Our fraud policy

2. Introduction

This policy gives guidance on the prevention, detection, reporting and handling of fraud within VisitScotland. VisitScotland is committed to ensuring that opportunities for fraud - both internal and external - are reduced to the lowest possible level of risk.

Staff are required at all times to act honestly and with integrity and to safeguard the public resources for which they are responsible.

VisitScotland will not accept any level of fraud and any case will be thoroughly investigated and dealt with appropriately.

4. Prevention

Managers and staff must always be alert to the risk of fraud, other forms of theft. Danger signs of internal fraud include evidence of excessive spending by staff engaged in cash or contract work, inappropriate relationships with suppliers, reluctance of staff to take leave, requests for unusual patterns of overtime and where there seems undue possessiveness of records. Junior staff should resist any pressure from line managers to circumvent internal controls or to over-ride control mechanisms. Such action could be indicative of fraudulent activity and should be reported.

A key preventative measure in the fight against fraud is to take effective steps at the recruitment stage. Written references will always be taken up and independent confirmation of any professional qualifications will be obtained before offers of employment are made.

VisitScotland is committed to ensuring that it takes effective measures for implementing and maintaining effective and efficient internal controls in computer systems. There is a need to ensure that the risks associated with new technology such as hacking, virus infections and fraud arising from the use of networks (whether local, national or international) are addressed.

Other measures designed to prevent and detect fraud include clear financial procedures, control systems, reconciliations, segregation of duties, supervisory checks and authorisations and an internal audit programme.

6. Responsibilities

The Scottish Ministers are responsible for issuing relevant guidance in the Scottish Public Finance Manual (SPFM) on the prevention, detection, reporting and handling of fraud. As a public body VisitScotland must implement this guidance and put appropriate procedures in place to prevent and detect fraud.

The Board has corporate responsibility for ensuring that VisitScotland follows guidance issued by Scottish Ministers. It addresses key financial and other risks such as fraud through the Audit & Risk Committee.

The Audit & Risk Committee oversees the risk management framework and governance arrangements on behalf of the Board. The Audit & Risk Committee therefore has a general responsibility for monitoring the operation and effectiveness of anti-fraud arrangements and requires regular reports on fraud activity. 

VisitScotland’s Chief Executive is responsible for establishing and maintaining sound systems of internal control to support our policies, aims and objectives. The systems of internal control are designed to respond to and manage the whole range of risks that VisitScotland faces. Managing fraud risk will be seen in the context of the management of this wider range of risks.

The Leadership Group support the Chief Executive by identifying those operational areas where the risk of fraud or other loss is greatest. This will help inform internal audit activities and should also provide pointers to where line managers should target their counter fraud measures.

The Fraud Response Co-ordinator is a nominated member of the HR team and is the first point of contact for any suspected fraud within VisitScotland. This individual leads on all fraud investigations ensuring that the investigation is prompt and thorough.

The Head of Finance has been delegated overall responsibility for ensuring that necessary controls are in place for managing the risk of fraud in VisitScotland. Responsibilities include:

• preparing relevant guidance on the prevention, detection, reporting and handling of fraud for issue to staff.
• establishing and reviewing an effective anti-fraud policy and fraud response plan.
• ensuring that core financial systems are designed and operated so as to minimise the risk of fraud.
• coordinating assurances about the effectiveness of anti-fraud policies to support the Statement on Internal Control.
• ensuring that appropriate anti-fraud training and development opportunities are available to appropriate staff.
• ensuring that appropriate action is taken to minimise the risk of similar fraud’s occurring in future.
• ensuring with the Head of Procurement that adequate supplier take-on and monitoring controls are in operation with appropriate internal segregation of duties.

The Internal Audit Contractor is responsible for:

• delivering an opinion to the Board through the Audit & Risk Committee on the adequacy of arrangements for risk, control and governance (including those for managing the risk of fraud) and ensuring that VisitScotland as a whole promotes an anti- fraud culture.
• assisting in the deterrence and prevention of fraud by examining and evaluating the effectiveness of controls commensurate with the extent of the potential exposure/risk in the various segments of VisitScotland's operations.
• ensuring that management has reviewed its risk exposures and identified the possibility of fraud as a business risk.
• assisting management in conducting fraud investigations.

Managers across the organisation are responsible for:

• ensuring that controls operate effectively and as intended within their areas of responsibility.
• assessing the types of risk involved in the operations for which they are responsible.
• regularly reviewing and testing the control systems for which they are responsible.
• ensuring that controls are being complied with and their systems continue to operate effectively.
• implementing new controls to reduce the risk of similar fraud occurring where frauds have taken place.
• contacting their Director and the Fraud Response Co-ordinator when suspicions of fraud are brought to their notice (managers should undertake some preliminary work to establish relevant facts).

All Members of staff are responsible for:

• acting with propriety in the use of official resources and the handling and use of public funds whether they are involved with cash or payments systems, receipts or dealing with suppliers
• conducting themselves in accordance with VisitScotland’s Employee Handbook and the values of the organisation.
• observing all current guidance contained within both the HR and Corporate Services Policies and Procedures sections on the Hub intranet, in particular those relating to buying goods and services, travel expenses and the IT Acceptable Use Policy.
• being alert to the possibility that unusual events or transactions could be indicators of fraud.
• reporting details immediately through the appropriate channel if they suspect that a fraud has been committed or see any suspicious acts or events.
• co-operating fully with whoever is conducting internal checks or reviews or fraud investigations.

8. Notification and reporting

Any instance of suspected fraud should be reported to the Fraud Response Co-ordinator immediately.

Details of losses due to fraud or theft must be submitted to the Head of Finance for recording correctly as a loss or write-off in the financial statements.

For any instance of fraud, an incident report will be prepared and submitted to the ARC for reporting to the Board and the Accountable Officer.

The Head of Finance provides an annual report to the Audit & Risk Committee, Board Scottish Government, Accountable Officer and external auditors detailing all instances of fraud detected during the year.