Fraud: the infinite game (but I’m not sure everyone’s playing)

Phil Sapey, Counter Fraud Manager, Cancer Research UK

In 2018 I saw fraud described as an ‘infinite game’ and in 2020 I happened across a webinar entitled ‘fraud a never-ending battle’ (I didn’t watch it!) Although I agree with the sentiment – fraud will always be with us – the problem is that both scenarios assume a level of interaction unless you’re playing solitaire or shadowboxing. Unfortunately, there are many charities who are hoping that if they keep their tennis bats, golf sticks or ping pong rackets in the loft, they won’t have to join the infinite game. The problem is, it’s not their choice.

Charities – like all organisations – are at risk of fraud and must balance the amount they spend on addressing fraud risks with their incredibly important objectives, like curing cancer sooner. In July 2022 a Cancer Research UK report concluded that for every £1 spent on cancer research in the UK in 2020/21, £2.80 of benefit was generated for the UK economy. The UK is unique in that a charity – Cancer Research UK – is responsible for half of all publicly funded cancer research. That investment has had a huge impact on cancer but also the UK’s economy, supporting tens of thousands of high-tech jobs and generating several billion for the UK economy. As a fraud professional I’m always advocating for fraud resource, but, hitting the sweet spot for investment in anti-fraud resources is nowhere near as simple as some might have us believe!

Zero tolerance

Many organisations state that they have a zero-tolerance policy when it comes to fraud, but their controls tell another story. Taking an example from outside the charity sector it might be a good time to mention the covid-19 grants and loan schemes. Everyone recognised that getting them paid quickly was important, but, if you really had a zero-tolerance policy regarding fraud you would have done adequate checks! As Sir David Green, chair of the Fraud Advisory Panel, noted in a BBC interview about bounce back loans: ‘simply because you’ve got to get money out of the door, doesn’t mean you throw … sensible checks out of the window’.

Counter fraud measures

Charities aren’t going to win the infinite game by failing to play; the fraudsters will keep kicking the ball into the back of the net with zero opposition. It’s common knowledge that the changes in the fraud risk landscape are exposing organisations to significant financial and reputational risks. This is driven by a number of factors, including macro-economic conditions (such as the cost-of-living crisis); digitalisation and cyber-crime; and the impact of the pandemic. One newspaper noted that Britain was named the fraud capital of the world in July 2022, with total losses amounting to £3bn. Around 40 million people in the UK have been targeted by scammers. But only 2% of the police are investigating what has been described as a ‘crime plague’.

Furthermore, counter-fraud measures in the charity sector are often immature, with low levels of fraud risk awareness and a tendency to ‘think the best’ of people by placing high levels of trust in people who are involved with the charity. Because funding is, understandably, allocated to the ‘front line’ as a priority there is often a low level of investment in counter-fraud measures.

Aggravating factors

The phrase ‘hostile environment for fraud’ has made something of a resurgence recently. It conjures up an image of a place where it is difficult for fraud to settle in. However, many charities have inadvertently created something of an inviting environment for fraud. Of course, there are some areas of charity business that are uniquely tricky – like the fact that on most occasions charities do not know how much is going to be donated: there is no invoice and corresponding debt on the balance sheet, charity shops don’t know what stock they will receive in the way of donated items and/or the quality of that material, and sometimes beneficiaries are difficult to manage – but  there are further aggravating factors that should also be considered. These include:

• large scale and simultaneous organisational change;
• new operating models and ways of working;
• significant turnover of staff, the loss of accumulated organisational knowledge, and the arrival of large numbers of new staff;
• legacy issues with IT systems and key self-developed IT systems and fundraising platforms;
• issues with limited organisational understanding of end-to-end business processes, including a lack of ownership and weaknesses in cross-departmental process interfaces;
• relatively low levels of fraud risk awareness and maturity within the organisation;
• a lack of awareness of related organisational risk appetite (especially at operational level), and a lack of clarity regarding how the organisation’s ‘cautious’ risk appetite for fraud plays out in practice (especially when considered alongside other organisational objectives with a less cautious risk appetite e.g. delivery of fundraising targets and growth objectives);
• everyday frustrations with processes and systems – which are often time consuming and difficult to navigate – may encourage staff to by-pass established process and systems where they can (with or without fraudulent intent);
• limited data, analysis and associated management reporting that might flag currently undetected fraud or errors; and,
• a complex and poorly enforced organisational policy framework.

With a shopping list of risks areas like this it’s small wonder that it’s easier to turn to the Charity’s core purpose and refuse to join the infinite game … the problem is the fraudsters are still playing and without any opposition they will win every time.

The thoughts in this post belong to Phil Sapey and do not necessarily reflect the views of CRUK.