On the Frontlines: Counting the Coffee Beans

Imagine the person whose job includes filling the coffee machines with coffee beans at your office. Let’s call him Joe Perks. Depending on the size of your organization, it could be that there are a lot of coffee machines that need to be fed with coffee beans, multiple times per day. Joe has access to a stock of coffee for the entire building. As time passes, Joe becomes tempted to take some coffee home for his own use. At first, Joe smuggles one package of coffee and takes it home. Considering the overall consumption of coffee within such a big building and so many coffee machines, this is not noticed. Most employees probably wouldn’t rank this indiscretion very high on their list of wrongdoings.

However, over time, let’s imagine that Joe becomes more comfortable with the situation and starts taking more coffee from the organization for his own use. Eventually, Joe stops buying coffee altogether and uses only the coffee from work for his personal consumption.

Perhaps Joe takes it a step further and figures out that some of the coffee can be sold to other people to generate a small income. Joe starts using online platforms to sell the coffee below the regular market price, pocketing the additional money. Joe also realizes that the organization provides employees free postal services, so he even starts to use the employee mail center to send the packages of coffee to his newfound customers.

Finally, Joe becomes very successful with the online business of selling coffee under the regular market prices. Joe is sending packages via the organization’s postal service every day; subsequently, consumption of coffee within the organization seems to increase significantly.

Eventually, the employee working in the organization’s mail center becomes frustrated with so much additional work that needs to be done for Joe and raises the topic to the line manager. Quickly, it becomes apparent that something is amiss, the topic gets escalated to internal audit, and they soon discover the whole fraud scheme.

There are several takeaways that can be derived from this situation:

Small things matter. Without minimizing the focus on the big-ticket frauds, the small ones are important to the organization, as well. Most employees can identify with small, everyday items, such as coffee. Knowing that there is an appropriate process and monitoring and control mechanisms — even for coffee — sends a strong message to all employees.

The importance of proper risk assessment. Often, small items are not properly assessed for related risks, due to their immaterial impact to the organization. However, fraud risk should always be in the focus, even for small items. Such items are within reach of many employees and can be easily manipulated. Periodic changes, job rotations, or temporary replacements can be good mechanisms to check if there are any deviations in inventory.

The significance of behavioral red flags. Body language and behavior can sometimes reveal important information to internal auditors. Of course, auditors cannot rely only on such red flags, but they can be a good starting point for further analysis and checks to be performed. Better checked than sorry, as internal auditors say. Coming back to our previously described coffee situation, several behavioral red flags were identified. When the auditors first questioned Joe, he acted strangely, averting his eyes. At the same time, Joe was claiming that he was visiting the mailroom a lot because he was waiting for a very important private letter. Such reactions triggered the auditors to investigate further.

A speak-up culture is key. Employees should be encouraged to speak up and report their concerns. Typically, people close to the wrongdoer are the first ones to notice strange behavior and are the best sources of information. Even though a speak-up culture can sometimes lead to false alarms, it can reveal a lot and serve as a good monitoring mechanism in the organization.

Soft preventive controls can be effective. Sharing details about fraud cases that have occurred within the organization, to the extent possible and reasonable, can raise awareness among employees that such things happen and people get caught. After all, the best control mechanism is the understanding that a control system is in place.

Finally, fraud cannot be completely prevented or stopped. However, proper risk assessment, good processes and management, as well as effective control mechanisms, can help protect the organization from fraud. Internal auditors can contribute to fraud prevention and detection, even with items as seemingly inconsequential as coffee beans.