[Organisation name] recognises that there are several potential risks of financial wrongdoing in our operations and program delivery. In recognising this, [organisation name] proactively assesses and manages identified risks in order to prevent harm. This is achieved by examining each activity and program and its potential for exposure to financial wrongdoing. Higher risk activities are subject to more stringent risk management procedures.
[Organisation name] regularly performs assessments of the risk of financial wrongdoing in its operations and programs. Mitigation strategies are designed with this risk assessment in mind, and these strategies are proportionate to the extent of the identified risk.
The risk of financial wrongdoing will be assessed on a [quarterly] basis as part of [organisation name]’s regular risk management process. The various different risks (fraud, corruption, bribery, money-laundering, terrorism financing and breach of sanctions) will have separate entries in the risk register and individual risk strategies for implementation and monitoring. In addition, the risk register should be updated whenever an incident of financial wrongdoing is suspected to have occurred. The risk register is reviewed by the Management Team, Finance & Audit Committee and Board each [quarter].
Each country of operation for [organisation name] will have a separate risk management plan that considers financial wrongdoing risks and their mitigation. This plan will be updated at least annually. Different regions of our countries of operation may have different levels of financial wrongdoing risk and therefore mitigation plans (for example if there has been a recent humanitarian emergency).
Each new partner relationship will be assessed in relation to financial wrongdoing risks. Our responses to identified risks may include: deciding not to work with that partner; providing capacity strengthening support to that partner; working with the partner with additional controls (such as more frequent, smaller tranches of money sent, more frequent monitoring visits), or require further assurances from the partner Board via the partnership agreement. Comprehensive partner risk assessments that include financial wrongdoing components will be completed every [two] years.
All staff, Board members, volunteers, contractors, consultants, suppliers and partners will be screened prior to their engagement with [organisation name] to ensure that they do not appear on any proscribed entities lists.
Prevention of financial wrongdoing clauses will be included in all agreements with our stakeholders, including employment contracts, Board agreements, volunteer agreements, supplier contracts and partnership agreements (Examples to be sourced and included).
Prior to signing any agreements for employment, volunteer or Board appointment, new suppliers or partners, the name of the individual or organisation will be checked against the DFAT ‘Consolidated List’ of persons and entities subject to targeted financial sanctions imposed by resolution of the UN Security Council, and the Attorney-General’s Department ‘List of Terrorist Organisations’ as per Division 102 of the Criminal Code 1995. [Organisation name] will not engage with any individuals or entities that appear on those lists.
From time to time, [organisation name] engages in activities where there is a higher risk of financial wrongdoing, for example humanitarian responses. In these instances, a separate set of detailed procedures is to be followed to mitigate this higher risk, whilst still providing for the level of flexibility required to respond to such a situation.
Staff, volunteers and Board members of [organisation name] are trained in prevention of financial wrongdoing and risk assessment. They are expected to be continually aware of the risks of financial wrongdoing as well as to actively minimise the opportunities and situations where such wrongdoing can occur.
Examples
Awareness raising of financial wrongdoing is the foundation for effective prevention and detection at [organisation name].
[Organisation name] will ensure that all staff, volunteers and governing body members receive training regarding financial wrongdoing risks, prevention and reporting as part of their induction, and thereafter will receive [annual] updates.
[Organisation name] will ensure that relevant staff and volunteers at partner organisations understand their responsibilities in relation to prevention of financial wrongdoing and reporting any suspected incidents. Where practicable, we will support them in strengthening their capacity to meet our requirements.
All staff and volunteers will be advised to use their best efforts to prevent financial wrongdoing. They will be provided with a copy of this policy upon initial engagement with [organisation name] and will be required to acknowledge that they have read and understood it.
Reporting, Investigation and Consequences
Clear reporting statements regarding suspected financial wrongdoing are required to ensure that your stakeholders are aware of their responsibilities to report. A fair, confidential and transparent reporting process will inspire confidence in these stakeholders to report their suspicions promptly.
Your policy should include some high-level guidance about reporting of and responding to incidents, and be supported by a detailed procedural document. Make sure any reporting instructions are accompanied by details of what to do if that role is themselves implicated in the financial wrongdoing. You should include consideration of different reporting pathways of incidents that occur in Australia or overseas, and for the different types of financial wrongdoing. This policy should reference your Whistleblowing and Complaints Handling policies, and how these interface with this process.
Examples
Any person who suspects a financial wrongdoing incident related to the operations of [organisation name] should report it to their manager as soon as possible. If they suspect that their manager is involved in the financial wrongdoing, they should report this to the Chief Financial Officer or Chief Executive Officer. Any person who reports suspected financial wrongdoing in good faith will not be penalised for raising a concern of this nature.
All cases of suspected fraud at [organisation name] should be initially reported directly to the Chief Financial Officer who will advise the CEO. The CEO will appoint an investigation team and decide whether to report the matter to the relevant local police authority and/or the ACNC.
For other cases of suspected financial wrongdoing, including possible corruption, bribery, money-laundering, terrorism financing or breach of sanctions, the matter must be reported immediately to the CEO who will perform a rapid assessment and, if necessary, notify DFAT.
All personnel are expected to report any suspected financial wrongdoing to their supervisor as soon as reasonably practicable. The supervisor must then immediately pass on this report to the Finance Manager who will inform the CEO. If the supervisor is suspected of being involved in the financial wrongdoing, the report can be made to the supervisor’s supervisor, or directly to the Finance Manager or CEO.
Reports of financial wrongdoing that are received via [organisation name]’s whistleblowing hotline should be forwarded to the CEO for immediate action. Our Whistleblowing policy and procedure should be referred to for more information on this process.
Any stakeholder complaints in relation to the management of financial wrongdoing at [organisation name] should be referred to the CEO in the first instance. Our Complaints Handling policy and procedure should be followed in this instance.
Suspected financial wrongdoing incidents will be reported to donors in compliance with the requirements in their funding agreements.
[Organisation name] will report suspected fraud or corruption involving DFAT funds to DFAT within five working days of detection, using DFAT’s prescribed form.
Persons suspecting financial wrongdoing should gather sufficient detail about the suspected incident to provide a report, but they should not perform any investigations themselves. They should keep their suspicions confidential, except for the person that they are reporting to. They should have consideration of their own safety and that of other team members. Persons reporting incidents will have access to counselling support if required. Where possible and safe to do so, evidence of the suspected financial wrongdoing should be copied or saved so that it cannot be destroyed.
An objective and impartial investigation will be conducted for all cases of suspected financial wrongdoing.
Once a prima facie case of financial wrongdoing is established, the CEO, Board Chair and external legal counsel will decide on next steps, including reporting to the relevant authorities.
Investigations of suspected financial wrongdoing at [organisation name] will follow the principles articulated in the Australian Government Investigations Standards, ie we will include investigation principles in our policies; we will measure performance of our investigations; we will ensure that investigators are appropriately qualified; we will ensure confidentiality in our investigations (where appropriate), we will consider foreign evidence if applicable; we will conduct ourselves ethically; and we will proactively manage media if required.
[Organisation name] will pursue every reasonable effort to recover losses sustained from financial wrongdoing.
No actions will be taken against staff that report suspected incidents of financial wrongdoing in good faith no matter whether the incident is proven or not.
If an allegation of fraud is substantiated by the investigation, disciplinary action, up to and including dismissal (or termination of an individual’s right to work as a contractor or volunteer), shall be taken by the appropriate level of management.
(Organisation’s name) will also pursue every reasonable effort, including court ordered restitution, to obtain recovery of any losses from the offender.
Where a prima facie case of fraud has been established, the matter shall be referred to the relevant authorities.
(Organisation name) will report to the Australian Federal Police or the National Security Hotline any suspicious activity or if any link is discovered between funds provided by (organisation Name) and a terrorist organisation or terrorist individual.
(Organisation name) will immediately withdraw all support, including any funding, if (organisation name) discovers that any partner organisation or any beneficiary of (organisation name)’s funds is on, or is subsequently added to, the Consolidated List or List of Terrorist Organisations.
Tip #1
It is very useful to include step by step procedures for reporting of different types of financial wrongdoing in procedural documents. Reporting flowcharts can be helpful in these instances. For example, ACFID have set out their complaints handling process in a flow chart.
Tips #2
When developing your incident reporting procedures, try to address: what to report; who to report to; when to report; how to report; and what happens next. It is also useful to include contact details for reporting financial wrongdoing suspicions to the authorities in your incident reporting procedures. ACNC list contact points for federal, State and Territory Police.
DFAT List where to report suspected incidents of sanctions breaches or terrorism financing.
Tip #3
Providing staff with an incident reporting template is a helpful way for them to gather sufficient evidence but not too much in order to report. It also helps in tracking statistics around the incident such as the time that it was discovered. DFAT requires that instances of fraud are reported to them using a standard form.
Tip #4
Remember and include the reporting obligations that you have in contracts with donors in your reporting procedures. For example, DFAT requires notification of a suspected fraud or corruption incident within five working days of detection. If the suspected fraud or corruption is detected at a partner, this requires rapid assessment and escalation to your organisation in order to be clearly reported to DFAT within their timeframes.
Tip #5
A comprehensive guide to complaints handling in a not-for-profit is provided in the Community Directors’ Policy Bank.
Tip #6
Investigating fraud reports can be very challenging and require specialist expertise. You may wish to refer the investigation to your auditors or another accounting firm. For frauds that occur overseas, your auditors may be able to provide recommendations of local reputable audit firms in their networks to assist in the investigation. Once a criminal offence is suspected, it should be referred to appropriate authorities for investigation. This may include the ACNC, State or Territory police or local police in the country of suspected fraud.
Tip #7
Organisations should not attempt to investigate potential terrorist acts themselves, as this can place them and their stakeholders in danger. Any concerns or suspicions in this area should be reported immediately to the contacts listed on the DFAT website.
Tip #8
When working with partners, make sure to spend some time with them to understand how the Prevention of Financial Wrongdoing policy translates in their cultural context and language. Be mindful that they may have different understandings of what constitutes standard business practice. Together, you may need to reword some elements of the policy to ensure that it is relevant to them and their staff. This does not mean losing the principles and intent that underpin your policy, rather it can assist in getting partners to have a better understanding of your expectations for implementation of the policy. This in turn can help to prevent them from agreeing to comply with your policy for fear of losing funding, even though they know that they won’t be able to fully comply.
