Fraud management plan
1 - Introduction
1.1 - Rhea's Anti-Fraud, Bribery and Corruption Policy and Strategy makes it clear that Rhea is committed to adopting a zero tolerance approach to fraud, bribery and corruption from both internal and external sources. Where fraud, bribery or corruption is suspected we will deal with the allegations seriously.
1.2 - This Fraud Response Plan provides guidance to staff on the procedures that should be followed where a fraud is suspected or discovered. It includes reporting requirements, responsibilities for actions and how allegations will be investigated.
It should be read in conjunction with the Anti-Fraud, Bribery and Corruption Policy and Strategy, and the Whistleblowing Policy.
1.3 - It is important to ensure that a structured and consistent approach is implemented by Rhea for the investigation of any cases of fraud, bribery and corruption.
This Fraud Response Plan sets out Rhea's approach to ensure:
Staff are aware of how to report any allegations of fraud, bribery or corruption.
There is a clear understanding of who will lead investigations, and appropriate staff are informed and involved.
Information about the investigation is retained by staff involved in the case
Further losses of funds or assets where fraud may have occurred are prevented, and the recovery of losses is maximised.
Evidence is gathered to support an allegation and inform further action.
Evidence necessary for possible disciplinary and criminal action is established and secured.
Any adverse effects or publicity on the business of Rhea or any other partner organisations involved are minimised;
A review is undertaken of the reasons for the incident and action taken to improve control, strengthen procedures and prevent recurrence.
1.4 - Under no circumstances should staff feel that they must tolerate the abuse of systems employed at Rhea by other staff members or outside persons in ways that may be classed as potentially fraudulent behaviour. Whilst total anonymity cannot be guaranteed, every effort will be made not to reveal your name. However, if criminal activity is found and the case is forwarded to the police, your identity may be needed later. However, all persons implicated by an allegation must be informed of the circumstances and relevant evidence and allowed to comment as part of the investigation.
1.5 - Rhea seeks to establish a flexible Fraud Response Plan to enable the approach to be varied in individual cases.
Generally, the approach taken shall depend on the perceived risk to Rhea in a financial or reputational sense. This shall be judged individually for each case, based on the information available.
Responsibility for investigating will initially be a line manager reporting to the directors.
In practice, investigations into the alleged actions of staff will usually be conducted by the line Manager and, in more serious cases, the matter be referred directly to the Police.
2 - Reporting Suspicions
2.1 - The procedures detailed below should be followed for all suspected cases of fraud, bribery and corruption involving staff, its partners and suppliers.
You may also come across instances where third parties are attempting to defraud or scam the Rhea, for example, by submitting bogus invoices or changing the bank details of suppliers. Any concerns such as these should be reported to the director, who will investigate further and arrange for alerts to be circulated to relevant areas of the Rhea.
2.2 - Examples of fraud, bribery and corruption include, but are not limited to theft, financial irregularities, and misuse of property, vehicles or equipment, misuse of systems, conflicts of interest and supplier kickbacks.
Action by Employees
2.3 - You should raise your concerns or suspicions with your line manager in the first instance.
If you feel unable to approach your line manager, you should report any concerns or suspicions of financial irregularity to the Director. Alternatively, you may choose to report your concerns or suspicions anonymously via a letter.
Whilst total anonymity cannot be guaranteed, every effort will be made not to reveal your name. However, if criminal activity is found and the case is forwarded to the police, your identity may be needed at a later date.
2.4 - If you suspect a colleague is committing fraud, under no circumstances confront him or her with accusations of wrongdoing. This may allow the destruction of evidence, and in extreme cases may expose you to physical danger. If your suspicions are mistaken, then workplace relationships may be poisoned irretrievably.
The official investigators are best placed to interview suspects.
2.5 - Once you have reported the incident, you may be contacted further by your line manager or director as part of the ongoing investigation. You should provide them with as much information as possible to enable the investigation to be effectively progressed.
Action by Managers
2.6 - If you have reason to suspect fraud, bribery or corruption in your work area, or a concern has been reported to you by a member of your staff, you should do the following:
Listen to the concerns of your staff and treat every report seriously and sensitively. Reassure staff that their concerns will be taken seriously and passed on to the appropriate officer.
Obtain as much information as possible from the member of staff, including any notes or evidence to support the allegation. Do not interfere with this evidence and ensure it is kept securely.
Do not attempt to investigate the matter yourself or attempt to obtain any further evidence, as this may compromise any disciplinary or police investigation.
Report the matter immediately to the director.
Action by Councillors
2.7 - If a Councillor suspects fraud, bribery, or corruption involving Council officers, or the Council's partner organisations, they must report it in line with their Council individual processes as generally this is unlikely to involve Rhea. If it does report to the Director as soon as possible.
Action by Members of the Public or Contractors
2.8 - If a member of the public would like to raise a concern, they should follow the reporting procedure contained within the Whistleblowing Policy. Alternatively write in.
2.9 - If an active or former contractor makes any allegations of inappropriate action by Rhea then report to the director as soon as possible
3. Malicious Allegations
3.1 - If you make an allegation which you believe is in the public interest, but it is not confirmed by the investigation, no action will be taken against you.
3.2 - All staff should be aware that malicious or vexatious allegations will not be tolerated and may be dealt with as a disciplinary matter.
3.3 - Contractors making such allegations should be referred to the Director for dealing with under the code of conduct.
4 - Investigating Allegations of Fraud
Preliminary Investigations (Fact-finding)
4.1 - In the event of any serious or immediate threat to Rhea’s financial position, significant fraud, bribery or major accounting breakdown, the director must be immediately informed
If it is considered that there are prima facie grounds for the concern or complaint involving the alleged misconduct of staff, the director will investigate. If preliminary investigation reveals the allegations to be groundless, the matter may then be dismissed and referred back to the line manager to resolve.
4.2 - Once the preliminary investigation has been completed, a report may be prepared by the director for recording purposes.
In more serious cases, it may be necessary to immediately implement further control measures.
4.3 - The director would report to shareholders if this was appropriate.
If it appears that a criminal offence has occurred, the director shall consider whether the matter should be referred to the Police.
4.4 - Depending on the seriousness of the offence, the Director will report to Blackpool Council as the Lead Authority.
4.5 - Also note that under Article 33 of the General Data Protection Regulation, in cases where the Fraud has included a personal data breach, Rhea has a duty to report the incident to the Information Commissioner's Office in accordance with Article 55. This shall be carried out without undue delay and, where feasible, not later than 72 hours after having become aware of the personal data breach.
The investigation person should be aware of the need to ensure that other statutory requirements are adhered to in the process of obtaining evidence, particularly the need to obtain in advance a RIPA (Regulation of Investigatory Powers Act) authorisation, should it be necessary to obtain evidence through the process of surveillance.
4.6 - Staff should note that failure to cooperate fully with an investigation may itself constitute grounds for disciplinary action.
4.7 - In some instances, the investigations may require technical expertise that the investigating person does not possess. In these circumstances, the director will decide whether external specialists should be involved.
Interviewing Employees as part of a Preliminary Investigation
4.8 - During the course of the preliminary/fact-finding investigation, it may be necessary to interview one or more employees.
In these cases, the employee should be informed of the purpose of the meeting and that he/she may not refuse to attend without good reason.
A refusal without good reason to answer questions relevant to the investigation may result in action being taken under Rhea's disciplinary procedure for potential gross misconduct.
4.9 - All interviews of employees where possible will be undertaken by two staff. Normally, one person will ask the questions and the other will take contemporaneous notes.
Once the notes have been typed up, a copy will be provided to the employee who will be invited to read them, make and initial any amendments and then sign the interview notes, accepting them as a correct record.
It is good practice for the interviewer to counter-initial any amendments to confirm their acceptance. Should there be any disagreement, the interviewer will need to consider the materiality of the amendment; if significant, this should be brought out in the ensuing report.
4.10 - The purpose of the preliminary interview will be to obtain information (fact-finding), and as such, the employee will not be entitled to be accompanied. However, should they wish to have someone present, this will be at the discretion of the director.
4.11 - During the course of the interview, if an individual admits to a criminal offence or the interviewer believes that an admission of a criminal offence is imminent, the recommended practice is that the interview be suspended, and the matter referred directly to the Police.
If, during an interview, an individual admits or appears likely to admit to a criminal offence, the recommended practice is to suspend the interview immediately and the matter referred to the Police.
Interviewing Employees under a Formal Disciplinary Procedure
4.12 - If, following a preliminary investigation, there is evidence to indicate that fraud, bribery, or corruption may have been committed by an employee, a formal investigation into the matter will be carried out in accordance with the disciplinary procedure.
4.13 - If the matter has been referred to the police and/ or Action Fraud, the director will consult with the police to determine whether the disciplinary process can proceed.
4.14 - Guidance does permit the continuation of an interview following admission of a criminal offence, but only after issuing a formal caution.
If it is considered that seeking a prosecution would not be appropriate, the interview can continue without issuing a caution.
5 - Reporting of an incidence of Fraud, Bribery and/or corruption
5.1 - Upon completion of the investigation and subject to Rhea's disciplinary procedures where relevant, where an incidence of fraud, bribery and/or corruption is found to have taken place, a report will be produced for recording purposes
5.2 - The report shall contain:
A description of the incident/issues alleged, including an assessment of the value of any losses.
The people involved and the means by which the fraud was allowed to occur (highlighting any control and/or operating weaknesses within the systems)
All possible facts relating to the alleged fraud.
Recommendations to improve/restore the controls and minimise the risk of a re-occurrence;
A conclusion on the way forward.
Any other relevant material.
5.3 - Where a line manager has investigated an incidence of fraud, bribery and/or corruption is found to have taken place, a report on the fraud shall be presented to the Director, along with the findings of any investigations undertaken.
6 - Recovery of Assets and/or Sanctions
6.1 - If evidence confirms that fraud has occurred and no earlier referral has been made, the Director will make a decision whether to refer the matter to the Police.
6.2 - In accordance with the Anti-Fraud, Bribery and Corruption Policy, if it is confirmed that Rhea has suffered financial loss, attempts will be made to recover such losses from the perpetrator
7 - Libel and Slander
7.1 - The nature of the industry that Rhea operates in, particularly where work is with Local Authorities and Contracts are being awarded, means that allegations are made related to bribery and corruption either by contractors making payments to gain access to work, or Rhea paying to gain commercial advantage.
All instances of any libelous or slanderous accusations should be reported to the Director immediately. Rhea operate an open book policy with Blackpool Council and as such can evidence any inappropriate accusations. Any action in this respect will be the sole responsibility of the Director, involving Blackpool Council if thought necessary or where it may impact upon the scheme
Assessment of fraud potential and areas to address for Rhea
Fraud prevention involves implementing policies, controls and strategies to deter, detect & respond to fraudulent activities that will protect an organisations asset’s, reputation and operations.
The components of Rhea’s strategies have been developed as a result of the recent potential fraud by a contractor under the CHiL scheme. In order to fully assess the potential Rhea looked at the following areas which are internal controls, risk assessment, policies & procedures, staff training, monitoring & response to fraud. Each of which will be covered more fully below:
Internal Controls & Oversight
Rhea has segregated the duties & responsibilities into hierarchal structures that ensure no one person can approve or carry out a fraudulent act without other layers of checking and engagement by staff.
Internal Controls
Internal controls serve three main purposes in fraud prevention: they make fraud harder to commit, increase the likelihood of early detection, and facilitate investigation when fraud occurs, they act as the organisational equivalent of a security system, providing checks and balances that reduce opportunities for fraudulent activity
Types of Internal Controls
Preventive Controls
These are designed to stop fraud before it happens. Examples include:
· Separation of duties: Ensuring no single employee has control over all aspects of a financial transaction, such as approving invoices, writing checks, and reconciling accounts
· Approval requirements and multiple signatures: Limiting authority for transactions to prevent unauthorized disbursements
· Ensuring work has authorisation under the scope of the CHiL scheme: That works represents best value tendering wherever timescales allow.
Detective Controls
These controls identify fraud after it occurs. Examples include:
· Regular reconciliations and audits of accounts.
· Monitoring unusual transactions or patterns that may indicate fraud. These may include work outside the normal scope of scheme delivery without formal authorisation
· Vendor verification processes to prevent fictitious vendor schemes
Corrective Controls
Implemented after fraud is detected, these controls aim to address weaknesses and prevent recurrence. Examples include:
· Updating policies and procedures based on identified fraud risks.
· Employee training to reinforce compliance and ethical behaviour
· The recent exclusion of a contractor from the scheme for potential fraud will ensure that more exhaustive checks are put in place.
Best Practices for Implementation
Risk Assessment: Identify processes most vulnerable to fraud and rank risks by likelihood and impact
Leadership Involvement: Senior management should establish a culture of integrity and clearly define responsibilities for monitoring controls
Documentation and Training: Policies should be documented, centrally located, regularly reviewed, and employees trained on their responsibilities
Layered Controls: Use multiple, complementary controls to make fraud inconvenient and risky for potential perpetrators
Continuous Monitoring: Regularly review and adjust controls to ensure effectiveness and compliance with regulations
What a Fraud Risk Assessment Is
A fraud risk assessment systematically identifies how fraud could occur within an organization, who could commit it, and which controls may fail. It is used across private and public sectors to reduce financial loss, regulatory exposure, and operational disruption.
Why It Matters
Organizations lose an estimated 5% of annual revenue
Public-sector bodies must complete Full Fraud Risk Assessments under Managing Public Money.
Core Components
1. Who is involved
Include finance, operations, compliance, internal audit, and IT. Gather process maps, financial flows, and control documentation.
2. Identify Fraud Schemes
Common categories include:
Internal/employee fraud
External/vendor or customer fraud
Financial reporting fraud
Payment fraud
Bribery and corruption
3. Score Risks
Assess each scheme using:
Likelihood × impact (Have not scored likelihood & risk for the initial assessment but would carry out verbalisation of the risks).
4. Evaluate Controls
Test whether existing controls (segregation of duties, approvals, monitoring) actually work.
5. Document and Prioritize
Produce a fraud policy.
6. Implement Mitigations
Examples:
Strengthen access controls
Introduce dual approvals
Improve vendor/customer verification
7. Refresh Regularly
Update annually or after major business changes. A stale assessment creates false assurance.
Public-Sector Considerations
Government organisations must complete Full Fraud Risk Assessments for high-risk programs, feeding results into enterprise-level assessments and ensuring accountability at senior levels. These public sector controls are linked with the way Rhea deliver the scheme and the outcomes expected of the LA’s in fraud terms.
A well-executed fraud risk assessment provides a defensible, data-driven basis for reducing fraud exposure and strengthening organisational resilience.
Fraud policies are designed to prevent, detect, and respond to fraudulent activities through clear definitions, legislative compliance, reporting mechanisms, and organisational accountability.
Purpose and Scope
Fraud prevention policies aim to establish a zero-tolerance approach to fraud, corruption, and misconduct, ensuring that all employees, stakeholders, and service providers understand their responsibilities in maintaining ethical conduct and protecting organizational resources These policies typically cover concerns raised by employees, the public, or other stakeholders and are applicable across departments, municipalities, and non-profit institutions receiving benefits.
Definitions
Fraud: An intentional misrepresentation causing actual or potential prejudice to another party
Theft: Unauthorized appropriation of property with intent to permanently deprive the owner
Corruption: Offering, accepting, or soliciting an improper inducement to act or refrain from acting in a particular manner
Legislative Framework
All work needs to comply with the laws of the land
Reporting and Investigation
Policies provide mechanisms for reporting fraud, direct reporting to risk management, or contacting law enforcement and oversight bodies. Investigations are conducted to assess allegations, recover losses, and ensure accountability, with outcomes communicated to relevant committees and, where legally permissible, to the public.
Organisational Responsibilities
Management and staff are responsible for identifying risks, implementing controls, and fostering an ethical culture
Audit and risk committees monitor fraud risks, advise on internal controls, and ensure corrective actions are taken.
Preventive measures include staff training, monitoring, audits, and clear procedures for procurement, recruitment, and financial management.
Principles and Values
Effective fraud policies emphasize ethical conduct, transparency, accountability, and proactive risk management. They aim to create a culture where fraudulent behaviour is discouraged, detected early, and addressed promptly, minimizing financial and reputational damage.
In summary, fraud policies integrate legal compliance, organisational accountability, reporting mechanisms, and preventive strategies to safeguard resources and maintain public trust. They are essential for both public and private sector entities to combat fraud and corruption effectively.
Fraud Prevention in Staff Recruitment
Effective recruitment practices help prevent hiring individuals who may pose a fraud risk.
Key measures include:
Background checks: Verify employment history, qualifications, professional licenses, and criminal records where legally permitted.
Reference checks: Contact previous employers to confirm the candidate's work performance and integrity.
Identity verification: Confirm the applicant's identity using official documents.
Qualification verification: Ensure certificates, degrees, and professional memberships are genuine.
Conflict of interest declarations: Require applicants to disclose any relationships or interests that could affect their impartiality.
Segregation of duties: Avoid assigning one employee complete control over financial or sensitive processes.
Probation periods: Monitor new employees closely before confirming permanent employment.
Fraud Prevention Through Staff Training
Regular training helps employees recognize, prevent, and report fraudulent activities.
Training should cover:
Code of conduct and ethics: Explain expected standards of honesty and integrity.
Fraud awareness: Teach employees about common fraud schemes such as procurement fraud, payroll fraud, identity theft, phishing, and financial misrepresentation.
Internal controls: Train staff on approval procedures, documentation requirements, and security protocols.
Cybersecurity awareness: Educate employees about password security, phishing emails, malware, and data protection.
Whistleblower procedures: Inform employees how to report suspected fraud confidentially and without fear of retaliation.
Legal and regulatory compliance: Ensure employees understand relevant laws, company policies, and disciplinary consequences of fraud.
Regular refresher training: Provide ongoing updates as fraud risks and regulations evolve.
Best Practices
Establish a strong ethical culture led by management.
Perform periodic fraud risk assessments.
Rotate duties and require mandatory leave for employees in sensitive positions.
Monitor employee compliance with internal controls.
Encourage open communication and prompt reporting of suspicious activities.
Review recruitment and training policies regularly to address emerging fraud risks.
Benefits of Effective Fraud Prevention
Reduces financial losses.
Protects the organisation's reputation.
Improves employee accountability and ethical behaviour.
Strengthens compliance with laws and regulations.
Increases stakeholder confidence.
Creates a culture of integrity and transparency.
By combining thorough recruitment screening with continuous fraud awareness training, organisations can significantly reduce the likelihood of internal fraud and foster a workplace where ethical behaviour is expected and supported.
Fraud Response and Investigation refer to the actions an organisation takes when fraud is suspected or detected, and the process used to determine what happened, who was involved, the impact, and how to prevent recurrence.
1. Fraud Response
The immediate actions taken after identifying a potential fraud incident:
Preserve evidence (emails, transactions, logs, documents).
Contain the issue to prevent further losses.
Notify relevant stakeholders (management, legal, compliance, HR, law enforcement if required).
Assess the risk and impact (financial, operational, reputational).
Maintain confidentiality to protect the integrity of the investigation.
2. Fraud Investigation
A structured process to establish facts and support decision-making.
Key Steps
Receive allegation or identify red flag
Whistleblower reports
Internal audit findings
Unusual transactions
Plan the investigation
Define scope and objectives
Identify required resources
Collect evidence
Financial records
System logs
Emails and communications
Interviews with relevant individuals
Analyse evidence
Determine how the fraud occurred
Quantify losses
Identify control weaknesses
Document findings
Prepare investigation report
Present facts, evidence, conclusions, and recommendations
Take corrective actions
Disciplinary measures
Recovery of losses
Legal action where appropriate
Strengthen internal controls
Common Types of Fraud Investigated
Asset misappropriation
Expense reimbursement fraud
Procurement fraud
Payroll fraud
Financial statement fraud
Cyber-enabled fraud
Corruption and bribery
Best Practices
Follow a documented fraud response plan.
Maintain chain of custody for evidence.
Ensure investigations are objective and independent.
Comply with legal and regulatory requirements.
Implement lessons learned to prevent future incidents.
Objective Statement
"The purpose of the fraud response and investigation process is to promptly identify, assess, investigate, and resolve suspected fraudulent activities while preserving evidence, minimising losses, and strengthening controls to prevent recurrence."
This site uses cookies to monitor site performance and provide a mode responsive and personalised experience. You must agree to our use of certain cookies. For more information on how we use and manage cookies, please read our Privacy Policy.