In recent years, the federal government and the accounting industry have responded to the erosion of public trust in the accuracy of financial reporting by enacting legislation and standards that specifically address management's responsibilities to minimize their companies' vulnerabilities to financial reporting and other internal frauds.

Words into action

Establishing -- and continually fine-tuning -- your organization's code of conduct, ethics policy and/or statement of business principles is an important first step to identifying and documenting the specific behaviors that management considers acceptable.

But companies must go further to "put teeth" in their code of conduct so that it produces significant and measurable fraud-prevention results.

For starters, according to the audit and consulting firm, Plante & Moran PLLC, "Implementing stringent human resource policies related to hiring, training and promoting staff helps to keep unethical or criminally inclined individuals from joining the organization or obtaining a position of trust."

Effective HR action steps supporting an anti-fraud tone at the top include:

• Pre-employment background checks of education, employment history and personal references.
  
  
• Periodic training on the organization's core values, covering…

[  ] What constitutes illegal/fraudulent behavior.

[  ] Employees' responsibility to report fraudulent behavior.

[  ] How to report fraudulent or suspicious behavior.

• Performance reviews that include discussions of an employee's contribution to creating the appropriate workplace environment.
  
  
• Continuous evaluation of compliance with the organization's values.
  
  
• Confirmation, covering…

[  ] An understanding of the organization's expectations.

[  ] Compliance with the organization's code of conduct.

[  ] A listing of known violations or statement of no known violation.

Important: These are examples of proactive business practices, which, if effectively implemented, should reduce the incidence of fraudulent conduct. However, organizations seeking to infuse the corporate culture with high ethical standards must focus on reactive measures to fraudulent or unethical behavior, as well.

Reason: The mere expectation that an illegal act will be discovered serves as a deterrent to future illegal behavior.

In addition, according to Christine Doxey, an internal controls expert at ApexAnalytix, it is extremely important to foster an environment where individuals are comfortable blowing the whistle on fraud. To send the right message when suspicious activity is detected, the organization should:

• Conduct an immediate and thorough investigation.
  
  
• Consistently take action against violators.
  
  
• Assess related controls and functional areas, and recommend improvements.
  
  
• Clearly communicate the organization's values and consequences of violations.

This is often best done through mandatory ethics and fraud awareness training. Such training should cover…

[  ] Specific forms of illegal conduct.

[  ] Clear instructions on the process for asking questions and getting management to correct apparent weaknesses in business processes.

[  ] Examples demonstrating illegal conduct by individuals in similar positions to those of the trainees.

[  ] Quizzes and/or tests to measure trainees' comprehension of the course material.

Important: As Doxey points out, training program participants should also experience and learn to cope with the stresses associated with ethical behavior.

Example: Doxey says that in the better fraud awareness/ethics training programs she's seen, participants review case studies of wrongful conduct and are asked what they would do if they are in the situation being illustrated. They are expected to answer that they would blow the whistle even though doing so might mean putting themselves at risk of retaliation.

Is "tone at the top" more than just window dressing?

Companies have attempted to establish the right tone at the top by implementing ethics offices, anonymous hotlines, training programs and communications campaigns. And anti-fraud consultants frequently report the existence on client companies' walls of such catchy slogans as "Do the right thing because it's the right thing to do," and "Be loyal to yourself and your company."

Important: Tone at the top not only starts at the CEO and CFO level, but resonates throughout the governance structure which includes the board of directors, audit committee, compensation committee, and risk management committee.

Also essential: Entity-level internal control reviews that validate the effectiveness --  or weaknesses -- of the corporate governance structure. Similarly, Doxey says that by requiring employees to fill out an annual anonymous questionnaire, the company can readily determine how well tone at the top is actually embraced by every employee. Examples of questions included in the annual questionnaire…

• Does the company have an established code of conduct that reflects core values of the organization and provides guidance to employees in avoiding fraudulent conduct?
  
  
• Does the company require periodic written confirmation of knowledge of and compliance with the code at various levels of management?
  
  
• Is the code of business conduct printed in a formal document that can be conveniently referenced?
  
  
• Does management have a process to assess whether employees understand and comply with the code's definitions of fraudulent and unethical conduct --  such as confirmations, employee surveys, quizzes, etc.?
  
  
• Do results of employee surveys convey that established levels of ethical conduct pervade the organization?
  
  
• Does the company provide a confidential hotline for reporting actual or suspected fraudulent activity, including suspected instances of management override of internal controls, etc?
  
  
• Is the hotline system regularly tested --  via spontaneous phone calls, E-mails, Web-based reporting, etc. -- to ensure that it is functioning as intended?
  
  
• Does the company regularly measure the hotline's usage? Is usage for reporting fraudulent or unethical conduct increasing? Declining? Remaining flat?
  
  
• Is a database in place to track and report all business conduct and fraud cases for the company?
  
  
• Is remedial action taken as necessary for every fraud case raised?

The bottom line

If the responses to these questionnaires indicate flaws or weaknesses in the company's tone at the top management must act immediately to remedy the problem. Failing to do so is the best way to allow tone at the top to become nothing more than three empty words.

PETER GOLDMANN is Editor of White-Collar Crime Fighter, a monthly newsletter providing expert advice on prevention, detection and reporting of corporate fraud. Peter is also the creator of FraudAware, the only Web-based employee fraud awareness training course developed by fraud prevention experts. For details, visit www.fraudaware.com