Proactive Approaches to Fraud Prevention Detection November 9

Proactive Approaches to Fraud Prevention & Detection November 9, 2016 Robert Campbell, CIA, CRMA, CFS CHIEF O F F I C EO F C O U N T YI N V E S T I G A T I O N S AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Introduction The Office of County Investigations • Overview • Duties & Responsibilities AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

COUNTY FRAUD HOTLINE Calendar Year 2015 Stats 1, 385 New Cases Opened 1, 207 Cases Closed 306 (25%) Substantiated 519 (43%) Not substantiated 382 (32)% Immaterial, previously investigated, not enough information, or referred outside agencies. Visit fraud. lacounty. gov to review semi-annual reports of Fraud Hotline Activity AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

OCI Rolling out to investigate a report of time abuse GELES COUNTY OF LOS AN OCI AUDITOR-CONTRO LLER AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

OCI – Who do we investigate? • County employees – Permanent, temporary, seasonal • County contractors and vendors • Customers, clients, participants – Involved with a County employee to defraud the County • …and cases referred by the Board of Supervisors. AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Office of County Investigations Responsibilities • Investigate waste, fraud and abuse allegations received via the Fraud Hotline. • Investigate and coordinate criminal cases with appropriate law enforcement. • Maintain the Hotline and a confidential database of fraud complaints and outcomes • Safeguard the integrity and independence of the investigative function AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Our Mission Promote public trust in County government by: – Providing a mechanism for reporting and investigating waste, fraud and abuse – Making impactful recommendations to improve business processes and strengthen internal controls – Working with prosecutors and management to ensure that appropriate criminal and administrative actions are taken AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Prevention & Deterrence OCI Axiom: Detection is grand, but prevention is divine! We provide specialized training to managers and employees throughout the County, to help them be the first line of defense in preventing and detecting fraud. AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Topics for Discussion • The Traditional Approach to Fraud Investigation • Case Study – Rehab Racket • New Approaches for Preventing & Detecting Fraud AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

OCI COUNTY OF LOS ANGE LES OCI John Naimo AUDITOR-CONTROLLER Dropping in to check on internal control compliance AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Fraud Investigations 1) Allegations of ongoing/prior misconduct 2) Investigation/Audit to gather evidence: are the allegations true? Did the misconduct actually occur? Can we prove it? 3) Report of findings and recommendations to appointing authority, prosecutors, etc. for action 4) Follow-up – were corrective actions taken? AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Drawbacks We are only catching fraud after it happens – and that’s expensive – Per the ACFE*, the median duration — the amount of time from when the fraud commenced until it was detected — for the fraud cases reported to them was 18 months *2014 Report to the Nations on Occupational Fraud and Abuse - http: //www. acfe. com/rttn-summary. aspx – The median fraud loss was $145, 000, and 22% of cases involved losses of at least $1 million. AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Drawbacks - cont. - Some operations/areas may be more susceptible to fraud, and more difficult to safeguard with traditional detective and preventive controls - Areas with a reliance on the integrity or dilligence of a single employee, or where decision making resides with third-parties, have been particularly problematic AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Risk Areas Over-the-Counter and in-person field transactions - Welfare and benefit applications and determinations - Plan checks and reviews - Restaurant Inspection/Grading - Code/Regulatory Enforcement AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Risk Areas – cont. Social Services Contracts - Substance Abuse Prevention & Control Counseling - Job Training and Placement (WIA) - Refugee Assistance, Training & Education - Third-party eligibility determinations - Domestic Violence and Homeless AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

“Dist. Atty. Jackie Lacey's office alleges that…the Chicana center's chief executive officer, used public funds to pay for expensive cars, homes, meals and even a political campaign fundraiser. Roughly $1. 8 million went toward…’lavish’ lifestyle, prosecutors say, including season tickets to the Dodgers and Clippers and rent on a home in affluent San Marino. . ” “…improperly used $35, 000 in taxpayer funds to charter a yacht in Seattle; $81, 873 to purchase a 2010 Jaguar in Pasadena; and $145, 653 to cover five years' of rent at the Visconti, an apartment complex in downtown Los Angeles. Prosecutors also allege three defendants created ‘fraudulent records and/or client files’ to support the monthly invoices that were sent to the county's Department of Public Social Services. ” http: //www. latimes. com/local/cityhall/la-me-chicana-services-charges-20150708 -story. html AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Risk Areas – cont. Specialty Procurements/Contracts - Highly technical, and/or requiring uncommon subject matter expertise - Limited market for the product or service - Organizational reliance on one or a few key employees, who participate in critical stages of the contracting process AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Risk Areas – cont. Vulnerable Service Populations/Groups - Juveniles/Dependents - The Elderly - Cultural or language barriers - Individuals with mental or cognitive disabilities/diseases AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

A Wake-Up Call Journalists conducted basic field observations and public records research, and identified a large-scale, distributed, and systemic fraud that went undetected by County and State agencies for years, resulting in millions in losses. http: //cironline. org/rehabracket AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

The Proactive Investigation Surveillance of clinics to count clients reconciled to monthly billings to the County for clients served 39 observed vs. 179 billed Brief client interviews identified individuals (group home residents who are dependents of the County) who said they did not need treatment, but were paid $5 to attend sessions or bused there by their caretakers The investigation raises questions about the adequacy of government oversight of California’s Drug Medi-Cal program, built on an honor system in which honor often is lacking. Oversight is marred by infrequent and cursory inspections and by a failure to act. . . * AUDITOR-CONTROLLER COUNTY OF LOS ANGELES *http: //cironline. org/reports/lax-oversight-leaves-california-drug-rehab-funds-vulnerable-fraud-5037

How Did We Miss This? – Deliverables/payables were inherently susceptible to fraud and manipulation – and that may not be correctible – Controls in place gave monitors a false sense of the integrity of these programs – Fundamental contractor AND STATE representations were not DIRECTLY verified – Monitors were not asking the right questions, and may not have been empowered to AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

F A L L O U T AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

F A L L O U T AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Identify target areas – and get buy-in - Do your operations have risk factors that make this a sensible proposal? - It might pay to advertise what you are doing - You’ll need support AND CONSENT of executive management, and often the supervisor of the targeted area AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity and compliance of your people - BE the customer - Create opportunity – see what happens - Talk to real clients – don’t just perform an audit verification (customer survey) - Walk the parking lot, scrutinize address changes, read form 700’s AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity of your systems - Try to obtain and use access to systems you should not otherwise be able to get or have – test the new-user sign-up and change management processes - Will users compromise system security to authority figures, or people they know? - Try phishing your staff for credentials AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity and compliance of your core business processes - Insert bogus documents into your process stream at key points to determine if staff responsible for scrutinizing them are doing their jobs, and if controls exist/work - Can you drop an extra invoice or application into the processor’s box unnoticed? Was it processed? AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity and compliance of your contracts - Seek out evidence of vendor-vendor and vendor-employee relationships - Are there trends in “competitive bids” that indicate possible bid rigging? - Use the internet to reality check prices, vendors, contractor principals, etc. AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity and compliance of your contracts (cont. ) - Third-party validation of procurement specifications & restrictive criteria - Lifestyle and other red flag indicators for contractor principals and employees - Disrupt the expected contracting process and see what happens! AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Consider the integrity and compliance of vendor/service provider payments - Have you verified vendors actually exist and are doing work? Could you walk-in and check on them? - Be a customer – try the services out and see if they are consistent with what you are being billed for AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

New Approaches Mine your data (this isn’t really new) - HR/payroll data can identify family relationships, and more. - Add your vendor data to the analysis and you might find some troubling connections - Keyword searches on email archives/ servers - GIS analysis - Data normalization / de-duplication AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

PROCEED WITH CAUTION - Consult with counsel and executives - Give the head of the unit being tested a role in the process, and present findings (good or bad) in the light that they were developed through cooperation between audit and management - Understand the line between integrity testing and entrapment – and don’t cross it AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

PROCEED WITH CAUTION - cont. - Consider the impact if violations/findings are noted, and how you will respond - Make sure people understand how these initiatives are consistent with the culture and values of your organization – and give them a reason to support the program AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Conclusion • Proactive approaches can be highly effective – when they are WELL PLANNED and CAREFULLY EXECUTED! • Get buy-in/approval • Let people know (generally) what you are doing, to enhance deterrent value • Publicize successes • Leverage technology AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

QUESTIONS AUDITOR-CONTROLLER COUNTY OF LOS ANGELES

Contact Me! Robert Campbell (213) 893 -0058 rcampbell@auditor. lacounty. gov http: //fraud. lacounty. gov AUDITOR-CONTROLLER COUNTY OF LOS ANGELES