Telecommuting exposures - risk assessments of new business processes

Internal Auditor, Oct, 1998 by Courtenay Thompson

Anticipating risks in new business processes - like telecommuting - can help eliminate financial losses and organizational embarassment.

"I've been thinking about some of the dramatic changes the organization has been making," Steve Andrews said. "I'm wondering if we should take a look at the fraud implications of some of these developments." Steve, General Auditor for ABC Financial Services Company, was talking with Lucy Sharp, a Senior Auditor at ABC with five years of experience.

Lucy replied, "We've been looking at some of the risk implications of these developments as part of our normal review of controls."

"I know, I know," said Steve, "but I'm concerned about exposures we haven't previously addressed. And what about the risks that haven't even occurred to us yet?"

"What do you mean?" asked Lucy.

Steve continued, "Just a few days ago I read a magazine article about the growing popularity of telecommuting, for example. More companies today are enabling employees to work at home, and the magazine was extolling the virtues of this new business trend. There was no mention at all of any drawbacks."

"ABC has several thousand people who work at home," Lucy said. "Some work at home all the time, others telecommute one to three days per week. In some divisions the sales staff will be in the field four days each week; they spend the fifth day at their offices - in their homes."

"I'm beginning to wonder if we've thought about the possible risk exposures in situations like that," said Steve. "Sometimes when an executive is enthusiastic about a new concept, the entire organization will get behind the idea without looking for the dark side."

"You mean without thinking about what can go wrong?" Lucy asked.

"Exactly," Steve responded. "I believe an important part of the creative process is to brainstorm what can go wrong. It's actually a positive exercise, but it might also identify problems in our planning process."

"I've witnessed some situations recently where anticipating problems might have saved a lot of money and embarrassment," said Lucy.

"So have I," said Steve. "We don't want to stop all progress, but I'd feel better if I knew that planning for changes like telecommuting included the consideration of fraud implications."

"What if we were to undertake a special project to do just that?" asked Lucy. "We could ask management what their concerns are about telecommuting and also find out if they've had any experiences that would give us a better handle on the exposures."

"We might also ask our colleagues at other companies to describe any difficulties that they have experienced," suggested Steve. "In the meantime, I can give you one case for your project. It's not classic telecommuting, but it's relevant. a sales representative who covered the Southeast for one of our divisions worked out of an office in his home. His productivity started to slide, and his bosses began to suspect a problem.

"An investigation revealed he was starting his own business and was planning to go into direct competition with us. He was using company equipment, supplies, phones, credit cards, and time for his business. We even paid for business trips that benefited his new business, but not us.

"Of course, he could have done almost the same thing from a company office; but it would have been more visible and perhaps would have been detected sooner. Anyway, let's start investigating the exposures in telecommuting and see what we can learn."

Six weeks later Lucy was back in Steve's office to discuss their progress. "The project has been very interesting," Lucy said. "Most of the managers we interviewed seemed primarily concerned with productivity issues. Are the employees working diligently all the hours that they claim?'...'Do home projects or childcare responsibilities get in the way of the employees' effectiveness?'...'Are the employees in danger of becoming too isolated?' That sort of thing. These are valid concerns, but no one mentioned any qualms about fraud or integrity issues until we asked them about the possibility.

"When we mentioned that fraud could be a telecommuting issue," Lucy continued, "many confessed they had focused on empowering employees, and they really had to trust them to do their jobs. Yet when the managers started contemplating the topic, several mentioned that integrity issues had arisen."

"For example?" asked Steve.

"Well, one employee was involved in a multi-level marketing company as a side business. After his productivity started to falter, his bosses suspected a problem and confronted him. He admitted most of his time was spent on his other business."

"How long did it take for that to surface?" asked Steve.

"About six months," she said. "Another manager told me about an employee who had been terminated. When he was fired, some confusion arose about who owned the equipment in his home office. He claimed it was his, that the company had told him he would own it in exchange for working at home and saving office space."

"I thought that was all spelled out in our telecommuting policy," Steve said.