Kroll reports fraud, cyber and security threats at all-time high

Fraud, cyber and security incidents reached an all-time high in 2017, according to a new report from Kroll that also finds the economic impact of fraud on the rise. Kroll has been tracking these risks during the past ten years, with its latest findings published in the company’s Global Fraud & Risk Report 2017. A survey of 540 global executives, on which the report is based, finds that some 84% experienced fraud at their organisations in 2017, up from 82% in 2016. However, the figures varied widely by region and country. Worst affected was the UK, where 97% of surveyed companies were hit by fraud in 2017. Next came Canadian firms at 92%, US at 91% and Italy at 90%. Cybercrime was experienced by 86% of respondents, up 1% on 2016. But Kroll noted that some countries and industries report much higher incidents of cybercrime, in some cases nearing 100% of firms. The UK recorded the highest levels of cyber incidents (94%). Italy, Mexico and Canada followed on 92%. Some 70% of respondents said they experienced at least one security incident during 2016, up from 68% in 2016. Kroll said the cost of fraud is rising. Almost a quarter (23%) of respondents said economic damage from fraud cost 7% or more of their company’s revenues last year, up from 3% in 2016. A further 46% reported losses of up to 3% revenue last year. Kroll found that companies in two sectors – retail, wholesale and distribution, as well as construction, engineering and infrastructure – accounted for 69% of companies reporting losses of 7% or more. Information theft, loss or attack became the most common type of fraud reported in 2017. It accounted for 29% of fraud, and took top spot for the first time in the report’s ten-year history. Theft of physical assets or stock, which was knocked off the top spot, accounted for 27% of fraud last year. Kroll said the greatest year-on-year increase was the result of corruption and bribery, representing 21% of fraud cases reported by respondents in 2017. This is up from 15% in 2016. “With the incidence of bribery and corruption almost doubling over the last two years, the risk for organisations has heightened considerably,” Kroll said. Kroll found that respondents reported an increase in every category of cyber incident last year. A virus or worm attack was most common at 35% of all cyber incidents, up from 33% in 2016. Some 33% of respondents said they experienced an email-based phishing attack last year, up from 26% in 2016. Data breach and data deletion affected 27% of cyber incidents, up from 25%. The report also analysed how cyber incidents occur. It found that software vulnerability was the most common cause – behind 25% of cyber incidents – while attacks against a corporate website accounted for 21% of incidents. However, employee error also featured highly and accounted for 20% of cyber incidents reported by executives. Employee manipulation accounted for a further 17% of incidents and employee malfeasance 14%. Kroll also found that companies are vulnerable to third parties, with 19% of executives experiencing a cyber incident as the result of an attack on a vendor or supplier. Security incidents were dominated by physical theft or loss of intellectual property at 41%. Environmental risks represented 28% of security incidents last year, while 23% were linked to workplace violence. Kroll said in addition to economic costs, fraud, cyber and security incidents also impacted widely on employees, customers, reputations and relationships with regulators. Some 82% of executives surveyed said employee morale was negatively affected by a fraud incident, 81% for cyber and 80% for security incidents. Three quarters of the survey said customers were negatively affected in all three risks areas. Two thirds of survey respondents said their company’s reputation was affected by a fraud, cyber or security incident. “In a world growing ever more interconnected, companies must contend with both sides of the risk coin, ie, not only can risk originate from any number of sources, the repercussions from incidents can make themselves felt in myriad ways. High-probability consequences such as operational disruption, financial losses, reputational damage and regulatory investigations all make it imperative for companies to commit to establishing and supporting sustainable processes that will afford them effective protection now and into the future,” Kroll said. The report reveals that while anti-fraud measures are widely adopted, board engagement is less satisfactory. Only 68% of surveyed firms said their board was engaged in the topic. “A surprisingly low percentage in the face of increasing regulations, regulatory enforcement, high incidence, and extremely wide and costly repercussions,” Kroll said. However, the report finds that 25% of respondents plan to implement board of director engagement in the next 12 months. The report also reveals that 78% of those surveyed implement information security controls and 77% have adopted financial controls and protection of physical asset measures. Kroll said it was surprised to find that only 74% have implemented whistleblower hotlines. The poll also found that 73% of surveyed companies use staff background screening. For cyber risk, Kroll said most respondents have already begun implementing employee-focused mitigation measures, including 89% placing employee restrictions on installing software and 83% conducting employee cybersecurity training. Some 80% of respondents also have incident response plans in place. Kroll said it found only 46% of executives involve the board of directors in cybersecurity policies, however a further 40% plan to take this on during the next 12 months. David Fontaine, CEO of Kroll, said this year’s report highlights more than ever that companies must adopt enterprise risk management to tackle the growth of fraud, cyber and security threats. “One of the report’s findings with the greatest implication for organisations is that many risks can no longer be neatly categorised and labelled as fraud, cyber or security-related. Instead, due to the convergence of a global economy, growing digital connections, and ever-constant human behavioural factors, organisations must adopt a holistic approach to enterprise risk management and develop integrated risk mitigation strategies to address this new threat environment,” Mr Fontaine said.

Kroll reports fraud, cyber and security threats at all-time high

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles