While hybrid working offers many recognised benefits, it has also given rise to significant ongoing challenges for businesses.
One of those, which we discussed at our Hybrid Working Confidential breakfast session earlier this week, is the enhanced risk of employee fraud and data security breaches as a result of a large number of staff working from home, pursuant to their employer’s hybrid working policy.
In this article we discuss employee fraud warning signs and suggest steps that employers can take to combat the risk and minimise the potential damage.
The increased risk of “out of sight out of mind”
The majority of employees are trustworthy and loyal, and workplace fraud is rare, which means that the risk of employee fraud may not be front of mind for many employers.
However, the illegal actions of just one employee can cause considerable damage to an organisation, both reputationally and financially – take the example of an employee who diverts payments intended for suppliers into a personal bank account. Not only has the business lost those funds, the employee has exposed inadequate security systems within the company, and potentially damaged ongoing commercial supply relationships.
Some employee fraud may be less blatant than the example mentioned above, however. Those with solid knowledge of their employer’s systems and controls may be able to manipulate performance results, for example. Enhanced results may, in turn, lead to higher personal bonuses, or ensure that there is a bonus pool in the first place (if business results would otherwise fall short of the bonus threshold).
The popularity of hybrid working, viewed against the background of the current economic downturn, has created enhanced opportunities for a minority of employees intent on dishonest conduct.
Our previous article on this topic, published during the pandemic, highlighted the fact that employee fraud is often underpinned by the concept of “need or greed” – the idea that employees are motivated by an actual or perceived pressure to address the shortfall in their finances.
Many employees are experiencing real financial hardship due to the cost-of-living crisis, and the prospect of a lengthy recession ahead means that the “need” element is likely to be of particular relevance just now.
If an employer has fallen into an “out of sight, out of mind” approach in relation to those staff who regularly work from home under a hybrid working policy, a dishonest employee may feel emboldened, expecting their fraudulent behaviour to go unnoticed.
Employee fraud warning signs
Given the risk highlighted above, employers should keep their guard up against employee fraud. There are various scenarios that can give rise to red flags that warrant further investigation. For example:
- New joiners and onboarding
Candidates in a competitive job market may be tempted to embellish their CV (at best), or outright lie about their qualifications, skills, and experience (at worst). While most recruitment vetting processes will pick up any obvious lies, there is always the possibility that some individuals slip through the recruitment net and are able to commence a role that they are not qualified to do. In a hybrid working world, interviews and “meet and greets” may have taken place online initially, but good first impressions do not remove the need to double-check qualifications and references. Fraud in this context would leave an employer facing reputational damage, negligence risk, and investigation and action by a relevant regulator (e.g. the SRA or PRA/FCA).
- Access to data
Employers should have a good understanding of which employees require access to proprietary data and confidential business information to properly perform their role. If it becomes clear that data has been accessed, viewed and processed by staff members who, on the face of it, have no reason to do so, then the employer should start asking questions.
- Untoward employee behaviour
It can often be personality changes or changes in behaviour in employees that alert line managers to the fact that something is wrong. Examples might include working excessive hours and a reluctance to take holidays or delegate (because wrongdoing could be uncovered by colleagues).
An upscaling in the employee’s lifestyle, without a separate explanation, could also raise alarm bells. Indeed, an employee who seemingly begins to live beyond their means is the number one indicator that the employee may be committing fraud.
There is no set profile in relation to a fraudulent employee, although statistically a long-serving, trusted employee is more likely to commit fraud than a relatively new joiner.
Similarly, seniority does not mean immunity from untoward conduct. In fact, senior employees may be willing to (and often do) take bigger risks in return for the benefit of a higher reward: Madoff, Enron, Wirecard, Parmalat, Volkswagen – household names that are as well known today for the massive frauds discovered being committed in the C-suite as they were in their heyday for their products and services.
Steps to minimise the fraud risk
With a view to reducing the opportunity for fraudulent conduct to occur, employers should ensure their hybrid working policies are effective and seamless. If employees can move easily between office and home and maintain their connection with colleagues and the business, there is less chance of individuals becoming disengaged and seeking to exploit opportunities.
A key element of this approach is making sure that the business operates effective security, systems, and controls whether staff are in the office or elsewhere. This is imperative in highly regulated industries, such as financial services, but it can receive less focus in businesses which do not face scrutiny from an external regulator.
Other key steps that employers should consider include:
- Recruitment due diligence
Ensuring you have robust recruitment checks and processes in place for job candidates (including financial checks, where appropriate) is a key element of the onboarding process. Following up with referees can be an effective way to ensure that candidates are as qualified and capable as they say they are, and do not have a history of misconduct.
- Siloed access to data
A review of which employees can access sensitive confidential information may reveal the need to tighten internal controls to reduce the risk that such information is misused. In particular, some businesses operate IT and business information silos, with very limited or no access for teams that have no need to do so on a day-to-day basis.
- Internal policies and fraud awareness training
Employers should review their internal policies to ensure that they address employee fraud, detail management’s zero-tolerance approach, and outline the potential for dismissal for gross misconduct. In turn, regular fraud awareness training will assist line managers in understanding the warning signs to look out for and the investigation process to follow if fraud is suspected.
- Supervision
One of the best ways to reduce the risk of employee fraud is to minimise the opportunity for employees’ behaviour to go undetected. Employers should analyse reporting lines to identify and address any supervisory gaps which would allow employees to work under the radar for extended periods of time. Line managers should meet regularly with team members and adopt a consistent approach to supervision, regardless of whether staff are working from the office or at home.
- Employee monitoring
Some employers have responded to the challenges of remote and hybrid working by expanding their employee monitoring, so that there is greater visibility in relation to employee productivity while working from home, and a means of quality checking work. While this may assist with spotting untoward behaviour, it still requires a cautious approach and consideration of the legal implications (including under the UK data protection regime). It is also a tricky balance from an employee relations perspective. Monitoring which is considered too intrusive by the workforce can easily damage the trust in the employment relationship. That said, it is relatively common in certain highly regulated sectors (such as financial services) and in some cases, automated monitoring in particular can offer an effective risk management solution – for example, AI solutions are great at detecting anomalies and do so very quickly.
- Respond quickly to red flags
Warning signs should be investigated as quickly as possible, with a view to determining the extent of any fraud and the methods used, so that the employer can regain control and minimise the potential damage. The longer it takes an employer to respond, the more chance a fraudulent employee will have to try to cover their tracks. A confidential reporting process e.g. whistleblowing hotline, can be an effective way to encourage employees to report suspected fraud to management and to facilitate a swift response.
- Keep in close contact with your people and watch for the danger signs
If you know your staff, you will know who feels underpaid, who feels overlooked for promotion, who feels at risk and who is having problems outside work. As noted above, if you know your people you will be able to detect changes in behaviour that may be an indicator of fraud.
Authors
Follow us online
