Gradient Solutions Corporation was founded by Calvin E. Webb II in June of 2003 as Webb Watch Corporation. For 21 years, Calvin successfully led a small number of consultants serving a variety of clients and industries. In January of 2024, Calvin stepped back from Gradient's operations due to an unexpected diagnosis of an aggressive form of cancer. After a valiant and year-long fight with his illness, Calvin passed away on January 30, 2025, just after his 69th birthday. Gradient will always be indebted to Calvin for his leadership and contributions to our company as will the many individuals, teams, and organizations he influenced over his career. We won't be the same without Calvin, but he was extremely excited about the trajectory of our growth, the expansion of our team, and the continuation of his legacy into the future. His obituary can be viewed below. Thank you for impacting his life with your friendship, thoughts, and prayers.

The ACFE recently published their biennial "Report to the Nations" regarding occupational fraud.  It is worth reviewing the results to update your understanding of occupational fraud in the United States and around the World.  You can use the button below to access the report.

I recently started re-reading Stephen R. Covey's book "The 7 Habits of Highly Effective People."  I hadn't read the book in over 15 years and felt that it would be a good refresher at this point in my career.  Early in the book, Mr. Covey begins to dissect the "habits" paradigm moving from the ideas of dependence to independence and finally to interdependence.  Mr. Covey says this, "[I[nterdependence is a far more mature, more advanced concept.  If I am physically interdependent, I am self-reliant and capable, but I also realize that you and I working together can accomplish far more than, even at my best, I could accomplish alone" (51).

Reflecting on the concept of interdependence in business processes and internal controls, I wondered how often any of us consider our interdependent needs in the design and execution of key processes and internal controls.  Whether we are approving a purchase or reviewing financial data to make decisions, the process that got us to the decision point required many hands and brains to create.  Not many of us would argue that we aren't, at least, somewhat reliant on others in many aspects of our career; however, how many of us have designed organizational culture and processes with the concept as the central focus?

Off the top of my head, here are a few questions that came to mind in answering the question above:

If I asked you about risk, your first thought might be of insurance, security, safety, or a specialized person that deals with risk at your organization such as a risk management team.  It could even be about personal risks to you such as those faced when investing, parenting, or driving on the road.  If I asked you what might go wrong on a camping trip to Alaska, you would immediately tell me things like bears, lack of food, frostbite, injury, or getting lost.  If I asked you about the value a home alarm system, you will probably tell me that it deters break-ins, detects fires, and allows you to monitor your home.  

If I asked you about what risks you see at your job, you may not feel comfortable answering. Maybe the concept of risk at work is outside your normal job description. Regardless of your current professional stance on risk, the fact is that we are all able and capable of assessing risk in our organization, but we often don't feel like it is a vital part of our jobs.  You and I are always assessing risk and understanding our role in processes and organizations. We just don't know we are doing it all the time.  When you make a decision about signing a form, what are you doing?  When you decide to take one course of action against another, what are you doing?  When you train someone to do a job well, what are you doing?  In all of these cases, you are inherently understanding, assessing, and applying risk management principles.  

The ability for multiple individuals to provide input is one of the foundations to Gradient's approach to risk management.  Being a part of assessing risk is not simply a job left to the management team, but a process where many throughout the organization can play a role.  In fact, it is very important to receive input from a variety of perspectives throughout any organization.  Each person has different experiences, different abilities and personalities, and different ways of seeing the organization.  It is because of this that a good risk management process needs input from a variety of sources.

Gradient's risk assessment process solicits input from several levels down into the organization, summarizes that input, and allows the management team to utilize and act on that input.  At whatever level of your organization, here are a few key questions to ask regarding your organization and process risk.  I would encourage you to ask them regularly with your teams and organizational leadership.

· How often do I think about the risks to the processes, departments, and groups that I am involved in at my organization? Is that enough?

· Looking back on processes, have there been instances where a failure or process breakdown occurred? What risks weren't mitigated to allow that to happen?

· What risks do I think could occur in the processes and/or departments I am involved in? Do we have processes in place to minimize those risks? If not, what should we do?

· Do I ask questions to other leaders, my direct reports, and their direct reports about the issues, risks, or failures they see in the organization? Do I seek out input from others on their suggestions and observations?

· Does our management team understand and address larger organization-wide risks?

· Are key organization-wide risks connected to processes that help mitigate those risks?

· Does your organization, department, or team have a strategy for using data (electronic, KPIs, etc.) for monitoring and responding to key risks?

If you want to learn more about Gradient's enterprise risk management (ERM) services, please use the contact form on our site or email info@gogradient.com. You can also review the latest Committee of Sponsoring Organizations (COSO) ERM executive summary at www.coso.org. Thanks for reading!

Many managers are ambivalent about purchasing cards (p-card).  This love, hate relationship with purchasing card programs has the potential to create unplanned risks.  Either a p-card program is too risky to consider or it provides a good outlet to control and monitor small dollar spending.  With the new strategies to recover costs through rebate programs, p-cards are becoming more of a staple of small to large entities.  Over the years, Gradient has seen a variety of controls and issues within p-card programs. Here are some of our recommendations (not comprehensive) to reduce risk in p-card programs. We’d suggest performing a thorough review of your own program against best practices.

 ·You need well designed policies, forms, and training. The information needs to be supported by strong cultural norms.  Without this, you don't have a foundation to monitor, instruct, and correct behavior.

·A single person or group (depending on size) needs to take responsibility for overall program management.  Responsibilities must be clear.

· Reconcile p-card policies to other organization policies including travel, purchasing, code of conducts, etc.

· Implement and monitor both single limits and monthly limits.

· Restrict vendors using the merchant category codes.

· Monitor rejected (denied) purchase reports.

· Require user input fields on transactions.

· Perform periodic monitoring and data mining of p-card transactions.

· Let people know when you find something.  They need to know you are looking.

· Ideally, link each individual transition to the general ledger to gain a comprehensive third-party spend view.

We’ve also performed numerous data analysis programs around p-cards and have well developed processes using both visualization and transaction analysis techniques. Here are some of our recommendations (not comprehensive) for data analytic procedures within p-card programs.

· Consider split transactions.

· Consider potential matching or duplicative transactions.

· Search for key words in the data.

· Review activity by categories such as weekday, merchant category code, department, title, and cardholder.

· Consider even dollar purchases.

· Consider items with sales tax.

· Flag and monitor particular vendor, cardholder, or merchant category code activity when appropriate.

· Review activity for frequency of cardholder usage, limit reasonableness, and spend against certain purchasing policy levels.