Fraud Policy and Procedures

Application

All members of the University community.

Purpose

To protect the University, its operations, its assets and all members of the University community from fraud and the consequences of fraudulent activity.

Introduction

The University is committed to maintaining the highest ethical standards in its activities and operations and preventing fraud and related misconduct.

As an organisation, which is entrusted with public funds, the University and its staff members are expected to exhibit the highest standards of integrity and honesty.

Responsibilities

1. All members of the University community must maintain the highest ethical standards in their own activities and operations and must not participate in fraud or any related misconduct. Members must take all practical steps to:

  • maintain the highest ethical standards in their activities and operations
  • must not participate in fraud or related misconduct
  • report suspected fraud, or related misconduct, and assist with the prevention and detection of such activities (refer procedures Section 6 onwards for reporting options available)
  • support and protect any individual who seeks, in good faith, to report suspected fraud or related misconduct.

2. All managers at the University must promote and implement measures to prevent and detect fraud amongst their staff members and colleagues and support robust fraud protection and risk management practices across the University. Managers must take all practical steps to:

  • support the University’s internal control system and monitor the output of fraud detection controls (e.g. unusual transaction analysis, internal audits or similar analytics) and other fraud risk management programmes
  • promote awareness of ethics and fraud prevention amongst staff members and colleagues, and
  • ensure any reports of fraud or related misconduct are dealt with in accordance with this policy, or as otherwise directed by the Registrar.

 3. The Chief Financial Officer (CFO) must:

  • ensure adequate and effective internal controls are in place for relevant business processes, particularly those that are assessed as having a higher risk of fraud
  • ensure the regular review of internal controls
  • where considered appropriate, appoint an internal / external investigator to analyse any allegation of fraud in conjunction with the Registrar
  • for confirmed wrong-doing, report all losses occurring as a result of fraud to the Registrar and Vice Chancellor and subsequently to the Chair of the Audit and Risk Committee and to others as appropriate through the Registrar.

4. The Registrar must:

  • report all confirmed wrongdoing resulting in losses from fraud to the Police or any other external authorities including Serious Fraud Office, Statutory auditor, and Insurer
  • report all confirmed wrongdoing resulting in losses from fraud to the Audit & Risk Committee. 

5. Risk Office must:

  • decide the incident level for alleged potential fraud in conjunction with the CFO
  • conduct analysis of alleged potential fraud based on its internal Fraud Analysis Protocols. The results of the analysis must be shared with the CFO to take an informed decision on further reporting to Registrar
  • promote awareness of ethics and fraud prevention among members of the University
  • deliver University fraud risk prevention and detection programmes (including unusual transaction analysis and internal audits).

Procedures

Detection and Reporting

6. An individual who is aware or suspects fraud or related misconduct must promptly report such activity to any of the following:

7. In the event that fraud is suspected, every effort must be made to preserve and protect all relevant information that may be required to support internal disciplinary action, or where appropriate, criminal prosecution.

8. All information collected or received during an analysis into fraud must be treated in confidence and abide with the Protected Disclosures Policy and Procedures - The University of Auckland, except as necessary for the thorough analysis and resolution of the complaint, to meet the requirements of natural justice or otherwise required by law. 

Analysis of Potential Fraud

9. Where appointed by the CFO, the analysis team is to:

  • develop an analysis plan
  • analyse the allegation(s) of fraud or related misconduct
  • after reviewing the information available, determine whether relevant records should be secured with limited access (information protection strategy)
  • identify expertise and resources required for the analysis
  • manage all privacy and protected disclosure issues
  • gather information, including interviews
  • prepare a final report.

10. The analysis team is to report to the Registrar through the CFO throughout the analysis as directed.

11. The analysis team is authorised to examine, copy, and/or secure university property, including the contents of files, desks, cabinets, and other storage facilities, including digital storage facilities, on or off campus without the consent of any individual. Personal property is excepted. 

Consequences

12. When the analysis is complete, the analysis team is to submit a final report to the Registrar through the CFO.

13. Where the analysis supports the allegation of fraud or related misconduct against a staff member or student, Risk Office will liaise with Human Resources or Proctor’s office respectively throughout the review to keep informed of progress. Upon finalisation of the report, Risk Office in conjunction with the CFO and the Registrar is to refer the matter to the Director HR/Proctor to determine whether the matter is to be dealt with under the applicable disciplinary policy and procedures.

14. In all other cases of alleged fraud or related misconduct, the Registrar is to determine how the matter is to be dealt with and/or what action, if any, is to be taken.

15. The recovery of any lost monies or other property is to be pursued wherever practicable and appropriate.

16. Manager, Risk Office is to prepare a report recommending what, if any, improvements to internal controls are to be undertaken.

17. The Registrar is to provide the Audit and Risk Committee with a summary of the findings and any actions taken.

Definitions

The following definitions apply to this document:

Fraud refers to any act of deception, misrepresentation, or concealment of information, committed with the intention of gaining a benefit, causing a loss, or avoiding an obligation, which is otherwise not rightfully due or owed. This includes, but is not limited to, obtaining property, funds, or services by false pretences, making false statements, or engaging in deceptive conduct. Fraud encompasses any act that involves dishonesty and manipulation to achieve an improper advantage or benefit at the expense of others.

Fraudulent activity is an intentional and dishonest act involving deception or misrepresentation, to obtain or potentially obtain an advantage for themselves or any other person. It includes the deliberate falsification, concealment, destruction or use of falsified documentation used or intended for use for a normal business purpose of the University or the improper use of information or position whether or not for personal benefit.

Protected disclosure means a protected disclosure as defined in the Protected Disclosures (Protection of Whistleblowers) Act.

Staff member refers to an individual employed by the University on a full or part time basis.

University means the University of Auckland and includes all subsidiaries.

University community includes all staff members (whether permanent, temporary or part time), honorary staff, students (whether full time or part time), contractors, subcontractors, consultants, alumni, associates, business partners or official visitors or guests of members of the University. It includes visiting and adjunct staff members and any other person providing services to the University.

Key relevant documents

Include the following:

Document management and control

Owner: Registrar
Content manager: Manager, Risk Office
Approved by: Vice-Chancellor
Date approved: 1 February 2018
Reviewed date: 24 January 2025
Next Review date: 24 January 2030