University of York Financial Fraud Response Plan

1. Introduction

The University’s activities are supported by substantial public funds, and as a publicly funded body, it is accountable to its stakeholders to ensure the most efficient and effective use of its resources in support of the University’s approved strategy. 

It is the responsibility of all staff to ensure the correct and honest use of all University resources/ assets and to report any circumstances which may indicate the improper use of these resources. Improper use of University resources must be reported to the Head of Department and/or the Finance Director.

While prevention of financial fraud is the key objective once a financial fraud is suspected or suggested it is important that prompt action is taken. Financial fraud is unpredictable, time-consuming to investigate, very disruptive and unpleasant. In addition to potential financial loss there may also be a risk to the University’s reputation. 

Financial fraud can be perpetrated by staff, students, visitors, suppliers and/or customers of the University. This fraud response plan covers all the people/ organisations that perpetrated the financial fraud against the University.

Fraud is not always obvious and preliminary enquiries will normally take place to ascertain that there is prima facie evidence of possible dishonesty having taken place before the Fraud Response Plan is invoked. Such enquiries should involve the individual concerned, wherever possible (without contravening "tipping off" or similar requirements). If such evidence cannot be ascertained (and it is, perhaps, misuse rather than dishonesty), then other University policies (eg staff or student disciplinary) should be followed in the first instance rather than the Fraud Response Plan, noting that further investigation may lead back to this policy, in some circumstances. [Note1]

Investigation of financial fraud is the responsibility of the Finance Director who may set up a group to investigate each case. The financial fraud response plan detailed below sets out the steps to be taken if a financial fraud is reported or detected.

2. Definition of Fraud

The term fraud is a broad one used to describe a number of activities including false accounting, misappropriation, bribery and corruption, deception and collusion. The Fraud Act 2006 provides a legal definition of fraud.   

In general, financial fraud may be described as any deception that results in a gain to one party/and or a loss to another. The Fraud Act 2006 includes three classes of fraud: 

• Fraud by false representation;
• Fraud by failing to disclose information;
• Fraud by abuse of position.

In all three classes of fraud, the Act requires that for an offence to have occurred, the person must have acted dishonestly and with the intent of making gain for themselves or anyone else, or inflicting loss (or risk of loss) on another. 

This response plan covers all of the above for financial matters.  

In terms of applying this financial fraud procedure within the University, fraud may be defined as the use of deception with the intention of: 

• Gaining an advantage, personally and/or for family and friends; or
• Avoiding liability; or
• Causing a financial and/or reputational loss to the University or one of its subsidiary companies.

The main types of irregularity are: 

• Theft: this may include the removal or misuse of funds, assets or cash (theft is not prosecuted as fraud but prosecuted under the relevant Theft Acts);
• False accounting: dishonestly destroying, defacing, concealing or falsifying any account, record or documents required for any accounting purpose, with a view to personal gain or gain for another, or with the intention to cause loss to the University or subsidiary or furnishing information which is or may be misleading, false or deceptive;
• Abuse of position: this applies where fraud is committed in situations where someone by virtue of their position is expected to safeguard another's financial interests or not act against those interests.   

In addition to the above, some examples of the classes of fraud in the context of how these might relate to the University are set out below. 

2.1 Fraud by false representation

• Abuse of the University’s expenses system by submitting claims for reimbursement of costs which are excessive, not reflective of actual activities or were never wholly incurred.
• Using the University’s logo or letterhead for personal reasons and implying the University has sanctioned the content of the document (and/or implying that the document is sent by and on behalf of the University).
• Using a stolen credit/debit card to pay tuition fees.
• Using a University purchase card for buying personal goods and services.
• Appropriating University property.

2.2 Fraud by failing to disclose information

• Failure to disclose a criminal conviction which may impact on the individual’s suitability to obtain or remain in employment in the University’s Finance department, subject to the provisions of the Rehabilitation of Offenders Act 1974.

2.3 Fraud by abuse of position

• A representative/member of the University is awarded monies from a third party to undertake research or research related activity as a result of the position or work they have undertaken at the University. The University representative/ member of the University fails to spend the grant monies in the way that it was intended and funds are used for personal benefit/gain.

3. Financial Fraud Response Process

3.1. Purpose

In the event of a suspected fraud/financial irregularity this response plan defines the authority levels, responsibilities for action and reporting lines. The use of this plan should allow the University to, where relevant:

• respond quickly and professionally to any suspicion or suggestion of fraud or irregularity;
• notify the Office for Students and other relevant bodies/ funders;
• minimise and recover losses;
• prevent further loss;
• establish and secure evidence necessary for the purposes of investigation;
• take appropriate action against those who have committed the fraud;
• review the reasons for the incident, the measures taken to prevent a recurrence, and any action needed to strengthen future responses to fraud;
• keep all persons with a need to know suitably informed about the incident and the University’s response.

It is noted that the University of York has processes in place to reduce the risk of fraud as far as practicably possible, such as approval limits and segregation of duties.

3.2. Process flowchart

3.3. Notification of financial frauds

Suspicion or alleged fraud or financial irregularity may be captured through a number of means, including the following:  

• requirements on all staff/ students to report financial fraud
• an investigation undertaken in accordance with the University’s “speak up” policy
• an investigation undertaken in accordance with the University’s disciplinary procedures for staff and students
• planned audit work
• operation of proper management control and procedures
• disclosure by the individual(s) concerned.

All alleged or suspected incidents should be reported immediately to the Financial Fraud Group using the email address fraud-group@york.ac.uk.

If University Executive Board member(s) or University Council member(s) are suspected of being involved in financial fraud, the incident should be reported to fraud-group@york.ac.uk and then relevant staff will inform those people not involved in the allegations ie Vice-Chancellor, Finance Director, Chief Operating Officer, and/or Chair of University Council and/or Chair of Audit and Risk Committee as appropriate.

3.4. Financial fraud group

The Finance Director or Group Financial Controller will perform a quick review of the financial fraud allegation and consider whether to take immediate action or wait until the Financial Fraud Group can be convened.

If immediate action is being taken then the Finance Director or Group Financial Controller will consider the following prior to the meeting of the Financial Fraud group:

• whether an investigation is required;
• who should undertake the investigation and the composition of any group set up to investigate the allegation/ suspected fraud;
• whether, and at what stage, internal audit needs to be involved in the investigation;
• whether the member of staff or student needs to be suspended;
• whether the matter should be reported to the police;
• which regulations/procedures/policies will be followed eg staff disciplinary, student disciplinary;
• if there are public relations/media issues involved and whether to inform External Relations staff.

Examples of when suspension of a staff member may be considered include where there is cogent evidence that dishonesty has occurred, there could be interference with the investigation, or to prevent the fraud continuing. [Note1]

A meeting of the Financial Fraud Group must be convened to decide on an initial response to the allegations/ suspected fraud. The group will comprise:   

• Finance Director or nominee;
• Director of Human Resources or nominee for staff-related suspected financial frauds
• Academic Registrar or nominee for student-related suspected financial frauds

The group will consider: 

• whether an investigation is required;
• who should undertake the investigation and the composition of any group set up to investigate the allegation/ suspected fraud;
• whether, and at what stage, internal audit needs to be involved in the investigation;
• whether the member of staff or student needs to be suspended;
• whether the matter should be reported to the police;
• which regulations/procedures/policies will be followed eg staff disciplinary, student disciplinary;
• if there are public relations/media issues involved and whether to inform External Relations staff.

Depending on the type, size and sensitivity of the suspected fraud the group will inform the following people about the allegations and the planned approach to the investigation:

• Chair of University Council, Chair of Finance Committee and Chair of Audit and Risk Committee
  • suspected/ alleged financial fraud which is likely to be reported to the Office for Students;
  • suspected/ alleged financial fraud involving University Executive Group members and University Council members;
• Vice-Chancellor and Chief Operating Officer
  • suspected/ alleged financial fraud likely to be reported to Office for Students;
  • suspected/ alleged financial fraud involving University Executive Group and
  • University Council members;
  • any other suspected/ alleged financial frauds;
• University Executive Board members;
  • All suspected/ alleged financial frauds involving staff, students or other individuals in their area of responsibility;
• Deans of Faculty; Heads of Department
  • All suspected/ alleged financial frauds involving staff, students or other individuals in their area of responsibility;

3.5. Staff

Allegations of financial fraud involving staff will be considered under the staff disciplinary procedure.

3.6. Students

Allegations of financial fraud involving students will be considered under the student discipline regulations (Regulation 7).

3.7. Other financial fraud

Financial Frauds that do not involve staff (covered in paragraph 5 above) or Students (covered in paragraph 6 above) are covered by this Fraud Response Plan.

3.8. Support

The University has facilities available to support staff or students who are victims or suspected or alleged to have committed fraud. For example, in the case of students they could be referred to the Open-Door Team and/or to the Students’ Union Advice Centre.

3.9. Establishing and securing evidence

Those individuals investigating the incident will:

• maintain up-to-date knowledge of the University’s disciplinary procedures, ensuring that evidence requirements will be met during a fraud investigation;
• obtain approval from University management prior to establishing and maintaining contact with the police;
• ensure that staff involved in fraud investigation are familiar with and follow the University’s approach to internal investigations.

3.10. Police involvement

Normally, once the initial investigation is completed and if it is found that there is a case to answer then it may be referred to the Police (see para 11). Each financial fraud case should be reviewed by the Financial Fraud Group to agree the appropriate course of action, depending on the circumstances of the case. The University Security Office must be involved when a case is referred to the police.

3.11. Police investigations

If the police are carrying out a criminal investigation into an alleged case of fraud that is also the subject of an internal disciplinary investigation, the University will ensure any internal investigation does not prejudice or disrupt the police proceedings. It should be noted that the person concerned may be less likely to cooperate with an internal investigation if they believe this could prejudice their defence with regards to the police.

Where a Police investigation does not result in prosecution, the University may still take the view that disciplinary action is justified, on the basis of its own investigation (see para 12). This is because in criminal proceedings the standard of proof is beyond all reasonable doubt, whereas the University operates like a civil court where the standard of proof is lower and is based on the balance of probabilities that the person has committed the alleged offence.

3.12. University investigations

The University will carry out its own reasonable investigation, as far as the circumstances allow. It will not rely on the outcome of Police investigations. The outcome of the University investigation will be based on the balance of probabilities that the person/ organisation has/ has not committed the alleged offence.

If, based on the outcome of the University investigation, the Financial Fraud Group decides that the person/ organisation has conducted a financial fraud then action will be taken, which may include:

• Invoking Staff disciplinary policy
• Invoking Student disciplinary policy
• Ceasing to trade with the organisation
• Other actions to limit losses

If, based on the outcome of the University investigation, the Financial Fraud Group decides that the person/ organisation is not guilty of the financial fraud then no action will be taken and the person or organisation will be informed of the outcome.

3.13. Insurance

Where a financial fraud has been committed the University Insurers should be notified in line with the requirements of the relevant insurance policies.

3.14. Prevention of further loss

Where the initial investigation provides reasonable grounds for suspecting a member(s) of staff or student(s) or other people of financial fraud, the Group will decide how to prevent further loss. This may require the suspension of the individual(s) and/or the removal of access to University facilities, buildings and systems.

• Suspension of a member(s) of staff will be in accordance with the University’s disciplinary procedure;
• Suspension of a student(s) will be in accordance with the University’s student disciplinary procedure (Regulation 7);
• Denying access to the University buildings/property will be conducted by Estates and Campus Services;
• Denying access to the University IT systems will be conducted by Corporate & Information Services.

3.15. Recovery of losses

Recovering losses is a major objective of any fraud response investigation. Those investigating the incident should ensure that in all fraud investigations the amount of any loss is quantified. Repayment of losses should be sought in all cases. 

Where the loss is substantial, legal advice should be obtained about recovery of losses through the courts, this may involve freezing an individual’s assets. The University would normally expect to recover costs from the court in addition to any losses. The University may also liaise with its insurers if appropriate.

3.16. References for employees disciplined or prosecuted for fraud

Any request for a reference for a member of staff who has been disciplined or prosecuted for fraud shall be referred to Human Resources.

3.17. References for students disciplined or prosecuted for fraud

Any request for a reference for a student who has been disciplined or prosecuted for fraud shall be referred to the Academic Registrar or nominee.

3.18. Post-investigation review

Once the investigation of the fraud is complete the Financial Fraud Group will consider measures that should be taken to prevent a recurrence of the incident and any actions required to strengthen the University’s future response in similar fraud cases.

4. Financial Fraud Reporting Requirements

4.1. Reporting to Council

Any fraud meeting the criteria for the Office for Students “Reportable Event” shall be reported in line with the University reporting requirements for “Reportable Events”.

4.2. Reporting to the Office for Students

The University is required to report suspected or actual fraud or financial irregularity to the Office for Students as a “Reportable Event” [Regulatory Advice 16] which is defined as:

“494. A reportable event is any event or circumstance that, in the judgement of the OfS, materially affects or could materially affect the provider’s legal form or business model, and/or its willingness or ability to comply with its conditions of registration. Reportable events must be reported to the OfS under condition F3(i) and include, but are not limited to:…

d. The provider is becoming aware of suspected or actual fraud or financial irregularity…”

Regulatory Advice 16 gives the following example in connection with fraud:

“suspected or actual fraud or financial irregularity which might take the form of theft or money laundering might relate to condition E2 (management and governance); a fraud perpetrated by an accountable officer or member of the governing body would be material even if its monetary value was small.”

4.3. Reporting to other bodies

Where the financial fraud relates to externally funded research or other externally funded activities the conditions of the contract may require the funder to be notified. The notification should be done by the most appropriate person eg Pro-Vice-Chancellor; Dean of Faculty, Head of Department or Finance Director.

5. Appendix

The Financial Fraud Response Plan is effective from November 2021.

Document control:

Event	Name	Date
Prepared by	Ian Smallwood, Group Finance Manager	February 2020
Reviewed by	Ruth Clark, Group Finance Controller	January 2021
Comments from	Finance Senior Management Team	October 2021
Commets from	Academic Registrar	January 2021
Approved by	University Executive Board	November 2021
Published	Finance website	December 2021
Date for review of policy	3 years after University Executive Board approval	September 2024
Document owner	Group Financial Accounts

Notes
Paragraphs marked with Note 1 were added in January 2022 following discussion between the Finance Director, HR and Dean of Social Sciences.