Culture is a stewardship issue and a fraud risk indicator

Rupert Evill, Founding Director, Ethics Insight

Note: The views expressed on these pages are the opinions of their respective author(s) only and do not necessarily reflect the views and opinions of UKSIF.

This website should not be taken as financial or investment advice or seen as an endorsement or recommendation of any particular company, investment or individual. While we have sought to ensure information on this site is correct, we do not accept liability for any errors.

 

Culture is a stewardship issue and a fraud risk indicator

Rupert Evill, Founding Director, Ethics Insight

Culture is a stewardship issue and a fraud risk indicator

By some estimates, cybercrime alone (a subset of fraud) is emerging as the world’s third-biggest economy. Fraud is any activity that relies on deception to achieve illicit or unethical gain. By that definition, fraud would also include corruption, bribery, theft, misstatement, misrepresentation, and all the ‘washings’ and ‘hushings’ (green, blue, etc.).

Estimates of fraud’s cost range from 1% to more than 7% of revenue. Whatever the exact percentage, it’s too much, financially and reputationally. Fraud is now a globalised organised criminal franchise. By enabling fraud, we’re helping the people behind our very worst (personal and professional) nightmares: human traffickers, corrupt politicians, and destroyers of the planet.

A three-headed hydra

Cressey’s Fraud Triangle suggests that fraud is a function of opportunity, pressure, and rationalisation. Most organisations gravitate towards the ‘how’ (opportunity), neglecting the seemingly more nebulous ‘why’ (pressure and rationalisation). That is missing a trick. Yes, it’s important to close control gaps. But even the most sophisticated externally originated fraud needs someone inside the organisation to do something they shouldn’t.

For example, in 2024, the UK engineering firm Arup lost ~£20m to a single fraud. A relatively junior employee was pressured into transferring large sums during a fake video call (AI clones of senior officers).

This case demonstrates the power of well-applied pressure.

But what of rationalisation? Well, that’s a trickier beast to summarise briefly. But in my experience, organisational culture creates that context. I crowdsourced the Ethical Excuses Bingo below a few years back. When you start to hear these phrases, know that there’s institutional rationalisation of wrongdoing.

Beyond the benighted employee survey

Pressure and rationalisation are measurable and can become the early warning indicators of integrity health. But we need to know where to look.

How many of you have been asked to complete employee engagement surveys? How many of you trusted that process and spoke freely?

Furthermore, many such surveys ask poor questions. A brief search for “good examples of employee feedback questions” yields:

1. Do you have the necessary tools, resources, and training to do your job effectively?
2. Do you see an opportunity for personal advancement and skill development in your career?
3. My manager clearly communicates performance expectations.
4. Do you feel comfortable raising concerns or disagreements with your manager?

1, 2, and 4 are compound questions. I may have amazing tools but no training; opportunities for advancement but no skill development; or comfort raising concerns about others but no safe space to raise direct disagreements. 3 puts the onus on analysing your manager’s performance, rather than asking, “I understand what is expected of me.”

You get the problem – rubbish in, rubbish out.

Think laterally

We have other indicators of cultural health in an organisation. Staff turnover, absenteeism, workplace disputes, disciplinary issues, exit interviews, overruns, delays, accidents, and on and on. We might also have a speak-up or grievance mechanism.

The Association of Certified Fraud Examiners’ 2026 Report to the Nations indicates that the number one way fraud is surfaced is through “tips” (43% of cases). Organisations without an effective ‘hotline’ suffered 50% higher fraud losses, and the schemes lasted 40%- 50% longer.

If the speak-up line is quieter than a Trappist monastery during prayer time, that’s probably not a good thing. Especially if it’s incongruent with the other data.

There’s no one-size-fits-all benchmark of what a healthy speak-up or cultural health framework should look like. To right-size, we need to accurately calibrate context, controls, and culture.

Three Cs

For investors, due diligence tends to freeze in time a picture of the asset or portfolio company. But the very act of injecting capital changes everything. New decisions, opportunities, and challenges (pressure) are coupled with targets, incentives, and requirements (often used to rationalise wonky ethics). In this setting, we might ask:

Context: What does the intended journey and destination look like? What will be done that has not been done before? Who will we be dealing with?

Controls: Where will speed matter more than controls? Where might we grow faster than the systems around us? Where is oversight already challenging? Where are the having-doing gaps (stuff that got written but never properly implemented)?

Culture: What does decision-making and delegation look like? How do we communicate? Are we moving fast and breaking things? How do we gather feedback? How do we set strategy, goals, and incentives?

When we start to right-size these three Cs, the universe of risk (including that 1%-7% revenue hit from fraud) becomes more targeted (80/20 principle).

Yes, we can continue to try to ‘build more fence’ to keep out the criminals, but until we consider the pressures and rationalisations (context and culture), clever humans will continue to find ways to jump that fence.

The views expressed on these pages are the opinions of their respective author(s) only and do not necessarily reflect the views and opinions of UKSIF.

This website should not be taken as financial or investment advice or seen as an endorsement or recommendation of any particular company, investment or individual. While we have sought to ensure information on this site is correct, we do not accept liability for any errors.