently than in 2021,” says Gaudreau. “However, the overall number of businesses that reported providing anti-fraud training to employees within the past year is concerningly low. Fraud is dynamic and evolves each year, which means employees may not be up to date on current fraud schemes. Our experience shows that training is often outdated and is sometimes only part of the hiring paperwork, which significantly reduces its impact.”

Consistent with the results from the 2021 survey, members of management such as vice presidents or directors are most likely to attend anti-fraud training, followed by other managers. Managers in businesses that have been impacted by financial fraud in the past are more often in attendance for anti-fraud training. Less than 40 percent of anti-fraud training was given to employees.

“Businesses are not targeting non-management employees to attend anti-fraud training,” says Bloom. “This is concerning because training is one of the most effective ways to decrease the risk of fraud. It enables owners to better identify risks and empowers employees to identify and report suspicious activities. Employees are one of the greatest assets a business can have in the fight against fraud.”

Missed lessons from previous fraud experiences

As noted previously, businesses that experienced financial fraud in the past perceived it as a higher risk than businesses that did not experience an incident of fraud. Of those that experienced a past fraud, 52 percent reported that the incident took place within the last three years. On average, survey respondents reported that their business was a victim to fraud three times.

Businesses that experienced fraud are more likely to take a stronger stance against fraud than in the past. While 10 percent of companies that experienced fraud did not change anything to prevent another occurrence in the future in 2021, the number has dropped to three percent in 2024.

Close to 40 percent of fraud cases amongst impacted businesses resulted in the dismissal of employees. A third of fraud cases also either resulted in a complaint to the police or led to legal proceedings. These three measures taken most often following a financial fraud are important as they send the message that fraud is taken seriously and that there is no tolerance for it.

Several businesses affected by fraud conducted an investigation to identify the root causes and mechanisms of the fraud in 2024. An internal investigation was conducted in 30 percent of cases and an external investigation was performed in 22 percent of cases. About 10 percent of businesses impacted by fraud chose to conduct a joint internal-external investigation.

Consistent with the other results of this survey, measures that were less commonly implemented included training for employees and management (27%) and performing a fraud risk assessment (14%). However, each of these measures are vital to reduce the likelihood of future incidences of fraud according to MNP’s experience.

“It is encouraging to see more businesses taking action to prevent future occurrences of fraud,” says Gaudreau. “However, these measures are less likely to be effective without additional training or an updated fraud risk assessment — which can help strengthen the measures already in place. These measures are also less likely to be effective without an external investigation, which brings a fresh and independent set of eyes on the issues.”