Information Technology and Security

Technology is something of a double-edged sword. Its complexity often gives fraudsters both a tool to perpetrate a fraud and a way of hiding a fraud that’s been committed. Sometimes, it gives the fraudster a place to hide.

Often, our unquestioning reliance on computers leads us to overlook fraud when it takes place. To be fair, however, technology also puts at our disposal ways of detecting fraud that would have been unthinkable a generation ago. In IT, as in other areas, it must nonetheless be conceded that fraudsters are often a step or two ahead of those trying to prevent fraud.

Information technology fraud has many aspects, all of which are difficult to detect. We are going to limit our coverage to the IT fraud risks, red flags and best practices to prevent fraud that directly pertain to governments.

In the days of computer-generated payroll and direct deposits, the old control of handing out paychecks to individuals to identify ghost employees is a thing of the past—employees, including ghost employees, in remote locations get paid automatically.

Not so long ago, issuing a warrant to a vendor involved generating a piece of paper. That piece of paper took time to process, required a physical endorsement, and required alteration to redirect it to a payee other than the person for whom it was intended. Electronic payments circumvent all of these potential pitfalls.

In the area of software development, time records may be overstated. Faulty or incomplete specification may lead to unwarranted additional charges. Programmers may purposely leave vulnerabilities in the software allowing them to later siphon off funds or gain access to confidential information.

With some of the traditional fraud detection methods no longer effective, preventive internal controls become increasingly important.