Schneier on Security
A blog covering security and security technology.
« Halloween and the Irrational Fear of Stranger Danger |
| Dan Geer on "Cybersecurity and National Policy" »
November 1, 2010
I had never heard the term "control fraud" before:
Control fraud theory was developed in the savings and loan debacle. It explained that the person controlling the S&L (typically the CEO) posed a unique risk because he could use it as a weapon.
The theory synthesized criminology (Wheeler and Rothman 1982), economics (Akerlof 1970), accounting, law, finance, and political science. It explained how a CEO optimized "his" S&L as a weapon to loot creditors and shareholders. The weapon of choice was accounting fraud. The company is the perpetrator and a victim. Control frauds are optimal looters because the CEO has four unique advantages. He uses his ability to hire and fire to suborn internal and external controls and make them allies. Control frauds consistently get "clean" opinions for financial statements that show record profitability when the company is insolvent and unprofitable. CEOs choose top-tier auditors. Their reputation helps deceive creditors and shareholders.
Only the CEO can optimize the company for fraud.
This is an interesting paper about control fraud. It's by William K. Black, the Executive Director of the Institute for Fraud Prevention. "Individual 'control frauds' cause greater losses than all other forms of property crime combined. They are financial super-predators." Black is talking about control fraud by both heads of corporations and heads of state, so that's almost certainly a true statement. His main point, though, is that our legal systems don't do enough to discourage control fraud.
White-collar criminology has a set of empirical findings and theories that are useful to understanding when markets will act perversely. This paper addresses three, interrelated theories economists should know about. "Control fraud" theory explains why the most damaging forms of fraud are situations in which those that control the company or the nation use it as a fraud vehicle. The CEO, or the head of state, poses the greatest fraud risk. A single large control fraud can cause greater financial losses than all other forms of property crime combined they are the "super-predators" of the financial world. Control frauds can also occur in waves that can cause systemic economic injury and discredit other institutions essential to good government and society. Control frauds are commonly able to defeat for several years market mechanisms that neo-classical economists predict will prevent such frauds.
"Systems capacity" theory examines why under deterrence is so common. It shows that, particularly with respect to elite crimes, anti-fraud resources and willpower are commonly so limited that "crime pays." When systems capacity limitations are severe a "criminogenic environment" arises and crime increases. When a criminogenic environment for control fraud occurs it can produce a wave of control fraud.
"Neutralization" theory explores how criminals neutralize moral and social barriers that reduce crime by constraining our decision-making to honest enterprises. The easier individuals are able to neutralize such social restraints, the greater the incidence of crime.
White-collar criminology findings falsify several neo-classical economic theories. This paper discusses the predictive failures of the efficient markets hypothesis, the efficient contracts hypothesis and the law & economics theory of corporate law. The paper argues that neo-classical economists' reliance on these flawed models leads them to recommend policies that optimize a criminogenic environment for control fraud. Fortunately, these policies are not routinely adopted in full. When they are, they produce recurrent crises because they eviscerate the institutions and mores vital to make markets and governments more efficient in preventing waves of control fraud. Criminological theories have demonstrated superior predictive and explanatory behavior with regard to perverse economic behavior. This paper discusses two realms of perverse behavior the role of waves of control fraud in producing economic crises and the role that endemic control fraud plays in producing economic stagnation.
EDITED TO ADD (11/11): Related paper on the effects of executive compensation on the abuse of controls.
Posted on November 1, 2010 at 6:02 AM
• 46 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Always good to read someone dealing carefully and systematically with "what everyone knows".
The apropos quotation is, "The best way to rob a bank is to own one."
Nothing new under the sun...
I should add one PS though - It's not just the CEO that can pull it off. See Enron, where (according to some) the CEO, Ken Lay, was basically innocent of all the shenanigans going on.
We have a classic example at the moment in the UK.
Official government debt is 1,050 billion GDP.
However this excludes some very large figures for other liabilities. They come to another 6,000 billion and are mainly pension related costs.
In this case, the government has taken money from people and promised pensions in return. Now, they have spent the cash. This for a private organisation would show up in the accounts. The payments in would create a liability, and if the money is spent, then there would be no assets and people would notice.
However, the trick in the UK is to define the money given for future payments as income. That must mean in the twisted logic that the pensions paid out are also spending. Then this is all legal because there is a convention that a prior government's spending promises are not legally binding, there is no need to account for the liabilities.
We also have other examples of control fraud. Members of parliament signed expenses forms saying their expenses were 'wholly and necessary' for their work as MPs. However, when the details were leaked, 52% had to pay back money. ie. They had committed fraud. However, they looked after themselves, and only threw the odd MPs who did something weird to the wolves and prosecuted them.
The situation in the Lords is even worse. There they have just gone for lords, of which most were black or asian. ie. A racist approach.
The others get away with it.
I am involved in safety regulation, and have been exploring the links between it and financial regulation; there are many interesting parallels. One could ask if BP were perpetrating control fraud in the safety sense, from what is in
Fraud & Theft are as old as mankind-- there's no need to use new pretentious terms like "Control Fraud" (or 'criminogenic environment').
Anyone with legitimate power in a human organization can use that power for good/bad ends. Very Obviously, higher/highest persons in the organization are more powerful and have more opportunity for malice.
Restraints on bad behavior come from the rest of the organization and from societal norms; but the effectiveness of those longstanding restraints depends on the awareness, discipline, and action of those 'others'.... whether corporate employees, owners, or citizens.
Power corrupts, especially in large organizations-- and especially in sovereign organizations like governments.
There are plenty of basic American laws on the books to handle fraud & theft in private businesses, but the problem in recent decades is the deluge of incomprehensible government laws, regulations, accounting rules, policies, and arbitrary enforcement. This maze of new rules has given corporate CEO's & top insiders ample maneuvering room & cover to loot & swindle.... nobody can easily determine anymore what is legal and/or honest.
Many CEO's/insiders of nominally reputable & productive U.S. corporations are indeed 'looting' their companies for personal gain and amusement... to them it's all a very rewarding 'game'; they don't see themselves as crooks, but rather skilled game-players who have learned the real rules of corporate activity and the American regulatory/legal system-- and prospered at others' expense. It didn't used to be that way in American business... there's been a major generational shift. Government leaders are even worse, much more powerful, and are the fundamental cause of the entire problem.
I'm unimpressed with author W.K. Black's cited work here. And the oddball stuff about "White-collar criminology findings falsify several neo-classical economic theories" .... is total nonsense !
""Individual 'control frauds' cause greater losses than all other forms of property crime combined."
I call B.S.
Take Bernie Madoff out of the mix and this is almost certainly a crock of doo doo. Might even still be baloney with him in it, if you express the losses in $/year of ongoing criminal activity.
As to falsifying neoclassical economics, that's a pretty low bar, if by "falsify" you mean the social science equivalent of noting that a system is not, in fact, frictionless (or that cows, truth be told, are neither spherical, of uniform density, or massless).
@: "control fraud by both heads of corporations and heads of state"
A lot of it depends on culture (corporate and societal). Those held to less scrutiny are more likely to succeed, which definitely includes CEOs, who can often get away with almost anything for a period of time because people are afraid to challenge them.
Insofar as heads of state go, that depends on the country... obviously, with power comes risk, but in some nations heads of state are held to constant scrutiny which is what I believe the constitutional freedom of the press is largely (though not exclusively) about. In countries where someone can be put to death for criticizing a leader, then I would imagine it is much worse.
Adam Smith understood this better, although he's widely misinterpreted by modern economists.
Wealth of Nations II.2.94 (in this instance discussing regulation of bankers' promissory notes):
"Such regulations may, no doubt, be considered as in some respects a violation of natural liberty. But those exertions of the natural liberty of a few individuals, which might endanger the security of the whole society, are, and ought to be, restrained by the laws of all governments, of the most free as well as of the most despotical."
I believe this issue in differentiating "control fraud" is that extensive mechanisms have been put in place to prevent "ordinary fraud," and control fraud involves first subborning those who control those mechanisms. Relating to:
Bernie Madoff was simply ordinary fraud, because for what he was doing there were not institutional internal watchdogs in place that needed to be corrupted. It's the legally required internal watchdog processes and institutions that help to differentiate control fraud.
> Always good to read someone dealing carefully
> and systematically with "what everyone knows".
I recently became involved in issues related to homeowners associations (H.O.A.). This seems to describe well the problems with H.O.A.s, which have the power of small governments (eg, to fine), but are shielded as corporations.
In theory, H.O.A.s are supposed to be neighborhood scale democracies. But "private local governments organized under nonprofit corporation law works against a good governance culture based on limits on the use of power and transparency and accountability" [Fred Pilot, 10/23/10].
When the corporate Board of Directors, in co-operation with the professional property managers and law firms, and under the umbrella of the Community Association Institute, have the power to keep financial records secret from the homeowners, count election ballots without 3rd party oversight, etc., fraud, corruption, embezzlement, petty tyranny, etc. become the norm. Given the profit motive, it can't be any other way.
As Evan McKenzie, a former H.O.A. lawyer himself, put it:
It's like something you would see in Nazi Germany or Soviet Russia. People think these things don't go on. But we know they go on every day in condo and homeowners associations. These people who have no idea how to use power at all. They won't even accept limits on their power. They don't even know what the law requires of them, these directors. They go by what some lawyer tells them to do, which the lawyer tells them to do only because he or she knows they can get away with it. Because the only recourse you have is some civil suit. Here in Illinois, we don't have an Ombudsman. Most states don't. There's nowhere for owners to turn. If the lawyer tells them "Oh, just jack 'em around. Who cares what the rules are? Who cares what the law says? It doesn't make any difference." The transaction costs of enforcing an owners rights are so great that they are hardly ever able to do it."
The SEC was laying down on the job. They were cowed, seemingly, by Madoff's status as a big fish.
it seems to me somewhat naive to think that *only* the ceo of a corporation can optimise the company for control fraud purposes.
not only does this gloss over the diversity of corporate governance structures, it constrains the idea to a single class of persons from amongst a range of those who may be in a position - or able to engineer themselves into a position - to use their authority and knowledge to construct a fraud of this nature.
a ceo may be in 'the best' position (perhaps for many typical american companies) but to refuse to contemplate other actors orchestrating something like this is to be wilfully blind. o.o
frankly, this looks like a new wrapper for an old problem: lack of accountability and inadequate oversight leads to a sense of invulnerability and superiority. being 'above' all that. it's not a lot different to the schoolyard bully.
deregulation without effective accountability machinery leads to an array of experiments in what one can get away with. worse, it leads to people thinking they are not accountable and can try anything.
and if you control all the mechanisms that are supposed to constrain you - say, by them being subordinate to you in a command and control culture (or by political machinations to dominate the people at the controls) ...
it occurs to me that the problem highlighted here is not only not new, but it's one that is well understood. and is one of the very basic reasons why societies have laws and police and so on: some people see everything as being about what *they* want - and when 'success' is rewarded with more, and everyone else is getting some, who wants to be the guy who's missing out?
The problem may not be new, as many commenters have remarked. However, the recent surge of neo-con theories has done everything to define and theoretice away the very concept of CEO fraud. The whole of Economic Theory was redrawn to argue it did not happen.
With this in hand, oversight was deregularized, or simply removed. With the horrible consequences of the past few years.
So I think it is very good to make the point with specificy: Powerful (C)EO's can take over and loot a company when they can control oversight.
Just as, with enough power, a politician can take over and loot a state. Eg, Poetin and Mugabe.
With this in hand, oversight was deregularized, or simply removed. With the horrible consequences of the past few years.
This brings to mind the question that to what degree is the current economic crisis caused by peoples dishonesty rather than e.g. "normal cyclic fluctuations present in a capitalistic system".
That *is* a very interesting paper. I think the author is a little too pessimistic about the closedness of economics to the more social sciences; "behavioral economics" (the study of how people do not make economic decisions rationally) has been a well-recognized part of the field for some years.
For anyone using the paper as their main guide to how corporate fraud occurs, I think it omits one very important point on how favorable laws are written: by the industry providing biased expertise to government, through lobbyists, through advisers, or through industry veterans who cross over to sit on regulatory boards. (The technical term is "deep capture".) This is a much more corrupting influence, and much harder to root out, than simple campaign contributions.
You say "dishonesty", economists say "information asymmetry". But it does seem to be the focus of a lot of attention right now, and the evolving answer appears to be that it is a large part of the explanation.
Whenever any person or group of people has the authority to use the resources of another person or group of people; fraud is possible. Neither regulation nor procedural controls nor jiggery-pokery will change this possibility. The only solution is vigilance on the part of those delegating the use of their rescources.
If a person makes an investment without knowing what they are putting their resources into; they have no-one else to blame but themselves when their investment turns bad. Loss is the natural penalty for ignorance and error.
In olden days we called this "corruption".
Agree with some of the other comments that the author has a very naive and incomplete understanding of modern economics. Actually, not even that modern because the theory of the firm and intensive study of the principle-agent problem predate WWII.
The author claims (or maybe just hand-wavingly implies) that neoclassical economics predicts that managers cannot fool creditors and shareholders. It would be more accurate to say that how the market deals with these problems isn't covered in a standard first semester microeconomics class.
Control fraud is always tempting. As noted above about "the best way to rob a bank," or anything else for that matter.
Given the current system of Government by Regulatory Capture (including both houses of congress and the White House, in addition to the regulatory agencies themselves), the temptation to commit such fraud ("My buddies in [list] will bail me out." must be enormous.
Madoff is just the example who got caught.
> The SEC was laying down on the job. They were cowed,
> seemingly, by Madoff's status as a big fish.
No argument at all with this. But this is still ordinary fraud, as there is no direct line of employment between Madoff and the SEC. Had the law required Madoff to have an internal auditing staff tasked to keep his books on the up-and-up, and had he hand-picked the staff to make sure that auditing wasn't correctly done, then it would have been control fraud. But Madoff didn't occupy the type of position where an internal audit staff was required.
None of that excuses the SEC for as you say, laying down on the job. In this case the responsibility was external to Madoff, not internal.
"As to falsifying neoclassical economics, that's a pretty low bar"
Exactly what one would expect from a discipline that uses an erroneous reading of the major work of classical economics to legitimize it's flight of fancy.
Control fraud need not come from the CEO (at least initially) as long as it comes from some person or group in a position to obligate a company beyond its position to repay. Hence both the organized-crime "bustout" or the LBO.
Closely related is corporate looting (see http://www.scribd.com/doc/13579076/... for the classic description) where fraud in the narrow sense need not be involved -- executives whose compensation is based on throughput, regardless of whether deals later turn sour, have an positive incentive to destroy their employers. What's interesting about the analysis in that paper is that it shows how an ecosystem of mutually-supporting designed-to-fail enterprises could arise. The mapping to the current set of financial-industry malefactors is clear.
Economist George Akerlof won the Nobel prize for revealing the role of information asymmetry in his famous paper "The Market for Lemons". It's not surprising he later wrote another paper, "Looting: The Economic Underworld of Bankruptcy for Profit", describing precisely this behavior.
There is an entire discipline of economics and management, taught in our business schools, and called "agency theory". In theory, CEOs and other agents for a corporation's true owners (the shareholders) could be dissuaded from embezzlement by aligning their incentives with the owners' using devices like stock options.
Of course, in the real world the said agents quickly figured out how to game the incentives and extract even more. No wonder why no one with half a brain discounts most of what economists have to say.
I think the key to "Control Fraud" is that there *are* no checks or balances since all of the mechanisms intended to keep the organization "honest" are under the control of the person managing he process of looting.
Do not discount the damage a crooked board of directors can do.
And, of course, we have the driving force of "institutional investors" looking to loot companies via analysts driving high dividends that actually eviscerate a company.
If there was a better way to drive an adversarial system to manage such checks-and-balances it would be helpful, but, as we've seen, the basic check and balance mechanisms in our national infrastructure have gotten pretty corroded over the years, all through "good intentions".
The hell of this is that the direct effects aren't that great a problem, it is the INDIRECT effects, like trust, that is one of the more dangerous assets being looted.
The Ponzi schemes in former eastern Europe, eg, Albania, qualify as control fraud. The perpetrators enlisted powerful politicians as protection.
Actually, US banks did the same.
This reminds me of one of my forensics investigations long ago. An executive within the finance dept suspected control fraud. I was hired to investigate internal audit. The investigation grew when I found the proverbial smoking gun. I then investigated the controller's office. We had the data but, much to my surprise, the certainty of evidence and guilt led to...resignation of the officer who had engaged me. He said the fight with the executives, even with clear proof, could not be won and he would not participate in fraud. External regulators eventually came in and put their foot down.
On p.4 of the Black paper we read:"Accounting fraud is the looter’s “weapon of choice.” The CEO uses it to overstate the company’s profits and net worth in order to convert company assets to his personal use through seemingly normal and legitimate corporate mechanisms (e.g., salary, bonuses and stock options).""
In the RE foreclosure crisis we now see this scheme in full action: Banks and other noteholders refuse to take a cramdown or short sale of an underwater property and rather foreclose, because as long as they have it on their balance sheet at its unrealistic earlier value, their balance sheet looks better, and it's Bonus Time for the senior bank management!
(The bank refusing a 200k$ short sale on a 206k$ debt in Arizona comes to mind.) No matter, that the foreclosed property cannot easily be sold without a much bigger loss, will deteriorate if not occupied, will cost property taxes...
But the bonus is paid out now, before the folly of this behavior becomes apparent to shareholders. And shareholders are anyway powerless (your pension fund or 401(k) may be a major shareholder, but do they do something about this?).
Americans save little, and what they save is in three forms: pensions, equity in houses, Social Security: Pensions/401ks are already looted - check!
Housing equity - gone underwater - check!
Now they are going for Social Security, next!
(So if you can, don't vote for people who tell you that they have to cut Social Security [so as to finance tax cuts for the rich, paid for from SS and payroll taxed on the first
Oddly, I was just studying sub-optimal Nash Equilibria in multi-agent systems this afternoon. I sense a cross-over paper...
Now to recode "criminogenic" in terms of game theoretic payout matrices, and we're off in a shot.
@ Kevin Peterson,
"Actually, no even that modern because the theory of the firm and intensive study of the principle-agent problem predate WWII"
Arguably it is much older than that...
Think about why "double entry book keeping" etc and other such systems where invented.
Basicaly the "owner(s)" of the businesses assumed (usually quite rightly) that the staff where commiting theft/fraud to augment the either meger or non existant wages (as was previously accepted custom and practice).
For instance in the UK Wren and his precedors who were apointed as "works managers" on a Royal or other commission where expected to take money out of the fund alloted for doing the job. It is where the expression "on commision" came from.
For hundreds of years this was the way of it people paid for the finished work not for the labour. It was the craftsman etc's responsability to provide any labour out of the price. And it was apprentices or indentured persons who often provided such labour in return for their keep.
It was only with greater demands for mobile workforces that being paid for the time you spent labouring brought forth the wage system.
And it was the process of getting rid of the notion of "on commission" as well as waged or salaried that raised the need for such controls.
While reading the paper it occurred to me that many of the control fraud types that lead to crises were beneficially to the US economics. This also makes it quite logical that Greenspan was both involved in whitewashing the S&L crisis and stimulating the sub-prime crisis.
At least since the 1980s, the US has a severe trade deficit. Americans consume using money borrowed from abroad.
Normally, this would mean that the exchange rate of the dollar would tank and interests would rise sky high to get people to lend to the USA. However, this does not happen because everybody needs dollars to buy oil and those who earn the dollars invest them in the USA.
The major task of the FED and financial policy of the USA is then to ensure that foreigners keep investing money in the US and that the value of the dollar does not go down to its "real" value (ie, money supply==productive capacity+capital goods).
This means that foreign investors must be made to believe that big profits can be made in the US. Hence, financial policies should support the reporting of inflated earnings and selling inferior products and inflated prizes.
This is just what the S&L frauds, junk-bonds, the Internet bubble, and the sub-prime mortgage packaging all did: Luring foreign investors with inflated earnings and fraudulent goods. And for the US as a whole, it doesn't matter where that money lands. It will be spend in the USA.
Somehow, I do not find it strange that all those neo-liberal economists that denied the existence of control fraud ended in those powerful positions.
All power tends to corrupt and absolute power corrupts absolutely.
I recognize three levels of corruption. First you have petty corruption, the official asking a (relatively) small fee to get things done you are already entitled to. Quite visible and rampant in many developing countries, where it augments the meager salaries of public officials -- less prevalent in most western economies; the second level are the more complex kick-back and rake-off schemes involving large government investments; these are often raised to a destructive level in developing countries, but also quite present in the west, and at the third level, you have buying policy influence, such to have laws made such that it benefits certain private interest rather than the public good. The first two are normally illegal, the later often is not, but the potential damages are the biggest. A good example of this was the CETA (Copyright Extension Act), an extension that was basically bought by Disney, for about one million dollar in donations to various re-election funds, and gave them a return of about a billion in continued royalty income, and probably cost the public a hundredfold of that latter amount in increased royalty cost and inability to use works scheduled to be in the public domain -- without the public getting anything in return.
Similar political maneuvering can lead to inadequate environmental laws (for example BP disaster); excessive libel protection (for example shielding the Kaupthing bank in Iceland from journalists releasing damning information, and thus making the collapse of the banking system in Iceland much bigger than needed). The list can continue endlessly...
Perhaps this is the real reason that boom and bust cycles in the economy.
The apparent growth in the economy is really an illusion- the real economy grows at 2% per annum, with little variation.
But we seem regular boom/busts that coincide with major frauds. For example the internet bubble, and the recent bank lending bubble, and all the other bubbles.
Probably they're the economic indicators that point to somebody engaging in major control fraud; it's not real growth at all.
One of the interesting things about the "Looting" paper is that it shows how a fairly small (!) amount of control fraud could lead to major misallocations of capital by legitimate operators. E.g. inflated real-estate prices paid by "developers" who never intended to carry projects through raising general expectations. Or the appetite of fraudulent S&Ls for high-initial-yield junk bonds, which in turn fueled merger and acquisition mania that left real companies and their stakeholders to overleveraged as well.
The ongoing real-estate mess is a great example of how technology (bundling and securitization) can decentralize this kind of fraud and push the risk away from the people who are actually doing the scam.
The apparent growth in the economy is really an illusion- the real economy grows at 2% per annum, with little variation.
Actually it would surprise me if there is much of any real growth long term. Yes short term it is possible, for reasons such as:
1. some new technology/service/etc on the market, and/or
2. ...because e.g. the US government changes their way of doing statistics, and/or
3. ...expresses the results in numbers that get "re-adjusted" (some months afterwards, when investors have already done their investing)
But in longer term, the problem is that the earth is a limited sphere and that the society in many countries is already full of DVD-players, refrigerators, etc. In emerging markets this aspect is a different story.
@ab sure, it's a limited sphere, but we're still getting better at (ab?)using it, and so the average productivity of humans is still going up, hence economic growth.
On the other hand, you could make a pretty good argument that in some/many cases the misallocation of resources due to bubbles acts as a serious impediment to the economic growth that would otherwise occur. You're diverting capital and labor not merely to lower-return uses but in many cases to what are ultimately negative-return uses.
(For example, the real estate bubble not only meant that a lot of things that weren't shoddy houses in unsustainable areas didn't get built, it effectively trapped many people in places where their non-housing operating expenses are much higher than before.)
@paul Yes, of course. In general, an illusion of rapid growth in one area will tend to suck money and effort out of other areas which will appear to be growing more slowly, but in actual fact will be growing more quickly- or *would* be if they could get the funds.
Paper introduces a lot of new terms that might be useful, but it seems like it's saying something pretty simple. Our system is pretty good and catching when individuals defraud each other one-on-one, but not when corporations defraud investors, etc. in subtle ways. Corporations can be cleverer and have more resources.
We *think* we know how to police them with audits, etc. but those systems are surprisingly weak for a large, modern company if top executives are on the wrong side.
They're doubly weak when the boss can start with the reputation of a company that also does or used to do productive work honestly.
So, it's not that you & others have not heard of this. You have, and have even probably read language that mentioned it. The context was different though. The Sarbanes-Oxley regulations are in part designed to combat various modes of control fraud. When these were being discussed, and with various IT examples used for the bit pushers control fraud comes up somewhat frequently, but it's not always a directly used term.
@Jon: "I should add one PS though - It's not just the CEO that can pull it off. See Enron, where (according to some) the CEO, Ken Lay, was basically innocent of all the shenanigans going on."
Really? The same Ken Lay who was convicted of 10 separate charges, but died before sentencing, was innocent? News to me, the press, the judicial system...
Corporate and a governmental head - then Vice President Chaney managed to push a clause through congress that provided a loophole for Haliburton. They do not have to meet clean water regulations for shale fracturing; a profitable process to release natural gas bound in shale deep underground. But what if the drill bore linings are misinstalled or break or contamination of ground water or aquifers result? They have no legal responsibility under the normal clean water regulations. Theft, fraud, any other misrepresentation it's all just lying.
While the fish may indeed rot from the the head down and the Ken Lays of the world will continue to be held accountable and therefore subject to prosecution, I would submit that the right or left hand of the CEO could be just as much a risk (or greater) if the CEO is an "absentee" landlord.
A CFO might be able to pull off the control fraud just as easily and keep his "boss" in the dark.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.