Rationalizing Fraud

Focus on the bigger mission.

Focusing on the bigger mission may be the most difficult rationalization to root out. COSO recognizes that diversity in employees’ backgrounds is instrumental for innovation and productivity, but it can backfire if not properly aligned with organizational objectives. Start by establishing the accountability and authority of employees within the context of broader organizational goals, then explaining clearly to employees the reasons for limiting their authority.

While many organizations focus their attention on developing an appropriate code of conduct, this is only one measure needed for an effective control environment. Management’s actual behavior and its reactions to deviations from the code of conduct send a much stronger message to employees than the content of the code itself. Recall that Enron produced a 64-page code of ethics, signed by every employee, as well as a training video on integrity. That code was no more than a piece of paper; management’s behavior—greed, corruption, and extreme hubris—created a toxic tone at the top and a culture tailor-made for fraud. An organization’s positive behavior in response to ethical deviations, and the creation of a culture of integrity and accountability, can just as effectively produce positive results.

Management must also be aware that employees operate in a broader society and are exposed to cultural norms that can override the conditions of the code. This is especially important when dealing with foreign subsidiaries or employees from different cultures. Studies suggest that people’s convictions of what is morally right or wrong (their “moral structures”) form very early in life as a consequence of cultural socialization. Once a moral structure is formed, acquiring another might be as difficult as acquiring a second language (Jesse J. Prinz, The Emotional Construction of Morals, Oxford University Press, 2009). Research on cross-cultural differences suggests that people from some countries have much higher tolerance than others for unequal power distribution within society, as well as a much stronger preference toward tightly integrated relationships outside immediate family (Geert Hofstede, Gert Jan Hofstede, and Michael Minkov, Cultures and Organizations: Software of the Mind, McGraw-Hill Education, 2010). Individuals from such cultures might experience stronger internal conflict between their collective group loyalty and formal code compliance when pressed to do something unethical by their colleague or supervisor.

Unfortunately, the “focus on a bigger mission” technique can be an effective way for such individuals to resolve a conflict in these circumstances. If an organization has significant international exposure, it is critical that internal auditors and antifraud executives are educated on these important intercultural differences. Even if the company operates exclusively in the United States, culture outside an entity matters as much as culture inside. To decrease the possibility of encouraging a “focus on the bigger mission” technique among employees, management needs to ensure that the corporate code of conduct is shared and enforced by business partners, especially those involved in the value chain and provision of outsourced services.

In addition, codes of conduct and corporate ethics programs are especially prone to a checklist mentality: schedule a workshop (check), require all employees to attend (check), read a list of dos and don’ts (check), and promise to do it all again next year (check). This attitude becomes further entrenched if management does not model appropriate behavior. Instead, think of the code of conduct as a daily practice, ensure timely updates to the materials and procedures, and instill the principles throughout every event, action, and reaction in the organization. Otherwise, efforts may quickly become stale and inadequate, inviting indifference and defiance.

Of course, even the most effective control environment is no guarantee against use of the “bigger mission” rationalization; it does little to deter the loyalty or fear of employees who commit fraud in order to protect their colleagues or families. Consider Betty Vinson, a WorldCom accountant who pleaded guilty to fraud charges. She cited concern for her family’s health insurance and a scarcity of comparable jobs in Jackson, Mississippi, as reasons for conceding to management demands. Similarly, David Myers, the former WorldCom controller, defended his fraud involvement by citing his desire to stay loyal to the team. Upping the ante was Scott Sullivan, the WorldCom CFO, who persuaded Vinson, Myers, and other WorldCom employees that their fraud-related actions were as essential to WorldCom’s survival as the behavior of an aircraft carrier’s personnel is to bringing planes and pilots safely home (Melanie O. Anderson, “Worldcom’s Betty Vinson and Cynthia Cooper: A Tale of Two Professionals,” Strategic Finance, July 2013, http://bit.ly/2BtaBgE).

How can companies fight this? First, consider that the incentive structures and external economic realities that feed this rationalization are common across employees. Recognize that all employees are likely to fear job loss and retaliation, and to feel a responsibility for their colleagues’ well being. Second, remember that some of the most prominent frauds of the past involved collusion, and many fraud instigators seem to be intuitively aware that appealing to the bigger mission is an effective method of convincing others to participate.

The few examples of rationalizations in COSO describe fraud committed by a “lone wolf.” Instead of limiting searches to such cases, think like the WorldCom crooks: consider the incentives and policies that could encourage employees to follow somebody like Scott Sullivan. Think like the Wells Fargo employees and consider whether incentive programs encourage employees to commit fraud en masse on a daily basis. How can such policies be redesigned to encourage the right behavior? What recourse is available to employees like Vinson and Myers to counteract the appeal to higher loyalties? Do employees know where to report the pervasive and destructive effects of organizational policies? Are there clear protocols for encouraging and protecting whistle-blowers? And more importantly, has the company demonstrated this commitment to employees?

Because it is impossible for an organization to influence most external realities, such as unique family duress, the next best option may be a strong, independent, well-staffed monitoring function. The fact that the internal audit function ultimately exposed the fraud at WorldCom is a lesson for all organizations. Such a function is crucial not just for detecting fraud before it becomes catastrophic but also for deterring fraud in the first place. COSO stresses the necessity to consider the joint effect of several components in achieving effective antifraud practices. While a strong control environment reinforces a commitment to integrity, clearly communicated lines of reporting and an effective monitoring function send the message that fraud detection is imminent and signal a willingness to take prosecutorial action.

Focus on responsibility.

A focus on responsibility is an easily accessible rationalization in accounting settings. The more people are included in a questionable decision or task, the easier it is to engage in diffusion or displacement of responsibility. This is a valuable insight for corporate boards, and suggests the need for a smaller number of members on committees that are prone to ethical temptation (e.g., compensation, audit). It’s a simple numbers game: fewer members means less opportunity to diffuse responsibility. If the company has embraced the team structure for work tasks, diligence is needed in carefully designing groups to mitigate this technique.

Furthermore, companies need to be particularly cognizant of midlevel managers acting in the role of transmitters (Shadd Maruna and Heith Copes, “What Have We Learned From Five Decades of Neutralization Research?” Crime and Justice, 2005, http://bit.ly/2SNAZM8). Research suggests that this group could more easily rationalize responsibility in order to pursue destructive commands. In a traditional organizational hierarchy, the people at the top are responsible for generating fraudulent initiatives (e.g., a scheme to manipulate earnings by capitalizing line expenses), while the people at the bottom are responsible for the direct execution of these plans (e.g., physically recording the transaction in the accounting system). The transmitters can use their position to deny any responsibility: they did not order nor implement the fraud. Companies should offer robust training for employees, both transmitters and those they pressure, to recognize and report fraudulent directives. Clear, consistent, and protective methods for whistleblowing are critical to encourage individuals to resist the temptation to absolve themselves of responsibility and instead take action when fraudulent behavior is suspected.

In addition, management should be mindful of the impact that outsourcing certain functions has on the ease with which this rationalization can be invoked. Outsourcing of functions and processes will likely decrease the sense of employee ownership over these processes and related controls. COSO recognizes the unique risks created when organizational activities are outsourced to a service provider (OSP) and explicitly discusses potential responses to such risks throughout the framework. For example, under Principle 1, COSO mentions the importance of communicating ethical values to OSPs, but also stresses that management should be aware that it still bears the ultimate responsibility for delegated processes and outcomes. COSO also points out under Principle 3 the importance of the board of directors to consider OSPs when establishing authority structures and reviewing potential conflicts of interest. These and other measures discussed in COSO with respect to OSPs should reduce the risk of invoking responsibility-driven rationalizations.

Focus on consequences.

This rationalization technique—and the next—is more intuitive and more familiar to CPAs. The Exhibit highlights methods commonly used by fraudsters to justify their actions through the perceived outcome. COSO suggests that a fraudster might frame her actions as borrowing with the intent to pay back; the ability to alter the accounting records to hide the “temporary loan” acts as the final push to move from contemplation of fraud to action. Similarly, framing a fraudulent act as being “below the materiality threshold” is another dangerous rationalization unique to the accounting context.

Given the complexity and highly technical nature of the accounting environment, fraudsters are likely to speak in sophisticated accounting jargon and sanitizing language—not only during conversations with others, but also in their internal monologue—to quiet a troubled conscience. For example, Sullivan defended the capitalization of line expenses to the WorldCom board with the matching principle. Sushovan Hussain, the ex-CFO of Autonomy Corporation who was convicted in 2018 of securities fraud that overinflated the company’s business by billions of dollars, attempted to exonerate himself while on trial by citing the technical differences between British and American accounting standards. Executives should be mindful about such doublespeak, and board members should follow up with probing questions if they spot it in senior management’s presentations.

Focus on the victim.

Focusing on the victim has multiple applications in accounting fraud. For embezzlers, the victim is the company, and by focusing on real or imagined slights in the work-place, the embezzler justifies his actions. Believing that the company “does not pay me enough” or “passed me over for that promotion” gives an embezzler a reason to neutralize or disengage. Generating fraudulent financial statements may be justified in much the same way, but in this case, the benefit gained is a bonus or stock option payoff. If executives feel pressured by shareholders and analysts’ expectations, the act of providing fraudulent statements to those very parties may be viewed as “deserved.” This technique draws attention to the importance of sound human resource policies for hiring and promoting, as well as supervising personnel activities. Ensuring that employees are paid fair market wages, receive adequate benefits, enjoy a safe work environment, and experience timely and effective responses to voiced concerns can reduce the inclination to “settle the score.”

In addition, denial of the victim is a popular rationalization when the victim is not known or physically distant. It is easy to invoke this technique while manipulating financial statements, because shareholders are so far removed from the immediate fraud perpetrators. Patrick Kuhse, who stole millions of dollars from the state of Oklahoma through fraudulent commissions in the early 1990s, rationalized that no one would be hurt much since Oklahoma has millions of taxpayers. In the above-mentioned case of Autonomy Corporation, Hussain’s lawyer argued the case should have been dismissed because Autonomy was a U.K. corporation, purchased by a Dutch subsidiary of Hewlett Packard—which made it challenging to identify the fraud victims and related jurisdiction. Creating feelings of ownership in the organization through stock options or similar compensation can also backfire, as past frauds prove that this encourages the very behavior companies seek to prevent. Accordingly, a strong corporate board, an internal audit function, and external audit monitoring are critical for mitigating this principal-agent problem.

Although this article focuses on the direct relationship between the fraudster and the company, it is important to remember that organizations do not exist in a social vacuum. The reasoning and behavior of leaders are directly affected by the activities and guidance of larger societal institutions, such as the SEC, PCAOB, and Congress. Not surprisingly, fraud becomes pervasive when those institutions establish dysfunctional incentives and loosen oversight (Ramamoorti et al. 2013).