Fraud Risk Management

1. Fraud Risk Management An Investigation and Anti-Fraud Primer

2. • Moderator - Dorina HertnerDirector – Risk Management • 7-Eleven Corporation • • Bill LeonePartner • Norton Rose Fulbright • • Ryan PrattPartner • Ernst & Young

3. What to Expect • Define fraud and its affect on the organization • Understand the investigative process • Risk Management’s role in investigations

4. Why people commit fraud: The Fraud Triangle • Opportunity • Companies are decentralized with inconsistent internal controls • Companies are downsizing, impacting internal controls. • Large projects and acquisitions increases risks of costs not being noticed • Lack of infrastructure and controls in locations • Stressed and disgruntled employees may have greater ability to rationalize improper actions • Layoffs and salary cuts creates personal financial hardship • Opportunity to • Commit Fraud • Tight credit environment • Dissatisfaction with compensation compared to peers and supervisors • Internal and External • Pressure • Internal • Controls • Stock prices are unstable • Pressure • Budgets are decreasing. Companies and organizations are doing more with less • Rationalization • More regulatory focus increased

5. Types of FraudThree primary categories Fraud tree Corruption Fraudulent Statements Conflicts of interest Bribery and corruption/ FCPA Illegal gratuities Bid-rigging/ procurement Revenue recognition GAAP Reserves Non- financial (Disclosures) Asset Misappropriation Cash larceny Theft of other assets – inventory/ AR/ fixed assets Fake vendor Payroll fraud T&E fraud Theft of data

6. Case Study – DenColo Products • Dencolo is a consumer technology company based in the US • Manufacturing in US and Japan with suppliers in Thailand and Hong Kong • In 2008/2009, the company went through difficult times – reduced sales, margins • Many departments, including risk management, were downsized

7. Case Study – The Rogue Risk Manager • DenColo Products receives a whistleblower hotline call - Allegations • Mickey Marks – VP of Risk – Multiple allegations • No change in premiums in 5 years – in volatile markets • Mickey is “too close” to broker - Jim Daniels – abdicating responsibility • Multiple trips with broker including a “conference” in Hawaii two weeks before renewal • Claim support and data goes ignored – no one else allowed to handle claims with insurers – suspect Mickey is not pursuing valid claims • “Pretty sure” that Mickey is either taking kickbacks or accepting “gifts” • Noticed invoices from MM Risk Services – Don’t know their task • *Elizabeth Craig – Assistant RM – is expected whistleblower

8. Responding to a Whistleblower • Take it seriously – set the tone • Respond promptly • Inform counsel – either external or internal • Assess credibility • Evaluate resources to respond • No retaliation

9. Conducting an Investigation • Involve counsel – internal or external • Preserve and protect information • Identify key players • Review communication and documents • Interview key players • Analyze accounting / financial data • Develop findings and report

10. Email Analytics

11. Case Study – Preliminary Findings • The investigation uncovered the following preliminary findings: • DenColo’s insurance always underwritten by same London insurer • Jim Daniels moved brokerage houses four times in last 7 years • No claims were filed for Japan quake or Thailand flooding despite losses • Emails between Mickey and Jim discuss how filing claims will “affect the arrangement we have with London” and Mickey getting to “take a mulligan” • Mickey’s time and expense show trips to Bermuda, Hawaii, Barbados and Scotland titled “Insurer meetings” • Mickey’s office has very little insurance materials but plenty of golf pictures with Jim • A review of vendor master shows that MM Risk Services was added six months prior – Address on the account is Mickey’s daughter, Mattie Marks

12. What’s Next? • Based on the preliminary findings what would you do next? • Interview Mickey Marks • Interview Jim Daniels • Interview insurance carrier representative • Analyze Mickey Marks’ expense reports further • Review Mickey Marks’ bank records (as available) • Interview Elizabeth Craig – Assistant risk manager? • Analyze other programs / claims history – worker’s comp, product liability • Analyze payments made to MM Risk Services • Scrutinize additional vendors against known addresses related to Mickey

13. What…? How…? Could you tell me about…? • Why…? Who…? Where…? • When…? What else …? • What if…? • To check my • understanding…? Interviewing in Investigations • Open questions • Probing questions • Hypotheticalquestions • Reflective questions • Closed questions to confirm

14. Case Study – Final Findings • Investigation is complete. Here’s what you found: • Mickey Marks has been taking kick-backs for the last ten years • “Taking a mulligan” was code for the annual payment he received • The arrangement called for Mickey to discourage DenColo filing claims in exchange for flat premiums and his annual “mulligan” • DenColo’s insurers deny any knowledge of “the arrangement” • Jim Daniels paid for all of Mickey’s travel expenses to the insurance meetings, so Mickey pocketed all travel expenses he “incurred” • Mickey had three vendors set up in the system with payments made directly to accounts he controlled • Including the “mulligans”, Mickey pocket nearly $750,000 over a ten-year period

15. Now What? • DenColo’s options • Prosecution – Mickey Marks and any accomplices • Recoup any available funds from Mickey • Crime Policy – Claim misappropriated funds • Errors and Omission claim • Action against broker and/or insurers • Report potential abuses to insurance regulators

16. Contact Information • Dorina Hertner • Director of Corporate Insurance and Risk Management • 7-Eleven Corporation • dorina.hertner@7-11.com • Bill Leone • Partner • Norton Rose Fulbright • william.leone@nortonrosefulbright.com • Ryan Pratt • Principal • Ernst & Young • ryan.pratt@ey.com

17. KEEP THIS SLIDE FOR EVALUATION INFORMATION/MOBILE APP ETC. Please complete the session survey on the RIMS14 mobile application.