A recent survey of executives has identified a growing “triple threat” to North American organizations that can be traced back to telework and hybrid arrangements.

KPMG in Canada surveyed more than 600 executives across multiple industries. The results point to organizations facing a “threat loop” of fraud, compliance risk, and cybersecurity threats. 60% of those surveyed said the shift to remote working has increased the risk of fraud within their organizations, because of a reduced ability to monitor and control for fraudulent activity.

67% identified external fraud (credit card fraud, identity theft from outside actors) in the past 12 months, while 17% experienced internal fraud (procurement, misappropriation from within the company) in the same period of time.

During the quick shift to remote work arrangements at the start of the pandemic many companies put processes and technologies in place without fully vetting them (or revisiting them), opening the organization up to new external and internal risks.

In the case of cyberattacks, 61% reported economic loss, 41% cited legal/compliance regulator reviews or investigations, and 21% saw impacts to their company’s reputation. 2021 was a huge year for cyberattacks, and as a result half of respondents expect their cyber risk to increase somewhat, while 35% expect a great increase.

That said, there’s strong confidence in organizations’ ability to combat cyber issues – 88% said they were somewhat or completely satisfied with how long it takes their company to recognize an IT attack.

Compliance issues were cited as the third leg in the triple threat, with 48% reporting a negative impact in compliance with IT security and 23% seeing a drop in the effectiveness of compliance, anti-corruption or anti-fraud training programs since implementing telework arrangements.

As a result, 55% said their business has paid regulatory fines due to compliance violations in the past year, and expect those numbers to increase as they spot more non-compliance issues in the future.

Since remote work will remain in some shape or form for the foreseeable future, mitigation recommendations include:

• Creating an interconnected defense strategy to cyber, fraud and compliance management
• Conducting risk assessments more often – especially if there’s a major change to the organization or event (such as a pandemic), and
• Accounting for a range of exposures (tech, people, processes) when assessing risks.