Victorian Auditor-General’s report 
6 June 2012 
Fraud Prevention Strategies in Local Government
Audit summary
Background
Fraud is the crime of obtaining financial or another benefit by deception. The impact of fraud on councils and their communities can be significant. It can disrupt business continuity, reduce the quality and effectiveness of critical services, and threaten the financial stability of a council. It can also damage a council’s public image and reputation. 
Each year, local government collects $7 billion in operating revenues, expends $6 billion, and manages assets with a total value of $60 billion. These significant resources are at risk if councils are not active, vigilant and effective in dealing with the risk of fraud.
The Local Government Act 1989 (the Act) requires councils to develop and maintain adequate internal control systems. An effective fraud control framework is widely recognised as a critical element of such systems. The Australian Standard 
AS8001–2008 on fraud and corruption control, and other related good practice guides, identify the key elements of an effective fraud control framework. These include:
·	a fraud control plan documenting an entity’s fraud prevention, detection and response initiatives
·	periodic and comprehensive assessment of an entity’s fraud risks 
·	documented policies and procedures for dealing with suspected fraud, including protection for whistleblowers 
·	a sound ethical culture supported by a code of conduct
·	regular fraud awareness training to maintain staff awareness of related policies and procedures 
·	internal audits of the effectiveness of fraud controls and of related procedures
·	dedicated controls for activities with a high fraud risk exposure.
Our 2008 report Local Government: Results of the 2006–07 audits undertook a high level review of fraud management practices across all 79 Victorian councils. It found that approximately one-third of councils had yet to develop a fraud control plan, clearly document their related policies and procedures, or provide management and staff with adequate training on identifying fraud risks.
This audit assessed the effectiveness of fraud prevention strategies at Maroondah City Council, Nillumbik Shire Council, Moira Shire Council, Buloke Shire Council and West Wimmera Shire Council. 
We also tested the adequacy of controls for targeted high-risk fraud areas, known to account for the majority of frauds in public sector entities.
Conclusions
The examined councils do not effectively manage their exposure to fraud risk as none have developed a strategic and coordinated approach to controlling fraud. This is concerning given the significant value of the public funds and assets they manage.
While each of the five councils has aspects of a fraud control framework, critical elements are either absent or poorly implemented.
Risk-based fraud control plans do not yet exist at all councils. Coupled with inadequate monitoring of the fraud control framework by management and audit committees, this shows they are not sufficiently vigilant nor effective in dealing with the risk of fraud.
Without a risk-based fraud control plan there is no formal basis to assess whether fraud strategies are soundly based, coordinated, purposely implemented and reviewed. 
These shortcomings increase opportunities for fraud and thus put councils’ reputations and limited public funds at risk.
Consequently, the examined councils cannot be assured that their fraud prevention strategies are effective and that all major fraud risks have been adequately mitigated. 
Councils, therefore, need to take the issue of fraud more seriously. 
The audit’s scope did not extend to undertaking an exhaustive fraud investigation. However, our targeted testing of high-risk areas disclosed a number of internal control deficiencies which further heighten the risk of fraud.
Findings
Limited improvements to fraud management practices since 2008 were evident at most examined councils. These included:
·	establishing specific fraud risk registers based on assessments of fraud risk––at Nillumbik and Buloke, with Maroondah in the process of developing one
·	issuing a code of conduct for staff, clarifying expected and unacceptable behaviours––at Maroondah, with codes already in place at the remaining councils
·	implementing a fraud policy detailing the consequences for fraudulent conduct, including procedures for managing allegations and incidents––at all councils except Moira
·	providing training to staff on their responsibilities for managing fraud risk––at Maroondah and Nillumbik. 
Although encouraging, these initiatives have not been sufficient to establish an effective fraud control framework at each council. 
The following sections highlight key shortcomings identified with existing fraud management arrangements, and the actions required to address them.
Fraud prevention strategies
Fraud control plans, risk assessments and policies
None of the examined councils had developed a fraud control plan, and only two out of five had completed assessments of their fraud risks at the time of the audit. Consequently, the fraud control strategies of all examined councils were neither adequately documented nor, in most cases, informed by a sound understanding of their exposure to fraud risk. Maroondah advised it completed its fraud risk assessments following the audit, and that this would inform its development of a fraud control plan.
Although most councils had developed adequate fraud policies and codes of conduct, the absence of fraud control plans and completed fraud risk assessments demonstrates that, in most cases, these policies were not being effectively implemented or enforced by management.
Further, while all councils relied on contractors and volunteers to deliver key services, only Maroondah had apprised them of its fraud policy. Similarly, none had distributed their code of conduct to contractors, and only Nillumbik had provided it to volunteers.
This reduces assurance that contractors and volunteers at the remaining councils are clear as to what constitutes fraud and ethical behaviour, and what action they should take in the event they suspect a fraud has occurred.
Moira acted to address this during the audit.
Fraud awareness training
With the exception of Nillumbik, none of the examined councils provided adequate fraud training to their staff. 
West Wimmera did not provide fraud awareness training to new and existing employees. Additionally, while the remaining councils informed new employees about the existence of their fraud policy and/or code of conduct, this was not adequately supported by further training and awareness-raising initiatives aimed at gaining assurance that staff understand their fraud control responsibilities. 
Maroondah began an extensive program of refresher training for existing employees in April 2011 and has since advised it will provide ongoing refresher and induction training for all staff. Moira and Buloke similarly commenced action to deliver fraud training to new and existing employees during the course of the audit. 
All councils had yet to establish arrangements for evaluating the adequacy of their fraud training and awareness programs.
Monitoring and oversight
There was significant scope to improve monitoring and oversight of the fraud control framework at all examined councils. 
None had established effective arrangements for systematically monitoring and reporting on the performance of their fraud control activities to senior management and the audit committee. 
Consequently, the examined councils were unable to demonstrate the effectiveness of their fraud control framework.
Internal audit
All councils, except West Wimmera, had a risk-based internal audit program, however, none systematically reviewed the adequacy of their fraud management arrangements. This, coupled with the absence of completed fraud risk assessments at Maroondah and Moira, offered little assurance that council internal audit programs adequately addressed all major fraud risks.
Moira conducted an audit of its fraud management framework in 2005. While the audit recommended it establish an integrated fraud control and risk management framework, this has yet to occur.
West Wimmera advised it intends to establish an internal audit function in 2013–14. 
Audit committee
Audit committees have a key role in monitoring councils’ fraud minimisation and detection programs, including whether there are strong internal controls to effectively manage key fraud risks. However, it was not evident that they actively monitored management’s efforts in implementing fraud prevention strategies. 
While all committees received reports and maintained a watching brief on suspected fraud incidents, they did not systematically review the effectiveness of the council’s wider fraud prevention framework.
Further, West Wimmera’s and Maroondah’s audit committees lack sufficient independence from councillors and council staff as neither was comprised of a majority of independent members. This impedes their capacity to effectively scrutinise management actions. Maroondah advised it intends to address this by restructuring its committee’s membership so that the majority are independent.
In addition, none of the councils adequately assessed the performance of their audit committee, and all relied overly on limited reviews of fraud management practices by their insurer. These reviews, however, have inherent limitations and do not provide sufficient assurance that fraud control arrangements are effective.
Internal controls to prevent and detect fraud
No instances of fraud were identified in our targeted testing at the examined councils. However, a number of internal control weaknesses were observed which heighten the risk of fraud. These are outlined below. 
Pre-employment screening
All examined councils had recruitment policies and procedures for pre-employment screening. However, none adequately addressed all major fraud risks. Specifically, only Moira and Nillumbik required verification of an applicant’s identity. Similarly, while all councils require a police criminal history check for some roles, only three of the five examined councils applied this to high fraud risk positions. 
Reference checks are mandatory at all councils. While they were evident in all cases examined at Moira, they did not occur in 80 per cent of the files examined at Nillumbik, 69 per cent of files at Maroondah, and around half of the files reviewed at both Buloke and West Wimmera. Following the audit, Maroondah, Nillumbik and Buloke advised that practices have since been improved.
Council policies require staff to verify the qualifications of new employees. This was evident in almost all files examined at four of the five councils. However, at Nillumbik, employee qualifications had been verified in only around 20 per cent of the files examined.
Accounts payable
Accounts payable relies on effective segregation of duties around the set-up and maintenance of vendor details to prevent payments to fictitious suppliers. This was the case for Nillumbik and West Wimmera, however, due to limited staffing and resources there was a lack of segregation of duties at the remaining three councils. 
Accounts payable staff at these councils can create and edit vendor details as well as enter invoices for payment. Although this increases the opportunity for fraud, both Maroondah and Moira have reasonable compensating controls. 
This was not the case at Buloke. While an independent officer signs off on a report of changes to vendor bank details, it is not supported by any documentation substantiating the changes. Without this the council is unable to verify if implemented changes are appropriate and, therefore, easily detect if a fraud has occurred.
Asset management
Maroondah, Nillumbik and Moira had adequate processes to safeguard their assets, however, there is scope for improvement at Buloke and West Wimmera. Neither council maintained an up-to-date and accurate asset register, nor did they assign a unique asset number to all assets so they could be traced. Additionally, West Wimmera did not do regular stocktakes. 
These weaknesses create an opportunity for assets to be misappropriated and misused without detection.
Recommendations
Number	Recommendation	Page	
	Councils should:		
1.	develop and maintain an up-to-date fraud control plan clearly documenting their fraud prevention, detection and response initiatives and responsibilities	19	
2.	conduct thorough, periodic fraud risk assessments to assure they identify and effectively manage all major fraud risk exposures	19	
3.	provide induction and periodic fraud awareness training to all council staff, to assure they understand their fraud control responsibilities 	19	
4.	systematically monitor and report on the effectiveness of their fraud control strategies	19	
5.	establish arrangements that assure effective ongoing scrutiny by executive management, internal audit and audit committees, of the effectiveness of the fraud control framework	19	
6.	establish effective pre-employment screening processes that provide sufficient assurance over the integrity, identity and credentials of all council staff	27	
7.	make sure accounts payable systems have effective preventative and/or compensating controls that adequately mitigate the risk of fraudulent purchases and/or payments	27	
8.	maintain accurate and an up-to-date asset registers that are regularly reviewed to mitigate the misuse and/or misappropriation of assets	27	
9.	systematically review the operation and effectiveness of all their internal control systems to assure they adequately prevent, deter and detect major frauds.	27	
Submissions and comments received
In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report was provided to the Department of Planning and Community Development, Maroondah City Council, Nillumbik Shire Council, Moira Shire Council, Buloke Shire Council and West Wimmera Shire Council with a request for submissions or comments.
Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments however, are included in Appendix A.