Cybercrime in the spotlight

Transcription

1 Cybercrime in the spotlight 6th PwC Global Economic Crime Survey n Edition November 2011

2 The PwC Global Economic Crime Survey remains the most comprehensive survey of its kind available worldwide. PricewaterhouseCoopers

3 Contents Foreword 1 Introduction 3 Face of economic crime in 5 Perpetrators and action taken 18 Global Economic Crime Survey

4 Foreword PwC conducts its Global Economic Crime Survey every two years. Separate reports are published by various I am pleased to present the n edition of the allows us to obtain a more representative data set which in turn produces a better picture of economic crime in. As in previous years, the purpose of our survey is to inform n business leaders on the notice, cybercrime receives focussed attention in the endeavours to curb economic crime. all the partners and staff that contributed their time and Louis Strydom National Forensic Services Leader 1 PricewaterhouseCoopers

5 Key findings and is now the fourth most common economic crime in South for cybercrime is achieved. Respondents have reported decreases in the most common n economic crimes of asset misappropriation and bribery & corruption. require access to sensitive information and more sophisticated know-how which Global Economic Crime Survey 2

6 Introduction forms of economic crime and puts the Figure 1 n respondents subjected to economic crime over the last 12 months participated in our survey. Professor Peter Sommer and the London School of Economics assisted us with the scope, content and interpretation of survey data and the PwC Global Economic Crime survey continues to be 29% 11% 60% Yes No Don t Know that economic crime remains a leaders all over the world and respondents in indicated Figure 2 Global respondents subjected to economic crime over the last 12 months 11% 34% indicative of a culture in which 5 Yes No Don t Know 3 PricewaterhouseCoopers

7 The prevalence of economic crime in has decreased a total of The decrease in the overall incidence of economic crime in is as a the top 3 n economic misappropriation, bribery & corruption economic crimes that have traditionally not been as prevalent in, are on the increase. Formal anti-fraud effective at fraud detection and ensure that they can deal with the traditional threats. Figure 3 Trend of prevalence of economic crime since % Global 30% 34% 83% % respondents who experienced economic crime in the preceding 12 months (2011 and 2009) and in the preceding 2 years (2007 and 2005) 72% 62% 60% We analyse this overall position in the subsequent sections. Global Economic Crime Survey 4

8 n organisations reported statement fraud than their global counterparts in Face of economic crime in the different types of economic crime these crimes, the distribution of economic crime in mirrors Figure 4 Types of economic crimes suffered in the 12 months preceding the survey Others Sustainability fraud Espionage Illegal insider trading Tax fraud Market fraud involving price fixing Money laundering IP infringement, including data theft Cybercrime Financial statement fraud Bribery & corruption Asset misappropriation 4% 1% 4% 2% 4% 6% 4% 4%10% 7% 1 9% 14% 7% 8% 23% 26% 24% 32% 24% 42% 72% 73% Global % respondents who experienced economic crime in the preceding 12 months 5 PricewaterhouseCoopers

9 misappropriation, bribery & corruption been the top three economic crimes in however that all three crimes have economic crime in and of economic crimes to detect as it involves theft of items with clear value. In our previous surveys, when we asked respondents if they had levels were very low and statistically results with other types of fraud in cybercrime this year and reintroduced it in the types of fraud question as a as one of the major economic crimes respectively. The cybercrime Figure 5 The big three 88% 82% 73% 53% 59% 42% Asset misappropria on Bribery & corrup on 42% 39% 32% Financial statement fraud % n respondents who experienced economic crime in the preceding 12 months (2011 and 2009) and the preceding 2 years (2007) Figure 6 Economic crimes that have shown significant increases in since % 14% 12% 10% 8% 6% 4% 2% 0% 3% 10% Tax fraud 1 Market fraud including price fixing 3% 4% Illegal insider trading % n respondents who experienced economic crime in the preceding 12 months Global Economic Crime Survey 6

10 As business transactions and social interactions move online, there is a clear shift from traditional crimes to crimes involving the use of information technology. Cybercrime in the spotlight to analyse and counteract. PwC used conjunction with Professor Peter An economic offence committed using the computer and internet. Typical instances of cybercrime are the distribution of viruses, illegal downloads of media, phishing and pharming and theft of personal information such as bank account details. This excludes routine fraud whereby a computer has been used as a by product in order to create the fraud and only includes such economic crimes where computer, internet or use of electronic media and devices is the main element and not an incidental one. Cybercrime does not leave the same physical traces as traditional crime and can be committed from remote locations. Due to these factors cybercriminals can operate with a level of anonymity and are able to conduct their own homes. Recently we have seen an increase in online activism often referred to as hacktivism. Groups like Anonymous.com are interest of the citizens they represent. statement. Motivations to conduct cybercrime can From a n perspective new personal information. In addition to to disclose all breaches or loss of be appointed. This is a fundamental previously dealt with such incidents as full disclosure can harm the reputation was merely lost and not misused after a breach. 7 PricewaterhouseCoopers

11 cybercrime in African respondents felt the risk of n perceptions of the source of cybercrime mirror the international respondents see cybercrime as only an access to protected information and customers and other individuals that premises and systems are likely to have access to such information. It is cybercrime as well. Figure 7 Source of cybercrime threat - internal or external? 50% 4 40% 3 30% 2 20% 1 10% % 14% 13% Internally % of all respondents 32% 29% Both internally and externally 4 46% Externally 9% 12% Don't know Global Global Economic Crime Survey 8

12 Figure 8 Internal sources about which n respondents were very concerned 70% 60% 50% 40% 30% 6 39% 63% 52% 56% 32% 47% 2 42% 34% 33% 26% Global 20% 10% 14% 17% 12% 8% 0% Operations Information technology department Finance department Physical / Information security division Marketing and Sales HR department Senior executive/board level Legal division % of all respondents Source of internal Cybercrime threat from various functions within an respondents view the most serious from Operations, Information n respondents are also Human Resource, Physical or Information Security and Finance counterparts. threats can come from anywhere in the world, and is not restricted by jurisdictional boundaries like many other conventional crimes. Figure 9: Global perception of the top 5 countries reported as the likely origins of cybercrime threats Figure 10: n perception of the top 5 countries reported as the likely origins of cybercrime threats Hong Kong (and China) India Nigeria Russia USA Hong Kong (and China) Nigeria UK USA 9 PricewaterhouseCoopers

13 Figure 11 Consequences about which respondents were very concerned 50% 4 40% 3 30% 30% 32% 34% 33% 42% 3 44% 36% 4 40% 4 31% 2 20% 1 10% 22% 18% Global 0% Regulatory risks Service disruption Cost of investigation and damage control IP theft & theft of data Theft or loss of personal identifiable information Reputational damage Actual financial loss from cybercrime activity % of all respondents cybercrime they were very concerned respondents indicated that reputational information are their main concerns. They are also much more concerned Cybercrime can cause more than just proposed Protection of Private Information Bill, failures to secure clients personal information will be Readiness to deal with cybercrime African respondents views on their cybercrime. Based on our survey, n and achieved: 1. elements of an holistic cybercrime prevention and response mechanism in place. Figure 12 Do you consider your organisation has adequate cybercrime incident response mechanisms/policies in place? 70% 60% 50% 40% 30% 20% 10% % 60% 53% In house capabilities to prevent and detect cybercrime % of all respondents 37% 40% In house capabilities to investigate cybercrime 58% Access to forensic technology investigators 39% 44% 37% Media & PR management plan Global 50% 54% Controlled emergency network shut down procedures Figure 13 Where does the overall responsibility of preventing cybercrime risk reside within your organisation? Chief Information Officer/Technology Director Senior executive/board level Operational risk department Don't know Within the business units Others Legal department 2% 4% 2% 2% 11% 9% 10% 8% 8% 21% 28% 37% 54% Global % of all respondents % 10% 20% 30% 40% 50% 60% Global Economic Crime Survey 10

14 Pre-emptive actions organisations should take to ensure readiness in the event of a cyber security attack Involve the CEO the CEO and the Board need to be aware of cyber threats. They need to understand the risks and opportunities in the cyber world. economic crimes, cybercrime is fast paced with new risks in response teams. awareness of threats and response plans and measures. account. From an IT perspective, IT staff needs to be trained on how to deal with attacks in a manner that will not compromise the evidentiary value of the compromised systems. Take an active and transparent stance towards cybercrime responsibility to address the risk respondents did not know who should carry this responsibility. responsibility lies at the senior responsibility on the Chief observation as Chapter 5 of the report deals with IT and recommends that the board should be responsible for IT responsibility can however be overseen by the board. 11 PricewaterhouseCoopers

15 3. indicated that either their board have never reviewed the risk of cybercrime or they do not know how often the board considers forward. IT security should however not be viewed to be the sole responsibility of senior also heavily dependent on proper but more than half of these stated once an event has taken place. the response time and make 5. Given the relative increase in the prevalence of cybercrime, it is also African respondents had not awareness communications of any and n respondents indicated that they considered human-based events such as workshops and presentations to be the most effective methods of awareness creation. Computer most popular choice. Social media readily or cheaply available in South Africa as in developed countries and employer s internet access for personal Facebook, Twitter or LinkedIn may not be the real source of cybercrime, they cybercrime more effectively. For members or to install malware onto the cybercrime more effective. Global. Economic Crime Survey 12

16 Are organisations detecting economic crime effectively? the risk of economic crime. Detection methods should not be viewed in isolation but as part of a comprehensive fraud risk structure. economic crime detections in South by accident which means there is room for improvement. The most effective detection methods statistics for these detection methods Figure 14 Detection methods: Global and Internal audit (routine) Fraud risk management Suspicious transaction reporting Corporate security (both IT and physical security) Rotation of personnel 2% 3% 3% 6% 10% 11% 14% 16% 16% 18% Corporate controls Tip-off (internal) Tip-off (external) Whistle-blowing system 7% 7% 8% 11% Corporate culture By accident Law enforcement / Investigative media Other detection methods Don t know 1% 4% 8% 11% 10% 14% Beyond the control of management Global % respondents who experienced economic crime in the preceding 12 months 13 PricewaterhouseCoopers

17 These detection methods are so-called corporate culture measures and the crimes. At the same time that tip-offs have declined, automated suspicious Automated suspicious transaction where sophisticated software tools are within the internal systems and thus potentially suspicious transactions. The contribution of automated reported detections. It is possible that has caused a relative reduction in human based detections. If so, does this mean that more economic crimes chosen to implement automated principal fraud detection method but it detections in. Improving effectiveness of whistle-blowing mechanisms mechanism required communicated Global Economic Crime Survey 14

18 Given the effectiveness of formal fraud respondents indicated that they were unsure whether any fraud risk assessment had been performed. was uncertainty about what a fraud fraud risk assessments. Our survey effective fraud detection methods, yet the perceived lack of value. of the four main n detection Figure 15 Most effective detection methods in since % 21% 22% 20% 1 16% % 10% 7% 11% 3% % Whistle -blowing system Tip-off (internal) Internal audit (routine) Fraud risk management % n respondents who experienced economic crime in the preceding 12 months (2011 and 2009) and the preceding 2 years (2007) 15 PricewaterhouseCoopers

19 detection method that has become crime in. The increase in economic crimes that have previously not been as prevalent in ensure that they are able to deal with Internal audit had traditionally been one of the more effective detection played a role in the drop in the internal audit spend was reduced we believe that the increased focus on to increased internal audit detections as well. Internationally, there has been a decline in the effectiveness of all A perception gap seems to exist regarding the value of fraud risk assessments. Global Economic Crime Survey 16

20 47% of n respondents stated that their losses for the 12 months before the survey amounted to more than US$ 100,000, with 11% reporting that their losses ranged between US$ 5 million and US$ 100 million. environment. Costs of economic crime Economic crime not only has a direct not underestimate the harm of these African respondents reported situation has also become more pronounced since our last survey. by n respondents. The impact of this should not be result in additional losses it could embolden others within the company and contribute to poor performance. Listed companies should note that the Figure 16 Percentage of respondents that stated that economic crime had significant impact on the following areas ( and Global) Employee morale 28% 36% Relations with regulators 1 22% Business relations Organisation s reputation/brand 19% 19% 27% 27% Global Share price 2% 7% % respondents who experienced economic crime in the preceding 12 months 17 PricewaterhouseCoopers

21 Percentage of internal fraud committed by senior management in in 2011 Perpetrators and action taken Percentage of internal fraud committed by senior management in in % 36% majority of crimes are still committed by internal parties. committed. These types of crimes typically require access to sensitive information and more sophisticated know-how, which Conversely, fewer economic crime junior employees. Figure 17 Perpetrators of economic crime Internal External Don't know 2% 4% 40% 49% 49% 56% Internal: Senior management Internal: Middle management Internal: Junior staff members Internal: Others 3% 2% 18% 28% 33% 36% 39% 41% External: Vendor External: Customer External: Agents / intermediaries 6% 9% 17% 18% 33% 3 External: Others 38% 44% Global % respondents who experienced economic crime in the preceding 12 months Global Economic Crime Survey 18

22 Figure 18 Action taken against internal perpetrators Dismissal Transfer Don't know Warning/reprimand Law enforcement informed Notified relevant regulatory Civil action was taken Did nothing 4% 3% 3% 3% 4% 6% 18% 14% 17% 22% 40% 44% 47% 56% 77% 72% Global % respondents who experienced economic crime in the preceding 12 months dismissals of internal perpetrators was but opted for dismissal in fewer serious economic crime committed by insiders, n entities took no that these perpetrators still remain demonstrate zero tolerance for transparent manner, rather than internally. n respondents were not as likely as their global counterparts to stop doing business with organisations whose employees were responsible for fraud attempts. Interestingly, ns were more likely to report external fraudsters to law enforcement, but less likely to take civil action, than their global counterparts. Figure 19 Action taken against external perpetrators Cessation of the business relationship Notified relevant regulatory authorities Law inforcement informed Civil action was taken, including recoveries Did nothing 8% 28% 39% 40% 43% 39% 50% 63% 7 Global % respondents who experienced economic crime in the preceding 12 months 19 PricewaterhouseCoopers

23 PwC Contacts Louis Strydom Gauteng Johannesburg Charles De Chermont Gauteng Johannesburg Gerhard Geldenhuys Central Region Mafikeng Colm Tonge Gauteng Johannesburg colm.tonge@za.pwc.com Horton Griffiths Western Cape Cape Town horton.griffiths@za.pwc.com Gerrit Jordaan Namibia Windhoek gerrit.jordaan@na.pwc.com Lionel Van Tonder Gauteng Pretoria lionel.vantonder@za.pwc.com Malcolm Campbell Western Cape Cape Town malcolm.campbell@za.pwc.com Peter Goss Gauteng Pretoria peter.goss@za.pwc.com Jacques Eybers Eastern Cape Port Elizabeth jacques.eybers@za.pwc.com Trevor Hills Gauteng Pretoria trevor.hills@za.pwc.com Trevor White KwaZulu-Natal Durban trevor.white@za.pwc.com Freddy Fobian Gauteng Johannesburg freddy.fobian@za.pwc.com PwC Global Economic Crime Survey 2011 Global Edition PwC Global State of Information Security Survey 2012 The Cyber-savvy CEO King s Counsel Global Economic Crime Survey 20

24 PwC firms help organisations and individuals create the value they re looking for. We re a network of firms in 158 countries with close to 169,000 people who are committed to delivering quality in assurance, tax and advisory services. Tell us what matters to you and find out more by visiting us at This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers does not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it PwC. All rights reserved. Not for further distribution without the permission of PwC. PwC refers to the network of member firms of PricewaterhouseCoopers International Limited (PwCIL), or, as the context requires, individual member firms of the PwC network. Each member firm is a separate legal entity and does not act as agent of PwCIL or any other member firm. PwCIL does not provide any services to clients. PwCIL is not responsible or liable for the acts or omissions of any of its member firms nor can it control the exercise of their professional judgment or bind them in any way. No member firm is responsible or liable for the acts or omissions of any other member firm nor can it control the exercise of another member firm s professional judgment or bind another member firm or PwCIL in any way. Designed by PwC Design Studio, ( ) Global Economic Crime Survey 21