If Theft or Fraud Happens, Do Not Make It Worse with Silence

It’s hard to find a nonprofit organization that has not been hit by a theft, fraud, or other material diversion of assets. It almost seems inevitable to happen at some point. We must continue to strengthen internal controls and stay vigilant, searching for evolving weaknesses and risk exposures. If a theft or fraud does happen, it is important to be fully transparent with messaging and avoid the tendency to go silent.

In a disaster recovery plan, there will be procedures and action steps in place to mitigate the damage and start the recovery process. Thoughtful and timely messaging plans will help with damage control and speed up the recovery process.

Assets can be lost from a theft or fraud event, but equally important are the future assets and resources that could be lost from related reputational damage. Careful and timely messaging is your best strategy to protect your nonprofit organization’s brand and reputation. Early messaging can also help stop the bleeding from the theft or fraud and improve your chances at asset recovery.

Two key considerations for your disaster recovery plan are the timing and the targets of your messaging efforts. Set up a messaging grid to track messaging action steps including the when (timing) and the who (targeted recipients of the communication).

1.         Timing

Begin by making a list of damage control and recovery action steps. Divide the action steps into three phases: alert, notification, and recovery. Your messaging efforts should be ordered to match these three phases.

The alert messaging phase is used to grab peoples’ attention that a theft or fraud event has occurred and been detected. This starts the clock for sharing initial information, building trust and confidence that information will be provided timely.

Next is the notification messaging phase, which is used to provide additional evolving information describing how the incident occurred, weaknesses exposed, and mitigation steps taken to control the damage. The purpose of this phase is to answer expected questions and provide assurance that senior management is proactive and in control.

The recovery messaging phase is reserved for providing details about the final outcomes from the incident and proposed action steps to optimize recovery, and to direct attention back to the organization’s mission and programs.

2.         Recipients

Next, segment the recipients of general messaging into four groups beginning with staff who will receive the most messages followed closely by the Board and other volunteer leadership. Reserve the final two groups for constituents (donors, members, funders, service recipients, etc.), and the general public. Craft messages specific to each of these groups and confer with your organization’s legal counsel to ensure that these communications do not expose the organization to additional risks (such as defamation lawsuits).

Among these groups of recipients, the general public will usually be the last to be informed about the incident and will generally receive the least amount of messaging. Depending on the circumstances, you may need to post a press release or other similar public notification. However, this must be handled very carefully to ensure the public messaging does not interfere with ongoing investigations or efforts to recover the assets. For significant diversions of assets or theft or fraud committed by a “disqualified person,” Form 990 disclosures will be required and be part of the concluding message to the general public.

Planning Tip – Consider the tone and length of messages related to theft, fraud, and other diversion of assets. Stress that timely sharing of information is the goal. Avoid candy-coating the message with unnecessary apologies and regrets. Keep the message short and to the point. Stress that management is proactive with investigations, committed to recovery efforts, and will be transparent with sharing important facts.

Periodically revisit your messaging grid to adjust your messaging to match changing circumstances. A fraud case can quickly expand or contract after initial discovery. What first appeared as a minor fraud event could quickly expand as investigations progress and additional frauds are discovered. However, for fraud cases that do not have these complications, early discovery can contain the damage and, with insurance and other protection efforts, assets can often be fully recovered.