Risk minimization and loss prevention strategies for small businesses

Risk Minimization and Loss Prevention in Small Business in the Post-9/11 ERA

Chapter 1, Introduction,

Chapter 2, Literature Review,

Chapter 3, Methodology,

Chapter 4, Data Analysis,

Chapter 5, Summary, Recommendations and Conclusions,

Small businesses face the same risks, in many instances, as do major corporations. For instance, both small businesses and major corporations face turnover, competition, fluctuating market demands, a volatile economy, bad business decisions and many other risks associated with entering the market place with a particular product, whether it be goods or services,

However, because of their size, small businesses are particularly vulnerable to certain types of losses and risks -- and also because of their smaller size and stature, the loss in revenue or profits is much more deeply felt in small businesses.

Unfortunately, most risk minimization and loss prevention literature is geared at large corporations. It is a significant problem for small businesses, that they do not have white papers or literature to which to turn to minimize their losses and risks. In fact, they have to seek out expensive consultants often to answer those questions for them, and since they cannot afford those consultants, they continue to suffer from preventable losses.

Purpose of the Study

This study seeks to provide best practices literature for small businesses in loss prevention and risk mitigation. As mentioned in the Statement of the Problem (infra), small businesses simply do not have much literature to guide them through loss prevention, and are the business forces that often are most in need of it.

As a result, this study will focus on some key areas of loss prevention for small businesses, and provide not only the problems -- many of which are entirely ignored by small businesses -- but why they cannot be ignored, and some steps to minimize risk and loss.

Large corporations pay teams of in-house and third party experts to determine how to prevent loss and risk. Small businesses must rely on their management team to foresee all. This study helps them do just that.

Importance of the Study

In the post-9/11 era, business fluctuates at a much more rapid pace than every before. Take the current gas crisis, for instance. Small trucking companies have had to cease several operations and ancillary products because gas is skyrocketing over $3 a gallon: They are facing challenges they have never faced before, unless they were in existence during the late 1970s, and chances are, they were not if they are relatively small.

Therein lies the importance of this study: Small businesses face fluctuations and additional risks and potential losses, and need a best practices guide to take through and allow loss prevention and risk minimization at a lower cost.

Large corporations are much more suited to surviving large supply shocks and business market changes than are small companies; but fortunately, small companies are more flexible and are able to re-orient on a dime. But, first they must survive crises and minimize losses before they can move beyond, and that is the importance of this study.

Scope of the Study

As the small business world is a changing one, this paper will focus on research developed in the past 15 years. It will summarily throw out research commissioned or performed prior to 1990, so as to guarantee the timeliest and most apropos information.

Also, the paper will rely on both statistical and anecdotal evidence in its formulations for risk mitigation and loss prevention for small businesses. Statistical evidence's importance is obvious: Numbers are essential to provide a guide to what exactly are the risks for small businesses and what are successful means of dealing with them.

However, anecdotal evidence is also critical from small business owners and operatives and experts in determining whether the theory actually extends to the practice. If the risks tagged to small businesses are merely academic, mitigating those risks will actually result in no loss prevention for small businesses.

Rationale of Study

This study's rationale is quite simple: A need exists for information, and this study will strive to provide it in the most unbiased, pithy and complete manner possible.

Small businesses must truly benefit from this study if it is to be considered a success -- and the timeliness and importance of the risks listed her and their mitigation strategies without doubt helps to prevent losses for small businesses in the post-9/11 era.

Definition of Terms

Small businesses are defined as any businesses that employ fewer than 150 people. In general, these can be privately held, shareholder driven or partnership driven. However, their maximum capitalization cannot exceed $50 million.

However, the vast majority of case studies included in this study deal with much small examples of small businesses -- 10 person firms, or even neighborhood Mom 'n' Pop stores.

Risk mitigation means the realistic hope that an impending and probable even that will adversely affect the business is being reduced in its probability of occurrence or its magnitude.

Loss prevention refers to successful risk mitigation resulting in a lower loss of revenue and profits for the small business.

Overview of the Study

This study finds that some of the most critical areas for loss prevention for small businesses are:

1) employee fraud

2) earthquakes

3) litigation

4) technology security issues

As a result, this paper will focus on those four issues and pursue strategies for loss prevention and risk mitigation. Generally, this study discovers that CPAs must be hired, earthquake insurance is not enough to prevent loss, there are indeed prophylactic methods to avoiding litigation and security issues must be combated on almost a weekly basis with regard to small business information technology.

Chapter 2

Literature Review

Introduction

While the events of September 11 have directly or indirectly impacted the daily life of many Americans, business life has also undergone change in so many concrete ways.

According to a survey conducted by Management Recruiters International, Inc. (MRI), nearly one-half (44.8%) of executives polled said that their companies have changed the way they conduct business in the post-9/11 era. MRI is the world's largest search and recruitment organization and a subsidiary of staffing and outsourcing leader CDI Corp. (MRI, 2005)

In further detail, of the nearly 1,800 executives surveyed, 30.7% said that their companies have somewhat changed the way they conduct business, while 14.1% said the change has been great. (MRI, 2005)

"There is no question that September 11 changed our lives forever, because not only have those catastrophic events triggered a domino effect in many sectors of the economy, they have also had an effect on America's workplace mindset," said MRI President and CEO Allen Salikof. (MRI, 2005)

Indeed, the results of the survey were staggering. "What we have seen are changes in day-to-day business activities such as a reduction in business travel in favor of teleconferencing or web conferencing, for example. Disaster contingency planning, an increase in telecommuting, and a shift in the way companies look at their real estate and how they distribute their operations geographically are a few examples of how companies are conducting business differently. We've even heard of instances where job candidates are hesitant to interview at companies headquartered in high-profile skyscrapers," continued Salikof. (MRI, 2005)

Intriguingly, however, more than 40% of those executives surveyed said that little or nothing had changed in the way they conduct their day-to-day business since September 11. 19.2% said that their companies had not changed anything and 21.8% said that they had only slightly changed how business is being conducted. (MRI, 2005)

"In spite of some changes in the way business is conducted on a daily basis, American resolve to continue 'business as usual' has become a powerful driving force in the workplace. While tightened security in the workplace is here to stay, as time goes by, American business leaders will undoubtedly revert back to doing the things that are best for their business. In addition, many companies not located in close proximity to the attacks have not really felt the impact first-hand," said Salikof. (MRI, 2005)

What is even more staggering is the impact of 9/11 on small businesses. Take Chinatown in New York city, for instance. After the destruction of the Twin Towers, Chinatown was nothing but a dust cloud for several weeks and months following the attacks, rendering many of the groceries, restaurants and fish markets bankrupt -- they were unharmed physically, but no one could walk down the streets to patronize them.

With the added risks of 9/11 and era in which we now live, it is increasingly important for small businesses to prevent preventable losses by having concrete loss minimization and mitigation strategies in place for today and for tomorrow.

There are countless measures in which small businesses can minimize risk, but this paper focuses on some of the most missed practices -- and those that can have the greatest impact.

Specifically, this paper will focus on preventing employee fraud, earthquake damage minimization, litigation mitigation and security risks dealing with technology.

This paper serves as a blueprint for ways in which particularly vulnerable small businesses in the post-9/11 era can minimize risks, survive, and even thrive.

Small Business' Need for a CPA

One of the critical investments a small business can make to mitigate loss and risk is hiring a CPA and putting that CPA on the 'management team.' As Wells notes in his groundbreaking research, "Denise, a bookkeeper for a small trucking firm in Birmingham, Alabama, wishes she had never heard of Ralph Summerford, CPA. Because of his thoroughness, Denise is facing several years in prison for embezzling $550,000 from her employer. At least she will look good standing before the sentencing judge: Denise spent a great deal of her illegal loot on head-to-toe cosmetic surgery. She blew the rest on a shiny new Lexus, luxury vacations, clothing and jewelry. And, of course, Denise had to have a big house to store all of her finery." (Wells, 2003)

Surprisingly, it was not at all the fancy standard of living that made her employer suspicious. "The owner was going over the trucking company's budget when he noticed Denise's salary was listed at $38,000 a year," commented the CPA Summerford. "But the business owner distinctly remembered that he had set her pay at $35,000." (Wells, 2003) The owner himself pulled Denise's personnel file and uncovered the fact that her pay record had been altered. It was obvious to the owner that no one but Denise would have been motivated to falsely increase her salary. Investigating further, he noticed suspicious-looking wire transfers from the company's bank account. At that point, he called in Summerford.

"Like a lot of small businesses, the trucking company had very limited accounting controls," commented Summerford, the veteran CPA, now a partner with Dixon Odom PLLC in Birmingham, Alabama. "In this case, the sole division of responsibilities concerned authorizing all the checks. While only the owner could sign checks, Denise did everything else: post the books, reconcile the checking account and authorize wire transfers." (Wells, 2003)

Denise's idea was beautiful in its simplicity. After wiring money straight from the company bank account to her own, Denise would post the books, charging the funds transfer to one or multiple accounts payable accounts. Then, when she balanced the bank account, she just quite simply rip up the evidence.

The CPA Summerford looked into the fraud case, interviewed Denise's coworkers and got together the documentary evidence including bank statements, wire transfer requests and bank deposit slips. Summerford then prepared charts and exhibits summarizing the scheme, which he inserted in a written report to prosecutors. Summerford's work was used to indict Denise for her thefts -- but although the owner did detect the fraud, he did so well after the $550,000 was lost. A CPA on staff constantly would have solved that problem before it because a revenue loser.

"Denise was well aware the owner did not review the bank statements," said Summerford, also a certified fraud examiner. "And since the business was not audited, there was no independent review of Denise's work; yet almost any degree of scrutiny of the bank statement could have prevented this scheme." (Wells, 2003)

Summerford notes in Wells' research that most schemes like Denise's start out relatively small. "But when thieves avoid detection, it motivates them to steal even more," he said. "Many will continue to steal from a small business until it literally runs out of money and goes broke." (Wells, 2003)

Although the small trucking company survived and did not go bankrupt, Denise's thefts were extremely costly. Small organizations face a serious fraud problem: Dishonest employees will steal them blind, and their thefts obviously mean a lot more to the Mom 'n' Pop trucking company than they do to, for instance, Microsoft. Plus, small businesses are much more vulnerable to this sort of fraud, as they do not have the human resources generally to anticipate and act as a prophylactic against fraud.

Small businesses have every reason to worry about fraud, Wells' research indicates. According to the Association of Certified Fraud Examiners' (ACFE) "2002 Report to the Nation on Occupational Fraud and Abuse," the per-employee losses from fraud in the smallest businesses are 100 times the amount of their largest counterparts. (The complete report can be downloaded at www.cfenet.com.) According to Wells, thus, this is one situation and scene in which CPAs can be valuable consultants to their clients. Although most small businesses do not have a need for a CPA to do a full audit; however, CPAs can provide a number of fraud prevention services.

First, there is employee education. CPAs can conduct on-site training for clients in the form of live presentations and/or computer-based education -- this will serve as a one-time cost to educate key employees at small business how to detect fraud on their own.

Second, CPAs can suggest and run internal control reviews. Reasonable internal controls are critical in every small business, according to Wells' research. A CPA brought in can review the existing system and make recommendations for improvements.

Third and finally, there is the advantage of cash reviews and reconciliations. Since 9 in 10 occupational frauds involve the company's cash, CPAs can regularly review receipts and disbursements for anomalies, even if they are not on the full-time payroll. As Wells' research establishes, however, although this is an excellent deterrent, it is important to realize that no CPA can guarantee that any specific procedures will uncover fraud.

CPAs are able to perform inventory observations and asset verifications. For organizations with inventory or other assets that make attractive misappropriation targets, CPAs are able to observe inventory procedures and/or verify specific items. Both the 1996 and the 2002 ACFE study showed a similar trend: Small business is very vulnerable to fraud. There appear to be three reasons:

First, there is inadequate employee prescreening. According to Wells, "Small businesses rarely spend the money to check work references, criminal records or professional recommendations of potential hires or require applicants to undergo drug screening, psychological testing and other vetting procedures. Undesirable applicants know this and thus gravitate to small businesses. The problem, according to the study, is that about 7% of employees have a history of workplace theft and fraud. This small but costly group knows the degree of scrutiny into their past likely will be minimal; all too often, they are right." (Wells, 2003)

Second there are limited controls at small companies. The very essence of fraud prevention is the division of responsibilities between employees. The reason is simple and cut-and-dried enough: It is one thing to steal by yourself but quite another to enlist the aid of a coworker. According to Wells, "Small businesses rarely have sufficient personnel to adapt adequate controls; "one-person accounting departments" as in Denise's case are the rule, not the exception. Consequently, it becomes important for the owner to overcome this deficiency with reasonable oversight, which can be accomplished two ways. First, the business owner should actively understand and verify the financial information reported to him or her. Second, the owner can engage a CPA to attest to the credibility of the financial information, even if the company doesn't have a regular audit. However, the audit can be a powerful deterrent in its own right: The ACFE study found losses to companies that had audits were about a third lower than losses at companies that didn't." (Wells, 2003)

Third and finally there is too much trust at small companies. This final reason for disproportionate fraud losses in small businesses involves the ever-present and ever-dangerous human element. In a company where employees know each other well, it is natural for them to trust one another. In fact, the intimate familial atmosphere of a small business is one of its most attractive features.

Most of the time, believing in one's coworkers is well founded, but not always, and without a CPA it is often impossible to distinguish. The CPA's job is to maintain distance and not allow friendships and comraderie to get in the way of the work and analysis that must be done. Without CPAs, the dichotomy is that trust is an essential element of business as well as an essential element of fraud. Never having confidence and trust in your employees is a bad thing; but unfortunately, so is always trusting them. The goal is to strike a balance between the two. Or, as Peter Dunne said, "Trust everybody, but make sure you cut the cards." (Dunne, 1930)

According to Wells' research, small businesses are most vulnerable to two types of fraud from within: asset misappropriation and corruption. Startingly, Moreover, the average length an occupational fraud goes on at a small company before discovery is about 18 months.

By getting tabs on the common warning signs or red flags of these schemes early, small businesses can reduce or avoid losses. Fraud indicators include: rising expenses and/or declining revenue, abnormally high inventory shrinkage, unfamiliar vendors or other payees and excessive spending by employees. Moreover, accountants' studies have shown that employees who engage in workplace abuse (excessive absenteeism, goldbricking, pilfering, for example) are at a higher risk to commit fraud. This of course seems quite obvious, but the trick is to pinpoint when the other events are happening.

Isabel Mercedes Cumming, a prosecutor in Baltimore, is a former internal auditor. "We see a great deal of fraud cases involving workers in small businesses" she commented. "Most of them involve employees stealing money or merchandise, and some cases involve hundreds of thousands of dollars. In my view there often is a certain naivete on the part of small business owners who fail to recognize that employees can and do commit fraud. Many of these offenses could be avoided altogether if the owners were alert to the risk and took reasonable internal control measures. Simply stated, small business owners tend to place too much trust in their employees." (Wells, 2003)

The definition of asset misappropriation is broader than simply theft; legally considered either larceny by trick or false pretenses, an employee who uses the company computers at night to run his or her own side business has not stolen the computers, but certainly something or value has been misappropriated. Although a crooked employee can misappropriate any company asset, these schemes can be broken down into two major classifications: cash and noncash -- a distinction that small businesses without CPAs may make, but often too late.

As a CPA adviser to a small business, one must ask this question: "If an employee could steal any asset, which one would it be?" (Wells, 2003) In 9 out of 10 cases, the answer is very simple: cold, hard cash. The rationales for this are equally apparent. A thief working for a car wholesaler would need to fence the illegal bounty on the black market; a dishonest employee working in the coal mines would need to pilfer tons of the stuff to do any good. But like Denise, everyone spends money. Any enterprise's cash is vulnerable in three areas:

First, there is skimming. Skimming means a dishonest worker pilfering money from the business before it is received and recorded by the company. The usual 'bad guys' are salespeople and accounting department personnel. They steal money that should be credited to sales or accounts receivable as their modus operendi.

Larceny is the theft of currency after the company has received and recorded it. The guilty worker usually is a cashier or someone with easy access to the currency. Because currency is generally closely watched, these schemes are infrequent and relatively undamaging to the company.

But here is the most important fraud to catch, according to CPAs for small businesses: fraudulent disbursements. According to Wells, "The most expensive cash frauds relate to fraudulent disbursements from a company's bank account. Employees in the accounting or bookkeeping department are in a position to cook up these schemes. In a typical case, the employee submits a false invoice the company unknowingly pays to the benefit of the thief. Fraudulent billing most commonly involves services that are not rendered to the company. The employee usually conceals illegal payments by having checks made out to friends, relatives and shell companies. In Denise's case, because of a complete lack of oversight, she didn't even have to bother with phony paperwork." (Wells, 2003)

In noncash fraud, although any other asset of the business is up for grabs, criminal employees usually opt to pilfer an item that is particularly useful to them personally. Consumer goods such as clothing, groceries, electronics and jewelry are favorites. Office supplies and equipment (laptop computers, handheld devices, software and calculators) are on top of the list of actual noncash assets likely to be stolen. (Wells, 2003)

A less prevalent but much costlier job fraud at small businesses involves a corrupt employee who conspires with someone outside of the organization. For instance, purchasing agents and buyers are always barraged with offers of free trips, gifts and other incentives by vendors attempting to curry favor. Often these ethically suspect situations turn into outright bribery. However, the victim company actually pays the bribe in the form of higher prices or substandard goods and services that the vendor delivers; widgets costing $100,000 -- which includes a $20,000 kickback -- can be purchased on the open market for $80,000 or less. (Wells, 2003)

In addition to the other methods discussed here, CPAs should advise their small business clients about measures to help prevent and detect internal fraud -- because often however educated a small business and its owner and its managers are about fraud, it may still happen.

First, there is the critical importance of education across the board, not just for management. Indeed, employees are the eyes and ears, so to speak, of small business; if something is going wrong, they likely will know about it before management or the auditors will.

That is why the lower level employees' education must focus on three areas: why fraud happens, how to notice it and what to do if they suspect fraud. The AICPA and the ACFE, as a very important public service, have jointly created a free one-hour interactive training program that can be used to educate small business employees about harmful fraud. CPAs can download it from the AICPA Web site at www.aicpa.org/antifraud/training/homepage/htm. (Wells, 2003)

There is also the issue of active oversight. The small organization's management team needs to learn about schemes, too, to be involved in fraud prevention in their companies. Most of all, the owner should receive an unopened bank statement directly from the bank so he or she can review it for any suspicious transactions. Basically, the management team needs to make sure it understands the small business' revenue and expense streams so it will be able to notice unusual trends.

There are is the need for reasonable personnel policies. Small business employees are much more likely to pilfer from businesses when they feel they are being treated unfairly or think the business owner is being deceptive. (Wells, 2003)

According to Wells, "In addition to setting the proper example, owners need to make sure they treat employees well and reasonably compensate them. Otherwise, employees might attempt to right their grievances with not only unproductive behavior, but with fraud and theft, too.

"Seek professional assistance. When an enterprise has serious questions about fraud prevention and detection, the CPA should advise the owners or principals to seek professional assistance from a CPA/CFE fraud specialist or from some other qualified expert. Although historically occupational frauds have been more expensive than white-collar crimes, the rise in the latter points to an increase in crooked customers, vendors and other outsiders. Small businesses are vulnerable in several key areas." (Wells, 2003)

Then there is the newly changing face of check fraud. Since the late 1980s, check frauds have grown significantly. (Wells, 2003) As nearly any small business retailer can tell you, accepting a forged, stolen or counterfeit check is completely normal.

A major enabling reason for check fraud has been the creation and proliferation of affordable laser printers and desktop printing equipment; in fact, the very tools needed to execute this crime are easily and cheaply obtainable at the neighborhood computer store.

Making matters worse for small businesses, yet one more cause of the rise in both check and credit card fraud relates to the current trend of identity theft.

Employee-criminals have found that it is relatively easy to get a completely fictitious name and the accompanying identification that is necessary for the scheme's success. With a false identify, the sea of commerce is, indeed, the prospective criminal's pearl from an oyster. The employee-criminal can open up bank accounts, obtain credit cards, buy property, incur debt, get passports, open offshore accounts -- basically anything. The best prophylactic for small businesses to identity fraud is for small business personnel to know and understand their customers. The second-best defense for small businesses is to faithfully train employees who accept checks to be alert to some common signs. (Wells, 2003)

First, counterfeit checks are frequently of poor print quality. Only government checks have smooth edges on all four sides -- any other legitimate check will have one perforated edge.

Second, the signature on a forged check will often extend past the signature line since the forger usually has limited experience writing someone else's name.

Third, new bank accounts are more prone to fraud than established ones. Before accepting a check, an employee should note whether the date the account was opened is listed on the face of the check. If so, he or she should be cautious in accepting checks from an account less than 6 months old.

Finally, CPAs urge small businesses to be wary of checks with a number less than 200.

However, the jury is still out on whether the new measures of Check 21 help or hurt check fraud perpetrators. The Check Clearing for the 21st Century Act (Check 21) was signed into law on October 28, 2003, and became effective on October 28, 2004. Check 21 is designed to foster innovation in the payments system and to enhance its efficiency by reducing some of the legal impediments to check truncation. The law facilitates check truncation by creating a new negotiable instrument called a substitute check, which permits banks to truncate original checks, to process check information electronically, and to deliver substitute checks to banks that want to continue receiving paper checks. A substitute check is the legal equivalent of the original check and includes all the information contained on the original check. The law does not require banks to accept checks in electronic form nor does it require banks to use the new authority granted by the Act to create substitute checks. (Federal Reserve Bank, 2004)

As for credit card fraud, although small businesses are victims of a wide variety of credit card fraud, most of the schemes can be divided into four types: According to Wells' research, these are, "stolen credit cards; identity fraud, which occurs when the card is issued to a user in someone else's name; altered credit cards, changed by flattening the alpha/numeric characters and reembossing them with different identifying information; and counterfeit cards. While some counterfeits and altered cards are undetectable to the naked eye, many more are crude look-alikes. Employees should be alert to * Holograms badly faked with tiny bits of aluminum foil.

* Misspellings on the card.

* Alterations on the signature panel.

* Discolored, glued or painted cards.

* Cards that appear to have been flattened and restamped with different numbers." (Wells, 2003)

Helping in the rampant success of these tactics is the idea that, according to a study by Money magazine, 95% of American cashiers did not verify credit card signatures by comparing them with those of the customers. This, of course, affects small businesses again more than it does large businesses as credit card fraud is generally sequestered to lower amounts, but can -- in the aggregate -- really sink a small business.

Like check frauds, the front line of defense in credit card frauds is employee education, which should include awareness of customer behavior. Employees handling credit cards should know that crooked customers frequently display certain characteristics such as

* Taking a credit card from a pocket instead of a wallet or purse.

* Purchasing an unusual number of expensive items.

* Making hurried or random purchases, with little regard to size, quantity or value.

* Making several large purchases under the approved limit or asking an employee what the limit is.

* Charging expensive items on a newly issued card.

* Signing their names on the sales receipt slowly or awkwardly -- this is generally the clearest giveaway. (Wells, 2003)

As Wells' research establishes, "For small businesses with their own charge accounts, CPAs should alert owners and employees to the risk that some customers will purposely buy huge amounts of merchandise and run up debts they have no intention of paying. This type of fraud is called a "bust-out" and usually is committed by newly established commercial enterprises. These "front" businesses normally start off charging small amounts, paying on or ahead of time in order to establish creditworthiness, and then ordering large quantities of inventory on credit. They subsequently sell the inventory at deep discounts, and the fraudsters avoid payment by one of two methods: They pull up stakes and disappear from sight or they file for bankruptcy." (Wells, 2003)

Robert DiPasquale, a CPA and certified fraud examiner with Videre Group in Parsippany, New Jersey, notes that bust-outs also can even be used to acquire a business. In one case, he was hired to investigate the sale of a family-owned retailer of baby furniture.

"The business had been in the family for generations. When one of the sons inherited it, he decided to sell," noted DiPasquale. "The buyer paid a small sum as a down payment with the seller financing the balance. After about a year, the payments to the seller stopped. Ultimately, the seller filed a lawsuit to recover the remaining inventory and other assets, but they were long gone." (Wells, 2003)

As a result of the legal imbroglio, the buyer of the store filed for both personal and business bankruptcy protection. That turned out to be a mistake when DiPasquale, the CPA, was brought on board to review the buyer's books and records. DiPasquale was able to assemble evidence that indicated the buyer had purchased the business with the intent of defrauding the seller -- and this of course is illegal, and only discoverable by a CPA or a similar professional tasked with identifying such fraud.

"We found out that immediately after the purchase of the business, the buyer began ordering large quantities of inventory that were later moved off-site and sold at huge discounts. Moreover, the buyer was skimming the store's sales for himself," DiPasquale said. DiPasquale's work resulted in both bankruptcy petitions being overturned. The court ordered the buyer to repay the seller the entire sales price with interest. (Wells, 2003)

Wells' research establishes that to avoid becoming the victim of a bust-out, small businesses should train employees to * Be cautious in extending credit to new commercial enterprises or unknown parties.

* Look for early repayments of small amounts followed by charges of increasingly larger amounts.

* Be alert to businesses that use a post-office-box address or are not listed in the telephone book.

* Check with the police or the Better Business Bureau if you are in doubt about the legitimacy of a charge account customer. (Wells, 2003)

Although the Internet and the computer have aided small businesses unquantifiably, this progress has not come without significant costs. Computer hacking, viruses and spamming have become ordinary, everyday business events. And according to Sandra Johnigan, a Dallas CPA and chairperson of the AICPA's litigation and dispute resolution subcommittee, small businesses are particularly at risk of computer-facilitated crimes. "Moreover, there is a growing trend of employees' using the company's computer to run their own businesses," Johnigan observed. (Wells, 2003)

Johnigan noted that dishonest small business employees also might steal their employers' technology, customer data lists or other trade secrets with the explicit intention of setting up a competing enterprise.

As a result, CPAs should advise their small business clients to take adequate security measures to protect the company's secrets, including ensuring that sensitive documents are shredded or otherwise rendered unreadable before they are discarded. (Wells, 2003)

With limited personnel, small businesses frequently must compromise on the division of labor with regard to preventing fraud. Regardless, to keep employees on the straight and narrow, managers at small businesses must attempt to assign separate workers to the functions of data entry and asset control. In the simplest terms, an employee who controls records should not control assets and vice versa.

Johnigan noted that conducting business on the Internet usually is a safe proposition when accompanied by a few basic security procedures. Last year, the White House released a draft report for small business to be mindful of cybersecurity and to consider five simple steps to reduce risks of fraud. (Wells, 2003)

* Use a tough password of at least eight digits, with a mix of numerals and uppercase and lowercase letters.

* Maintain an updated virus protection program.

* Install update "patches" (that is, check software company Web sites for improvements to existing security).

* Use filtering techniques.

* Use firewalls in computers that have "always on" broadband connections. (Wells, 2003)

According to Wells' groundbreaking research, "Fraud is a cost of doing business that is hidden from view. We know about frauds only when they are discovered, and then it sometimes is too late to do anything to avoid catastrophic losses. The first line of defense is a CPA who advises business owners about fraud prevention and detection techniques. These include hiring the right employees -- people with no known history of dishonesty -- and treating them fairly. Employers and workers need to learn about fraud and how to report it, and CPAs can greatly assist small businesses by providing such antifraud services. Eliminating fraud completely is not possible, but with reasonable measures, its impact can be limited. Preventing fraud from occurring in the first place, however, is the only win-win situation." (Wells, 2003)

One of the biggest challenges for small businesses is to actually attract the attention of quality CPAs to help them in their fraud-combatting efforts. Essentially, CPAs do not value, often, the revenue streams of small businesses, and take their business to large corporations instead. However, studies show small businesses:

* Account for 58% of the nonfarm workforce.

* Contribute to 43% of all sales in the country.

* Generate 51% f the private gross domestic product. (www.sba.gov)

As a result, CPAs would find it in their best interest to be retained by small businesses -- and help them minimize loss and mitigate risk by combating fraud, as one of their core competencies.

Small Businesses Must Minimize Litigation In Order to Succeed

It reads exactly like an employer's worst nightmare. A minority employee is passed over for a relatively minor promotion. He sues his employer company, alleging racial discrimination. His white supervisor -- who has already resigned to take a job with higher pay at another company -- joins in the suit. The supervisor claims that he was first pressured not to promote his subordinate and then, after he supported the subordinate's complaint of discrimination, was denied a promotion himself -- which is eventually why he left.

The court record in all actuality demonstrates no demonstrative evidence that the employer discriminated, but a jury finds for the plaintiffs anyway. It awards them a sum covering economic harm, emotional distress, and punitive damages. The total: $89.5 million, one of the largest awards ever made by a state or federal court in an employment-law case. (Barrier, 1998)

An appellate court reduces the punitive damages sharply -- but they still total $7.8 million. The court affirms the damages for emotional distress, which are, at a total of $5.5 million for the two plaintiffs, also extraordinarily high. The damages in all three categories, including $4 million affirmed form economic harm, result in a total tab of $17.3 million -- plus, of course, the immense costs of litigating the matter. (Barrier, 1998)

That case arrived before the California Supreme Court, which must decide if the employer, Hughes Aircraft Co., is entitled to a new trial.

As Barrier's research demonstrates, "Hughes Aircraft, of course, is not small. And a small-business owner may be tempted to dismiss the likelihood of such a calamity happening to him or her as improbably remote. But where employment law is concerned, a case like this has everything to do with small companies.

"Employment law is a form of tort law -- the branch of civil law through which plaintiffs seek recompense for wrongs. they supposedly have suffered. Tort law in recent decades has been a powerful weapon in the hands of trial lawyers. They have drawn blood from business repeatedly, sometimes winning monetary awards that are so astonishing that they attract nationwide attention." (Barrier, 1998)

Although trial lawyers have long tended to go after companies with "deep pockets," for obvious reasons, small companies have become increasingly vulnerable to employment lawsuits. The grounds for such suits have multiplied in the past few decades as a result of state and federal laws barring discrimination based on race, disability, age, and gender.

Sometimes these lawsuits would seem ridiculous if it were not for the costs they impose on the small businesses that are the unwitting targets. (Barrier, 1998) Often, the goal is just to coax a settlement out of the small businesses trepidations about paying for litigation.

As Barrier's research notes, "Take, for example, the case of a 16-employee machine shop in a Western state. According to the firm's owner, one of its employees -- a man approaching retirement age -- volunteered in front of witnesses to be laid off if layoffs became necessary.

"Eventually, business slowed to the point that the employee had to switch jobs in the plant or be laid off, and, the owner says, the employee chose to be laid off. Two years later the laid-off employee sued, charging age discrimination. In 1997, after a year and a half of litigation, the company settled, paying a total of $140,000 in damages and attorneys' fees." (Barrier, 1998)

The owner of the small business in this case claimed that he felt he had no prerogative in the matter. His accountant (see CPAs for small businesses, infra) informed him that if he settled for that much, his costs would be no more than they would be if the case went to trial and he won -- and there was the very real danger that a jury would find for the plaintiff and give him a large award. So the owner decided, he says, "to protect the company and the jobs of the people here." (Barrier, 1998)

"It's really kind of heartbreaking to get involved with the legal system," he says. "You think you're going to be treated fairly, and it all boils down to dollars and cents." (Barrier, 1998) Indeed, this is true for small businesses. They cannot shoulder litigation costs and burdens on time that larger companies can shoulder, so are often vulnerable to otherwise untenable lawsuits and settlement offers -- frightening indeed.

There are many such examples, says Michael Lotito, managing partner of the San Francisco office of Jackson, Lewis, Schnitzler & Krupman, a New York City-based national law firm that specializes in representing management in labor and employment cases.

Lotito cites one example in which an employee appropriated company property for her own use. After she was terminated, she sued, alleging sexual harassment "even though she had never mentioned any type of harassment during her employment." (Barrier, 1998)

To date, the company has had to spend about $100,000 in legal fees to defend itself, according to Barrier's research.

'Lotito also cites a case in which an employee's claim of sexual harassment was valid and the company fired the offenders, yet the harassed employee sued anyway -- after she left the company for a better-paying job -- and won punitive damages of $1.2 million. The employee's attorney wants the company to pay his legal fees, which he puts at $600,000; that would be in addition to the fees the company has paid its own lawyers, which total around $300,000." (Barrier, 1998)

This small business threat results from the disproportionate and recent expansion of damages. Trial lawyers picked up new financial incentives to pursue employment-law cases against small firms when Congress passed the Civil Rights Restoration Act of 1991.

That landmark law exploded the possibilities and magnitude of the remedies available to victims of employment discrimination under statutes such as Title VII of the 1964 Civil Rights Act and the Americans with Disabilities Act (ADA), which was enacted in 1990. (Barrier, 1998)

Today, plaintiffs in a wide range of cases can now seek not just compensation for economic damages and attorneys' fees but also punitive damages and damages for emotional distress -- and this can really add up against a small company, especially with plaintiff-friendly juries across America, both red states and blue states, as they are now known.

Compensatory damages for emotional distress "are frequently the largest component of a verdict," says Chrys Martin, an attorney with the law firm Bullivant Houser Bailey in Portland, Ore. It is very likely, she says, that if someone gets, say, $60,000 for lost wages, they'll get at least as much for emotional distress. (Barrier, 1998)

"We had a case where a woman had no lost wages, but we lost the case for $125,000 [for emotional distress] -- which is a large verdict here in Portland," Martin commented. "She did not have one witness testify. Just her own testimony that this upset her -- sleepless nights, stomachaches, those kinds of things. The jury didn't like what happened to her." (Barrier, 1998)

Plaintiffs' lawyers argue that it's often only through such emotional-damage awards that the courts can discipline abusive employers -- and that is the goal of the Civil Rights litigation in the first place. As Mary Anne Sedey, an attorney with the St. Louis firm Sedey, Moench and Associates and president of the National Employment Lawyers Association, comments: "I used to have to turn people away who had very legitimate claims. They had suffered outrageous sexual harassment on the job, but they didn't have a wage loss; they quit the job and got another job." (Barrier, 1998)

And a lot of the issues facing small business on litigation are because of lawyers' influence. However powerful the emotions an employer's conduct may arouse, critics doubt that many workers would nurse their wounds without lawyers' encouragement. (Barrier, 1998)

In fact, employment-law litigation is "clearly following where the money can be obtained, rather than what workers spontaneously think of as the original grievance," commented Walter K. Olson, a senior fellow at the Center for Judicial Studies at the Manhattan Institute, a nonpartisan research organization in New York City, and the author of The Excuse Factory: How Employment Law Is Paralyzing the American Work-place. "Now that it's easier to sue for emotional distress, it seems that there's scarcely a fired worker who does not have psychiatric distress." (Barrier, 1998)

If there exists one bright spot for small business, it is that the 1991 law puts a cap on the amounts that can be assessed for punitive and emotional distress damages. The total for such damages cannot exceed $50,000 for firms with 15 to 100 employees. The ceiling rises after that, to $300,000 for the largest companies. (Firms with fewer than 15 employees are not subject to the 1991 law.) (Barrier, 1998) So, small business are indeed protected to an extent, but still the damages awards, especially on multiple suits, can be staggering.

Those damage caps may not sound exceedingly high, but some states -- among them California, as the Hughes case demonstrates -- have anti-discrimination laws that are even tougher on employers than federal law, extending protection to workers in companies with fewer employees and imposing no caps on damages, and this is completely legal within the Erie Doctrine of federal case law.

In addition, commented Portland attorney Martin in Barrier's research, successful plaintiffs "almost walways get an attorneys'-fees award, and the awards have been really outrageous. In many of these cases, the awards are many times higher than the damages." (Barrier, 1998)

According to Barrier's research, some states have laws that are employer-friendly, but there is no real sanctuary anywhere. Employment law is the most cross-cutting, the most universal business exposure to the problems of the liability system," Olson says. "In part because so much of it is federal, there aren't any states where you're particularly safe from it." (Barrier, 1998)

'Throughout the country, plaintiffs' lawyers who once might have turned away an aggrieved employee now have powerful incentives to file such suits.

"There is nothing to prevent a plaintiffs attorney who has been awarded attorneys' fees from also getting an agreed-upon percentage of the plaintiff's damages as a contingency fee. It's easily conceivable that a trial lawyer could suck hundreds of thousands of dollars out of a small business in a successful suit and then walk away with much more of that money than the plaintiff." (Barrier, 1998)

"Trial lawyers are entrepreneurs," says Gregory R. Joseph, an attorney with the firm Fried, Frank, Harris, Shriver & Jacobson in New York City. "You give them a profit opportunity, and they're going to focus on it. Congress is giving a series of profit opportunities; those are not going to be ignored." Joseph would know, as he chairs the American Bar Association's litigation section, which has about 60,000 litigating members from both the plaintiffs and defense bars. (Barrier, 1998)

The real bane is litigation for small businesses. There exists no feasible way to calculate the exact impact of the 1991 federal law on litigation (and threats of litigation) involving small business, but the number of employment-related civil-rights suits -- that is, suits alleging illegal discrimination -- filed in federal district courts has risen sharply in the '90s, at a rate 50% higher than that for civil rights suits generally. (Barrier, 1998)

For instance, the Society for Human Resource Management (SHRM), a national organization of human resources professionals, surveyed its members last year and found that 57% of respondents had been targets of employment-related lawsuits in the previous five years -- small businesses must understand that this figure includes them as well -- and the cost of litigating compounded with the 57% probability of litigation looms ominous over their business model.

Lawyers with little experience in this complex field are entering employment law in large numbers. "There used to be only a handful of employment attorneys," says Martin, who chairs the employment-law committee of the Chicago-based Defense Research Institute, a nationwide organization of defense attorneys. "Now there are hundreds of them in every major city."

Martin decries inexperienced lawyers for plaintiffs in employment litigation "who don't know a good case from a bad case," and Sedey of the National Employment Lawyers Association acknowledges that "now there are lawyers who see the availability of compensatory [damages for emotional distress] and punitive damages as an incentive to get involved in this area. As time passes, they will become more competent at it," so that fewer suits will be filed but the cases will be stronger." (Barrier, 1998)

However, Olson believes that the legal system is a long way from reaching equilibrium as far as employment law is concerned. This, he says, is because "the influx of lawyers, the expansion of damages, and the addition of new laws and new doctrines" -- in particular, those that protect an increasing number of categories of workers from dismissal unless certain conditions are met -- have been occurring at such a rapid pace. (Barrier, 1998)

All of this data means extremely hard lessons for extremely small and defenseless firms across America. In this unstable environment, many small-business owners "first become educated about employment-law disputes when they're at the other end of a gun," says Lotito. "It's a difficult and expensive learning experience." (Barrier, 1998)

As a result, the small-business defendant often winds up facing a hard business reality: It may be in the best interests of the company to settle with the plaintiff and swallow a loss of thousands of dollars, however unjustified the original complaint. Says Jeffrey L. Needle, a plaintiffs' attorney in Seattle and a spokesman for the Association of Dial Lawyers of America (ATLA): "Employers have to make some calculated decisions about what the risks are." (Barrier, 1998)

When a lawyer for employment-law suing plaintiffs is considering whether to accept a client, Olson says, the question often is not whether the client might prevail in a jury trial but whether "a quick $50,000 settlement" can be squeezed out of the defendant. "Often the answer will be yes," he says, "even for a not-very-big business." (Barrier, 1998)

Many times, Lotito comments, "I wind up being not so much a lawyer as a psychologist," emphasizing to an angry and frustrated client "the uncertainty of getting in front of a jury that is not composed of company presidents." (Barrier, 1998)

And that is because juries are so unpredictable, Martin believes, that so many employment-law cases get settled without a trial. "If you get a bad jury," she says, "you can get killed." And of course, the opposite applies to small businesses too. Even a completely spurious case, like those listed above, may result in damages against the company.

There can be yet another incentive for companies to settle. "People don't advertise these kinds of things," says Terry Deeny, chairman and CEO of Deeny Construction in Seattle, about sexual-harassment cases in the construction industry. "When they happen, you don't hear about them, because it's embarrassing and expensive." (Barrier, 1998) Small business just cannot afford the bad press.

Often, as Lotito noted in Barrier's research, "especially when you deal with harassment complaints, what happens is that there's a rush to a confidential settlement, before anything is filed, because people are concerned not just with money and emotion but also with reputation." (Barrier, 1998)

This essentially betrays the destructive power of litigation against small businesses.

Even when sexual harassment is not involved, employment cases of all kinds can be exceptionally difficult and unpleasant to resolve. Says Lotito: "Employment disputes are very much akin to marital disputes, family disputes." (Barrier, 1998)

For instance, according to Barrier, "Deeny's construction company weathered just such a suit -- the only one ever filed against the company in its 59 years in business. That suit was not part of the current litigation boom -- it was filed in the 1980s and did not involve a claim of illegal discrimination -- but in its destructive power it was identical to many more-recent suits."

'Enough time has elapsed, though, that Deeny can bring himself to talk about the suit for the record, unlike many victims whose wounds are fresher.

"The Deeny suit involved a family quarrel. It was filed by a relative by marriage whose claim for $6 million, Deeny says, was based on a supposed promise of lifetime employment by Deeny's deceased father. "I din't take it seriously at all," Deeny says of the relative's claim of wrongful termination. "My attorney didn't take it seriously, either." But the suit turned out to be deadly serious." (Barrier, 1998)

The costs itinerant to litigation were just staggering. "We had to value the company," Deeny says, "and that cost $25,000. Then we had depositions that went on for weeks and weeks." After 2 1/2 years of conflict that consumed most of his time and energy, Deeny accepted his attorney's suggestion to bring in a mediator. (Barrier, 1998)

Deeny wound up paying attorneys' fees for both sides, which totaled more than $250,000. He also bought out the relative's share m the company, ultimately spending around $750,000 -- more than the company's annual revenues at the time. (Barrier, 1998) Just think about the effect such costs could have on the risks and losses of a small business.

"In 1980, I had $1 million in the bank and didn't owe anybody anything," Deeny says. "In 1990, I had a $250,000 loan and 10 cents in the bank." (Barrier, 1998) Litigation can truly crush a small business.

Fortunately, this did not happen to Deeny and the firm managed to survive. Deeny Construction has recovered -- it now has 35 to 40 employees and annual revenues of around $4.5 million -- but the company's prosperity hasn't erased Deeny's bad memories. "Once you bring attorneys into the picture," he says, "it's a bad situation." (Barrier, 1998)

That is why preventative maintenance is absolutely key in loss prevention for small businesses when it comes to the risks and costs of litigation.

As Deeny's experience indicates, a small-business person's first priority must be to prevent a suit from being filed -- not to win one after it is filed.

Obeying the laws against discrimination is one obvious way to do that, and plaintiffs' lawyers insist that there's nothing difficult about it. The prohibitions are clear, Sedey says: "The notion that this is somehow hard to understand is incomprehensible to me." (Barrier, 1998)

Eugene Volokh, a law professor at the University of California at Los Angeles, agrees that "the ban on intentional discrimination isn't particularly vague. On the other hand, the ban on sexual harassment -- on creation of a hostile or abusive work environment -- is extremely vague. Employers know they have to shut up their employees so that they don't say offensive things" -- but they don't know for sure what those offensive things are, he says, so "they just have to guess." (Barrier, 1998)

Likewise, he says, the ADA "is really, really bad in many respects. It's not just a ban on discrimination, it's a requirement of discrimination. It requires you to favor handicapped people." And this is especially true for small business -- the ADA can be read as an easy avenue to sue small businesses for damages and little else.

The ATLA's Needle says that "some fine-tuning might be appropriate" -- and the courts are already doing that, he suggests. "They're in the process, I think, of diminishing the breadth of the ADA." (Barrier, 1998)

Such fine-tuning could continue for quite a while in all areas of employment law. Martin commented in Barrier's research that "it will be another five years, probably," before enough cases "get to trial, all across the country, and go up on appeal and are reversed or affirmed" to restore some element of predictability. (Barrier, 1998)

In the meantime, and despite the uncertainty, small businesses that which to prevent litigational loss must take on what Robert L. Fanter, a defense attorney with Whitfield & Eddy PLC in Des Moines, Iowa, and president of the Defense Research Institute, calls a "preventive maintenance" program for personnel problems. Here is a checklist of preventive measures recommended by Fanter and others:

Make a realistic assessment of whether you are at risk.

You may need to be especially careful, for instance, if some employment-law case has recently received wide publicity in your community. If a jury awarded a large sum to another company's employees, one of your employees might start getting ideas.

Try to hire people with the right values.

Hire people who, as Lotito says, "buy into the idea that they have to show you how well they perform before being rewarded. If you hire individuals who feel that life owes them, that life has thrown them a curveball they've never been able to catch, what makes you think that you're going to turn them around?"

Document what you are doing and why you're doing it.

Make sure you have good and clearly articulated reasons" for whatever employment decisions you make, Volokh advises. Even when you're inclined to overlook an employee's mistake, don't do it -- keep a record "whenever your employee does something wrong, even if it's not a firing offense."

Adopt strong, clear employment policies and procedures.

If you get sued for sexual harassment, it probably will make a difference in court if you can show that you have a sexual-harassment policy that has been enforced.

"Usually," says Betsy Plevan, a defense attorney with the firm Proskauer Rose LLP in New York City, "those policies would include some sort of grievance mechanism, so if an employee has a problem, you have a mechanism available for them to try to resolve it."

Employment applications and employee handbooks should state explicitly that employment is "at will" -- that is, both employer and employee are free to end the relationship at any time.

An employer of any size, Martin says, can require employees to acknowledge reading and accepting the policies in an employee handbook upon being hired; the handbook can provide for mandatory arbitration of employment disputes and a waiver of the employee's right to a jury trial in such disputes.

Such provisions "are fairly routinely being upheld," she says. Putting together such a handbook requires an attorney's help, though, since state laws differ greatly.

Stay abreast of the various federal rules and deadlines.

That includes keeping the employee bulletin board up-to-date, even when some of those required posters seem to invite employees to sue you.

Cut your losses when you see trouble ahead.

"Try to be sensitive to situations where you think an employee is going to be litigious when they're being terminated," an says. "Consider the possibility of paving them a little severance in exchange for a [promise not to sue]. You're not going to do that if somebody is being fired for stealing, but if it's a performance issue, you may save yourself a lot of headaches."

Talk to your insurance broker about taking out employment-practices liability insurance (EPLI).

When employers have EPLI, Martin says, "if they do get hit, they can afford to litigate. They've got somebody paying for their defense costs; they may even have indemnity. There are scores of products on the market right now at much more reasonable prices than a couple of years ago, with very inclusive coverage." (Section adapted from Barrier, 1998)

There exists, indeed, just so much that a small business can do on its own to protect itself from unjustified lawsuits. Ultimately, reforms in both state and federal law offer the best protection. Business presents a model for such a reform effort in its increasingly successful counterattack against expanded product liability. But still, preventative measures such as those discussed above must be taken to prevent loss.

According to the New York City-based Insurance Information Institute, an industry-sponsored communications organization, 50% of American states passed laws to limit product liability between 1986 and 1996, and even more states acted to limit punitive damages. In 1996, Congress -- fulfilling one of the promises in the Republicans' "Contract With America" -- passed a bill with bipartisan support that would have imposed uniform federal product-liability standards on the states, but President Clinton vetoed it. (Barrier, 1998)

The U.S. Chamber of Commerce, which has led the limitation of the product-liability damages movement, is now increasing that campaign to embrace thorough reform of the civil-justice system, with a special emphasis on employment law -- and this may help small businesses, but the efforts have as yet met with little success.

That is because "Groundless suits by dismissed employees are a major drain on small businesses," Chamber President and CEO Thomas J. Donohue says. "We need to find ways to discourage suits that don't serve any purpose except to line trial lawyers' pockets." (Barrier, 1998)

According to Lawrence Kraus, "a Chamber senior vice president who will run the reform drive, the Chamber will pursue an effort to bar judges from hearing cases involving attorneys or clients who have contributed to their election campaigns and will support adoption of the "loser pays" rule in areas such as employment litigation. Under that rule, the losing party in a lawsuit would have to pick up the tab for the fees of the winner's attorneys." (Barrier, 1998) The adoption of such a rule, already in use in Europe, "would eliminate a lot of meritless litigation almost overnight," Kraus comments in Barrier's research. (Barrier, 1998)

Another potentially powerful reform would be to limit punitive damages -- and damages for emotional distress as well -- not just in absolute dollar terms but as some multiple of economic loss -- so as a percentage of the total tab. Small businesses must lobby for this change.

Judyth Pendell, whose Bloomfield, Conn., firm, Pendell Consulting LLC, advises businesses that are concerned about legal reform, says that strong caps on punitive damages would be an important reform not just in themselves but because of "the shadow effect" that outrageous awards have on settlements. (Barrier, 1998)

Also, Portland attorney Martin thinks that realistic caps are critical. She thinks that because juries can be swayed so easily their sympathy for a plaintiff, the cap the 1991 federal law are about twice as high as they should be. Martin notes that judges already have the power to reduce damages, "but they rarely, rarely do it with emotional-distress damages." (Barrier, 1998)

Pendell believes that, "Judges have the ability to prevent and repair just about every problem in our courts today. There's nothing we could do that would be more valuable than to get good judges in place." (Barrier, 1998)

The way to get better judges, says the ABA's Joseph, is through "merit selection," in contrast to the elections that now prevail in much of the country. "That's something the business community has to be involved in," he says. "Elected judges cannot help but be influenced by the fact that somebody made a significant donation." Trial lawyers especially have been raked over the coals for their donations to judges' campaigns. (Barrier, 1998)

Some reformers target not elections so much as the voters' awareness of judges' records. The Judicial Evaluation Institute for Economic Issues, a nonprofit organization based in Bethesda, Md., is offering expertise and funding to several budding state efforts at systematic judicial evaluation. The idea is to review judges' records "from the point-of-view of free-enterprise values," according to the institute, "with a special emphasis on liability and litigation reform."

In the few states where judicial evaluations have played a part in elections, says John J. McMackin Jr., a Washington, D.C., attorney and institute board member, the results have been encouraging, so this is another reform for which small businesses must push.

As Barrier concludes in his research, "Ultimately, where employment law is involved, the reformers' goal is to make the public as a whole aware of the costs imposed by a legal system that sometimes seems like a black-robed version of a lottery, dumping millions of dollars on successful plaintiffs almost at random." (Barrier, 1998)

Along with the other issues detailed in this paper, litigation is a huge potential risk and loss for small businesses, and must be combated on several grounds -- mostly, preparedness, realism and lobbying.

Small Businesses Must Use Technology to Minimize Risk

A recent study from SBTI and Symantec exposed small business information security gaps and successfully provided insight on how they can mitigate risk.

The study in fact found that 56% of small businesses have at least one security incident a year, as noted above in this examination as well. (SBTI, 2005)

Basically, the Small Business Technology Institute (SBTI), a non-profit organization dedicated to fostering technology education and adoption among small businesses, and Symantec Corp. (Nasdaq: SYMC), the global leader in information security, announced in July 2005 the results of a new report titled "Small Business Information Security Readiness." (SBTI, 2005)

According to the July 2005 report, "Preventing and resolving information security incidents is a critical challenge for small businesses in the United States. The report confirms that small business information systems are increasingly vulnerable to attack, and urges the adoption of security technology, proactive policies and stronger vigilance to protect information assets and minimize business risk.

"The report findings reveal that the rate of information security exposure is growing as small businesses deploy increasingly sophisticated information technology (IT) infrastructure and automate more of their business processes. The report concludes that small businesses must take immediate steps to protect themselves from the productivity and economic losses that occur when sensitive business data is compromised as a result of viruses, hackers, privacy threats or disasters." (SBTI, 2005)

'Small businesses represent an extremely high point of exposure for the U.S. economy based on their significant contribution to the Gross Domestic Product (GDP) and their insufficient information security readiness," commented Andrea Peiro, CEO and practice director of Market Intelligence for the Small Business Technology Institute in the report. "This issue is of critical importance to small businesses. Any data loss or system downtime resulting from security incidents can severely affect their ability to do business. SBTI has identified a significant opportunity for small businesses to mitigate the risks and improve operational control by embracing a proactive approach to information security based on solutions designed expressly for their needs." (SBTI, 2005)

'Small businesses are just as likely to experience information security threats and risks as large enterprises, so it's pertinent they have the right resources to protect their critical assets," noted Enrique Salem, senior vice president, security products and solutions, Symantec Corp. "Symantec has played an instrumental role in protecting small businesses through the security solutions we offer and our educational books and CD-ROMs, which address the unique needs of small businesses. Symantec's partnerships with organizations like the SBTI have given us the opportunity to conduct research and create tools that allow us to lead the way in providing small businesses with the right resources to truly be secure." (SBTI, 2005)

Obviously, part of Salem's advice is geared towards selling Symantec's products, but the truth of the matter lies in the fact that software products are necessary to protect against security risks for small businesses -- of course, Symantec has competitors too.

Basically, the key findings in this report signal escalating information security risks for small businesses.

According to the report, "The accelerating adoption of networking and mobile computing infrastructures is driving greater security exposure for small businesses. They can significantly minimize risk by adopting more sophisticated security measures. Small business technology adoption is growing rapidly in areas such as networking, mobile computing and Internet access, even among one-person, home-based businesses. However, many small businesses lack sufficient security controls over even basic systems such as e-mail (18% are not secured) and wireless networks present a new area of concern (60% are not secured). Most small businesses (74%) perform no formal information security planning to counter these threats." (SBTI, 2005)

Small businesses are, for the most part, making information security a priority, but at the same time, they are not increasing their investment in protection to keep pace with increasing threats.

For instance, the majority of small businesses (56%) have experienced at least one security incident in the past year, citing computer viruses, spyware and other malware as the main cause (60%). Yet only a small number (30%) have increased spending on information security solutions and less than half (41%) allocate a specific budget for these solutions. (SBTI, 2005)

This means that small businesses continue to call for security solutions and product information that is tailored to meet their unique needs. The majority (70%) of small businesses feel information security product materials could be improved to help them make more informed purchasing decisions, and small businesses continue to call for products which meet specific small business requirements. (SBTI, 2005)

Small businesses suffer most from limited awareness of information security issues and generally a less-than-adequate understanding of the economic consequences of related incidents. The SBTI report's analysis concludes that this lack of knowledge is inhibiting the adoption of adequate information security policies and solutions. (SBTI, 2005)

'The National Cyber Security Alliance (NCSA) firmly believes that securing small businesses' computers plays a crucial role in protecting our nation's Internet infrastructure," said Ron Teixeira, executive director, National Cyber Security Alliance. "We support the efforts undertaken by the SBTI and Symantec to shed more light on the security issues affecting small businesses throughout the nation, and we encourage continued education and action to help strengthen the security of small businesses throughout the nation." (SBTI, 2005)

As a result, the SBTI report establishes that not only must small businesses invest in natural disaster prophylactics such as earthquake preparedness and insurance, and also litigation protection, they must also invest in technology that will protect against security risks.

This technology can dovetail nicely with the technology and practices needed to stop employee fraud as well.

Chapter 3

Methodology

Approach

This study utilized research derived from the most recent years of small business risk minimization accountability and awareness. As the small business world is a changing one, this paper will focus on research developed in the past 15 years. It will summarily throw out research commissioned or performed prior to 1990, so as to guarantee the timeliest and most apropos information.

Also, the paper will rely on both statistical and anecdotal evidence in its formulations for risk mitigation and loss prevention for small businesses. Statistical evidence's importance is obvious: Numbers are essential to provide a guide to what exactly are the risks for small businesses and what are successful means of dealing with them.

However, anecdotal evidence is also critical from small business owners and operatives and experts in determining whether the theory actually extends to the practice. If the risks tagged to small businesses are merely academic, mitigating those risks will actually result in no loss prevention for small businesses.

Data Gathering Method

This study garnered data from academic journals, but focused mainly on data gathered from periodicals and semi-academic journals dealing more with the day-to-day trials and tribulations of small business.

The purpose of this marked shift in research was to remove this paper from the ivory towers and realm of academia and move it at least partially into the practical business world.

In order to help small businesses prevent losses by minimizing risks, one must study what small businesses actually do how they actually react to market changes -- not what they should do and how they should react. As a result, even though academic research was placed at a premium, non-academic research was performed as well.

Database of Study

The study's database is unlimited, virtually. Small business in America is both the database and the target of this paper. In other words, as noted above, anecdotal evidence plays a large role in this paper's formulation and strategies and conclusions.

However, for obvious reasons, the section on earthquake loss mitigation hinges on data garnered from areas of the country that are most susceptible to earthquake losses.

Validity of Data

As the data contained and used in this paper is from the last 15 years -- most from the last 5 years -- it is highly valid in its timeliness.

The statistical evidence has been garnered through double-blind studies, and the anecdotal evidenced was mined for outliers and anomalies in interviews and accounts.

Consequently, both statistical and anecdotal evidence in this study hover in the high ranges of validity.

Originality and Limitation of Data

This data is not original -- it is culled from, as mentioned above, academic and non-academic (periodical) sources, and it is carefully limited to American small businesses.

For instance, most of the problems that small businesses face that are detailed and discussed in this study are unique to the American economy: rampant fraud and earthquakes are dangers almost everywhere, but heavy litigation and harassment suits are almost unique to America, for instance. As a result, this study is limited in its data to American small businesses.

Summary

This paper uses data from the last 15 years (primarily the last 5 years) and sequestered said data to American small businesses -- and in the earthquakes section, to those areas of the nation affected directly and adversely by earthquakes.

Both anecdotal and statistical evidence is utilized, with equal but different importance and usage placed on both.

Chapter 4

Data Analysis

This paper establishes that the key difficulties faced by small businesses with regard to risk mitigation and loss prevention are not those that are necessarily on their agenda today.

Specifically, this paper will focused on preventing employee fraud, earthquake damage minimization, litigation mitigation and security risks dealing with technology.

This paper serves as a blueprint for ways in which particularly vulnerable small businesses in the post-9/11 era can minimize risks, survive, and even thrive. (MRI, 2005, 3)

However, this paper found that small businesses largely ignore or do not have the means to deal with those four immense risks. They do not hire CPAs to prevent and catch employee fraud, they are ill-prepared for earthquakes other than having purchased insurance, they are very wide open to litigation losses and transaction costs and their networks are subject to breach and data manipulation and worms. (Wells, 2003, 120)

In order to thrive in this fluctuating post-9/11 business world, small businesses simply must follow the conclusions and recommendations presented below based on the data presented above. (Wells, 2003, 120)

The first step, however, is the analysis of the data presented above. Earthquakes are very infrequently happening disasters that, though infrequent, can serve to knock out the capacity of an entire small business. (Williams, 200, 131)

In reality, a small business can simply cease to exist following an earthquake. As a result, most small businesses in affected areas have at least considered earthquake insurance, if not actually purchased it. (Williams, 2005, 120)

This study demonstrates that small businesses must go far beyond simply purchasing insurance in order to survive an earthquake.

Similarly, much more needs be done by small business on the other tree areas discussed in detail too, as demonstrated below in Chapter 5. (Williams, 2005, 120)

Chapter 5

Summary, Recommendations and Conclusions

Small businesses face the same risks, in many instances, as do major corporations. For instance, both small businesses and major corporations face turnover, competition, fluctuating market demands, a volatile economy, bad business decisions and many other risks associated with entering the market place with a particular product, whether it be goods or services. (MRI, 2002, 1)

However, because of their size, small businesses are particularly vulnerable to certain types of losses and risks -- and also because of their smaller size and stature, the loss in revenue or profits is much more deeply felt in small businesses. (MRI, 2005, 1)

Unfortunately, most risk minimization and loss prevention literature is geared at large corporations. It is a significant problem for small businesses, that they do not have white papers or literature to which to turn to minimize their losses and risks. In fact, they have to seek out expensive consultants often to answer those questions for them, and since they cannot afford those consultants, they continue to suffer from preventable losses. (Wells, 2003, 109)

Small businesses have every reason to worry about fraud, Wells' research indicates. According to the Association of Certified Fraud Examiners' (ACFE) "2002 Report to the Nation on Occupational Fraud and Abuse," the per-employee losses from fraud in the smallest businesses are 100 times the amount of their largest counterparts. (The complete report can be downloaded at www.cfenet.com.) According to Wells, thus, this is one situation and scene in which CPAs can be valuable consultants to their clients. Although most small businesses do not have a need for a CPA to do a full audit; however, CPAs can provide a number of fraud prevention services. (Wells, 2003, 110)

First, small businesses must commission CPAs to educate employees. Then they must perform internal reviews, and finally cash audits. Following these steps will allow small businesses to anticipate, prevent and beat employee fraud. (Wells, 2003, 119)

Interestingly, most small businesses, of course, do not have a risk manager, so the role of earthquake damage mitigation falls to the management team, which means that minimizing losses resulting from earthquakes is even more forgotten as a general rule in small businesses. (Williams, 2005)

"Any discussion of earthquake risks is important, because this is usually a topic that ends up on the back burner," says Michael Egan, property officer with Swiss Reinsurance in Philadelphia. "Most of the attention these days seems to get paid to hurricanes, floods and terrorism." (Williams, 2005, 120)

But earthquakes are just as dangerous to a small business. As a result, the trick is looking into earthquake insurance, but going much further: Small businesses must look into retrofitting their buildings and also working with the insurance companies on a host of preventative measures, not just cost.

To generalize, this means a fine balancing act. A good risk manager at a large company or the management team at a small business will look not only at insurance and engineering as separate issues, but he or she will also examine the interaction between the two and create an ideal balance.

"Firms should adopt loss prevention measures that will reduce damage should an earthquake occur," notes Kunreuther. (Williams, 2005, 121) Even aside from the obvious benefit of reducing damage, loss prevention strategies can lead to premium reductions. Some insurance companies, however, may have a difficult time determining how much of a reduction to actually give, since they may lack experience in this area, says Kunreuther. And the diminishment could be a very small one. (Williams, 2005, 121)

The costs and risks of litigation are gigantic for small businesses as well.

This small business threat results from the disproportionate and recent expansion of damages. Trial lawyers picked up new financial incentives to pursue employment-law cases against small firms when Congress passed the Civil Rights Restoration Act of 1991.

That landmark law exploded the possibilities and magnitude of the remedies available to victims of employment discrimination under statutes such as Title VII of the 1964 Civil Rights Act and the Americans with Disabilities Act (ADA), which was enacted in 1990. (Barrier, 1998, 22)

Today, plaintiffs in a wide range of cases can now seek not just compensation for economic damages and attorneys' fees but also punitive damages and damages for emotional distress -- and this can really add up against a small company, especially with plaintiff-friendly juries across America, both red states and blue states, as they are now known.

Compensatory damages for emotional distress "are frequently the largest component of a verdict," says Chrys Martin, an attorney with the law firm Bullivant Houser Bailey in Portland, Ore. It is very likely, she says, that if someone gets, say, $60,000 for lost wages, they'll get at least as much for emotional distress. (Barrier, 1998, 22)

Finally, technology threats to security loom low over small businesses as well. They must ensure that their information systems are treated with the latest in virus and breach protection technology; this prevents hackers and also helps to prevent employee fraud as well, tying into the first strategy outlined in this paper.

Small businesses are, for the most part, making information security a priority, but at the same time, they are not increasing their investment in protection to keep pace with increasing threats.

For instance, the majority of small businesses (56%) have experienced at least one security incident in the past year, citing computer viruses, spyware and other malware as the main cause (60%). Yet only a small number (30%) have increased spending on information security solutions and less than half (41%) allocate a specific budget for these solutions. (SBTI, 2005, 7)

This means that small businesses continue to call for security solutions and product information that is tailored to meet their unique needs. The majority (70%) of small businesses feel information security product materials could be improved to help them make more informed purchasing decisions, and small businesses continue to call for products which meet specific small business requirements. (SBTI, 2005, 7)

In conclusion, there are numerous ways in which a small business can mitigate risk and prevent loss, but these four steps are oft forgotten and can go incredibly far in helping a small business survive in the face of dangers.