Fraud is increasing year on year, and businesses are facing increasingly sophisticated threats. As companies tackle new threats, it is important they look beyond policies and procedures.
Robust fraud-prevention policies and procedures are a minimum requirement, as management accountants know. These provide benefits such as clarity for staff, leading to operational efficiencies. They also provide checks and balances to minimise bad-faith actors’ opportunities to exploit vulnerabilities.
Many companies also have codes of conduct, approval policies, and whistleblowing protocols.
So why are these not enough? Well, we should remind ourselves that many significant examples of corporate fraud have occurred or been alleged in organisations with policies already in place (eg, Société Générale, Wirecard, Olympus Corporation, Enron, Volkswagen). Fraud-prevention policies are not enough.
“Policy describes the theory, controls aim to provide a safety net, but the driver of behaviour and whether that’s ethical is culture. That’s where we should be spending most of our energy,” according to Annabel Gillard, co-founder of the FORGOOD Initiative, supported by the London School of Economics and Political Science.
More than policies telling people what to do when it comes to fraud prevention, companies need an ethical culture to inform how people think about fraud prevention. And as this culture develops, management accountants may be distinctly able to help.
Culture by design
When we consider workplace culture, we should be thinking about the word “behaviour”. Ethical cultures are really an accepted system of shared beliefs and values that inform the behavioural norms of the collective. This matters because well-crafted internal fraud-prevention policies only successfully prevent fraud if used.
The Association of Certified Fraud Examiners estimates that organisations lose 5% of revenue to occupational or employee-perpetrated fraud each year and 84% of fraudsters exhibit at least one behavioural red flag (eg, an unusually close relationship with vendors, issues of control or an inability to share duties, and a “wheeler-dealer” attitude).
The responsibility for cultivating an ethical culture within any hierarchical organisation must start at the very top with ethical leadership.
If employees see executives and senior staff behaving inappropriately, staff of all levels see the example being set and the scope of permissible behaviour. It also emboldens “bad faith” employees, as they feel they will be less likely to be held accountable. If senior management ask staff to “massage” forecasts to “smooth” results, or pressure staff to bypass controls, this sets the company’s modus operandi.
“Ethical culture is most fragile at the point where pressure meets silence. Leaders set the tone not only through the standards they articulate but through the behaviours they tolerate. If leaders bend controls, the message the organisation hears is that controls are optional,” said Emma Sweeney, ACMA, CGMA, an Ireland-based finance leader and a former member of CIMA’s Disciplinary Committee.
“Across organisations, most ethical failures don’t start with dramatic acts of wrongdoing — they start with small compromises that go unchallenged,” Sweeney said, based on her observed experience.
“Culture is what determines whether those early warning signs are addressed or ignored,” she said.
It is important that the culture can survive the natural employee churn over time. Depending on the company, the economy, and a wide range of personal factors, an employee may be at a company for a few months or a few years.
The culture also needs to be strong enough to withstand the breadth and force of personalities within an organisation. Culture is in some ways organic and evolves with the personalities in the business.
Force of personality, however, can disproportionately affect the evolution of culture. A charismatic demagogue or vocal, disaffected malcontent can cause a breakdown in the collective. The culture must be able to withstand those who might disturb it, intentionally or otherwise.
Bad-faith actors will seek to exploit fraud opportunities, and a culture that lacks ethical resilience is an easy target. This starts with recruitment — not just hiring one type of personality but instead hiring people who both exhibit the behaviours you seek and demonstrate the capacity to effectively participate in reinforcing the culture sought.
Effective interview questions and precisely crafted scenario-based competency exercises can help to provide clarity. Such scenarios may involve pushing back against a suspicious expense claim or refusing to sign off on an inaccurate financial report. Both require fortitude, especially when weighed against any possible financial pressures the individual is under.
“Technical competence can be taught, but ethical judgement is far harder to retrofit,” Sweeney said. “Hiring people who are willing to challenge, who ask uncomfortable questions, and who understand the weight of financial stewardship is critical to building a resilient culture.”
Furthermore, staff who are more uncomfortable with unethical behaviour may be more likely to move on from a company where that behaviour is normalised. Staff who are comfortable colouring outside the lines will feel as though they have found a home in a company where that behaviour is not just tolerated but encouraged.
Management accountants and ethical role-modelling
Integrity is a core ethical principle and one of the five Fundamental Principles found within the CIMA Code of Ethics (R111.1). AICPA members must adhere to the AICPA Code of Professional Conduct, including its “Integrity Principle” (ET §0.300.040).
“Ethical behaviour and integrity are so important when it comes to ensuring good practice within the accounting community,” said Damien O’Kane, FCMA, CGMA, transformation director at UK-based Shadla Business Solutions and a CIMA Council Member.
“As CIMA members, it is important that we always demonstrate these traits, even when at times there may be an easier route to take. CIMA members should never shirk the responsibility of acting with integrity,” he said.
As stated in the CIMA code’s preface: “As chartered [global] management accountants, CIMA members (and registered students) throughout the world have a duty to observe the highest standards of conduct and integrity, and to uphold the good standing and reputation of the profession. They must also refrain from any conduct which might discredit the profession.”
This is regardless of the wider culture they may find themselves in. An ethical culture does not replace the individual professional integrity required of CIMA members. Instead, each feeds the other, further cementing the quality of professional practice while allowing the professional to help shape the desired culture in the process.
Management accountants occupy an integral space when it comes to shaping organisational culture. They are in fact at the forefront of an organisation’s ability to fight fraud, not just with policies and procedures but through the ethical culture that they can embody and enforce.
Management accountants can become effective ethical role models both internally and externally. They can push back against unrealistic targets that can pressure staff to act unethically to achieve them. They can encourage a broader range of and increased transparency in reporting and engender public trust in the company itself.
These five practical actions can cultivate ethical cultures:
Fuse culture into interviewing skills matrices: Consider using situational judgement questions based on behavioural science. These questions can help identify candidates who have the capacity to contribute to the ethical culture you want to cultivate. This is not about creating a workplace that hires one “type” of person. This is about identifying people who will positively contribute to workplace culture.
Ensure ethical role–modelling by leaders: People observe what leadership does, not just what it says. Leadership needs to ensure its ethical role–modelling is authentic and visible.
Create psychological safety for people to admit mistakes and raise concerns: “Most ethical fails do not occur because of bad actors or rogue individuals, but from blind spots, group think, or a failure to surface concerns,” Gillard said.
Mistakes will happen, and oversights can occur. Creating an environment where individuals can admit mistakes without fear of retaliation can substantially benefit the workplace. For example, arrange structured team debriefs to analyse errors without emphasising personal blame. Instead, prioritise learning from the situation, which can benefit the collective.
Equally, staff need to know they can flag unethical behaviour without retaliation, even when that unethical behaviour is by a senior leader. This can be managed through internal whistleblowing procedures or other similar routes and in a way that the employee feels comfortable.
Use behavioural nudges: Implementing intentional cautionary delays at high–risk moments, such as when a payer is making a large one–off payment, may help reduce fraud.
Research from the UK’s University of Nottingham shows that the use of calls to action (CTAs) can help reduce the likelihood that an individual becomes a victim of fraud. Different nudges, though, are needed to guard against different types of fraud. For example, research from Axiom Economics suggests that to counter CEO fraud (where a fraudster pretends to be a senior executive, such as the CEO, and directs that an emergency payment be made) it would be prudent to prompt individuals “to scrutinise the entity’s credentials and to question the methods of communication” used to request the transfer.
Empower local teams to help shape ethics: Responsibility for shaping an ethical culture is top down. But that does not have to completely exclude everyone else. Encourage individuals within teams to consider ways to embed the desired values into their own ways of working. They are the subject matter experts — use their expertise. The environment must allow people to think beyond “What does the policy say?” Ethical behaviour starts with ethical thinking, and ethical thinking is a skill to be cultivated.
Xose Lumor is manager—Advocacy & Professional Ethics at the Association of International Certified Professional Accountants. To comment on this article or to suggest an idea for another article, contact Oliver Rowe at Oliver.Rowe@aicpa-cima.com.
MEMBER RESOURCES
Articles
“Test Your Ethics Knowledge”, FM magazine, 31 January 2025
“Ethics in Action: Misleading Reporting and the ‘Familiarity Threat’”, FM magazine, 21 March 2024
Codes
AICPA Code of Professional Conduct
Web page