‘If one employee is submitting consistently false expense reports and they’re getting away with it, other employees may rationalize similar behaviour’
While many white-collar employees remain comfortably ensconced at home during the COVID-19 pandemic, the chance of an employee engaging in unethical solicitation or purloining company funds is a genuine consideration.
Canadian HR Reporter talked to Breanne Campbell — partner in the litigation group at SVR Lawyers in Calgary — about some of the issues employers should keep top of mind when considering potential fraud.
Q: What steps can an employer do to prevent employee fraud?
A: “Conduct an internal risk assessment to determine where the company is most vulnerable. It should identify specific schemes that present a risk in the company’s industry and assess the likelihood and possible impact on the business and what systems they should have in place to mitigate the risk.
“Fraud schemes are constantly changing and as a result of the pandemic and remote working, different types of schemes might be more prevalent than working in an office.
“The most common areas of focus would be around cash, receipt and payment of funds and other valuable assets, like inventory and intellectual property. Most importantly, companies should ensure there’s an appropriate segregation of duties for the core finance functions even when employees are working remotely, and even though it’s going to be more difficult to do.
“For example, there should be to two signatures on every check. If all your workforce is remote, it’s going to be a huge hassle to get two signatures but it shouldn’t be overlooked how important that is. The key is that companies should ensure that no one employee can initiate and complete a financial transaction or has responsibility for more than one of the core finance duties: access to cash, access to the bank account, collecting payments from customers, signing authority on bank accounts, approval of expense reports, recording transactions in the accounting system and reconciliation of the accounting system.”
Q: Is there anything that can be written into an employment contract?
A: “Companies should document expectations for their employees in a code of conduct or code of ethics and also create specific policies which document their financial roles. Where a company doesn’t have a code of conduct or financial policies in place, the employee might claim: ‘Oh, I wasn’t aware of the expectations,’ and use that as an excuse to justify their actions.
“Employers should have non-compete and non-solicitation clauses in the contract and the employee should acknowledge that he owes the company a duty of good faith and loyalty. It should be signed and that way it’s something that you can point to after the fact if the employee does divert corporate activities to himself from the company.”
Q: What are best practices for doing remote investigation of a worker?
A: “First and foremost, the employer needs an investigation plan. They need to figure out who is going to be on the team and they need to limit it to a need-to-know basis, so there’s no leaks.
“They need to determine what information is needed: bank statements, credit card statements, expense reports, emails… and how to obtain them.
“Immediately, the company needs to revoke the employee’s access to company systems, both virtually and physically. That employee might have access to the VPN network to work remotely, that needs to be revoked. Also, physical access to the building needs to be revoked. That way, they can’t alter any evidence and it also prevents any further harm from taking place.
“Depending on the severity of the allegation, company devices like a laptop or iPhone, you could send them a prepaid registered mailbox. If it’s very serious, you would want to send someone out to the home.
“The next step is preserving the evidence and this is really important: They need to take a forensic image of the data stored on devices before that data is reviewed, because just reviewing the data could alter it. As a general practice, physical documents should be kept exactly how they are found and it should be noted in writing. If documents are clumped together with a paperclip, they should be kept that way and there should be no notes made on the document that would alter them.”
Q: Can employees be legally monitored while at home?
A: “Generally speaking, at-home workers have a higher expectation of privacy compared to an employee who works in an office. Employers should keep in mind that monitoring needs to be reasonably connected to the management of the employment relationship and the employer should use the least intrusive means available.
“The employer should have clear policy in place, giving advance notice to the employee of what is being monitored and ideally, the employee will provide written consent to that. That’s important because it’ll reduce the employee’s reasonable expectation of privacy and that’s one of the considerations that a court would consider in determining whether there was a privacy breach.
“Don’t use monitoring technology unless there’s some reason for it. If you’re noticing overall performance has been notably affected by working at home, then you might want to start considering using it but excessive monitoring and micromanaging can have the opposite effect intended and can breach the trust between the employee and the employer.”
Q: Why does a whistleblower program make sense?
A: “If one employee is submitting consistently false expense reports and they’re getting away with it, other employees may rationalize similar behaviour.
“Human resources should set up a whistleblower program, either internally or through a third-party contractor, and that way employees can anonymously report suspected fraudulent activities of others. Data shows that 43 per cent of occupational frauds were detected by a tip. You need employees to feel comfortable that they can come forward with these tips and there’s not going to be any repercussions for them because they’re going to be anonymous.
Canadian HR Reporter spoke to experts for answers on key questions around mask-wearing policies and what to think about when an employee asks to move to another jurisdiction.
