Message from the Chairman
As we enter 2019, I want to address several items to TheIIC Membership. The first is notification that this edition of TheIIC e-Newsletter will be the last accessible to anyone via our website. Although the website can be accessed by anyone, starting with the next edition in 2019, all future, as well as archived versions of TheIIC e-Newsletter, will be located within the Resources Section of the website under the MEMBERS ONLY PORTAL and accessible ONLY by Members-in-Good-Standing. More details are included in the e-Newsletter below.
Also, I want to address some confusion on the acronym for the association; specifically, IIC versus TheIIC. Note that our official association name is the INSTITUTE FOR INTERNAL CONTROLS and that we have dropped "THE" prefix in our corporate name. Again, I will address this in one of the article sections below, but I do want to announce that we have applied for the trademark "TheIIC" and commencing immediately we should be referred to as TheIIC. We are also currently attempting to trademark the acronyms "CICA" and "CCS".
Lastly, I wanted to address the Quiz that is accessible via TheIIC e-Newsletter for CPE award. For those that completed the Quiz for the last edition of the e-newsletter, you noticed that we added a new functionality that allows for immediate grading of the quiz and issuance of the Certificate of Completion for members scoring the minimum passing grade. In addition, we allow retesting if a passing grade is not attained. We will also use this process for the Quiz for TheIIC e-Magazine to be released in mid 2019.
As TheIIC grows in its status as the premier association for Internal Controls Professionals, I want to remind our members that we are not limited to any specific profession. Our members extend beyond the traditional audit function and include anyone who is directly involved in Internal Controls in the areas of Management Controls, Operational Controls, Financial Controls, IT controls (including network controls, data access controls etc.), Physical Security and Loss Prevention Controls, and Risk Management. Our members are not limited and include not only auditors and accountants but extend to internal auditors, external auditors, accounting professionals, consultants, systems engineers, computer security specialists, systems and program analysts, programmers, physical security professionals, loss prevention professionals, QA/QC professionals, etc. Our members are not limited by profession, but by their involvement in the audit/review, evaluation, design, and monitoring of internal controls. Note that an article will be included in the inaugural edition of TheIIC e-Magazine, detailing the history and scope of TheIIC.
Dr. Frank
MEMBERS ONLY PORTAL to be Activated in 2019
In December 2018 we begin the migration of all active members of TheIIC to the new Membership Management System (MMS) that will be located within our Association website. The migration will be completed in segments, starting with January renewals and should be completed by the end of the first quarter. Only Members-in-Good-Standing will be migrated to the new MMS. A Member-in-Good-Standing is defined as a member who is active and has maintained his/her membership via payment of their annual dues certification of compliance with TheIIC Code of Professional Standards, TheIIC Code of Ethics, and where applicable with TheIIC CPE Policy. You are reminded that your membership must be active and in good standing in order to hold the CICA or CCS professional certification. The expiration date of your current membership is located on the front of your membership card which is updated annually upon payment of your dues.
Although access to TheIIC website will be open to anyone, valuable resources and benefits will be accessible only to Members-in-Good-Standing via the MEMBERS ONLY PORTAL. During the year we will add to this section to include not only TheIIC e-Newsletter, but also TheIIC e-Magazine (which will be released in mid 2019), a library of Internal Control Questionnaires (ICQs) that will be stocked from ICQs developed by TheIIC or via contributions from members, White-Papers on Internal Controls written by TheIIC Staff and Members and Guest Authors, as well as discounted offers by vendors for items of interest to Members, downloads for TheIIC artwork, including TheIIC logo and seal, templates for personal or business use of TheIIC logo or seal, screen savers, screen backgrounds, and much more.
Access to the MEMBERS ONLY PORTAL of our website will be via your preferred email address on record. This is the email used in the receipt of the announcement for this newsletter. Note that receipt of this email does not confirm your standing as a Member-in-Good-Standing. If in doubt, check your membership card as noted above or contact the Membership Department at membership@theiic.org for confirmation of your status. Any changes should be reported via the Member Change Request form located on the Contact Us page of our website (www.theiic.org). Note that the new website and MMS will allow members to access their profile and make changes as needed. Additional instructions will be emailed to the Membership once the MMS implementation is completed.
Changes to Institute Name & Acronym
Members have inquired about the proper name of the Institute. In starting what was originally referred to as “The Institute” in 2005, we were limited in several areas in selecting the name for the association, as well as the acronym and internet domain. For those who have been associated with the IIA for a long time, you may remember that they experienced some of the same problems in selection of a domain for their website. First, in naming the organization and selecting a domain for our website it was revealed that the domain @iic.com was taken. Noting the importance of having dual domains, one for dot com and for dot org, we needed an alternative available choice. As a former member of the IIA, I remembered that their solution was to add the prefix “the” and therefore chose the domain @theiia.org for their website. We followed this by selecting the domain @theiic.org as our domain and a similar domain name for dot com with automatic forwarding to the dot org website. Simultaneously, we chose to incorporate the institute as “The Institute for Internal Controls, Inc.” a New Jersey Corporation. However, protocol in incorporating in New Jersey as well as IRS caused the elimination of the prefix “The” and we were officially incorporated as the “Institute for Internal Controls, Inc.” In the more than 14 years of operation we have found ourselves switching our acronym between “TheIIC” and the “IIC”. This year, in attempting to trademark some of our acronyms and symbols we have found that some have been denied due to conflict with existing trademarks. For example, the trademark “IIC” was taken but the trademark “TheIIC” was open. Therefore, we choice TheIIC trademark as well as our logo and seal. To be consistent, the Board has agreed that we would use the acronym “TheIIC” going forward. In line with this, we will be seeking designs for TheIIC trademark, with the only limitation being that its primary color would be blue. The initial version is show in the title of this article. We have also eliminated the word “The” from our name which was originally included on our initial seal but removed several years ago. Note that we have applied for aliases so both versions of our corporate name and acronym can be accepted, if needed.
MAY I OFFICIALLY WELCOME EVERYONE TO TheIIC ™ (Trademark pending)
Board's Role in Promoting an Ethical Culture
Extract (Modified with comments from Chairman)
PART II (continuation from Fall 2018 e-Newsletter
Source: Journal of Accountancy - July 1, 2018
An excellent article that was published in a recent edition of the Journal of Accountancy discusses the role of the Board of Directors in promoting a heightened level of ethics throughout the organization. The author astutely notes therein that “Boards that prioritize corporate culture, watch for red flags, and set clear expectations, will encourage ethical behavior throughout the company.” However, we continue to see large scale fraud or inappropriate actions, especially in companies like Wells Fargo, Theranos, and most recently Facebook, where it appears that profits override concerns for good business practices and privacy of individuals. As internal controls professionals we need to ask is policy or action reality. I suggest you use your professional skepticism in reading the article to determine what they want you to believe and what is reality.
Professional Ethics research over the past 20 years has continued to underscore that integrity drives performance. Corporate culture and tone at the top are considered key drivers of ethical behavior, but Boards of Directors (and Audit Committees) often devote little time to the topic. Although Board members generally recognize their responsibility to oversee ethics and compliance, they struggle with what questions to ask and what information to look for; that is, they are not well-versed in recognizing red flags. Most have had little or no training in ethics or the required in depth sensitivity to the risks in the industry itself. Serving on a board is a big job. Business strategy and expansion, risks, and enforcement frequently take priority. Board members are aware of the importance of an ethical corporate culture and that it is driven from the top down, but 87% considered culture and engagement a top challenge, according to a Deloitte survey published in 2015. A 2016 Deloitte study found that just 28% of executives said they understand their organizational culture and 12% thought their company was driving the "right culture." This is evident in the Facebook incident(s) that continue with new revelations every day.
The problem often starts right in the boardroom. Research from a 2016 survey by the Rock Center for Corporate Governance at Stanford University and The Miles Group suggested that only 46% of board members strongly believe their board tolerates dissent. The same percentage believes that a few directors have an outsize influence on board decisions. A 2017 Blue Ribbon Commission of the National Association of Corporate Directors (NACD) suggested that boards can tackle the challenges. This is similar to what we heard from the AICPA in addressing the Lincoln/Keating scandal that wiped out the FSLIC and the Savings and Loan industry. Implementing new statements on auditing standards without training and compliance will not wipe out fraud and unethical practices. What they need to do is become as disciplined in overseeing corporate culture, an active on-going internal control environment, and implement a process for recognizing RED FLAGS.
The author noted that many businesses have codes of ethics that employees are supposed to follow and mission statements that promote values such as ethical behavior. But the real problem is integrating this ethical culture throughout management (especially at the executive level) where it must be integrated as best practices and a way of doing business. It is important that these statements and codes exist, but what really counts is having the board and senior management know and buy into them, and practice them themselves. Tone at the top means that the board truly believes in the corporate culture and assures that the entire team adheres to the cultural values, starting with the directors and executive officers of the company.
It's important that during the executive sessions, audit committee members ask broad questions. In developing the AICPA Audit Committee Toolkit for Public Companies, it was stressed that during annual executive sessions, audit committee members ask broad questions to uncover any questionable activities. TheIIC opinion is that these be converted into an ICQ format, with all responses documented and that the Board, Audit Committee and Auditors, all exhibit professional skepticism in evaluating the responses. At a minimum the following questions should be asked:
-
Are you aware of any issues that could cause embarrassment to the company?
-
Have you ever been told anything in confidence or otherwise that would embarrass the company if it were known publicly?
-
Are there any items that you have discussed with the CEO, CFO, other officers, or outside counsel of which the audit committee is not already aware?
-
Is there any activity in the organization with which you are uncomfortable, consider unusual, or that you believe warrants further investigation?
-
Are you aware of any current or past fraud occurrence or any kind of fraud in the organization?
-
Do you know of any situations in which fraud could occur?
-
Do you feel comfortable raising issues without fear of retribution?
-
Are there any questions we have not asked that we should have asked? If so, what are those questions?
Note that the above covers just the basics and the ICQ should be
specifically designed to address risks to the company. For example, in the Facebook situation, a deeper level of questioning was needed for obvious issues such as privacy concerns, what data do their customers/vendors have access to, what is everyone doing with this data, is what we are doing ethical, et. As you can see, this just touches the concerns and a system of internal controls need to be implemented to prevent or provide early detection of ALL risks that need to be identified ad addressed.
To establish clarity on the fundamental elements of a strong organizational culture, as well as promote and enforce it, the NACD’s Blue Ribbon Commission recommends that Boards follow these 10 recommendations:
-
The board, the CEO, and senior management need to establish clarity on the behavior they expect across the organization regardless of geography or operating unit, and they should develop concrete incentives, policies, and controls to support the desired culture.
-
Directors and company leaders should take a forward-looking, proactive approach to culture oversight to achieve a level of discipline that is comparable to leading practices in the management and oversight of risk.
-
The board's nominating and governance committee should ensure that board policy documents and committee charters clearly delineate the allocation of culture oversight responsibilities and explain how culture oversight is embedded into the board's ongoing work.
-
Directors should regularly review the culture of the whole board and its key committees, both formally in the evaluation process and informally by allowing conversation in executive sessions. Results of these reviews should inform board composition, succession planning, and continuous improvement efforts.
-
Directors should assess whether the chief legal officer/general counsel and other officers in key risk management, compliance, and internal control roles are well-positioned within management and in relationship to the board to support an appropriate culture.
-
Integrate culture into the board's ongoing discussions with management about strategy, risk, and performance, emphasizing that the way results are achieved is as important as whether a given goal is met.
-
Boards should set the expectation with management that regular assessments of culture will include qualitative and quantitative information and incorporate data from sources outside the organization.
-
Directors should make culture an explicit criterion in the selection and evaluation of the CEO and set the expectation that the CEO and senior leaders do the same in their own leadership development and succession-planning activities.
-
Boards and compensation committees should review the company's recognition and reward system to ensure that they reinforce the desired culture and avoid unintended outcomes that could undermine it.
-
Shareholder communication should include a description of how the board carries out its responsibility for overseeing and actively monitoring the company's culture.
Lessons Learned from Municipal Fraud Cases
Exract JOA - October, 2018 (with comments by Chairman)
In the early 80’s, as a criminal investigator in the Corruption Unit for the New Jersey Division of Criminal Justice (DCJ), my unit was overloaded with cases against government employees, contractors, vendors, and others, in investigating allegations of fraud and other illegal acts in municipalities and government agencies throughout the state. I would extend this to townships of all sizes, cities, counties, school districts and to State divisions . In several of these, the number of cases were numerous, and spread throughout the government as the lack of any internal controls systems tempted anyone who had an opportunity to embezzle funds, steal property, overbill, etc. We found that municipal/etc. fraud was not only rampant in New Jersey but throughout the country. However, we found that much of this was often preventable.
As noted in the JOA article, it is an all-too-common headline “Government employee steals public money”. While the details are different, the general outline of the scheme is usually the same. A trusted employee, at the financial center of the municipal body, siphons off small amounts of money by writing checks or electronically transferring funds to himself/herself, or co-conspirators, over the course of several years until one day, he/she is discovered to have stolen hundreds of thousands, if not millions, of dollars. In other cases, it was discovered that contractors were hired to perform work on the property of the government employee or purchase personal items and charge the government entity. Other cases included kickbacks in the form of cash or luxury items or personal work in return for government contracts.
There have been several shocking cases of municipal/etc. fraud and illegal acts discovered in the last decade. Rita Crundwell, a long-trusted comptroller and treasurer in the small town of Dixon, Ill., stole nearly $54 million over 22 years to finance a lavish lifestyle of competitive horse breeding; Michael Minh Nguyen, a financial services manager in Placentia, Calif., embezzled $5 million by wire transferring money to himself and others to pay off gambling debts and make dubious investments; Claudia Vilest, the tax collector in Anson, Maine, for 33 years, was convicted of stealing $500,000 in tax receipts from 209 to 2015. While I was at DCJ an increase of embezzlement was seen as Atlantic City allowed casino gambling and government employees used their ill gotten gains to finance their gambling debts.
Unfortunately, these crimes aren't rare. While most cases don't feature the same kind of publicity-generating dollar totals, municipal/etc. fraud is widespread across the country. Although many states now have Inspector General units to investigate allegations of irregularities often found by auditors or calls from hotlines, the oversight within the agencies itself are weak or non-existent, leading to temptation at all levels.
Investigators and internal controls professionals have cited many reasons for the trend in government fraud and illegal acts contributing to weak or non-existent internal controls; including:
- culture of blind trust;
- lack of financial literacy among elected officials;
- lack of supervision or oversight;
- lack of internal controls systems;
- turnover among elected officials as contributing to weak internal controls;
A good example of the above was the Orange County (California) bankruptcy where citizens continuingly re-elected the country treasurer, Robert Citron, based on his ability to keep taxes down, not knowing that he was accomplishing this by stealing from the pension unions to finance the county’s deficits. His creative financing and investment strategies which seemed to earn high incomes for the county without raising taxes through risky, high leveraged bond positions, eventually lead to a cash crunch when interest rates increased and financiers for the county required increased collateral from the county.
So what can municipalities do to develop oversight systems to prevent embezzlement, and what can CPAs, auditors, IGs, etc. do to assist them?
Read the JOA article via the link below about what three municipal fraud experts note about the lessons they've learned about this type of crime and what can be done to prevent and detect it. They include:
- Divide and conquer.
- Trust the system, not people. "Don't trust the person, trust the system," Brown said.
- Be proactive.
- Bridge the expectation gap.
Click for source article
Ethical Implications of Artificial Intelligence
Artificial Intelligence (AI) is constantly surfacing in articles in general business, management, and accounting/auditing. Most authors have note that AI presents a new set of ethical challenges for business leaders whose active deployment of mechanization may have profound effects on the workforce and society. The article extract belowrecently published in a recent edition of Financial Management points out several concerns that should be noted by the authors. As part of our introduction of TheIIC e-Magazine in 2019 as well as White Papers from staff, members and colleagues of TheIIC, we will introduce concepts and concerns to the Internal Controls professionals.
Source: Financial Management Magazine – December 2018
EXTRACT (Modified with comments from TheIIC Staff)
In the race to adopt rapidly developing technologies such as Artificial Intelligence, blockchains, and others, organizations run the risk of overlooking potential ethical implications that could produce unwelcome results, especially in artificial intelligence (AI) systems that employ machine learning. Machine learning is a subset of AI in which computer systems are taught to learn on their own. Algorithms allow the computer to analyze data to detect patterns and gain knowledge or abilities without having to be specifically programmed. It is this type of technology that empowers voice-enabled assistants such as Apple's Siri or the Google Assistant, among myriad other uses. In the accounting space, the many potential applications of AI include real-time auditing/monitoring and analysis of company financials.
It should be noted that data is the fuel that powers machine learning based on what is assumed to be real, valid, accurate, etc. But what happens if the data fed to the machine are flawed or the algorithm that guides the learning isn't properly configured to assess the data it's receiving? Things could go very wrong remarkably quickly, without the knowledge of management or the auditors. Conclusions can be assumed to be correct based on the assumption that the data is accurate.
With regulatory and legal frameworks struggling to keep pace with the rapid pace of technological change, public demand is growing for greater transparency as to how these tools and technologies are being used. However, as we know, in our attempts to fix things quickly, we sometimes do a poor job, or make things worse. The UK's Institute of Business Ethics (IBE) recently issued a briefing urging organizations to examine the risks, impacts, and side effects that AI might have for their business and their stakeholders, as well as wider society. Tackling the issues requires these diverse groups to work together. Research identifies several challenges facing business leaders, auditors and IC professionals. These include:
What degree of control can an organization retain over our machines' decision-making processes?
- How can we ensure that the systems act in line with the organization’s core values?
- Since biased algorithms can lead to a discriminatory impact, we must ask how can we ensure fairness and accuracy?
The report notes that all stakeholders need to be empowered to take personal responsibility for the consequences of the use of AI, and they need to be provided with the skills and tools to do so. The report proposes a framework outlining ten core values and principles for the use of AI in business which are intended to "minimize the risk of ethical lapses due to an improper use of AI technologies". The values are:
- Accuracy
- Respect of privacy
- Transparency
- Interpretability
- Fairness
- Integrity
- Control
- Impact
- Accountability
- Learning.
The authors noted that companies applying AI to the finance function face the challenge of designing algorithms that produce unbiased results and are not too complex for users to understand
how they work and make decisions. This transparency is essential to avoid the "black box" problem, in which a computer or other system produces results but provides little to no explanation for how those results were produced. In the case of machine learning, the greater the complexity of an algorithm, the more difficult it is for users to understand why the machine has made a certain decision. Another challenge is to avoid bias in the algorithm and in the dataset the algorithm uses for learning. One way of mitigating bias is to use combinations of learning types, including unsupervised learning. Assumptions noted include:
- Supervised learning is based on label data, and often the labels themselves create bias.
- Humans essentially bring their own biases to machine learning scenarios.
By contrast, unsupervised learning has no labels and essentially will find what is in the data without any bias.
AI provides a difficult set of ethical questions for society as well. One question centers on the preservation of the workforce. In the accounting profession, for example, AI can extract data from thousands of lease contracts to enable faster implementation of new lease accounting standards. This can enable the people who would have handled data extraction to perform more complicated accounting tasks and perhaps even contribute to strategy. This can be a positive development as those people perform more meaningful work. But if the people whose tasks are replaced by AI lose their jobs rather than being promoted to higher-level work, the implications for society can be ominous. If people who perform repetitive tasks across multiple professions and industries all lose their jobs instead of being promoted, implementation of AI could leave many people without options for work and damage their lives and the economy.
The technology may be here now, but the ethical rules for managing, controlling and auditing AI will take time to develop.
Click here to read the original article
.jpg)
10 questions to ask about adopting or using AI
In the FM article published above a reference to 10 questions to ask about adopting or using AI was referenced. We will discuss this article in the next issue of TheIIC e-Newsletter (note that the link to the article briefing has been included at the bottom of this article. They include:
1. What is the purpose of our job, and what AI do we need to achieve it?
2. Do we understand how these systems work? Are we in control of this technology?
3. What are the risks of its usage? Who benefits and who carries the risks related to the adoption of the new technology?
4. Who bears the costs for it? Would it be considered fair if it became widely known?
5. What are the ethical dimensions, and what values are at stake?
6. What might be the unexpected consequences?
7. Do we have other options that are less risky?
8. What is the governance process for introducing AI?
9. Who is responsible for AI? Because machines are not moral agents, who is responsible for the outcome of the decision- making process of an artificial agent?
10. How is the impact of AI to be monitored?
Source: IBE Business Ethics Briefing,“Business Ethics & Artificial Intelligence”
TheIIC is Developing ICQ Library for Members
As part of the design of the new website, which will contain a Members' Only Portal, TheIIC is soliciting members to donate Internal Control Questionnaires for use by members. It should be noted that all ICQs should be non-copyrighted or if copyrighted, contain a release to allow use by TheIIC and its members.
An email alert will be sent to the membership providing more details on this project. As an incentive, all members who donate an acceptable ICQ will be awarded one raffle ticket for a drawing for the award of a $100 gift card.
TheIIC Releases Certification via Curriculum Program
|
Commencing in 2018/2019, candidates can earn the CICA or CCS certification by completing a curriculum of courses in the areas of internal controls. The program will entail corporate ethics and governance courses, how to courses, and tools and technique courses. The curriculum syllabus will be outlined in the new website which will be released this year. The courses will initially be held in live group sessions, and then converted to a high-quality DVD/CD-ROM format, with examinations held online at the end of each course. Once all course requirements are met, the candidate can apply for the CICA or CCS and candidates who meet all the requirements for certification will be awarded the professional designation. The program will be phased in over a one year period as courses become available.
|
| Scholarship Fund Established |
|
 As previously announced by the Chairman, a Scholarship Fund has been established for award to undergraduate students who are majoring in accounting or auditing, IT/MIS, finance, or Security. The scholarships will be funded by donations from members at renewal time, as well as direct contributions from TheIIC, and shared profits from the sale of TheIIC Internal Controls Case Study book to be released in 2019. Scholarships will be awarded based on set amounts collected. Plans are to award at least one scholarship each year. Scholarships will be awarded based on financial need. Student Members of Student Chapters of TheIIC or school Accounting Clubs will be given priority for the award of all scholarships.
|
FREE Job Posting Service
|
As a service to our members, TheIIC offers all members, their organizations, and recruiters FREE Job Posting Service. TheIIC will post any appropriate job opening the may be of interest to the membership. Postings must include the title of the position, the organization and department, and the location of the position. Salary information is optional but recommended to prevent frivolous inquiries. In addition, a "direct link" to the job posting at the organization's website must be provided. Doc files will no longer be accepted. Note that when listing certifications required or preferred for the position, the list MUST include the CICA or CCS as a preferred certification at a minimum. Job postings will be posted for 60 days or until notice is received by TheIIC that the position has been filled. In addition to posting on TheIIC website, the Office of the Chairman may email the membership alerting them of the opening. All requests for posting should be emailed to the Office of the Chairman at chairman@theiic.org.
Details for this service are available on the Job Openings page of our website as well as the Resources page.
|
|
Virtual Card Numbers Can Help Fight Travel Fraud
Source: WEXINC.COM / Posted August 27th, 2018 by Clare Murphy
EXTRACT (Modified)
Internal Controls professionals, as auditors, designers, monitors, etc. must be concerned with many aspects of their organization. As auditors, for many years, the emphasis of IC team was on what was termed “materiality.” However, as we have seen, although materiality does affect the financial statements, it does not address areas such as governance, ethical behavior of executives, employees, vendors, customers, and others. One area where fraud and illegal acts are prevalent in most organizations is travel/entertainment fraud. Typically, when addressed the IC professional was more concerned with the effect on the company itself, that is, employee theft via falsification of T&E reimbursement when employees overstate expenses via fake or altered receipts, personal items expensed as a business expense, use of company credit cards for personal expenses, etc. This has been further complicated by the use of company credit cards which are often approved by the card holder him/her self who is falsifying the T&E.
Aside from the above it should be noted that the travel industry itself is also facing a growing fraud threat, particularly from the increasing use of Card-Not-Present (CNP) transactions. Both consumers and businesses are at risk, but virtual card numbers can present a solution. CNP transactions, that is, those that are processed without a card physically presented to a merchant, such as by phone or online, have become a top target for fraudsters. A 2017 study estimated that CNP fraud will cost retailers more than $71 billion worldwide 2017 to 2021. And while all industries are affected by this type of fraud, the travel industry has been hit particularly hard with reports of fraud rising 4% in 2017, much higher than industries such as fashion and electronics that are seeing only a 1% increase.
The past few years have seen a number of high-profile data breaches affecting hotels, even large multinational chains. Just last week it was revealed by Marriott that the Sheraton division they recently acquired had their system hacked before the acquisition in 2017, resulting in 500 million customers affected. According to Verizon, the hotel industry had 338 data breaches in 2017, and 90% involved point of sale (POS) intrusions. This stolen card data is often used by fraudsters to commit CNP fraud, as the physical card itself is not needed for the transaction.
Travel companies use several models to work with hotels can make a difference in how consumers, and the companies themselves, are exposed to risk.
In the agency model, the booking is made with the travel company and the consumer’s card details are passed through to the hotel. This model is most prevalent in Europe and Asia. In this scenario, if the hotel’s data is hacked or otherwise subjected to a data breach, the traveler’s card data is at risk of being used for CNP fraud. This, of course, affects the traveler but also harms the reputation of both the hotel and the travel company responsible for booking the travel. Although the agency model may provide some cash flow benefits to hotels, the fraud risk and consequential reputation damage may not be worth it. The merchant model is another option and is the most prevalent model used in US. In this model, the travel company accepts the traveler’s payment and does not pass this data along to the hotel. The hotel is later paid directly by the travel company without putting the traveler’s data at risk. And if the travel company uses Virtual Card Numbers (VCNs) instead of a traditional corporate card to pay the hotel, their data is then also protected from CNP fraud should a data breach at the hotel occur. VCNs offer an attractive alternative to traditional cards and have features to protect against CNP fraud, including:
- One-time use: VCNs are set up to be used only once, so even if the data is subject to a breach, the card cannot be used if the hotel has already processed the payment.
- Controls can be set to limit how the card is used: With VCNs, parameters can be set that control the types of purchases that can be made, the maximum purchase amount and when the purchases can be made. This prevents any charge other than that which is specified.
Protecting Travelers Against Payment Scams
The merchant model combined with payment by VCN protects travelers from more than just CNP fraud. It can also help protect against accommodation scams that target travelers booking hotels and other accommodation online. These scams work by fraudsters hacking into travel booking websites and fraudulently collecting payment on behalf of the hotels/accommodations or collecting payment for hotels/accommodations that don’t actually exist. These scams happen across the globe. When travelers expect to pay the travel company, as in the merchant model, they’re less likely to fall victim to scams that ask for direct payment for hotels. When travel companies use the merchant model and, in turn, use VCNs to make payment to hotels, both travelers and the travel company are protected. In addition to protection against CNP fraud, travel companies can also benefit from other features of using virtual payments, including earning money on payments made, savings on international payments, and automation of accounts payable tasks.
COMMENT FROM THE CHAIRMAN: Internal Control Professionals should design their T&E procedures and audits to address the above scams and concerns, as well as the customary T&E frauds we see by insiders and now outsiders. Volunteers will be sought to develop new ICQ’s to address these concerns.
If you have expertise in T&E procedures/policy design or audit and would like to volunteer for the T&E ICQ Design Team, contact the Chairman at chairman@theiic.org
Click here to read the original article
URGENT! Update Your Profile !
All members are reminded that TheIIC is a GREEN organization, and as such, minimizes all paper mailings. Most communications from the IIC to the membership is via email. Therefore it is imperative that TheIIC have your current preferred email address. Please provide ALL changes to both your personal and work email immediately to ensure you received all communications from the IIC, including the e-newsletter, notices of Job Openings, as well as important communications.
Note that this information will also be used to set up the Members Only Portal on our new website, which will allow members to change their information online. This information will also be used for mailings and invoicing.
Click the button below to update your information.
Student Chapter Established at Istanbul 29 Mayis University in Turkey!
A new student chapter has been established, bringing the issues regarding internal controls to students who will be entering the field upon graduation. 
Under the direction of Dr. Cevdet Kizil, Ph.D, CICA, a student chapter known as the Accounting & Internal Controls Club, was established recently at Istanbul 29 Mayis University in Turkey. This is the first student chapter established in Eastern Europe. A second chapter in Turkey is planned for operation at Yalova University. Congratulations to Dr. Kizil in bringing internal controls to the attention of university students in Turkey.
A Call for Papers and Articles
|
|
A key resource for members is the sharing of information among the membership via papers and news articles. Subject matter including techniques for reviewing internal controls, discussion of available tools, case studies, etc. can assist both the new and experienced internal controls auditor/specialist.
If you would like to submit a paper, article or monograph on any subject matter that may be of interest to the overall membership, we encourage you to do so. You can direct any materials for review directly to the Chairman at chairman@theiic.org.
|
Message from Editor of the TheIIC e-Newsletter
|
For first timers, I would like to welcome you to the TheIIC e-Newsletter. In the design of the newsletter, we completed extensive research on how to make the e-newsletter successful. As you can see, the layout is a little different than you see in other e-newsletters. While most e-newsletters only give you a few lines of the article, with a link to the full article, we have decided to present an abstract type summary of each, with a link to the full article, when available. We feel that this allows you to get the substance of the article without having to link to another site. However, we do provide a link for those who want any additional details available. This also provides you with the ability to print out the newsletter and read it at your leisure.
NOTE that to successfully pass the QUIZ you will need to download some of the articles or reference material via the links provided.
We encourage any comments or suggestions for improving the e-newsletter. Comments, as well as contributions including manuscripts for publication, should be sent to the Office of the Editor at e-newsletter@theiic.org.
|
Call for Volunteers
|
As discussed in previous communications from the IIC, we are currently seeking volunteers for the following positions:
- Organizers to commence operations to start local chapters.
- Volunteers to present as instructors training course
- Volunteers to develop courses on internal controls, ethics, auditing, etc.
- Authors and contributors for articles for the upcoming Internal Controls Magazine.
- Educators and researchers to present articles on research related to internal controls for publication in the upcoming Journal of Internal Controls.
All interested members should contact the Office of the Chairman at chairman@theiic.org
Instructions for CPE Quiz
An active member in good standing is eligible to earn one CPE via completion of the quiz below with a passing grade of at least 70%. Click on the button below to take the quiz online. Select the best answer listed for each question, and complete the quiz before the deadline. The CPE quiz will be open until January 31 2019. The quiz is self-grading and you will know your results immediately. A Certificate of Completion for 1 CPE credit will be emailed to members with a passing grade of 70%. You may take the CPE quiz multiple times and there is no time limit on the quiz other than the deadline date of 1/31/2019. NOTE NO QUIZ WILL BE ACCEPTED AFTER THE DEADLINE LISTED ON THE QUIZ. CPE CREDIT MAY BE AWARDED FOR 2018 OR 2019 DEPENDING ON THE ACTUAL DATE OF SUCCESSFUL QUIZ COMPLETION.
*NOTE: Quizzes are based on TheIIC e-Newsletter content as well as information contained in the link to the full article. Links should be opened to read entire article.
The Quiz has closed. .png)
|
TheIIC e-Newsletter
.jpg)
.jpg)
.jpg)
