Chris Ekimoff: Hello and welcome to the Immaterial Podcast where we explore the front page and the footnotes to discuss accounting, the law, white collar crime, and everything in between. I'm your host Chris Ekamoff and today we're back with an analytical procedures episode focused on recent developments and current events in the legal accounting and finance space with my friend Mason Wilder. Today we're digging into something that every organization talks about. most organizations struggle with and almost all professionals will encounter at some point in their careers, that's fraud risk management. The Association of Certified Fraud Examiners or ACFE in partnership with Grant Thornton just released their Anti-Fraud Blueprint, a foundational framework designed to help organizations build, mature, or enhance their fraud risk management programs. And this isn't just another white paper on the shelf, it's meant to be practical. It's meant to be usable and importantly, it's meant to meet the reality of today's fraud landscape. One that's shaped by remote work, complex organizations and increasingly sophisticated technology. To talk about it, I'm joined by I'll say the author, he'll say he's not the author, Mason Wilder from the ACFE. He's closely involved in bringing this blueprint to life. He's a certified fraud examiner and the research director at the Association of Certified Fraud Examiners and he leads many of the ACFE's global research initiatives, especially one of my favorite page turners every two years, the Report to the Nations, as well as a variety of other benchmarking reports and thought leadership projects. Now, before joining the ACFE, Mason actually lived what he talks about now, spent more than a decade in corporate security intelligence and investigations, working on due diligence, background investigations, and international risk and crisis response. He's a frequent author, trainer, and speaker on emerging fraud risks. If you're a CFE member, you probably know or have seen Mason before. He's uniquely positioned to help translate complex fraud trends into practical guidance for us as practitioners. Mason, welcome to the Immaterial Podcast.
Mason Wilder: Thanks so much, Chris. Happy to be here. And even though I had to sit through that whole long thing about myself that made me slightly uncomfortable, I appreciate it.
Chris Ekimoff: ⁓ you're good.
Mason Wilder: you know, ⁓ always enjoy an opportunity to talk about some of the work we're doing at the ACFE that is often really informed by, you know, the contributions of really passionate ⁓ anti-fraud professionals such as yourself, including this one. And yes, ⁓ not the sole author. This was a collaborative effort ⁓ and lots of ⁓ really good contributions from the Grant Thornton side. And then of course, our ACFE design team did an excellent job as
Chris Ekimoff: Of
Mason Wilder: always bringing its life and making it look really good.
Chris Ekimoff: It does take a village. And for those viewers and listeners out there who are not familiar with the ACFE, they are the largest leading anti-fraud organization in the world. I think we number in somewhere in like the 400,000 members. Mason, I don't have the actual count, ⁓ but there's a lot of folks. Little high? Yeah. Four, we're at four members? Only four members?
Mason Wilder: It's a little bit high there. think we're just over... Yeah, no, we're coming up on 100,000 worldwide and about close to 60,000 of those are CFEs.
Chris Ekimoff: 100,000, excellent. Excellent. Yeah, it's a great group. And again, if you're not familiar, definitely check out their work, great podcast, great training environment for those in the anti-fraud profession. So, all right, let's get back to this Blueprint Mason here. We're talking maybe 10 days after it went live. So we're in the early days of publication. ⁓ One question I've got for you as an active participant in everything the ACFE does, what's up with this Blueprint and why do we have it now? We've got a fraud risk management guide from the ACFE. We know about the anti-fraud playbook that came out. What is the difference and what is the reason for the anti-fraud blueprint today?
Mason Wilder: Well, I think, ⁓ you know, the fraud landscape in the last five, six years or since the original COSO Fraud Risk Management Guide that we put together with COSO in 2016, things have changed a lot. The pace of change is kind of increasing. And so, you know, it was we felt like it was ⁓ time and, you know, a good opportunity ⁓ to update some of this and give it more of a practical application lens. to help organizations deal with this pace of change that is requiring adjustments and evolution of fraud risk management programs to keep up with these changes to the fraud landscape that seem to be just accelerating.
Chris Ekimoff: I like too the idea that we've got kind of these, know, semantics matter, right? Nomenclature matters. So we have management guides, we have playbooks and we have blueprints. Maybe talk to me a bit about what those words mean and why you guys chose to title that as such.
Mason Wilder: Yeah, so this blueprint is actually kind of a replacement for a previous ⁓ piece that we put together also with Grant Thornton that was the Anti-Fraud Playbook. And so this... kind of reflects an evolution of that playbook that takes it to another step that ⁓ offers really the kind of blueprint for ⁓ putting into action a lot of these principles and guidance that are ⁓ explained in much more detail in the COSO Fraud Risk Management Guide. Another point, this is not meant to replace ⁓ that COSO Fraud Risk Management Guide that we just published in 2023.
Chris Ekimoff: Mm-hmm.
Mason Wilder: ⁓ this is really a supplement and really you know a blueprint for turning those principles and that guidance into action items that can really have a positive impact on your organization's fraud risk management program, regardless of what level of maturity it currently is. Most organizations have fraud risk management programs in place. this so that doesn't mean this document isn't for them. It's not just about establishing or building one. It's about regularly assessing and evolving
Chris Ekimoff: Mm-hmm. Mm-hmm.
Mason Wilder: your program to ensure that it is as effective as it can be.
Chris Ekimoff: Yeah, I like to think of the word blueprint and feel free to do what I did out there, viewers and listeners go, go to your favorite artificial intelligence tool and type in what is a blueprint for a great definition. You know, a lot of reading on this was enjoyable, but to me that this blueprint is really that bridge between the thought processes around why fraud risk management is important and effective and actually doing it right as a homeowner, you know, here in my house, Mason. I understand a blueprint to kind of be where we go from the idea of what a doorway should look like and how to build a stinking doorway, right? How to make that happen. That doesn't mean my doorway is gonna be perfect or it's gonna be up to specs, spoiler alert. I am an accountant, so my ability to perform construction work is not so high. But that blueprint to me is really how can I look at a document, look at ⁓ an idea and make it happen, right? Move from the idea to... to actuality. as I read through the blueprint over the past couple of weeks, that's really where I see a usable document, as we talked about upfront, more so than just another proclamation from your ivory tower down there in Austin.
Mason Wilder: Yeah, I mean, I guess to keep your analogy or metaphor going, you know, you might know that you want three bedrooms, two bathrooms and an office space and roughly, you know, 2000 square feet or whatever it is. But then that blueprint is what the architect uses to actually make that happen and make sure that it's structurally sound and that, you know, it is going to, you know, maintain integrity for the life of the home.
Chris Ekimoff: Mm-hmm. Mm-hmm. You got it. Let's say that integrity lasts only as long as the next problem, but that's more on the homeowner metaphor than on this blueprint. So let's talk a little bit more about the document, right? I go to the ACFE, I see the blueprint, I download it. What do I get? How do I read it? What are the thoughts that I should have going into reviewing this?
Mason Wilder: Yeah, so it's a pretty straightforward guide and with some some very ⁓ straightforward organization. It's really based on these kind of five pillars and principles of the COSO Fraud Risk Management Guide, which is why you see the design elements that feature like the Roman columns in those structural support pillars.
Chris Ekimoff: Mm-hmm.
Mason Wilder: that align with the 2023 COSO Fraud Risk Management Guide fraud risk governance, fraud risk assessment, fraud control activities, fraud investigative and corrective action, and fraud risk management monitoring activities. And so ⁓ what makes this blueprint, you know, kind of an actual blueprint or beyond a playbook or just a an outline is that each of these sections includes, you know, practical explanations of these principles, ⁓ key questions that organizations can ask themselves to kind of assess how their fraud risk management program stacks up against these principles, checklists for action items to help mature and bring those ⁓ principles into play, into policies and processes, and ⁓ examples they kind of, you provide a a blueprint for translating policy into action. And one of the most important pieces in it is Grant Thornton's enterprise anti-fraud maturity assessment model, which is a really effective piece of guidance, I think, for organizations because there's no one size fits all fraud risk management prescribed path. Different organizations are in different
Chris Ekimoff: That's right.
Mason Wilder: industries, different sizes, have different operations, and so you know there's not just one ⁓ way to do it right. And organizations can take this model and kind of assess where they are, where they want to be, and how to get there.
Chris Ekimoff: Mm-hmm. Yeah, I'm pulling that up on the screen for those of you watching on video for this episode. And you can see, you know, we've got those five pillars that we just talked about down the left-hand side. And then across the top, we kind of move in that quote unquote maturity spectrum of, you know, I've seen this done many different ways. Grant Thornton and the ACFE has put together a very complete version here, but kind of talking about that earliest stage of maturity being ad hoc or merely just responsive. bad things have happened or they might happen. We don't have our legs under us to be able to respond to them proactively. We haven't designed programs in a way that are specific or maybe we haven't even done a fraud risk assessment yet, right? That's really the level one area of that ad hoc maturity model all the way up to, I really enjoyed this nomenclature, the leadership level, right? What are the leading ideas that are out there? How can you identify within your organization how you're performing relative to others in the fraud risk management monitoring activities, right? How are we structuring this? What are we doing? Again, this is not prescriptive, but it's more of a framework to understand what type of response is needed. Now, when I'm out working with clients on their fraud risk management frameworks, these types of ideas are really where we talk. Not only from what can be accomplished or where we should fall on this spectrum. Also, you know, this is kind of a shorthand for cost to a degree. Now, every expense is gonna be different for an organization, but... Being able to understand that, I think that our fraud risk assessment is good at the initial stages or at that level two stage on the model, moving to a repeatable level three or even a leadership level five stage, it's gonna take some effort, it's gonna take some time and work. And each organization can decide for themselves if they have the budget, the bandwidth, the ability to move up in that area, maybe next year, or make that aspirational for years down the
Mason Wilder: Yeah, absolutely. So again, that's why I think particular in particular, this assessment model that's part of the report is super valuable. Whether you're you know, you have responsibilities for the fraud risk management program at your organization. You just play a small role in it, but have the opportunity to contribute to fraud risk assessments or other activities or monitoring activities. You have some input that you can contribute ⁓ that is guided by this. Or in your case, if you're working with clients, you have a really valuable resource to use in your consultation or assessment of that organization's program. it gives you a lot to work with, regardless of what your specific role is ⁓ in the anti-fraud profession.
Chris Ekimoff: And I think one of the most meaningful parts of the document is really what I think are three key takeaways ⁓ for these practitioners, right? And the first theme that I saw is really that fraud risk management is not a piece of paper, right? It's not a well-annotated and internally referenced document of policy A, B, C, D. It is about living a lifestyle of fraud risk management. It's about putting these things in practice, not just having it written down.
Mason Wilder: Yeah, mean, certainly a thorough anti-fraud policy is a very important foundational piece of a fraud risk management program. But, you know, just establishing a good policy. ⁓ putting that in the handbook that every employee has to sign when they get hired and everything is not going to be a sufficient fraud risk management program. If you're taking fraud seriously, it's got to be about the people involved that the policy sets out, you know, what processes and what responsibilities the organization has for fraud detection and prevention. And, you know, those processes and controls that are in place as well as, you know, the technology and
Chris Ekimoff: Mm-hmm.
Mason Wilder: tools that those people use in order to do the prevention and detection and investigation of fraud. So, you know, it's really an extension of ⁓ a policy and, ⁓ you know, it needs to be a living thing that is part of the organizational culture in order ⁓ for, you know, to put your organization in the best position for ⁓ fraud resilience.
Chris Ekimoff: Yeah, I like to say if someone stumbles upon something or has a worry that there might be fraud, waste or abuse happening, a policy should guide them on what to do. And that process should deliver on what they should do. Who do I escalate to? How do I report this? What's my expected response from that person or that hotline or that investigation? If that can be spelled out and agreed to across the organization, it's a lot easier for these things to be. appropriately dealt with and bubbled up to the right levels ⁓ of scrutiny. And I think that level of scrutiny too is another key part of the blueprint in that, one of the other takeaways I got was that the risk appetite, the fraud risk mitigation appetite of each organization really matters. ⁓ Mason, you and I, I believe agree as well as many with the ACFE that we're never going to completely eliminate fraud, but how far down that... ⁓ mitigation effort do we want to get to? How much do we want to focus on this, spend on this? ⁓ What's an acceptable level for us of maybe bad things happening? That's an important conversation to have within each organization.
Mason Wilder: Yeah, and it can often be kind of uncomfortable. ⁓
Chris Ekimoff: Mm-hmm.
Mason Wilder: even sometimes seemingly counterintuitive conversation. And again, this is part of every organization is different, but you should be thinking about fraud and taking it seriously. And to really take it seriously and be mature about it, you do have to, like you said, acknowledge that there's just no way that you're gonna be able to eliminate all fraud risk. Now you have to decide, you might be able to put a lot of things in place that you feel really good about to mitigate fraud risk and get it a lot lower than it was when you started on this risk assessment process. ⁓ And you might be able to transfer some of that risk through insurance policies so that if something does slip through those controls that you put into place, you're lowering the impact on your organization. But
Chris Ekimoff: Mm-hmm.
Mason Wilder: At the end of the day, you are going to have to decide or identify a level of risk appetite that you're comfortable with based on all the resources involved to get to that mitigation point with, again, the understanding that there's no way to eliminate fraud risk and ensure that your organization will never suffer fraud loss.
Chris Ekimoff: One of my favorite conversations to have with a new client is when they tell me that they have a zero tolerance policy for fraud. And I say, I understand where you're coming from. Tell me about your travel and entertainment expense process. What is the limit at which you require a receipt? And they'll say $25. And I said, great. So you have no idea if every $24 expense, know, $24 or less expense is fraudulent or not. And they say, ⁓ and I said, well, yeah, right. You've made a decision that the value of the transaction is dictating how you're gonna treat it from a fraud risk perspective. And that really kind of has a light go on with them that of course, none of us are out there preaching that there's a better solution than a zero tolerance policy for fraud, but you have to make organizational decisions about how you deal with that. And that receipt kind of requirement example is a Rosetta Stone to get folks to understand that, of course, I'm not gonna ask everyone in our multi-thousand person organization, what they spent $2.50 on, right? It's just kind of that cost benefit really, really helps land that plane.
Mason Wilder: Yeah, and you know, just quick addition to that, you're not trying to shame anybody or say that like there is there is not an
Chris Ekimoff: Of course, no.
Mason Wilder: appropriate level of risk appetite there certainly is because let's say you know, you can't have ⁓ a fraud investigator or an auditor spend a couple hours trying to verify every $24 claim you're spending more on the mitigation and investigation or auditing of that claim then you would actually suffer if that claim was fraudulent and so you got to you know, You got to be reasonable with things and there's no like you said, there's no way to eliminate it
Chris Ekimoff: Exactly. Mm-hmm. And then one third takeaway I got, which is the world I live in, that investigations for each organization is part of a prevention or a fraud risk mitigation exercise. If we are going to identify these types of issues, but not run them to ground and not respond to the evaluation of an investigation, why did this specific fraud issue happen or why was it brought up? The Blueprint does a great job of talking about responses to each of these and how you structure a framework to be kind of ever evolving and updating to be responsive to those conclusions after something's identified.
Mason Wilder: Yeah, obviously, you know, ⁓ as a former investigator talking to another ⁓ investigator, we're a little bit biased, but investigations are such a crucial piece of the puzzle. And a lot of times we find that people are put in positions in fraud risk management programs to where they're responsible for either contributing to or carrying out investigations without having a ton of experience doing that. So especially for that audience, this is very helpful to
Chris Ekimoff: Yep. Mm-hmm. ⁓
Mason Wilder: you know, help them ⁓ establish some consistent efforts. And again, this isn't a paint by numbers approach. Not every ⁓ fraud case is going to be the exact same or require the exact same steps and the exact same orders and the same amount of resources and time. So, you know, those that response needs to be proportionate and reasonable for the circumstances. And then, you know, if you aren't taking the results of an investigation and identifying opportunities, to improve the overall fraud risk management program and reduce the chances that you're going to have the same situations occur over and over again, then you're really missing an opportunity. And so it's not just about finding out who was or was not responsible or whether or not allegations were credible. It's what you can learn from all of that to enhance and strengthen the overall fraud risk management program.
Chris Ekimoff: Yeah, I encourage all my fellow CFEs. Obviously, you got the same email blast I did. Definitely spend some time with the Blueprint. For those practicing in the accounting world, feel free to reach out to the ACFE and see if you can grab a copy as well. And then finally, for those who work maybe more on the legal side of things, this is a great kind of defensible framework when it comes to financial investigations, allegations of fraud, waste and abuse that can really help color whether you're an in-house counsel working on behalf of an organization or... constantly consulting externally with folks as an attorney. This is a great document to really help frame your thinking, organize your thoughts. Again, like you said, Mason, there's no paint by number here. ⁓ My accounting friends out there will love the checklists that are included because that's where we live. But knowing that we can expand and grow from those, I think is gonna be an important thing. ⁓ As we come up on the end here, Mason, what is your one big takeaway from the Anti-Fraud Blueprint? How do you talk about it in that kind of elevator pitch to someone you just meet about this coming out?
Mason Wilder: Yeah, I think my main point here is that, ⁓ you know, this document gives you the tools to ⁓ not just build or fix a fraud risk management program. but to have it be a living thing that is continuously being assessed and updated. And this isn't, you know, about preparing you for the fraud landscape today. It's about giving you the tools to be able to... adapt and be prepared for whatever the fraud landscape ends up ⁓ evolving into because that is one thing that we know is that the fraud landscape will continue to evolve and organizations are going to have to meet those challenges and this is going to be a great tool ⁓ to help anti-fraud professionals feel prepared to do that.
Chris Ekimoff: Yeah, as we say in our industry, Mason, we're never done, right? It's an arms race. The better we get at fraud risk mitigation, the better those bad actors may get ⁓ at changing their tactics. So definitely check out the ACFE and Grant Thornton's anti-fraud blueprint. We'll put a link to that in the show notes, as well as to some other content from the ACFE. Mason, thank you for taking the time to share a little bit about the blueprint with us. I'm excited to bother you with the next ACFes release in a few months to get you back on the show to talk a little bit more about that as well.
Mason Wilder: Yeah, thanks so much for the invitation. Happy to come anytime. We've got a couple reports coming out. We got one at the end of next month about anti-fraud technology. ⁓ We've got the report to the nations in May and you know, there'll be more. yeah, there's always to talk about. Happy to be here anytime. And thanks again for having me.
Chris Ekimoff: thanks everyone for joining us with the Immaterial Podcast here that although we're not authoritative, we will always be authentic. We will see you next time. Thank you for tuning in.
Mason Wilder: Thanks so much, Chris. Happy to be here. And even though I had to sit through that whole long thing about myself that made me slightly uncomfortable, I appreciate it.
Chris Ekimoff: ⁓ you're good.
Mason Wilder: you know, ⁓ always enjoy an opportunity to talk about some of the work we're doing at the ACFE that is often really informed by, you know, the contributions of really passionate ⁓ anti-fraud professionals such as yourself, including this one. And yes, ⁓ not the sole author. This was a collaborative effort ⁓ and lots of ⁓ really good contributions from the Grant Thornton side. And then of course, our ACFE design team did an excellent job as
Chris Ekimoff: Of
Mason Wilder: always bringing its life and making it look really good.
Chris Ekimoff: It does take a village. And for those viewers and listeners out there who are not familiar with the ACFE, they are the largest leading anti-fraud organization in the world. I think we number in somewhere in like the 400,000 members. Mason, I don't have the actual count, ⁓ but there's a lot of folks. Little high? Yeah. Four, we're at four members? Only four members?
Mason Wilder: It's a little bit high there. think we're just over... Yeah, no, we're coming up on 100,000 worldwide and about close to 60,000 of those are CFEs.
Chris Ekimoff: 100,000, excellent. Excellent. Yeah, it's a great group. And again, if you're not familiar, definitely check out their work, great podcast, great training environment for those in the anti-fraud profession. So, all right, let's get back to this Blueprint Mason here. We're talking maybe 10 days after it went live. So we're in the early days of publication. ⁓ One question I've got for you as an active participant in everything the ACFE does, what's up with this Blueprint and why do we have it now? We've got a fraud risk management guide from the ACFE. We know about the anti-fraud playbook that came out. What is the difference and what is the reason for the anti-fraud blueprint today?
Mason Wilder: Well, I think, ⁓ you know, the fraud landscape in the last five, six years or since the original COSO Fraud Risk Management Guide that we put together with COSO in 2016, things have changed a lot. The pace of change is kind of increasing. And so, you know, it was we felt like it was ⁓ time and, you know, a good opportunity ⁓ to update some of this and give it more of a practical application lens. to help organizations deal with this pace of change that is requiring adjustments and evolution of fraud risk management programs to keep up with these changes to the fraud landscape that seem to be just accelerating.
Chris Ekimoff: I like too the idea that we've got kind of these, know, semantics matter, right? Nomenclature matters. So we have management guides, we have playbooks and we have blueprints. Maybe talk to me a bit about what those words mean and why you guys chose to title that as such.
Mason Wilder: Yeah, so this blueprint is actually kind of a replacement for a previous ⁓ piece that we put together also with Grant Thornton that was the Anti-Fraud Playbook. And so this... kind of reflects an evolution of that playbook that takes it to another step that ⁓ offers really the kind of blueprint for ⁓ putting into action a lot of these principles and guidance that are ⁓ explained in much more detail in the COSO Fraud Risk Management Guide. Another point, this is not meant to replace ⁓ that COSO Fraud Risk Management Guide that we just published in 2023.
Chris Ekimoff: Mm-hmm.
Mason Wilder: ⁓ this is really a supplement and really you know a blueprint for turning those principles and that guidance into action items that can really have a positive impact on your organization's fraud risk management program, regardless of what level of maturity it currently is. Most organizations have fraud risk management programs in place. this so that doesn't mean this document isn't for them. It's not just about establishing or building one. It's about regularly assessing and evolving
Chris Ekimoff: Mm-hmm. Mm-hmm.
Mason Wilder: your program to ensure that it is as effective as it can be.
Chris Ekimoff: Yeah, I like to think of the word blueprint and feel free to do what I did out there, viewers and listeners go, go to your favorite artificial intelligence tool and type in what is a blueprint for a great definition. You know, a lot of reading on this was enjoyable, but to me that this blueprint is really that bridge between the thought processes around why fraud risk management is important and effective and actually doing it right as a homeowner, you know, here in my house, Mason. I understand a blueprint to kind of be where we go from the idea of what a doorway should look like and how to build a stinking doorway, right? How to make that happen. That doesn't mean my doorway is gonna be perfect or it's gonna be up to specs, spoiler alert. I am an accountant, so my ability to perform construction work is not so high. But that blueprint to me is really how can I look at a document, look at ⁓ an idea and make it happen, right? Move from the idea to... to actuality. as I read through the blueprint over the past couple of weeks, that's really where I see a usable document, as we talked about upfront, more so than just another proclamation from your ivory tower down there in Austin.
Mason Wilder: Yeah, I mean, I guess to keep your analogy or metaphor going, you know, you might know that you want three bedrooms, two bathrooms and an office space and roughly, you know, 2000 square feet or whatever it is. But then that blueprint is what the architect uses to actually make that happen and make sure that it's structurally sound and that, you know, it is going to, you know, maintain integrity for the life of the home.
Chris Ekimoff: Mm-hmm. Mm-hmm. You got it. Let's say that integrity lasts only as long as the next problem, but that's more on the homeowner metaphor than on this blueprint. So let's talk a little bit more about the document, right? I go to the ACFE, I see the blueprint, I download it. What do I get? How do I read it? What are the thoughts that I should have going into reviewing this?
Mason Wilder: Yeah, so it's a pretty straightforward guide and with some some very ⁓ straightforward organization. It's really based on these kind of five pillars and principles of the COSO Fraud Risk Management Guide, which is why you see the design elements that feature like the Roman columns in those structural support pillars.
Chris Ekimoff: Mm-hmm.
Mason Wilder: that align with the 2023 COSO Fraud Risk Management Guide fraud risk governance, fraud risk assessment, fraud control activities, fraud investigative and corrective action, and fraud risk management monitoring activities. And so ⁓ what makes this blueprint, you know, kind of an actual blueprint or beyond a playbook or just a an outline is that each of these sections includes, you know, practical explanations of these principles, ⁓ key questions that organizations can ask themselves to kind of assess how their fraud risk management program stacks up against these principles, checklists for action items to help mature and bring those ⁓ principles into play, into policies and processes, and ⁓ examples they kind of, you provide a a blueprint for translating policy into action. And one of the most important pieces in it is Grant Thornton's enterprise anti-fraud maturity assessment model, which is a really effective piece of guidance, I think, for organizations because there's no one size fits all fraud risk management prescribed path. Different organizations are in different
Chris Ekimoff: That's right.
Mason Wilder: industries, different sizes, have different operations, and so you know there's not just one ⁓ way to do it right. And organizations can take this model and kind of assess where they are, where they want to be, and how to get there.
Chris Ekimoff: Mm-hmm. Yeah, I'm pulling that up on the screen for those of you watching on video for this episode. And you can see, you know, we've got those five pillars that we just talked about down the left-hand side. And then across the top, we kind of move in that quote unquote maturity spectrum of, you know, I've seen this done many different ways. Grant Thornton and the ACFE has put together a very complete version here, but kind of talking about that earliest stage of maturity being ad hoc or merely just responsive. bad things have happened or they might happen. We don't have our legs under us to be able to respond to them proactively. We haven't designed programs in a way that are specific or maybe we haven't even done a fraud risk assessment yet, right? That's really the level one area of that ad hoc maturity model all the way up to, I really enjoyed this nomenclature, the leadership level, right? What are the leading ideas that are out there? How can you identify within your organization how you're performing relative to others in the fraud risk management monitoring activities, right? How are we structuring this? What are we doing? Again, this is not prescriptive, but it's more of a framework to understand what type of response is needed. Now, when I'm out working with clients on their fraud risk management frameworks, these types of ideas are really where we talk. Not only from what can be accomplished or where we should fall on this spectrum. Also, you know, this is kind of a shorthand for cost to a degree. Now, every expense is gonna be different for an organization, but... Being able to understand that, I think that our fraud risk assessment is good at the initial stages or at that level two stage on the model, moving to a repeatable level three or even a leadership level five stage, it's gonna take some effort, it's gonna take some time and work. And each organization can decide for themselves if they have the budget, the bandwidth, the ability to move up in that area, maybe next year, or make that aspirational for years down the
Mason Wilder: Yeah, absolutely. So again, that's why I think particular in particular, this assessment model that's part of the report is super valuable. Whether you're you know, you have responsibilities for the fraud risk management program at your organization. You just play a small role in it, but have the opportunity to contribute to fraud risk assessments or other activities or monitoring activities. You have some input that you can contribute ⁓ that is guided by this. Or in your case, if you're working with clients, you have a really valuable resource to use in your consultation or assessment of that organization's program. it gives you a lot to work with, regardless of what your specific role is ⁓ in the anti-fraud profession.
Chris Ekimoff: And I think one of the most meaningful parts of the document is really what I think are three key takeaways ⁓ for these practitioners, right? And the first theme that I saw is really that fraud risk management is not a piece of paper, right? It's not a well-annotated and internally referenced document of policy A, B, C, D. It is about living a lifestyle of fraud risk management. It's about putting these things in practice, not just having it written down.
Mason Wilder: Yeah, mean, certainly a thorough anti-fraud policy is a very important foundational piece of a fraud risk management program. But, you know, just establishing a good policy. ⁓ putting that in the handbook that every employee has to sign when they get hired and everything is not going to be a sufficient fraud risk management program. If you're taking fraud seriously, it's got to be about the people involved that the policy sets out, you know, what processes and what responsibilities the organization has for fraud detection and prevention. And, you know, those processes and controls that are in place as well as, you know, the technology and
Chris Ekimoff: Mm-hmm.
Mason Wilder: tools that those people use in order to do the prevention and detection and investigation of fraud. So, you know, it's really an extension of ⁓ a policy and, ⁓ you know, it needs to be a living thing that is part of the organizational culture in order ⁓ for, you know, to put your organization in the best position for ⁓ fraud resilience.
Chris Ekimoff: Yeah, I like to say if someone stumbles upon something or has a worry that there might be fraud, waste or abuse happening, a policy should guide them on what to do. And that process should deliver on what they should do. Who do I escalate to? How do I report this? What's my expected response from that person or that hotline or that investigation? If that can be spelled out and agreed to across the organization, it's a lot easier for these things to be. appropriately dealt with and bubbled up to the right levels ⁓ of scrutiny. And I think that level of scrutiny too is another key part of the blueprint in that, one of the other takeaways I got was that the risk appetite, the fraud risk mitigation appetite of each organization really matters. ⁓ Mason, you and I, I believe agree as well as many with the ACFE that we're never going to completely eliminate fraud, but how far down that... ⁓ mitigation effort do we want to get to? How much do we want to focus on this, spend on this? ⁓ What's an acceptable level for us of maybe bad things happening? That's an important conversation to have within each organization.
Mason Wilder: Yeah, and it can often be kind of uncomfortable. ⁓
Chris Ekimoff: Mm-hmm.
Mason Wilder: even sometimes seemingly counterintuitive conversation. And again, this is part of every organization is different, but you should be thinking about fraud and taking it seriously. And to really take it seriously and be mature about it, you do have to, like you said, acknowledge that there's just no way that you're gonna be able to eliminate all fraud risk. Now you have to decide, you might be able to put a lot of things in place that you feel really good about to mitigate fraud risk and get it a lot lower than it was when you started on this risk assessment process. ⁓ And you might be able to transfer some of that risk through insurance policies so that if something does slip through those controls that you put into place, you're lowering the impact on your organization. But
Chris Ekimoff: Mm-hmm.
Mason Wilder: At the end of the day, you are going to have to decide or identify a level of risk appetite that you're comfortable with based on all the resources involved to get to that mitigation point with, again, the understanding that there's no way to eliminate fraud risk and ensure that your organization will never suffer fraud loss.
Chris Ekimoff: One of my favorite conversations to have with a new client is when they tell me that they have a zero tolerance policy for fraud. And I say, I understand where you're coming from. Tell me about your travel and entertainment expense process. What is the limit at which you require a receipt? And they'll say $25. And I said, great. So you have no idea if every $24 expense, know, $24 or less expense is fraudulent or not. And they say, ⁓ and I said, well, yeah, right. You've made a decision that the value of the transaction is dictating how you're gonna treat it from a fraud risk perspective. And that really kind of has a light go on with them that of course, none of us are out there preaching that there's a better solution than a zero tolerance policy for fraud, but you have to make organizational decisions about how you deal with that. And that receipt kind of requirement example is a Rosetta Stone to get folks to understand that, of course, I'm not gonna ask everyone in our multi-thousand person organization, what they spent $2.50 on, right? It's just kind of that cost benefit really, really helps land that plane.
Mason Wilder: Yeah, and you know, just quick addition to that, you're not trying to shame anybody or say that like there is there is not an
Chris Ekimoff: Of course, no.
Mason Wilder: appropriate level of risk appetite there certainly is because let's say you know, you can't have ⁓ a fraud investigator or an auditor spend a couple hours trying to verify every $24 claim you're spending more on the mitigation and investigation or auditing of that claim then you would actually suffer if that claim was fraudulent and so you got to you know, You got to be reasonable with things and there's no like you said, there's no way to eliminate it
Chris Ekimoff: Exactly. Mm-hmm. And then one third takeaway I got, which is the world I live in, that investigations for each organization is part of a prevention or a fraud risk mitigation exercise. If we are going to identify these types of issues, but not run them to ground and not respond to the evaluation of an investigation, why did this specific fraud issue happen or why was it brought up? The Blueprint does a great job of talking about responses to each of these and how you structure a framework to be kind of ever evolving and updating to be responsive to those conclusions after something's identified.
Mason Wilder: Yeah, obviously, you know, ⁓ as a former investigator talking to another ⁓ investigator, we're a little bit biased, but investigations are such a crucial piece of the puzzle. And a lot of times we find that people are put in positions in fraud risk management programs to where they're responsible for either contributing to or carrying out investigations without having a ton of experience doing that. So especially for that audience, this is very helpful to
Chris Ekimoff: Yep. Mm-hmm. ⁓
Mason Wilder: you know, help them ⁓ establish some consistent efforts. And again, this isn't a paint by numbers approach. Not every ⁓ fraud case is going to be the exact same or require the exact same steps and the exact same orders and the same amount of resources and time. So, you know, those that response needs to be proportionate and reasonable for the circumstances. And then, you know, if you aren't taking the results of an investigation and identifying opportunities, to improve the overall fraud risk management program and reduce the chances that you're going to have the same situations occur over and over again, then you're really missing an opportunity. And so it's not just about finding out who was or was not responsible or whether or not allegations were credible. It's what you can learn from all of that to enhance and strengthen the overall fraud risk management program.
Chris Ekimoff: Yeah, I encourage all my fellow CFEs. Obviously, you got the same email blast I did. Definitely spend some time with the Blueprint. For those practicing in the accounting world, feel free to reach out to the ACFE and see if you can grab a copy as well. And then finally, for those who work maybe more on the legal side of things, this is a great kind of defensible framework when it comes to financial investigations, allegations of fraud, waste and abuse that can really help color whether you're an in-house counsel working on behalf of an organization or... constantly consulting externally with folks as an attorney. This is a great document to really help frame your thinking, organize your thoughts. Again, like you said, Mason, there's no paint by number here. ⁓ My accounting friends out there will love the checklists that are included because that's where we live. But knowing that we can expand and grow from those, I think is gonna be an important thing. ⁓ As we come up on the end here, Mason, what is your one big takeaway from the Anti-Fraud Blueprint? How do you talk about it in that kind of elevator pitch to someone you just meet about this coming out?
Mason Wilder: Yeah, I think my main point here is that, ⁓ you know, this document gives you the tools to ⁓ not just build or fix a fraud risk management program. but to have it be a living thing that is continuously being assessed and updated. And this isn't, you know, about preparing you for the fraud landscape today. It's about giving you the tools to be able to... adapt and be prepared for whatever the fraud landscape ends up ⁓ evolving into because that is one thing that we know is that the fraud landscape will continue to evolve and organizations are going to have to meet those challenges and this is going to be a great tool ⁓ to help anti-fraud professionals feel prepared to do that.
Chris Ekimoff: Yeah, as we say in our industry, Mason, we're never done, right? It's an arms race. The better we get at fraud risk mitigation, the better those bad actors may get ⁓ at changing their tactics. So definitely check out the ACFE and Grant Thornton's anti-fraud blueprint. We'll put a link to that in the show notes, as well as to some other content from the ACFE. Mason, thank you for taking the time to share a little bit about the blueprint with us. I'm excited to bother you with the next ACFes release in a few months to get you back on the show to talk a little bit more about that as well.
Mason Wilder: Yeah, thanks so much for the invitation. Happy to come anytime. We've got a couple reports coming out. We got one at the end of next month about anti-fraud technology. ⁓ We've got the report to the nations in May and you know, there'll be more. yeah, there's always to talk about. Happy to be here anytime. And thanks again for having me.
Chris Ekimoff: thanks everyone for joining us with the Immaterial Podcast here that although we're not authoritative, we will always be authentic. We will see you next time. Thank you for tuning in.
