Fraud Prevention Strategies in Local Government

Background

Fraud is the crime of obtaining financial or another benefit by deception. The impact of fraud on councils and their communities can be significant. It can disrupt business continuity, reduce the quality and effectiveness of critical services, and threaten the financial stability of a council. It can also damage a council’s public image and reputation.

Each year, local government collects $7 billion in operating revenues, expends $6 billion, and manages assets with a total value of $60 billion. These significant resources are at risk if councils are not active, vigilant and effective in dealing with the risk of fraud.

The Local Government Act 1989 (the Act) requires councils to develop and maintain adequate internal control systems. An effective fraud control framework is widely recognised as a critical element of such systems. The Australian Standard AS8001–2008 on fraud and corruption control, and other related good practice guides, identify the key elements of an effective fraud control framework. These include:

• a fraud control plan documenting an entity’s fraud prevention, detection and response initiatives
• periodic and comprehensive assessment of an entity’s fraud risks
• documented policies and procedures for dealing with suspected fraud, including protection for whistleblowers
• a sound ethical culture supported by a code of conduct
• regular fraud awareness training to maintain staff awareness of related policies and procedures
• internal audits of the effectiveness of fraud controls and of related procedures
• dedicated controls for activities with a high fraud risk exposure.

Our 2008 report Local Government: Results of the 2006–07 audits undertook a high level review of fraud management practices across all 79 Victorian councils. It found that approximately one-third of councils had yet to develop a fraud control plan, clearly document their related policies and procedures, or provide management and staff with adequate training on identifying fraud risks.

This audit assessed the effectiveness of fraud prevention strategies at Maroondah City Council, Nillumbik Shire Council, Moira Shire Council, Buloke Shire Council and West Wimmera Shire Council.

We also tested the adequacy of controls for targeted high-risk fraud areas, known to account for the majority of frauds in public sector entities.

Conclusions

The examined councils do not effectively manage their exposure to fraud risk as none have developed a strategic and coordinated approach to controlling fraud. This is concerning given the significant value of the public funds and assets they manage.

While each of the five councils has aspects of a fraud control framework, critical elements are either absent or poorly implemented.

Risk-based fraud control plans do not yet exist at all councils. Coupled with inadequate monitoring of the fraud control framework by management and audit committees, this shows they are not sufficiently vigilant nor effective in dealing with the risk of fraud.

Without a risk-based fraud control plan there is no formal basis to assess whether fraud strategies are soundly based, coordinated, purposely implemented and reviewed.

These shortcomings increase opportunities for fraud and thus put councils’ reputations and limited public funds at risk.

Consequently, the examined councils cannot be assured that their fraud prevention strategies are effective and that all major fraud risks have been adequately mitigated.

Councils, therefore, need to take the issue of fraud more seriously.

The audit’s scope did not extend to undertaking an exhaustive fraud investigation. However, our targeted testing of high-risk areas disclosed a number of internal control deficiencies which further heighten the risk of fraud.

Findings

Limited improvements to fraud management practices since 2008 were evident at most examined councils. These included:

• establishing specific fraud risk registers based on assessments of fraud risk—at Nillumbik and Buloke, with Maroondah in the process of developing one
• issuing a code of conduct for staff, clarifying expected and unacceptable behaviours—at Maroondah, with codes already in place at the remaining councils
• implementing a fraud policy detailing the consequences for fraudulent conduct, including procedures for managing allegations and incidents—at all councils except Moira
• providing training to staff on their responsibilities for managing fraud risk—at Maroondah and Nillumbik.

Although encouraging, these initiatives have not been sufficient to establish an effective fraud control framework at each council.

The following sections highlight key shortcomings identified with existing fraud management arrangements, and the actions required to address them.

Fraud prevention strategies

Fraud control plans, risk assessments and policies

None of the examined councils had developed a fraud control plan, and only two out of five had completed assessments of their fraud risks at the time of the audit. Consequently, the fraud control strategies of all examined councils were neither adequately documented nor, in most cases, informed by a sound understanding of their exposure to fraud risk. Maroondah advised it completed its fraud risk assessments following the audit, and that this would inform its development of a fraud control plan.

Although most councils had developed adequate fraud policies and codes of conduct, the absence of fraud control plans and completed fraud risk assessments demonstrates that, in most cases, these policies were not being effectively implemented or enforced by management.

Further, while all councils relied on contractors and volunteers to deliver key services, only Maroondah had apprised them of its fraud policy. Similarly, none had distributed their code of conduct to contractors, and only Nillumbik had provided it to volunteers.

This reduces assurance that contractors and volunteers at the remaining councils are clear as to what constitutes fraud and ethical behaviour, and what action they should take in the event they suspect a fraud has occurred.

Moira acted to address this during the audit.

Fraud awareness training

With the exception of Nillumbik, none of the examined councils provided adequate fraud training to their staff.

West Wimmera did not provide fraud awareness training to new and existing employees. Additionally, while the remaining councils informed new employees about the existence of their fraud policy and/or code of conduct, this was not adequately supported by further training and awareness-raising initiatives aimed at gaining assurance that staff understand their fraud control responsibilities.

Maroondah began an extensive program of refresher training for existing employees in April 2011 and has since advised it will provide ongoing refresher and induction training for all staff. Moira and Buloke similarly commenced action to deliver fraud training to new and existing employees during the course of the audit.

All councils had yet to establish arrangements for evaluating the adequacy of their fraud training and awareness programs.

Monitoring and oversight

There was significant scope to improve monitoring and oversight of the fraud control framework at all examined councils.

None had established effective arrangements for systematically monitoring and reporting on the performance of their fraud control activities to senior management and the audit committee.

Consequently, the examined councils were unable to demonstrate the effectiveness of their fraud control framework.

Internal audit

All councils, except West Wimmera, had a risk-based internal audit program, however, none systematically reviewed the adequacy of their fraud management arrangements. This, coupled with the absence of completed fraud risk assessments at Maroondah and Moira, offered little assurance that council internal audit programs adequately addressed all major fraud risks.

Moira conducted an audit of its fraud management framework in 2005. While the audit recommended it establish an integrated fraud control and risk management framework, this has yet to occur.

West Wimmera advised it intends to establish an internal audit function in 2013–14.

Audit committee

Audit committees have a key role in monitoring councils’ fraud minimisation and detection programs, including whether there are strong internal controls to effectively manage key fraud risks. However, it was not evident that they actively monitored management’s efforts in implementing fraud prevention strategies.

While all committees received reports and maintained a watching brief on suspected fraud incidents, they did not systematically review the effectiveness of the council’s wider fraud prevention framework.

Further, West Wimmera’s and Maroondah’s audit committees lack sufficient independence from councillors and council staff as neither was comprised of a majority of independent members. This impedes their capacity to effectively scrutinise management actions. Maroondah advised it intends to address this by restructuring its committee’s membership so that the majority are independent.

In addition, none of the councils adequately assessed the performance of their audit committee, and all relied overly on limited reviews of fraud management practices by their insurer. These reviews, however, have inherent limitations and do not provide sufficient assurance that fraud control arrangements are effective.

Internal controls to prevent and detect fraud

No instances of fraud were identified in our targeted testing at the examined councils. However, a number of internal control weaknesses were observed which heighten the risk of fraud. These are outlined below.

Pre-employment screening

All examined councils had recruitment policies and procedures for pre-employment screening. However, none adequately addressed all major fraud risks. Specifically, only Moira and Nillumbik required verification of an applicant’s identity. Similarly, while all councils require a police criminal history check for some roles, only three of the five examined councils applied this to high fraud risk positions.

Reference checks are mandatory at all councils. While they were evident in all cases examined at Moira, they did not occur in 80 per cent of the files examined at Nillumbik, 69 per cent of files at Maroondah, and around half of the files reviewed at both Buloke and West Wimmera. Following the audit, Maroondah, Nillumbik and Buloke advised that practices have since been improved.

Council policies require staff to verify the qualifications of new employees. This was evident in almost all files examined at four of the five councils. However, at Nillumbik, employee qualifications had been verified in only around 20 per cent of the files examined.

Accounts payable

Accounts payable relies on effective segregation of duties around the set-up and maintenance of vendor details to prevent payments to fictitious suppliers. This was the case for Nillumbik and West Wimmera, however, due to limited staffing and resources there was a lack of segregation of duties at the remaining three councils.

Accounts payable staff at these councils can create and edit vendor details as well as enter invoices for payment. Although this increases the opportunity for fraud, both Maroondah and Moira have reasonable compensating controls.

This was not the case at Buloke. While an independent officer signs off on a report of changes to vendor bank details, it is not supported by any documentation substantiating the changes. Without this the council is unable to verify if implemented changes are appropriate and, therefore, easily detect if a fraud has occurred.

Asset management

Maroondah, Nillumbik and Moira had adequate processes to safeguard their assets, however, there is scope for improvement at Buloke and West Wimmera. Neither council maintained an up-to-date and accurate asset register, nor did they assign a unique asset number to all assets so they could be traced. Additionally, West Wimmera did not do regular stocktakes.

These weaknesses create an opportunity for assets to be misappropriated and misused without detection.

Recommendations

Councils should:

1. develop and maintain an up-to-date fraud control plan clearly documenting their fraud prevention, detection and response initiatives and responsibilities
2. conduct thorough, periodic fraud risk assessments to assure they identify and effectively manage all major fraud risk exposures
3. provide induction and periodic fraud awareness training to all council staff, to assure they understand their fraud control responsibilities
4. systematically monitor and report on the effectiveness of their fraud control strategies
5. establish arrangements that assure effective ongoing scrutiny by executive management, internal audit and audit committees, of the effectiveness of the fraud control framework
6. establish effective pre-employment screening processes that provide sufficient assurance over the integrity, identity and credentials of all council staff
7. make sure accounts payable systems have effective preventative and/or compensating controls that adequately mitigate the risk of fraudulent purchases and/or payments
8. maintain accurate and an up-to-date asset registers that are regularly reviewed to mitigate the misuse and/or misappropriation of assets
9. systematically review the operation and effectiveness of all their internal control systems to assure they adequately prevent, deter and detect major frauds.

Submissions and comments received

In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report was provided to the Department of Planning and Community Development, Maroondah City Council, Nillumbik Shire Council, Moira Shire Council, Buloke Shire Council and West Wimmera Shire Council with a request for submissions or comments.

Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments however, are included in Appendix A.

1.1 Introduction

Fraud is the crime of obtaining financial or another benefit by deception. The Australian Standard for fraud and corruption control defines fraud as:

‘Dishonest activity causing actual or potential financial loss to any person or entity including theft of moneys or other property by employees or persons external to the entity and where deception is used at the time, immediately before or immediately following the activity. This also includes the deliberate falsification, concealment, destruction or use of falsified documentation used or intended for use for a normal business purpose or the improper use of information or position for personal financial benefit’.

Fraud can be perpetrated by employees, customers, contractors and external service providers, acting alone or in collusion. Research indicates that around 65 per cent of fraud is perpetrated by an employee.

1.1.1 Major frauds by type

There are many different types of fraud. Examples include:

• theft of cash or assets
• unlawful use of equipment including misuse of vehicles, telephones and other property or services
• creating dummy or duplicate vendors to process fraudulent payments
• falsifying expense claims
• obtaining ‘kickbacks’ or bribes from suppliers or contractors
• creating a ‘ghost’ employee and depositing their salary into the fraudster’s bank account
• unauthorised use of a credit card
• disclosure of sensitive or confidential information, with the discloser obtaining some benefit
• falsifying academic or training credentials in an employment application.

Figure 1A and 1B show the incidence and value of major fraud types in Australia and New Zealand based on the aggregated results of KPMG’s biennial fraud and misconduct survey of private and public sector entities from 2006, 2008 and 2010.

Figure 1A

Proportion of major fraud incidences by type

Source: Victorian Auditor-General's Office based on information from KPMG's Fraud and Misconduct Survey 2010, 2008 and 2006, Australia and New Zealand.

Figure 1B

Proportion of the value of major frauds by type

Note: The total combined value of major frauds during the last three reporting periods was $142.6 million.

Source: Victorian Auditor-General's Office based on information from KPMG's Fraud and Misconduct Survey 2010, 2008 and 2006, Australia and New Zealand.

KPMG’s survey results show that the theft of cash, followed by the theft of assets, and accounts payable fraud accounted for almost 60 per cent of reported fraud incidents during the last three reporting periods. Similarly, these accounted for 70 per cent of the total value of all reported major frauds.

1.1.2 Fraud in local government

Fraud is a significant problem for private and public sector entities worldwide. However, quantifying the extent and cost of fraud is difficult because of its concealment by perpetrators, and the lack of reliable reporting. The Australian Institute of Criminology (AIC) estimates that for every fraud identified, there are three that go unreported or undetected.

Each year, local government collects $7 billion in operating revenues, expends $6 billion, and manages assets with a total value of $60 billion. These resources are at risk if councils are not active, vigilant and effective in dealing with the risk of fraud.

AIC estimates that all fraud costs the Australian economy around $8.5 billion per year, which includes reported and estimated fraud and associated costs. This represents around a quarter of the total cost of crime nationally. In Victoria, fraud is estimated to cost over of $640 million per year.

The incidence and cost of fraud in the Victorian local government sector is unknown as there is no requirement for councils to compile and centrally report this information. However, research by PriceWaterhouseCoopers indicates that government and state‑owned enterprises, on average, experienced a higher incidence of fraud than private entities. This suggests that fraud is an issue local government should be vigilant about.

Incidences of fraud in local government

Councils are custodians of significant public funds, and it is important that the public has assurance that these are adequately protected from fraud.

Fraud can adversely impact a council’s ability to meet its legislative obligations and achieve its objectives. It can damage its public image and reputation and adversely impact on business continuity including service delivery and financial stability. A council’s finances may also be significantly impacted by fraud as usually only a small percentage of losses are recovered.

A number of incidences of fraud have occurred recently in Victorian local government:

• More than $377 000 was stolen from inner city council parking meters over a 15‑month period from 2007 to 2008. The thefts were committed by contracted employees responsible for collecting the council’s parking revenue. The offences were uncovered when an audit identified discrepancies in the revenue collected. In addition to the stolen money, the council incurred costs of over $76 000, including the repair of meters. The accused were all prosecuted and received sentences ranging from two to four years prison, suspended sentences and community-based orders.
• A senior compliance officer at another inner city council took bribes of more $134 000 between 2002 and 2010 from brothel operators. The officer agreed not to investigate breaches and to tip off operators about compliance inspections by the council. The offender was prosecuted and received a 20-month prison sentence.
• An accounts payable clerk at another inner city council used 88 blank council cheques to steal a total of $596,868 over a two-year period between February 2005 and March 2007. The theft was found when the council changed computer software and reconciled its cheques. The offender was prosecuted and sentenced to two years and eight months jail.

1.2 The regulatory framework

Local Government Act 1989

The Local Government Act 1989 commits councils to establishing a code of conduct and an audit committee, and to developing and maintaining adequate internal control systems.

A fraud control framework is widely recognised as a critical element of such systems. Councils therefore have a responsibility to minimise opportunities for fraud, and to respond to inappropriate actions and behaviours.

Whistleblowers Protection Act 2001

The Whistleblowers Protection Act 2001 (the Act) facilitates the making of disclosures of improper conduct or detrimental actions by public officers and public bodies. The Act sets out procedures for both disclosure and investigation, and provides protection to a person who makes a disclosure as well as remedies for the person where detrimental action has been taken against them.

Under the Act, each public body is also required to establish written procedures for handling any disclosures.

Standards and guidelines

The Australian Standard AS8001–2008, Fraud and Corruption Control provides authoritative guidance for organisations wishing to implement a fraud and corruption control program.

Similarly, the Australian National Audit Office’s 2011 better practice guide, Fraud Control in Australian Government Entities, provides additional information on the principles and practices for effective control that are relevant to Victorian councils.

Local Government Victoria has also developed several better practice guides for councils that are relevant to fraud management:

• Framework for the Development and Review of Council Staff Codes of Conduct, September 2011, which provides direction to councils in fulfilling their responsibilities to develop and implement a staff code of conduct under the LocalGovernment Act 1989.
• Conflict of Interest: A Guide for Council Staff, October 2011, which summarises staff obligations in regard to conflict of interest. Similar guidance was also developed for councillors in June 2011 and members of council committees in 2012.
• Audit Committees: A Guide to Good Practice for Local Government, January 2011, which aims to assist councils in establishing an effective audit committee.

1.3 Key elements of effective fraud control

To minimise the occurrence and impact of fraud, councils need a robust fraud control framework to prevent, detect and respond to fraud. The key elements of an effective fraud control framework, drawn from the Australian standard and other good practice guides, are shown in Figure 1C. These elements are discussed in the following sections.

Figure 1C

Fraud Control Framework

Source: Victorian Auditor-General’s Office.

The fraud control plan is a critical component of an effective fraud control framework. The plan should:

• communicate the council’s intent and responsibility for fraud management
• contain key risks identified through the fraud risk assessments
• outline the key internal controls in place to limit opportunities for fraud
• set out monitoring and review activities to assure the council’s fraud control framework is effective.

The fraud control plan should suit the needs of the council, and cover the essential elements required to effectively manage the council’s fraud risks.

Communicating intent

A fraud policy and code of conduct are key mechanisms for clearly articulating a council’s objectives and expected outcomes in managing fraud. An effective fraud policy clearly establishes a council’s attitude and approach to fraud control, while a code of conduct promotes high standards of ethical behaviour expected of staff and a council’s commitment to these standards.

Setting the right ‘tone at the top’ is critical to fraud control. A council culture based on sound ethics and integrity, as displayed by senior management, underpins an effective fraud control framework.

Identifying risks

Developing an effective fraud control framework requires having a good understanding of a council’s key fraud risks.

The fraud risk assessment should cover all the discrete functions and operations of a council. To assure an integrated and consistent approach, the assessment should also form part of a council’s overall risk management strategy.

Limiting opportunities

Once a council has established its fraud risk profile through a risk assessment process, it needs to implement dedicated internal controls—system, processes and procedures—that will minimise those risks.

Raising awareness

Fraud awareness training is an effective method of assuring that all employees, contractors and volunteers are aware of their responsibilities for fraud control and of expectations for ethical behaviour in the workplace.

Monitoring

Audit committee oversight is critical to the success of the fraud control framework. The audit committee should regularly review a council’s internal control, risk management processes and fraud control strategies.

An effective internal audit is a key mechanism available to councils to discharge this responsibility. Internal audits review internal controls for key risks, including fraud risk, within a council and provide assurance to management about the operating effectiveness of these controls.

Senior management also have a role in reviewing the outcomes of monitoring activities and using the insights gained to inform continuous improvement in fraud prevention.

1.4 Previous audit

Our 2008 report Local Government: Results of 2006–07 audits included a high-level review of the fraud control framework of all 79 councils. It examined whether each council:

• had a fraud policy, procedures and code of conduct
• had a fraud control plan and associated strategies based on a comprehensive fraud risk assessment
• provided fraud awareness training
• maintained an appropriate level of insurance for fraud
• implemented pre-employment screening processes.

The audit found that approximately one-third of councils did not have a robust fraud control framework in place. These councils did not have clearly documented and up‑to‑date fraud policies and procedures, a fraud control plan, or provide adequate staff training on identifying fraud risks. The audit recommended that councils develop a fraud control plan and undertake fraud risk assessments as a priority, and review the adequacy of their fraud management policies and procedures.

1.5 Audit objectives and scope

The objective of this audit was to determine the effectiveness of fraud prevention strategies by local councils. Specifically, for a selection of councils the audit assessed whether they:

• have an effective fraud control framework, which is integrated with their organisation-wide risk management strategy
• have appropriate, well understood and current fraud control plans, which address major risks
• have established effective fraud controls
• have adequate internal systems, training and reporting processes to support effective implementation and monitoring of fraud control plans
• regularly test, monitor and report on the effectiveness of the fraud control plan and associated practices
• review the outcomes of testing and use the insights gained to inform continuous improvement in fraud prevention and to update fraud control plans to ensure their ongoing appropriateness.

The audit examined fraud prevention policies, plans and practices and the adequacy of selected fraud controls at the following councils:

• Maroondah City Council—an inner metropolitan municipality
• Nillumbik Shire Council—an outer metropolitan municipality
• Moira Shire Council—a large rural municipality
• Buloke Shire Council—a small rural municipality
• West Wimmera Shire Council—a small rural municipality.

1.6 Method and cost

The audit was conducted in accordance with the Australian Auditing and Assurance Standards. The cost of the audit was $485 000.

1.7 Structure of the report

The report is structured as follows:

• Part 2 discusses fraud prevention strategies
• Part 3 discusses key internal fraud controls.

2.1 Introduction

Sound prevention strategies are the foundation of a reliable fraud control framework. While they cannot eliminate fraud risk, coordinated and effectively implemented strategies can minimise the chances of it occurring.

Key preventative measures critical to a sound fraud control framework include:

• a fraud control plan documenting the responsibilities for fraud prevention, detection and response initiatives
• periodic fraud risk assessments to identify and treatmajor fraud risks, and inform the fraud control plan
• a fraud policy establishing clear standards and procedures for dealing with suspected fraud incidents
• a code of conduct clarifying the council’s expectations for ethical behaviour that is demonstrably adhered to and promoted by senior management
• regular staff fraud awareness training on their responsibilities for identifying, preventing and reporting potential wrongdoing
• scrutiny by internal audit and the audit committee of the effectiveness of the council’s fraud control framework and related activities
• effective controls for activities with a high fraud risk exposure.

Once implemented, these preventative measures should be regularly monitored and evaluated to assure their effectiveness in operation.

This Part of the report assesses the adequacy of the fraud control framework at each examined council. Specifically, it examines whether fraud control plans and associated strategies are soundly based and minimise opportunities for fraud to occur.

2.2 Conclusion

The examined councils have not yet developed a strategic and coordinated approach to the management of fraud risk. Although most have a fraud policy and all have a code of conduct setting standards for ethical behaviour, this is only part of the solution.

The absence of documented fraud control plans at all five councils, and completed risk assessments at Maroondah, Moira and West Wimmera, means fraud policies were neither effectively implemented nor enforced. Therefore these councils could not be assured that their fraud prevention strategies were effective and that all material fraud risks had been identified and adequately mitigated.

Figure 2A summarises the adequacy of each council’s fraud control framework.

Figure 2A

Assessment of council’s fraud control framework

(a) Council took action to strengthen practices during the audit.

Source: Victorian Auditor-General’s Office.

2.3 Fraud control framework

Each examined council has aspects of a fraud control framework in place. However, all the practical elements required for effective fraud control are not yet established or fully integrated.

Specifically, none of the councils have clearly documented their actions for implementing and monitoring key fraud control initiatives. Additionally, none have developed adequate indicators for evaluating the effectiveness of their initiatives.

The councils advised that these weaknesses were influenced by ongoing resource constraints and the difficulty of attracting and retaining staff skilled in fraud control, particularly in regional and rural areas.

The following sections summarise the key issues identified at each council.

2.3.1 Fraud control plan

A soundly based fraud control plan is a critical element of a council’s fraud control framework. However, all five examined councils had yet to develop such a plan.

The fraud control plan documents the approach to controlling fraud at a strategic, tactical and operational level, including the responsibilities for implementing and monitoring related activities.

Key features of a sound fraud control plan include:

• a summary of the council’s major fraud risks identified through a robust fraud risk assessment
• details of strategies and controls for mitigating material fraud risks
• clear roles and responsibilities for implementing and monitoring key prevention, detection and response initiatives
• performance measures, including procedures for assessing the plan’s effectiveness.

A sound fraud control plan provides the basis on which a council can obtain assurance that it is aware of all its major fraud risks, and that it has adequate prevention, detection and response initiatives in place.

The fraud control plan should be periodically reviewed and updated, as needed, following an assessment of its effectiveness. It should also be tailored to the needs of each council, reflecting its relative size, structure and fraud risk profile.

It is important to note that a fraud control plan is a key operational document that explains how the council’s discrete fraud policy, risk register, prevention, detection and response strategies should coordinate, be operationalised and reviewed. Therefore, the plan is not simply a mechanism for physically co-locating these separate elements, it is the overarching guiding framework that demonstrates their effective coordination in practice.

The absence of a fraud control plan at the selected councils means they cannot demonstrate their fraud prevention, detection and response strategies are soundly based, coordinated, purposely implemented and reviewed.

2.3.2 Identifying fraud risks

Fraud risk assessment

Effective fraud management depends on a thorough fraud risk assessment, but this had not yet occurred at most examined councils. Only Nillumbik and Buloke had thoroughly assessed their fraud risks and had developed a fraud risk register at the time of the audit.

These shortcomings mean that most examined councils could not demonstrate they were effectively managing all their major fraud risks as unidentified risks cannot be planned for and addressed.

Fraud risk management is an important adjunct to a council’s risk management framework. It goes beyond considering general risks to the achievement of strategic objectives normally found in corporate risk registers, to identifying, analysing and addressing specific fraud risks.

Apart from Buloke and Nillumbik, the remaining councils mainly relied on their corporate risk registers as the foundation for managing their fraud risk. However, West Wimmera’s corporate risk register was incomplete and did not include any fraud risks. Similarly, Maroondah’s and Moira’s corporate risk registers contained a limited number of fraud risks, but there was little assurance they reflected all major fraud exposures in the absence of completed fraud risk assessments.

Moira’s risk register also lacked information about the adequacy of existing controls for some listed fraud risks. Therefore, it was not evident how the council had determined the risk rating in these cases.

Maroondah had commenced work prior to this audit to strengthen its fraud control framework. It was in the process of developing an organisation-wide fraud risk register, which had already led to improvements to some of its controls. Maroondah advised following the audit that it completed its fraud risk assessments, and that this would inform its development of a fraud control plan.

These actions are positive and the council intends to use the insights from this audit to inform its future improvement initiatives.

2.3.3 Communicating intent

A well understood fraud policy and code of conduct that is demonstrably adhered to and promoted by senior management is essential for establishing a sound ethical culture.

Most examined councils had adequate fraud policies and codes of conduct. However, the absence of fraud control plans and completed fraud risk assessments demonstrates that, in most cases, these policies have not been effectively implemented and enforced by management.

Fraud policy

A sound fraud policy should include:

• a definition of fraud
• a clear statement of the council’s tolerance and attitude towards fraud
• the required standards and procedures for preventing, detecting, reporting and investigating suspected fraud incidents
• staff responsibilities for mitigating fraud risks and managing fraud incidents
• staff responsibilities for reviewing and updating the policy
• information on where further details can be found about specific fraud management responsibilities.

The policy should also be regularly reviewed and distributed widely throughout the council including, where necessary, to contractors and volunteers.

All councils, except Moira, had developed adequate fraud policies.

Moira had yet to develop a specific fraud policy, and instead relied on fraud detection and reporting procedures contained within its code of conduct. These procedures, however, are limited and do not address the requirements for implementing effective fraud prevention strategies.

Whistleblowers Protection Act 2001

The Whistleblowers Protection Act 2001 requires all councils to have written procedures for handling and investigating disclosures about improper conduct by public officers and/or bodies. The Act provides protection to a person who makes such a disclosure, and offers remedies for detrimental action taken against them.

Only three of the five examined councils—Maroondah, Moira and Nillumbik—had established written procedures for managing allegations arising from protected disclosures and made explicit reference to these within their fraud policies.

While Buloke and West Wimmera include a general reference to the Act, neither policy refers to such procedures as they don’t exist.

Consequently, Buloke and West Wimmera are less likely to adequately discharge their statutory responsibilities for whistleblower protection when responding to alleged fraud incidents.

Buloke developed training on the general requirements of the Act during the course of the audit. Although positive, this initiative does not acquit its statutory obligation to develop written procedures for handling protected disclosures.

Code of conduct

The Local Government Act 1989 requires the chief executive officer to develop and implement a code of conduct for council staff.

In 2011, the Department of Planning and Community Development released guidance for councils, titled Framework for the Development and Review of Council Staff Codes of Conduct, to assist them meet this statutory requirement.

We found that all councils had implemented a code of conduct for staff consistent with the requirements of the Act. However, there was significant scope for improvement at West Wimmera as its code does not clearly convey who it applies to, what happens if there is a breach, where to report a breach, or how staff conflicts of interests should be managed.

Therefore, it fails to inform staff clearly about what constitutes ethical behaviour, and the likely consequences, including disciplinary action, of breaches of the code.

Coverage of contractors and volunteers

While all councils relied on contractors and volunteers to deliver key services such as information technology, statutory planning, emergency management and recreational services, only Maroondah had apprised them of its fraud policy. Similarly, none had distributed their code of conduct to contractors, and only Nillumbik had provided it to volunteers.

This reduces assurance that contractors and volunteers at the remaining councils are clear as to what constitutes fraud and ethical behaviour, and what action they should take in the event they suspect a fraud has occurred.

Moira acted to address this during the audit.

2.3.4 Raising awareness

Fraud training

Induction and periodic refresher training for staff assists in assuring they are aware of and understand their fraud control responsibilities.

However, except for Nillumbik, none of the remaining councils provided adequate training to their staff.

Specifically, West Wimmera had yet to establish arrangements to train its staff on fraud control.

Similarly, while Maroondah, Moira and Buloke informed new employees about their fraud policy and/or code of conduct, this was not sufficient to assure staff understood their fraud control responsibilities in the absence of supporting training.

The weakness of this approach was highlighted by the Australian National Audit Office in its 2011 better practice guide Fraud Control in Australian Government Entities. Specifically, it noted an internal review by the New Zealand Inland Revenue Department which found that its employees did not generally read the organisation’s code of conduct until it was breached.

Maroondah began an extensive program of refresher training for existing employees in April 2011, and advised that it has now completed the training for all staff. While, it had yet to introduce induction training for new employees it has since advised that it will provide ongoing refresher and induction training for all staff.

Moira and Buloke similarly commenced action to deliver fraud training to new and existing employees during the audit.

All councils are yet to develop systems for evaluating the quality and effectiveness of their training programs. Consequently there is little assurance the training has been successful and that staff are sufficiently aware of their fraud control responsibilities.

Nillumbik provided both induction and regular refresher training to all staff on fraud and the code of conduct, requiring a minimum pass score of 80 per cent. Testing whether participants achieve the required minimum score is a positive initiative that assures they understand the content, but is not equivalent to evaluating the quality and effectiveness of the training provided in terms of whether it is fit for purpose.

2.3.5 Monitoring

There was significant scope to improve monitoring and oversight of the fraud control framework at all examined councils.

None had established effective arrangements for systematically monitoring and reporting on the performance of their fraud control activities to executive management and the audit committee.

Consequently, the examined councils were unable to demonstrate the effectiveness of their fraud control framework.

Internal audit

Internal audit has an important role to advise the audit committee about the effectiveness of a council’s internal controls and fraud prevention strategies. However, West Wimmera had yet to establish an internal audit program and none of the remaining councils adequately review existing fraud control arrangements.

Further, while the program was periodically reviewed by the audit committee, the absence of completed fraud risk assessments at Maroondah and Moira offered little assurance in each case that it adequately addressed all major fraud risks.

Additionally, none of the internal audit programs systematically reviewed the adequacy of the council’s wider fraud control arrangements. Most focused instead on targeted reviews of key controls associated with high-risk financial functions, such as payroll, accounts payable and cash handling.

While these reviews are useful, broader audits of organisational fraud management arrangements can assist a council to gain a better insight into the adequacy of its fraud control framework and of the extent of compliance with related fraud policies and procedures.

Moira conducted an audit of its fraud management framework in 2005. While the audit recommended it establish an integrated fraud control and risk management framework, this has yet to occur.

Nillumbik had scheduled an audit of fraud management in its forward program for completion by 30 June 2012.

The current absence of an internal audit program at West Wimmera represents a significant gap in the council’s governance framework, and offers little assurance over the effectiveness of existing fraud controls. West Wimmera advised during the audit that it intends to establish an internal audit program in the 2013–14 financial year.

The following case study derived from a recent investigation by the NSW Independent Commission Against Corruption (ICAC) shows how the absence of an internal audit function at a council can create an environment in which fraud can easily occur.

Figure 2B

Impact from the absence of internal audit

Source: Victorian Auditor-General’s Office based on ICAC’s 2010–11 Annual Report.

Audit committee

Audit committees have a key role to monitor a councils’ fraud minimisation and detection programs. Relevant good practices identified within Local Government Victoria’s 2011 guide Audit Committees: A Guide to Good Practice for Local Government include monitoring:

• whether fraud risks have been adequately identified, assessed and mitigated
• management’s efforts to establish strong internal controls
• the council’s fraud prevention and detection framework, including any action taken with respect to actual and suspected instances of fraud.

However, it was not evident that council audit committees actively monitored management’s efforts in implementing fraud prevention strategies. While all committees received reports and maintained a watching brief on suspected fraud incidents, they did not systematically review the effectiveness of the council’s wider fraud prevention framework.

Buloke advised that it considered regular reviews by its audit committee of council’s fraud risk register as indicating that it adequately assesses fraud activities. However, this could not be substantiated as meeting minutes only indicate that the risk register is noted by the committee, and do not document its discussions and assessments of the wider fraud control framework.

Local Government Victoria’s good practice guide also highlights the importance for the majority of audit committee members to be independent of council management, and for periodic reviews of the audit committee’s performance.

At West Wimmera the audit committee does not include any independent members and consists of councillors and senior council staff. Similarly, at Maroondah the audit committee does not comprise a majority of independent members. Consequently these audit committees lack sufficient independence, which impedes their capacity to effectively scrutinise management actions. Maroondah advised it intends to address this by restructuring its committee’s membership so that the majority are independent.

Further, none of the councils adequately assessed the performance of their audit committee. Buloke’s audit committee undertook a self-assessment in 2011. While the outcome was generally positive, the assessment had inherent limitations as it relied solely on the unverified perceptions of existing audit committee members without reference to objective criteria and supporting evidence.

2.4 Evaluation and continuous improvement

Periodic evaluations of a council’s fraud control arrangements are important for continuous improvement and for assuring they remain effective. Specifically, they can assist in determining:

• the relevance and priority of fraud strategies in light of current and emerging risks
• whether fraud strategies are effectively targeting the right and/or desired areas
• whether there are more cost-effective ways of managing key fraud risks.

None of the councils had adequately assessed the performance of their fraud control activities, nor had they internal reporting processes that adequately monitored compliance with their fraud policies or procedures.

Additionally, none had adequate arrangements for detecting fraud in the event that their preventative systems failed. For example, none had performed regular data mining and forensic data analysis to detect potential fraud incidents.

Consequently, the examined councils cannot demonstrate that their current fraud control arrangements are effective.

Notwithstanding, limited improvements to fraud management practices since our 2008 review were evident at most examined councils. These included:

• establishing specific fraud risk registers based on assessments of fraud risk—at Nillumbik and Buloke, with Maroondah in the process of developing one
• issuing a code of conduct for staff clarifying expected and unacceptable behaviours—at Maroondah, with codes already in place at the remaining councils
• implementing a fraud policy detailing the consequences for fraudulent conduct including procedures for managing allegations and incidents—at all councils except Moira
• providing training to staff on their responsibilities for managing fraud risk—at Maroondah and Nillumbik.

Further improvements were also evident from our reviews of the external assessments of fraud management practices at Nillumbik, Moira, Buloke and West Wimmera by their fidelity insurer.

These assessments involve assigning a score to each council based on a limited review of their corporate governance, fraud policy, fraud risk assessments, controls, and fraud awareness training. All examined councils showed an improvement from their previous assessment—ranging from a 16 per cent increase in score at West Wimmera to 32 per cent at Nillumbik, 52 per cent at Buloke and 55 per cent at Moira.

These reviews, however, do not provide sufficient assurance that fraud control arrangements are effective as they are high-level in nature and exclude key fraud control initiatives essential for good practice, such as whether councils have a fraud control plan in place.

Therefore, while the improvements are encouraging, they have not been sufficient to establish an effective fraud control framework at each council.

Recommendations

Councils should:

1. develop and maintain an up-to-date fraud control plan clearly documenting their fraud prevention, detection and response initiatives and responsibilities
2. conduct thorough, periodic fraud risk assessments to assure they identify and effectively manage all major fraud risk exposures
3. provide induction and periodic fraud awareness training to all council staff, to assure they understand their fraud control responsibilities
4. systematically monitor and report on the effectiveness of their fraud control strategies
5. establish arrangements that assure effective ongoing scrutiny by executive management, internal audit and audit committees, of the effectiveness of the fraud control framework.

3.1 Introduction

Research by KPMG indicates that more than half of all major frauds occur because of poor internal controls or the overriding of these controls.

Adequate internal control systems are critical for preventing and detecting frauds. The nature and extent of these systems should reflect each council’s unique operating environment, fraud risk profile and available resources.

Although strong preventative controls are the best defence against fraud risk, establishing them may not always be feasible because of resource constraints, particularly at smaller rural councils. In these cases, effective compensating controls are needed. These are normally detective in nature as they generally operate after a fraud has occurred.

While this is less satisfactory than preventing a fraud, it represents a practical approach for small resource-constrained councils to mitigating the increased risk through deterrence.

This Part of the report examines the effectiveness of internal controls at selected councils for activities with a high fraud risk.

Recommendations

Councils should:

1. establish effective pre-employment screening processes that provide sufficient assurance over the integrity, identity and credentials of all council staff
2. make sure accounts payable systems have effective preventative and/or compensating controls that adequately mitigate the risk of fraudulent purchases and/or payments
3. maintain accurate and an up-to-date asset registers that are regularly reviewed to mitigate the misuse and/or misappropriation of assets
4. systematically review the operation and effectiveness of all their internal control systems to assure they adequately prevent, deter and detect major frauds.