The Salvation Army has been in the news due to a massive theft of children's toys from its warehouse. It fired its executive director in response and is investigating the circumstances surrounding this crime.
While the scale is large, it is not unusual to encounter examples of theft and embezzlement in organizations. The pharmaceutical industry has had its share of problems with Pfizer having to pay over $2 billion in fines over fraudulent marketing practices and Abbott Laboratories having agreed to pay $1.5 billion to resolve allegations that it illegally promoted the drug Depakote. In 2007, PBSJ's CFO was imprisoned after his $36 million embezzlement scheme only to find them in trouble again in 2009 for illegal campaign contributions. What is going on here?
Most large organizations have loss prevention officers whose role is to protect assets through implementing security and safety programs for employees and customers. They also have internal audit functions and controls to test, monitor and prevent these types of crimes. What happens when these systems break down and crime occurs?
Theft happens when there is opportunity, incentives and lack of internal controls. A board, or lack thereof, controls and approves all of these factors -- and in particular, controls. Richard was in Calgary after the XL Foods crisis, lecturing to a room full of directors on beef association boards in Alberta.
"Do you approve the internal controls over food safety?" he asked. Not many hands went up. "Do you take tours of the plant, seeing the line, and talking to workers? Do you have an internal audit function that tests the design and effectiveness of internal controls, and reports directly to you?"
Again, not many hands went up.
A proper board will want to see validation over the internal controls over all material risks -- in the form of real-time risk registers with individual accountability and mitigating actions. Material risks are not just financial, but non-financial. This includes operational controls, such as the line in a meat plant, or the warehouse with toys in it. As the Basel Committee on Banking Supervision has advised (see Principle 9 on page 3), the "board of directors has the ultimate responsibility for ensuring that senior management establishes and maintains an adequate, effective and efficient internal control system."
What leads to this apparent lack of awareness of the need for board involvement in internal controls? Internal controls basically constrain management. No one likes to be controlled and there is the subsequent resistance to increasing pressure from the board to management to have proper controls in place. Tension exists between the desire by management to operate independently and the board's duty of oversight. In not-for-profits and charities especially, there are stretched resources, volunteers, and a tendency to trust people. However, fraudsters exploit these areas of vulnerability.
Trust is at the heart of the issue. The implicit social contract that exists between boards and senior management is essential to the effective management of any organization. It would be impossible to run any organization effectively if the board micro-managed the executives.
In charitable organizations, the level of trust is even higher. This is especially true for faith-based organizations when it seems to be anathema to the spirit and the essence of the faith to doubt its volunteers and employees.
Therefore, boards who are concerned with not appearing heavy-handed or disrespectful may err on the side of blind trust. This is a grave mistake. This leaves a large gap where fraudsters see an opportunity and take advantage. This also leaves a gap for abuse or taking advantage of beneficiaries such as children or others. We only have to think to the recent Penn State scandal to know of the tragedy that ensues.
Controls need to be person-proofed and require a diligent board with authority and competency to require adequate reporting, controls and follow up. Sadly, this was not the case at the Salvation Army and the board (or lack thereof) is at fault. Donations may suffer but more importantly, so will children at this time of year.