DRAFT Program Description
for
City of Cupertino
Fraud, Waste, and Abuse Program
July 13, 2022
Adopted:
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Table of Contents
I. Executive Summary 1
II. Fraud, Waste, and Abuse Definitions 2
A. Fraud Definition 2
B. Waste Definition 2
C. Abuse Definition 2
III. Fraud Categories 4
A. Financial Statement Fraud 4
B. Asset Misappropriation 4
C. Corruption 5
IV. Ethics 6
V. Implementation 7
A. Planning 7
B. Fraud Hotline 9
C. Methods for Capturing Complaints 10
D. Program Review 10
E. Communication Plan 11
F. Reacting to Complaints 11
VI. Whistleblower Protection Policy 14
VII. Training 15
Executive Summary
All City of Cupertino (City) employees share the common purpose of serving the public and ensuring public funds are spent wisely. The work of the City should be conducted fairly, equitably, ethically, and transparently. Proactive steps must be taken to ensure community commitments and management objectives are met. It is important for employees and the public to be provided a mechanism to voice appropriate concerns when they see or feel something is not right.
As a result, the City has established a Fraud, Waste, and Abuse Program that is available to all City employees and the public. The program operates 24 hours a day, 7 days a week. Reports of suspected inappropriate activity can be made using the City’s toll-free number, mail, phone, or in-person. All reports submitted are treated confidentially.
City employees are entrusted with public funds and have a duty to use those funds economically, efficiently, effectively, and ethically. If City employees do not honor that obligation, then it is imperative to identify and correct those actions. The City is committed to reviewing all complaints and investigating all legitimate concerns.
Purpose of a Fraud, Waste, and Abuse Program
A Fraud, Waste, and Abuse (FWA) Program is a mechanism for employees or members of the public to report activities perceived to be misconduct, violations of City policy or ethics, theft, waste, or misuse of City assets. The objective of a FWA program is to identify and stop loss of City resources and act as a deterrent to fraud, waste, and abuse.
In order to facilitate reports of fraud, waste, or abuse, a FWA hotline is administered by a hotline vendor. The vendor receives calls on the FWA hotline and forwards the incident report to the City’s Internal Auditor. Please do not use this program to report grievable labor issues, which should be reported to the Human Resources Department. Matters of threat to a person should be reported to the Police Department by calling 911.
Benefits of a Fraud, Waste, and Abuse Program
There are numerous benefits to a FWA Program. It is important for not only identifying and quantifying losses to the City, but also preventing future losses. Specific benefits include:
Identification and termination of occurrences of fraud, waste, and abuse.
Recovery of funds as a result of investigations.
Deterrence of inappropriate behavior by increasing awareness of these actions.
A safe mechanism for employees and the public to voice concerns and report suspected inappropriate activity.
Commitment to the City’s core values through the promotion of the program.
Improvement in the City’s internal control processes.
Enforcement of an ethical work environment.
Fraud, Waste, and Abuse Definitions
Fraud Definition
Fraud is defined as a dishonest and deliberate course of action that results in obtaining money, property, or an advantage to which City employees or officials committing the action would not normally be entitled. Fraud also encompasses intentional misleading or deceitful conduct that deprives the City of its resources or rights. There are three categories of fraud. They include 1) financial statement fraud, 2) misappropriation of assets, and 3) corruption. Examples of fraud include, but are not limited to:
Falsifying financial records to cover up theft.
Theft or misuse of City money, equipment, supplies, and/or other materials.
Intentionally misrepresenting the costs of goods or services provided.
Falsifying payroll information.
Use of City equipment or property for personal use/gain or non-business reasons.
Submitting false vouchers for reimbursements.
Soliciting or accepting a bribe or kickback.
Intentional use of false weight or measures.
Waste Definition
Waste is defined as the needless, careless, or extravagant expenditure of City funds, incurring of unnecessary expenses, or mismanagement of City resources or property. Waste does not necessarily involve private use or personal gain, but it almost always signifies poor management decisions, practices, or controls. Examples of waste include, but are not limited to:
Purchase of unneeded supplies or equipment outside of established limits.
Purchase of goods at inflated prices without appropriate bids or research.
Abuse Definition
Abuse is defined as the intentional, wrongful, or improper use or destruction of City resources, or improper practice that does not involve prosecutable fraud. Abuse can include the excessive or improper use of an employee or official's position in a manner other than its rightful or legal use. Examples of abuse include, but are not limited to:
Failure to report damage to City equipment or property.
Using one's position in one City department to gain an advantage over another City resident when conducting personal business in another City department.
Abuse of City time such as significant unauthorized time away from work or significant use of City time for personal business.
Abusing the system of travel reimbursement.
Receiving favors for awarding contracts to certain vendors.
Using City property, information, or position for personal gain or resulting in extra or special charges to the City.
Appropriating or diverting any business opportunity or idea in which the City might have an interest.
Competing with the City in an inappropriate way.
Failure to disclose a conflict of interest.
Participating in decision making where a conflict of interest resides.
Improper use of supervisory authority in response to an employee taking action or refusing to take action.
Fraud Categories
Financial Statement Fraud
Financial statement fraud includes intentional misstatements, omissions, or disclosures in financial statements designed to deceive financial statement users. Fraudulent financial reporting often involves upper management and management override of controls that otherwise may appear to be operating effectively. Common occurrences include overstating revenues and understating liabilities or expenses. Examples include:
Manipulation, falsification, or alteration of accounting records or supporting documents from which financial statements are prepared, such as overstating assets and understating liabilities.
Misrepresentation in or an intentional omission from the financial statements of events, transactions, or other significant information.
Intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure.
Asset Misappropriation
Asset misappropriation is theft of an entity's assets that causes the financial statements not to be presented in conformity with Generally Accepted Accounting Principles. False or misleading records or documents, possibly created by circumventing controls, may accompany misappropriation of assets. Examples include:
Embezzlement of cash where accounts have been manipulated or false invoices have been created Skimming revenue before the funds have been recorded in the City’s financial records Cash larceny
Lapping accounts receivable
Check tampering
Over-billing customers
Stealing assets such as office supplies or computer equipment Causing the City to pay for goods and services that have not been received Data theft or intellectual property
False expense claims
Duplicate reimbursements
Payroll fraud
Paying personal expenses with the City’s resources
Corruption
Corruption is the wrongfully use of influence in a business transaction in order to procure some benefit and contrary to their duty to their employer or the rights of another. Examples include:
Seeking or accepting kickbacks
Engaging in conflicts of interest
Bid rigging
Contract manipulation
Economic extortion
Illegal gratuities
Hiring or promotion based on personal relationship (known or unknown) Ethics
Business Ethics
Business ethics apply to right and wrong behavior in the business world and take on different meanings in different cultures, making it challenging to truly define business ethics. However, there are a number of areas where unethical practices may occur more frequently, including human resources and accounting.
Human Resources Ethics
Interactions between managers and employees create opportunities for breaches of ethics, such as discrimination based on ethnicity, gender, age, or other factors. Managers who discriminate against minority groups in hiring practices, compensation decisions, and terms of employment can face legal and social consequences. Dishonesty and manipulation are also examples of unethical workplace behavior.
Accounting Ethics
Financial accounting is a major ethical issue, and no amount of industry or government regulation seems able to prevent dishonest people from reporting financial information in unethical ways. Certain unethical accounting practices are illegal, such as misrepresenting income or expenses in financial statements through unjustifiable shifting of expenses to inappropriate periods to influence current financial results, obtain a better debt rate, or to maintain debt covenant requirements.
Implementation
Planning
Roles and Responsibilities
The FWA Program will be administered and managed as follows:
City Council – requires and funds a FWA Program.
City Manager – sets the tone for the program, provides messaging on the City’s intranet page promoting ethical behavior with appropriate links for reporting, reviews all recommended actions by the Internal Auditor regarding how to respond to complaints, and provides recommendations to the City Council (but does not participate in conducting investigations).
Internal Auditor –coordinates the FWA Program; monitors, triages, and disseminates complaints to appropriate City personnel; conducts investigations as appropriate; monitors and reports on the progress of addressing complaints received; and performs follow-up procedures as appropriate.
City Attorney– reviews FWA Program reports, as necessary, to determine if there are civil matters to be addressed and takes appropriate action(s) in collaboration with the Internal Auditor.
Sheriff’s Office – reviews applicable reports to determine if there are criminal matters to be addressed and takes appropriate actions.
Director of Administrative Services – reviews FWA Program reports and works with Internal Audit, Human Resources, and Finance to take appropriate action as a result of substantiated complaints.
Human Resources Department – receives complaints and works with management and bargaining unit representatives to take appropriate action as a result of substantiated complaints.
Department Heads –support the FWA Program and cooperate with an investigation should one occur within their Department, and work with management regarding insurance coverage and claims.
City employees –report suspected inappropriate activity.
Tracking and Monitoring of Complaints
The City has established a case management process to capture, track, and report the following elements to the audit committee on a quarterly basis, as meeting schedules allow:
Complaints received by category and sub-categories, as desired.
Fraud: expense reimbursements, cash, and skimming
Wasteful spending and abuse
Ethics
Threats: City, people, property
Complaint triage and recommended action will be made by the Internal Auditor. Otherwise, the Internal Auditor will determine that no action is needed because:
Information is insufficient for investigation
Complaint does not pertain to the City government
Compliant should be referred to another department
Referrals will be made by the Internal Auditor as deemed appropriate to the situation. Specific examples of referrals include:
Referrals will be made to the Sheriff’s Office if the complaint indicates a life threatening situation or other type of crime Labor relations and other personnel matters and grievances may be referred to the City’s Human Resources Department or appropriate department head, depending on the nature of the complaint.
Financial complaints may be referred to the Director of Administrative Services or his/her designee.
Investigations by the Internal Auditor
Determine the methodology for investigation. Procedures may include, but not be limited to, the following types of activities that specifically relate to the allegation received:
Interviews of individuals deemed to have direct knowledge of the matter Interview with the employee(s) named in the complaint
Interview with the person(s) who made the complaint, if known Interview with person(s) external to the City deemed to have direct knowledge of the matter at hand Review of documentation supporting the transaction(s) questioned Review of City policies and procedures
Review of City Council meeting minutes
Review of emails
Confirmation from third parties substantiating transactional activity such as financial institutions, investment administrators, and vendors Testing of internal controls and/or transaction details Electronic analysis of transactions utilizing automated tools deemed appropriate to the situation Final disposition or conclusion by the Internal Auditor Substantiated matters will be reported based on relevant standards, including the following elements:
Condition – what really happened
Criteria – what is expected to happen, including identification of laws, rules, regulations, statutes, and generally accepted accounting principles Effect – financial impact to the City
Cause – why the condition happened, including weaknesses in internal controls or override of internal controls Recommendations – address changes to internal control structure, assignment of duties and responsibilities, training, disciplinary action, or referral to the City Attorney for civil or criminal action Unsubstantiated matters will be reported in a manner that protects the subject of the complaint. Elements reported may include the following:
Date the complaint was received
Period of time Internal Auditors conducted the investigation Summary of actions taken to investigate the complaint
Conclusion regarding evidence of criminal or civil wrongdoing Recommendations for improvement in internal controls or operations, if warranted The frequency and content of FWA Program reporting may include:
Number of hotline reports received during each reporting period General nature of reports
General actions taken
Report recipients, as appropriate
Reporting forum
Open public meeting
Closed session discussion (nondisclosure to public), as required Fraud Hotline
Providing individuals with a means to report suspicious activity is a critical part of an anti-fraud program. Fraud reporting mechanisms, such as hotlines, are set up to receive tips from both internal and external sources and support anonymity and confidentiality. Management encourages employees to report suspicious activity, as well as enact and emphasize an anti-retaliation policy. According to the Association of Certified Fraud Examiners, the number one source for the initial detection of fraud is through a tip, with over 50% of tips coming from employees.
Third-PArty Hotline Administrator
The City has elected to contract with a third-party vendor (vendor) to administer the offsite reporting system. Incident reports can be submitted in a number of ways and allows employees or members of the public to call and speak to an operator via a designated phone number staffed by the vendor. There are distinct benefits to managing the hotline in this manner. Examples include:
Services are available 24 hours a day/7 days a week/365 days a year.
The persons receiving the calls are hotline professionals, trained in how to obtain the information necessary for the City to determine an appropriate course of action.
The Vendor has the ability to receive documents (Word, Excel, and PDF) and forward them to the City as evidence for the complaint, while maintaining the privacy of the caller.
The Vendor has the ability to communicate back and forth with the caller without revealing the identity of the caller.
The Vendor will provide notification of the incident and the incident report to the City’s Internal Auditor.
The Vendor will provide case management of calls received, including archiving and data retention.
Methods for Capturing Complaints
The City is providing employees and members of the public a variety of methods for reporting suspected inappropriate activity and behavior. These methods include:
Hotline (anonymous reporting mechanism, internal vs. external) – all incident reports are forwarded to the City’s Internal Auditor.
Phone call – if received by the City’s Internal Auditor, then the caller will be encouraged to call the FWA hotline, or the City’s Internal Auditor will handle the call by obtaining the information required to determine if an investigation is necessary. If a call is received by City personnel, then the incident/complaint will be forward to the FWA hotline or the City’s Internal Auditor.
Face-to-face – City personnel will take appropriate notes of the meeting and encourage the complainant to report the matter through the FWA hotline.
Mail – mail will be forwarded to the City’s Internal Auditor for investigation, as appropriate.
Program Review
The City Council will periodically, at least annually, review the program to validate that the FWA Program is meeting City Council and management objectives and providing useful information. The review will include confirmation of individual roles and responsibilities, policies and procedures, and the results of investigations. Statistical information will also be reported, such as the following:
Number of complaints received
Referred – non-City, information requests, etc.
Under investigation
Open – pending additional information
Closed
Sources of complaints
Hotline
Phone
Face-to-face
Mail
Other
Types of complaints
Non-City issues
Referral to other department
Internal auditor investigation for fraud, waste, or abuse Other
Cases closed and reason for closing
Investigated – substantiated
Investigated – not substantiated
Referred
Insufficient information – no action taken
Case Highlights – Investigations conducted – loss substantiated Identified loss and impact to the City
Finding elements – condition, criteria, effect, cause
Recommendations in internal controls
Program Implementation Status – Implementation of recommendations resulting from an investigation may take 2-3 years.
Summary of recommendations
Management’s response
Actions taken to date
Estimation from management of when implementation will be completed Communication Plan
The City launched the FWA Program in 2022. The program incorporates the City’s tone from the top. Consideration is also being given to the following:
Intranet/Internet page link to reporting options for employees and the public Whistleblower protection policy
Plan for ongoing support and communication about the program Message on payroll stubs
Posters
Newsletters
New hire training
Annual training
Reacting to Complaints
Regardless of the mechanism through which the City receives a complaint, the following procedures are established for triaging complaints, performing investigations, and communicating investigation results.
Triage Escalation
The City has established escalation for complaints as follows:
Immediate response – call indicates misappropriation of the City’s assets, false reporting, misuse of City assets, etc.
Referral – based on the circumstances of the complaint, reports may be referred to other departments or outside the City. In such instances, the caller will be notified of the referral if the caller requests. The call can be closed upon referral but should be reported as such, or it may remain open until the final resolution is communicated to the City. Matters indicating a personal emergency will be forwarded to the appropriate party for action (for example, a life threatening situation or child abuse).
Annual audit plan – call indicates the need for a process redesign or modification to internal controls but no financial loss to the City.
Follow-up – call requires additional information before appropriate action can be determined.
Closed as received – including but not limited to:
Call is incomplete
Caller did not provide sufficient information to determine the appropriate action and caller has not elected for two-way anonymous communication Matters regarding non-audit issues (i.e., request for the number of a local dump) Investigating Complaints
The complaint will be forwarded to the appropriate party for investigation. If the City’s Internal Auditor investigates, then the following activities will be performed:
Read the initial hotline report.
Obtain any supporting documents provided by the caller through the Vendor.
Identify additional evidence needed to resolve the complaint, including but not limited to:
City policies and procedures
Copy of or access to Council meeting minutes
Copies of invoices, receipts, contracts, etc.
Other documentation deemed necessary to determine validity of the incident report Identify who will be contacted during the investigation, including but not limited to:
Suspect to the allegation
Victim(s)
Witnesses
Complainant, if known and the individual wishes to be interviewed Those who are part of the internal control process, but who may not have knowledge of the specific complaint Law enforcement, if appropriate
Others as determined necessary
Perform investigative procedures to determine the validity of the complaint and documenting:
Steps taken
Evidence gathered – chain of custody
Conclusions reached
Quantification of financial loss to the City, if any
Criteria, condition, cause, effect, and recommendations, as appropriate Keep the appropriate parties informed of the progress of the investigation.
Communicate the final results of the investigation, including notification and reporting, as appropriate, including, but not limited to the City Council, City Manager (or designee), Administrative Services Director, and city management.
Manage information on a need-to-know basis.
Maintain case files for an appropriate period. This may be driven by whether or not the case results in civil or criminal charges.
Communication
Within the escalation process, the City has created a reporting structure. The City will continue to modify that structure as appropriate. The current structure includes reporting to the following:
City Attorney – potential activity that would result in civil liability Sheriff’s Office – potential criminal activity
Director of Administrative Services and Human Resources Department – employee disciplinary action City Manager (or designee) – consideration of audits performed and status of investigations (care will be taken to ensure the detail provided does not violate privacy laws) City Council/Audit Committee – periodic reporting of activity Statistics of calls received by the third-party hotline or the City’s Internal Auditor Summaries of completed investigations of fraud, waste, and abuse, where disclosure is permitted by law and would not materially jeopardize any pending or anticipated civil, criminal, or administrative proceeding Whistleblower Protection Policy
The risk and fear of retribution can deter many people from reporting allegations of wrongdoing against a colleague, manager, Council member, or a City vendor. The public policy of the State is to encourage state and local officers and employees to disclose improper governmental action and protect the rights of persons making such disclosures.
The City’s Whistleblower Protection Policy and prohibits retribution against any employee who may have made a report of suspected inappropriate activity. The City will take each call seriously and investigate as the issue warrants and evidence is available. The City has made available an anonymous reporting mechanism to facilitate this process.
If an individual makes a report through the FWA hotline, then the Internal Auditor will not make any effort to identify the complainant. If the individual wishes to be contact by the Internal Auditor, then the individual should leave contact information at the time of the FWA hotline call. The Internal Auditor will not reveal the identity of the individual(s) unless required to do so by law.
Training
The City is providing initial and ongoing training to all City employees on the FWA Program.
Initial Training
Initial training includes discussion of the following:
Program purpose and benefits
Roles and responsibilities
Employee responsibilities for reporting suspected inappropriate activity How to make a report using all various methods (hotline, web, or face-to-face) Investigation considerations
Reporting of investigation results – public vs. private information.
Ongoing Training
Ongoing training is important to reinforce management’s commitment to reducing loss of resources to the City. The training can be part of the City’s training program or specific to a Department. A fraud, waste, and abuse training webinar will be accessible by all employees via the Internal Auditor.
In order for City employees to understand when and what to report, employees need to receive fraud awareness training. Consideration should be given to which employees should receive training (managers, directors, supervisors, line employees, etc.). Training could include the following topics:
Definition of fraud, waste, and abuse with examples of each Fraud triangle, fraud environment, and why fraud happens Opportunity points for fraud to occur
Internal controls intended to prevent and detect fraud
The importance of corrective controls and the message it sends to employees Fraud schemes – what does fraud look like, how to identify and understand various schemes Characteristics and red flags of perpetrators
Fraud, Waste, and Abuse Program Description for City of Cupertino Fraud, Waste, and Abuse Program Description for City of Cupertino 15