Governance Toolkit: Financial abuse

Conduct a risk assessment to identify and assess the risks of financial abuse. Your charity can use our template risk assessment as a guide.

A risk assessment involves:

• identifying the risks of financial abuse that your charity faces
• prioritising each risk according to its likelihood and consequences
• identifying the policies, procedures and systems that will deal with the risks.

This is a methodical way to make sure that your charity has considered what could happen, and how it will approach incidents that do happen. You can conduct risk assessments for the whole organisation, for a particular department, or even for specific processes, programs or projects.

Risk assessments do not have to be complex and bureaucratic. A simple and methodical approach is best.

When conducting a risk assessment for financial abuse, use these points as a guide:

• Think broadly about all the things that could be targeted. This might include data, people, funds – even financial statements. Where are these things located? To what forms of financial abuse could they be exposed?
• Consider both internal and external activities, such as your charity’s supply chain, partners and subcontractors. What could go on just beyond your charity’s view?
• What is the likelihood of your charity’s resources being affected by these risks? How common are incidents like these?
• What might the consequences be in the case of an incident? Consider the effects on your charity’s beneficiaries, reputation, financial position, partners, and the morale of staff.
• Seek lots of information to understand the risks. Consult widely, for example through meetings, workshops and surveys, and identify information sources such as previous incidents, audit reports, events in other organisations, and media reports.

Once you have identified the likelihood and consequence of risks, you can focus on the most significant ones and address them with appropriate policies, procedures and systems.

Review the risk assessment regularly to ensure it is up to date – for example, an annual review may be appropriate or after significant changes in your charity’s operations.

Maintaining a registry of your charity’s legal obligations can also be helpful. This can help you keep track of any changes that may affect how your charity manages its risks.

Your charity’s leaders (Responsible People and senior management staff) should clearly express their commitment to fighting financial abuse. This commitment could be demonstrated, for example, through written statements, endorsement of strong policies against financial abuse, or contributions to wider anti-fraud and corruption initiatives.

The cornerstone of your charity’s approach to managing risk, though, should be a policy that works to prevent financial abuse. Such a policy should:

• include a clear statement of commitment that your charity will not tolerate financial abuse
• define key terms, such as fraud, corruption and conflicts of interest
• give people specific responsibilities to manage the risk of financial abuse
• explain how people should report their suspicions, and what protections exist for those that do.

Everybody should be able to access the policy – beneficiaries, staff, volunteers, partners, vendors and suppliers, and perhaps even the public. It is good practice to make it available to the public.

Part of your charity’s commitment means making sure that all staff and volunteers understand the risks of financial abuse, how they can help prevent it, detect it, and act on incidents.

A good way to raise awareness among staff of the risks is to have regular informal discussions and workshops – for example, at a monthly meeting. Dedicated training on financial abuse and wrongdoing is always a worthwhile option, and there are many good resources available online for free.

Developing a culture that minimises the risk of financial abuse is an important and effective way to protect your charity. To help develop and maintain a culture that strengthens your charity against financial abuse, consider these questions:

• Does your charity express its values in a code of conduct?
• Does the leadership of your charity embody the desired culture, and do their words and actions encourage others to be part of it?
• To what extent do the people in your charity demonstrate integrity, transparency and accountability?
• How are these values built into your charity’s governance, management processes, and systems?
• How do attitudes and events in your charity compare with the culture your charity wants to develop?

Policies, procedures and systems can reduce the likelihood and consequences of financial abuse. These are commonly called internal controls.

Internal controls should be appropriate for your charity’s circumstances. When creating them, the following principles might help you identify the best controls for your charity.

• Segregation of duties: prevent and detect financial abuse by requiring more than one person to approve or carry out financial activities. For example, have a rule that means two or more people are needed to approve transactions or to count cash together.
• Access controls: prevent abuse by limiting access to systems and storage. Who needs access to what, and why? This may include passwords for computer systems, and physical locks for safes, cabinets and rooms.
• Audit: detect abuse with physical or electronic audits. This includes checking inventories of assets, stock and cash.
• Reconciliation: detect abuse by carefully checking assets, funds, stock or documentation. For example:
  • before approving a transaction, compare the invoice and the purchase order
  • compare the balances in your charity’s books and records with its bank accounts
  • look at inventory numbers – is anything missing?
• Standardising documentation: detect and prevent abuse by having documented procedures and ensuring staff and volunteers follow them. Standard formats can help to promote good practices, highlight deviations, and make reviews easier.
• Approvals: prevent abuse by having clear processes for approvals. In general, transactions of higher value or greater risk should be approved by higher authorities – and remember the importance here of having more than one person approve transactions.
• Due diligence: prevent abuse by doing sufficient background research and checks for decisions involving finances. For example:
  • before signing a contract, research the potential supplier
  • before reimbursing an expense, check that it was a legitimate expense and there is a receipt to support it
  • before employing someone, check their references and verify their identity.
• Trial balances: detect abuse early with regularly checking your charity’s accounts.

Typically, a charity will set out its controls in policies and procedures such as:

• a code of conduct
• a policy for addressing conflicts of interest
• a policy, procedure or manual for finances
• a policy, procedure or manual for procurement, supply and logistics
• a policy and procedure for fraud control.

These policies and procedures will be different according to the size and resources of a charity. For example, a small charity may have a single manual covering all these requirements, while a larger charity may need several different policies and procedures.

It may not be possible to prevent all incidents of abuse, but detecting incidents that slip through early, and taking immediate action in response, is important.

The longer your charity takes to act on financial abuse, the worse the likely consequences will be.

A helpful concept is the red flag. A red flag represents suspicious activity that might indicate abuse. Red flags are not proof of anything bad, and there may be innocent explanations for things with a red flag, but it is important consider them as a possible indicator of financial abuse.

A red flag may be used for a single anomaly, such as a transaction at an unusual time, or it may be used for several things that become suspicious in a particular sequence or context.

The Association of Certified Fraud Examiners identifies five categories of red flag:

• Accounting anomalies: for example, missing supporting documents or unexplained journal entries.
• Internal control weaknesses: for example, persistent failures, such as controls being overridden by managers, or no segregation of duties.
• Analytical anomalies: for example, transactions that happen at odd times, or the dates on documentation being out of sequence.
• Operational anomalies: for example, unusual events in the life of an organisation, such as high turnover of staff in a compliance team.
• Behavioural anomalies: for example, staff living beyond their means, never taking leave, being over-defensive or protective of their work, personal financial problems or addiction to substances.

Sometimes charity workers believe that because their charity has not detected any incidents of abuse, there are none to find. This is unwise because most forms of abuse are deliberately deceptive.

Detection alone is a poor measure of the extent of incidents or the scale of the risks. It is important to consider whether there are any red flags, and whether your charity can identify them.

There are a range of ways to detect red flags.

Active detection might include using data analytic software, or doing proactive reviews of processes, accounts and documentation.

Passive detection might include:

• an overt reporting system in which people report suspicious activity to appropriate people in the charity
• a confidential reporting system in which people can report suspicious activity confidentially and anonymously.

Typically, ways to detect red flags are set out in policies and procedures, such as a confidential reporting or whistleblower policy.

It is important to take prompt action on potential incidents.

Your charity should have:

• a clear, documented process for managing a suspected incident
• clearly assigned roles and responsibilities – make sure people know who is responsible for doing what
• access to qualified and experienced staff to carry out investigations if necessary
• an effective procedure for dealing with misconduct
• a procedure for reviewing incidents to ensure that lessons are learned
• a procedure for reporting incidents to external parties, if necessary – for example the police, the ACNC, or a partner or donor agency.

It is often a good idea to keep these documented processes and procedures together in a response plan.

When considering how to investigate a matter, consider:

• Does your charity have skills, experience and capability to properly investigate the matter? If your charity doesn’t have the capability, it is a good idea to seek support from outside.
• Would your charity be able to show that the investigation was sufficiently independent?

If your charity has to address an incident of financial abuse, it is crucial that it learns from the experience. Lessons could lead to:

• a new policy, procedure or process where previously none existed
• improving an existing policy, procedure or process
• training for current employees and volunteers
• hiring staff to fill necessary positions.