CGj reviews the latest guidance note issued by the Institute, focusing on helping charities and NGOs understand the dangers of fraud, as well as offering practical advice on its prevention and mitigation, and provides an overview of all guidance notes published by the Institute between April and September 2024.

As an integral part of its thought leadership initiatives, the Institute regularly publishes guidance notes as a way to assist governance professionals in Hong Kong and the Chinese mainland to better fulfil their roles as the governance guardians and gatekeepers of their organisations, and to promote good governance practices.

The Institute, with the support of its Public Governance Interest Group under the Technical Consultation Panel, published a two-part guidance note in September 2024, titled Fraud Prevention and Mitigation for Charities and NGOs, to highlight the risk of fraud faced by these organisations, and outlining a number of pragmatic measures for prevention and mitigation.

Background

In today’s more interconnected and digitalised world, it is an inescapable fact that fraud – such as identity theft and phishing – is becoming increasingly prevalent across all industries. NGOs and charities are particularly vulnerable, for several reasons.

Resources for NGOs and charities to adequately protect against fraud and cybersecurity breaches may be limited – as the guidance note explains, ‘they usually face severe competition against funding allocation for operational services requirements’. In addition, charities may be viewed by fraudsters as soft targets for identity theft, as the nature of these organisations ‘may result in less stringent financial controls and a lack of awareness of possible hazards’, the guidance note warns. Identity theft hazards include impersonation fraud, website cloning, phishing attacks and unauthorised fundraising campaigns.

In addition, the risk of identity theft and phishing is particularly relevant to charities and NGOs since they depend so heavily on donations and goodwill from the general public. The loss of reputation, on top of possible financial losses, resulting from such breaches has a very detrimental impact – a negative reputation can last indefinitely and can affect a charity’s capacity to carry out its goals.

Case examples

The guidance note highlights UNICEF as a pertinent example of the fraudulent use of a charity’s name and logo – in this case, through ‘the fraudulent use of our name and logo by unethical individuals who deliberately abuse the trust of UNICEF supporters worldwide’– citing the UNICEF website, which provides clear and precise information on how fraud is perpetrated and what measures can be taken to protect against such abuse. This demonstrates that even a large international organisation like UNICEF, which has far more resources than the majority of smaller charities and NGOs, is not immune to cybersecurity breaches, identity theft and phishing.

While this was a worldwide issue for UNICEF, the Institute’s guidance note pinpoints a number of recent examples from Hong Kong. In September 2023, HK Ballet suffered a ransomware attack, where hackers took control of the data of 8,122 individuals. The guidance note reveals that, in this case: ‘The Office of the Privacy Commissioner for Personal Data found deficiencies in information system management, lax monitoring of the data security measures adopted by the service vendor, lack of policies and guidelines on information security and lack of appropriate data backup solutions.’ More recently, in July 2024, Oxfam Hong Kong suffered a cyberattack in which the personal data of 470,000 people was potentially leaked.

Fraud prevention and mitigation

Awareness of possible threats and a robust system of risk management, along with installing a culture of vigilance, are vital to protect against the ever-growing threat of fraud and identity theft. While the guidance note states that ‘the possibility of fraud cannot be eliminated, even with preventative measures in place’, it points out that charities and NGOs should take steps to lessen their exposure, as well as establish a number of mitigation measures in the event that fraud does take place.

Fraud prevention

It is essential that everyone involved in a charity or NGO is aware of the organisation’s fraud prevention guidelines and that there is a programme of regular, up-to-date training sessions – not just for the board members, other senior members and employees, but also for any volunteers. It is also important to have a clear whistleblowing policy.

• Inspection and surveillance: according to the guidance note:  ‘Charities and NGOs should implement stringent screening procedures for any people or groups claiming to be raising money on their behalf.’
• Robust internal regulations: robust internal controls, such as segregation of roles, frequent financial audits and personal data protection, are necessary to help prevent fraud.
• Regular review and audit: regular review and audit by both internal and external parties can help identify fraud or irregularities at an early stage.
• Internal training and building awareness: good governance practice calls for regular and frequently updated training on risk and governance issues, covering both management control and operational levels.
• Awareness-raising initiatives: NGOs and charities should proactively inform their donors of the dangers of fraud and the precautions they can take.
• Digital security measures: ‘online contribution platforms and websites for charities and NGOs must be secured. This entails using SSL certificates, installing two-factor authentication for administrative access and routine software updates to guard against security flaws,’ the guidance note recommends.

Fraud mitigation

Fraud can – and does – happen, even if preventative measures exist. Charities and NGOs should therefore also institute a framework for fraud mitigation to counteract any occurrence.

Crisis management plans: crisis management strategies and incident response plans that specify what actions to take, and by whom, need to be put in place. This would include protocols for communication with donors.

Reputational management: the guidance note clearly states that ‘communicating openly and promptly with the public, stakeholders and contributors is crucial’, and suggests that professional external communication specialists should be engaged if the incident is considered to have a sizeable impact on the reputation of the organisation or on the community.

Insurance coverage: acquiring insurance coverage to guard against fraud can lessen the financial damage and provide funds for any repairs or legal fees.

Working with authorities: charities and NGOs must know what legal remedies are available in the case of fraud, such as notifying the proper authorities, taking legal action against those responsible, and cooperating with the police to locate and retrieve money that has been lost, if possible.

Key takeaways

‘In the current difficult climate, charities and NGOs must always be on the lookout for fraud,’ the guidance note emphasises. While the possibility of fraud cannot be totally eliminated, charities and NGOs can take active steps to safeguard their assets, donors and reputations. However, as the guidance note cautions, ‘there is no one-size-fits-all solution’, so these organisations must adopt clear and careful strategies to deal with identity theft and other examples of fraud by remaining vigilant and encouraging a culture of alertness.

The Institute would like to thank all those involved in the production of this two-part guidance note (see ‘Guidance note roundup’ for details).