Rising risk and financial crime impacting Real Estate and Construction

Katherine Shamai
Hi, I'm Katherine Shamai. We're here today to talk about fraud and corruption risks in the Real Estate and Construction Sector. With me today I have Chris Watson, who is a Partner in our Risk Consulting practice up in Brisbane, specialising in cyber incidents response, cybersecurity, and investigations. And Neil Jeans, who has deep domain expertise in money laundering and counterterrorism financing.

Especially with a lot of major infrastructure projects around Victoria, but also in Queensland with the Olympic games coming up, there are more opportunities and more risk facing that sector when it comes to big spend, big projects, and really short time frames. Here to talk about all those things, but also what's, I guess, the traditional fraud and corruption risk, but also what some of the emerging ones are, as well as what's happening in the anti-money laundering space as well.

So, with some of the traditional real estate and construction risks, it centres around procurement and conflict of interests and declaration. Chris, in your view, do you think that's changed over the last few years?

Chris Watson
I don't think it's changed. I don't think it's something new within the real estate construction industry. But I think, as you mentioned in the introduction with the large infrastructure spends, and I think there are some added pressures, particularly since COVID around supply chain logistics. There's a number of reports out there which talk about a lack of plant being available, and there was just a report the other day, but again, they're talking about the lack of people, human capital to build this stuff. So, I think with those pressures, along with deadlines, particularly in building stadiums, roads or whatever, that inevitably provides more opportunity for procurement frauds, or other types of frauds to occur in order to just get things done in the quickest, simplest way, for sure.

Katherine Shamai
And we've seen and heard reports of duplication of payments of workers, for example, across multiple sites, but timesheets completed for the same night, for example, some very simple, small examples of fraud and corruption. where in a less pressured environment, you would take the time to review those things, cross check, use your data in a smart way to identify any duplications.

Chris Watson
Unlike say, financial services who typically, traditionally are really good at using technology to gather, understand and analyse the data for patterns and to highlight things like duplicate payments or duplicate entries or ghost employees, that kind of stuff. The real estate and construction industry has that data and has obviously the accessibility to that technology but isn't using it. I don't think that situation has changed much, and I think it's probably one of the more frustrating things because in using or better use of the technology at hand, construction organisations could be so much better at that whole monitoring and detection side of things, for sure.

Katherine Shamai
Absolutely. And a lot of projects that we look at from a forensic perspective, they often have very manual, record keeping systems, if indeed they have record keepings. But another thing that I guess comes into play when you have multiple projects is the funding of projects and who's funding those projects? And Neil, I think you have some insight into some of those issues.

Neil Jeans
Capital is far more, should we say, internationally mobile now these days than it was previously. There are multiple and varied funding sources. Criminal elements undoubtedly use some of those funding sources in order to basically launder their proceeds of criminal activity. So, whilst the risks, I think, as you say, are the same, I think there are additional risks that are being added on. I don't think the existing risks have got any smaller. I think we've got a wider suite of risks that the real estate professional and the construction professional needs to understand and think about. So, it's not really only, okay, how am I going to get the funding? It's where's that funding coming from? Is that going to create a problem? Am I going to be exposed to proceeds of crime, potentially, if I take that funding? So, there's a lot of things to consider now which to a certain degree, weren't on the agenda two or three years ago.

Chris Watson
Interested in hearing what you're seeing, Katherine? But certainly, with investigations that I’ve seen, there's still all the traditional stuff of whether it be theft of equipment and plant. I mean, the other classic being that equipment from the site being used for private projects and sort of, you know, doing all that sort of mate’s rates outside of the organisation, but then also putting down the time to the job.

Katherine Shamai
With the heightened awareness around conflicts of interest, particularly in the public sector where a lot of this activity is occurring. That's really important for builders, constructors, but also for public sector to be aware of. And a lot of the better project managers, for example, come from construction. So, you do have those close ties. How do you manage those relationships? How do you declare them, be transparent and make sure that even from a perception perspective, there is no conflict of interest or favouritism?

Neil Jeans 
And that's really a culture of compliance. I think that's maybe one of the key issues we should discuss, which is the industry set up for a culture of compliance? You build a hospital, you get a garage. 20 years ago, that was probably acceptable. Is it acceptable today, in the environment where there's probably more concern around impacts and getting value for money and getting value for taxpayer’s money particularly? Do we think that there's a cultural deficit in this space? i.e., around corruption, fraud? Is there just a low level acceptance or acceptance of a low level of activity?

Katherine Shamai
I think from my perspective, culture is a really important piece, but the financial pressures will be the thing that's building, that's going to break that culture. So, the more financial pressure individuals and construction companies are under with the level of bankruptcy, et cetera, going on, that's going to place a financial pressure to incentivise them to do some of this activity. To secure a contract, to make sure they stay in business. Because what's a garage when you're building a hospital? Multimillion dollar project. So, I think between the two, there has to be a balance somewhere. But, yeah, I'm not quite sure where we sit, and I suspect the closer we get to deadlines, the worse it's going to get.

Chris Watson
This element of culture allows the environment for fraud or corruption to occur. But I think there's deadline pressures, there may be some political pressures in getting things built. You've only got to think about sort of the cost blouse on every major project, but the people on the ground are having to deliver this on already razor thin margins. It's human nature to sort of think, I'll cut that corner, or I won’t report that aspect. And I think so often you get that coming around, oh well, I saw XYZ do that, so I did this.

Neil Jeans
It must be right. It must be okay.

Chris Watson
Yeah. I still find that culture quite prevalent within the construction industry.

Katherine Shamai
Which then you increase the risk of cheaper substitution of quality of products and cutting corners when it comes to occupational health and safety, for example. So, it has some bigger ramifications.

Neil Jeans
So how do construction companies and property developers sort of face into this? We've talked about culture, we've talked about risks, we've talked about acceptable levels, potentially acceptable levels of fraud and corruption on a project. How do property developers and construction companies, how should they start to think about this, and what should they start to do to try and mitigate those risks?

Chris Watson
Well, I'll come back to, I think one of the things is the technology is there. It's not especially expensive these days, right. And actually, in house there's already quite a lot of expertise, but understanding what data you capture, what data you hold, and what kind of questions you want to answer, whether it be around the duplicate or substitution. I always remember, it may be a bit apocryphal, but another organisation was doing an investigation, and they kind of ratting the numbers up around cubes of concrete that were being bought. Not like cubes, but like cubic measurements. And it all kind of added up. Yeah okay, ten cubes at $1,000, that made sense. But it wasn't until simply, but it doesn't cost $1,000 to buy a cube concrete but being able to sort of gather that data and then to ask the question of it, it would have gone unnoticed.

Neil Jeans
And, yeah, certainly in my space, those type of things, the data is sitting there and it's staring you in the face. And if you're not using it, you look at the Australian Wheat Board issue around paying well and truly over the odds for wheat into Iraq, which was basically a guise for corruption. So again, what we're saying is that the information's there. You've just got to look.

Chris Watson
Katherine, what are your views on enforcing some of that cultural stuff?

Katherine Shamai
Yeah, I think Boards have a big role to play when it comes to setting the tone. It's not profit at all costs, and the focus will drive what management does a lot. And I think the Directors themselves have to understand what does integrity look like for their organisation? And understand what their fraud and corruption risks are. A lot of organisations do risk management or project risk management, but not necessarily taking a focus on fraud and corruption. So, understanding that is going to be key to making sure that they're directing the organisation in the right way and making sure that they're getting information that they need. For example, having a whistleblower hotline, preferably independently staffed so that people get confidence that it's going to be confidential and taken seriously, but also then reporting what are the outcomes of some of those without breaching confidentiality. So, are we getting phone calls? Are people educated? Is it effective? That drives that compliance culture, but also that ethical culture and that behaving with integrity is expected and encouraged, and that there are no reprisals for raising issues? That's a really key thing.

Chris Watson 
One sort of more recent investigations, and I think these fits into some of that top culture stuff. And I was chatting away to the CFO and they said, oh look, this person has, it's not really fraud, but basically they put some expenses down that weren't for the job. No, that's fraud. What you've just described is fraud. If somebody puts an expense down that isn't for a legitimate business purpose, but this kind of like almost like an acceptance or lack of understanding maybe around what fraud really is.

Katherine Shamai
Or maybe denial. Because we want to trust our workmates. We want to trust our team to be doing the right thing, so maybe it's an accident. But how many accidents before it becomes fraud is the question, where's the line in the sand?

Neil Jeans 
And look, I think it's a truism, which I'd be interested in your comments on, which is that when most of these things blow up, when the big things blow up, there's usually somebody or at least one or two people go, yeah, I knew about that, but they didn't act. And I think it's that question about actually acting. And it comes back to the culture, having a culture and environment where you are comfortable to raise things without fear of reprisal and without fear of retribution.

Katherine Shamai
Per the Association of Certified Fraud Examiners report, whistleblowing tip offs is the highest way or the best way to pick up an issue. It's not done through internal audit or external audit, whistleblowers. Because we all see things and it's who speaks up that makes a big difference.

Chris Watson
The IOC have mandated that all Olympics should be carbon positive. There should be a circular economy. With that in mind, what do you think some of the challenges or some of the ramifications of that are for the real estate and construction industry?

Katherine Shamai
I think compliance is going to be tricky. So, finding enough suppliers, finding enough supply chain to fulfill that obligation. We did a review here in Victoria around local jobs first and looking at a lot of major projects across Victoria and how they've committed to local spend. So, spend with Australian or New Zealand suppliers, the commitment's there but the delivery might be a different issue. We talked earlier about supply chain issues when you have short supply chain and the project to deliver, yes, whilst you might know circular economy, local suppliers, it's just not realistic. So how do we hold organisations accountable to plan far enough in advance to have those supply chains in place and actually make sure they perform that commitment. Carry that out?

Neil Jeans
And I think, again, it's another truism of the financial crime world. Certainly, from a money laundering perspective. Where there's a high level of activity in a focused area, it's a lot easier for the bad guys to actually hide money in plain sight. It's a lot easier to undertake your nefarious activity where there's a larger pie, because as you say, there's less scrutiny or less ability to scrutiny because of the level of activity that's going on. So, whilst we're talking about potentially risks of construction industry, of the construction industry, where do I get my suppliers from? Have I got enough of them? There's also the risk of, is that money that's coming into fund, where's that money coming from and what's the returns they're getting and where's those returns going to? Because effectively, money laundering is a sophisticated industry, and it looks for opportunities and it's looking to store value in industries and in real assets. And obviously, with a potential boom of assets in Brisbane, undoubtedly, that will be attractive from a money laundering perspective.

Chris Watson 
And picking up on both points, I think one of the real challenges is that nobody really understands what carbon positive means or what circular economy means, right. So, putting my cynical hat on, it's really easy for me to go to XYZ and say hey, I’m completely green, I’m carbon positive, buy from me. But there's the whole know your customer thing, know who you're dealing with, how do organisations know? How do they even get to grips with well, what's the process for doing that? Because there's an AML, there's a very clear AML sort of way of doing.

Neil Jeans
But it comes back to diligence, due diligence. It's know your customer, know your counterparty, understand what they're doing with them. they assume that everybody's playing to the same code as them, or playing to the same standards as them, and that's not the case. So, I think it's really a case of thinking carefully about it, making sure you do the level of due diligence. And I appreciate that's hard because you've got time pressures, you're in a competitive environment as well, and the bad guys are very good at creating that competitive environment for themselves. So therefore, with an encouragement to you to not take the level of diligence or undertake the level of due diligence that you really should.

Chris Watson
And does that tie into your comment around it can't be profit at any cost? There's got to be a little bit more due diligence or governance to the process when engaging with people.

Katherine Shamai
Yeah, absolutely. And I think having a robust supplier vetting framework is really important, and it links into modern slavery as well. So, a lot of these organisations would need to report for modern slavery purposes, how do you know what's down your supply chain? How do you know what labour hires being used, the type of people, employment conditions? So, understanding your supplier and their supply chain is critical to answering all those questions and saying, do I want to work with them? Do I reputationally want to be tied with such an organisation if something comes out of that?

Neil Jeans
And on the modern slavery front, I mean, the federal government have recognised this with the proposals that are currently going through where they're going to reduce the limits for modern slavery from $100 million turnover to $50 million turnover. That's a clear recognition that there potentially is a problem. So therefore, if you're in that $50 million plus turnover mark, you're now bound by the model slavery requirements, which is again another level of regulation that these organisations are going to have to manage. The problems always occur in hindsight, actually setting up the systems and controls correctly for these projects, having the right project due diligence and doing the additional due diligence that we've talked about today sets the project up for success, but also sets the business up for success.

Katherine Shamai
I think understanding what you're looking for is really important too. What's modern slavery? We don't think we have it in Australia, but we do. What does that look like? Wouldn't somebody know what it looks like if they came across it?

Chris Watson 
Apparently, there are more people, 36 million plus people in slave conditions now, which is more than ever was in history. And that's just astonishing, right? Because you talk about modern slavery and you think about it being some kind of historical context, but it is really concerning and in fact is worse than ever, right? It sounds like something which is archaic. It sounds like something which doesn't affect us here in Australia. I mean, what should organisations be doing to even think about how to address that?

Katherine Shamai 
Understand the supply chain. Understand customer, suppliers. Do a risk assessment of your top suppliers and say, do we know what they do, where they get the materials from, where they get their staff from, what jurisdictions they operate in? And any media, understanding who you're dealing with and very similar to the customer investment sort of concept, it's knowing who your counterparty is and being comfortable with them.

Chris Watson
I think the other thing just on the Olympics to maybe round that part off is to talk about the cyber aspects of fraud, right. The Olympics brings with it a whole heap of global focus and attention. And I think to your point earlier, Neil, around the opportunity that these things provide to money launderers and other criminal organisations, there is no doubt that as a result of this increased visibility, businesses, not only locally in Queensland, but I think right across Australia will become more attractive targets. Certainly, or sort of raise above the parapet things like business email compromise, where emails are sent purporting to be from the CFO to pay this bank account, this amount of money quickly. And it gets done because nobody really sort of questions that. As well as the increase in ransomware attacks and general sort of compromise of the system. So again, I think what I would suggest is that whole notion of understand your environment, do a risk assessment. What is your visibility, what's the likelihood of, what is the risk to your organisation if you succumb to this? And to start addressing those from a cyber perspective as well.

Neil Jeans
And that goes straight to what we've been briefly talking about, which is these projects are going to be on very tight time frames, with high pressure environments. If you then throw a cyberattack into the mix, what's that going to do to the project? So, you need to then, one, do a risk assessment on it, but also then put in place the controls to mitigate these risks because eventually most of these risks are treatable if you take the effort up front. In my perspective, hopefully you share that view, but if you don't, you'll be scrambling to try and manage the project.

Katherine Shamai 
And I've always found it fascinating organisations that do not have a business continuity plan or a disaster recovery plan. What do you do when the lights go out? Do you just sort of sit in the dark and go, someone turn it back on? And another feature, I guess that's more and more common, even in normal household is smart homes. And does that provide another avenue for potential hackers or vulnerabilities?

Chris Watson
Yeah, look and exacerbated through the whole work from home COVID thing, right, where many a CIO or CTO were quite literally sort of pulling the hair out because they'd gone from a nice ring-fenced known perimeter to now, if you've got 1600 employees in the organisation, you've now got potentially 1600 areas of vulnerability, right? So, for sure that the way that we now work with the flexible arrangements and that's got to be factored into any risk assessment.

Neil Jeans 
But in terms of managing the complex construction challenges we have, if I'm in real estate or construction, do I demand that my suppliers, my counterparties, have the same level of control environment? Because eventually they are the vulnerability as well.

Chris Watson 
Really good point. And that third party risk is if you think about all the big compromises that have happened in recent times, they've been really as a result of third-party failures.

Katherine Shamai 
And having that assurance program in place, whether it's something that you asked for from your suppliers around, get your systems reviewed, audited and attested to, that's absolutely something that's worth considering.

Chris Watson
I mean, it's quite a checklist, isn't it for suppliers now, because we're talking about modern slavery, whistleblowing, cyber.

Neil Jeans 
In my view, actually being realistic and pragmatic about the risks that you're facing and doing what you can up front to stop the pain later on, basically. So, whilst a lot of organisations don't necessarily want to think about these things or will push them off to a particular part of the organisation, say you think about those, we’re not wearing those. I think to take Katherine's point, this should be at a board level. They should be interested in making sure that the organisation deals with this because these could be significant challenge for any organisation which could severely create risks for their ongoing sustainability. So, it's all about accepting, unfortunately the world is an interesting and sometimes nasty place and there's lots of people that are undoubtedly trying to take advantage of everybody and making sure that your control environment is appropriately reflected for that.

Katherine Shamai
And I think in this sort of situation, prevention is definitely better than cure. Remediation gets very pricey and very painful.

Neil Jeans
Exactly.

Katherine Shamai
There’s lot of regulatory change like Modern Slavery Act that you just mentioned, Neil. But probably the most impactful one coming down the line fairly quickly is the change in the AML laws. We've seen a lot of headlines about current reporting entities failing to meet their obligations and not doing enough in that space. So, for a new entrant into the regime, it'd be really quite intimidating. What can organisations do to start preparing themselves or start thinking about?

Neil Jeans
That's a good question. I think really at this point in time, we're waiting for legislative certainty. I think in the next two to three months we're hearing that the Attorney General's Department will issue the next consultation in October. That will really set the legislative agenda. But start to think about your business. If you've got sister businesses overseas who are already part of this legislation, start talking to them to understand what the impact was. And certainly, my experience having spent significant time in New Zealand, working with similar organisations, starting now and spending time thinking about things before you have to start doing things. Getting prepared for things is vitally important because that makes things easier. As you go, as we get more certainty. the moment we don't have too much certainty, I think we've probably got it clear around the 80-90 per cent of what's going to happen, how it's going to happen, we’re still negotiating with the Attorney General's department. But really start to think about this, start to look at your supply chain, start to look at your funding mechanism, start to look at who you're dealing with, who are your counterparties, who would be my customer if I was providing particular designated services. So that's really the start to start to think about this, start to get ready, but don't do too much because you don't want to overspend now, because we don't have the level of regulatory certainty that we will probably have in six months’ time.

Chris Watson 
When we talk about real estate coming under the act, people can get kind of a bit of a tunnel vision around what real estate is. Or you sort of think of your high street, is it more than that?

Neil Jeans 
It's basically residential and commercial real estate, right. So, it's not only houses and real estate agents buying and selling houses. It's large-scale investment into commercial property, into shopping centres, into factories, into office blocks, managing those. And my dealings with the real estate sector are primarily in that side of things, where you've got an investment company that's born an office block, that's basically funding an office block, invested in office block, and now pass it to another part of its business to then do the ongoing management of that. All those businesses are going to be captured separately because they're going to be providing different services. So, working out how we sort of minimize the impact of the requirements that are going to be the same across all these different parts of the business is the things you need to start thinking about now. So almost doing a map, understanding where these things are now would be an important thing. But it's very broad extending to leasing. So, within the international standards, leasing is not defined as being something that needs to be regulated. But the Attorney General has made it very clear that they're going to, intending to bring leasing in simply because they see that as part of the money laundering system, where if there's dirty or criminal money that's gone in to invest, particularly in the commercial property space, the rent is coming out is the proceeds of crime. So therefore, understanding that financial flow, understanding where the money is coming from and where the money is going to is going to be increasingly important.

Chris Watson
And notwithstanding 2026 and FATF. And you've mentioned a couple of times around regulatory certainty, but this is happening, right? It's not something that is for discussion, because again, this has been on the books for some time.

Neil Jeans
This has been on the books since 2007, to put it in perspective. The Attorney General is consulting on this. They have made it very, very clear, both publicly and privately that this will happen. The minutiae of the time frame are still being debated. We will get more certainty end of September, early October, when we see the next consultation paper from the Attorney General's Department. And again, I would encourage everybody to read that and also engage with your industry associations as part of that process because that's going to be where the sort of the rubber is going to start hitting the road and the impact on your businesses will start to be understood. What you're then going to get undoubtedly is legislative change in early 2024, regulatory change in mid-2024 with really a financial, next financial year, start of an assisted compliance period. An assisted compliance means you will be captured by the legislation, but you will be given time to be compliant so long as you're working towards compliance which will probably last a year to 18 months. So, if you think about that, for some of the people listening to this with large complex organisation, 18 months to bring about this level of regulatory change, adjust your systems and controls, put in new processes, adapt existing processes, that's no time at all. So that's why I think we start now, start to understand your business, start to understand where potentially this might impact your business and then get ready to start to understand what the legislative and regulatory change is going to be over the next six or seven months.

Katherine Shamai 
So, we've covered a lot of topics today. We talked about, I guess the more traditional fraud around procurement, conflict of interest. We talked about some of the more emerging trends like greenwashing and supply chain issues and we talked about regulatory change around modern slavery and the incoming AML requirements. And I think what strikes me is there's a lot happening in this space. There's a lot of complexity, a lot of moving parts. And I know whilst the three of us think about financial crime all day long, that's not a client's business. They're in the business of building roads and buildings and apartment blocks. I think, I know the three of us are always really happy to have a chat and talk about financial crime and whichever flavour that is. So, it'd be great to have those conversations and unpack this a little bit more. This was very much a taster; I think of the deeper issues.

Neil Jeans 
We have the DNA to help the clients. It really comes back to then every client is different. So, every challenge has a level of similarity but is different. Doing this in a vacuum on your own can be challenging for organisations. We can, I think, help them by bringing that industry insight that we have.

Chris Watson
Not only can we sort of relieve the burden because they want to get on with doing the day job, I think we certainly bring that independence, that sort of external, can't see the wood from the trees sort of that trust by verification aspect that sometimes organisation is a bit too close to. But I think the other really important thing as well is that it provides the organisation, depending on what it is and how it gets reported, but it provides the organisation that this issue is being treated seriously. We've brought the experts in, they've done this investigation, or they have done this review and here are their thoughts.

Katherine Shamai
Absolutely, that reinforcing that tone of culture and transparency and accountability.

Neil Jeans
We can actually provide sustainable solutions.