Stealing While Dying: The Motive for Fraud Comes in Many Forms

Day 15 in 30 Days of Fraud

Some fraudsters steal while dying. What’s their motive? Possibly to avoid leaving their family with medical bills. Whatever the reason, it’s a strange thing. Today we visit a fraud that I encountered over twenty years ago.

stealing while dying

The Theft

In one of the stranger frauds I’ve seen, the bookkeeper of a small health department, Susan, stole money. And she did so while she was dying. In the last months of her life, she fought a battle with cancer. In between the chemo treatments, she continued her work. I’m sure she believed she would survive. After all, she was only thirty-six. 

I had provided external audit services to this health department for years and knew Susan well. She sent me thank-you cards–yes, thank-you cards–for my audit work. She was polite and great at her job. If ever I thought there was someone who would not (and could not) steal, it was her.

But external circumstances can make the best of people do the unexpected. The medical treatments resulted in numerous medical bills, many of which she received while still working. She died just before my annual visit for the audit.

Knowing that Susan had passed away, I knew the audit would be challenging, especially since the health department board had not hired anyone to replace her.

Upon my arrival, I requested the bank statements, but the remaining employees could not locate them. I thought maybe she had taken the bank statements home and had not returned with them due to her illness, but that was not the case. After the employees searched for some time with no result, the health department requisitioned the bank statements and cleared checks from the bank.

In reviewing the cleared checks, I quickly noticed round-dollar checks written to Susan. The first one was for $7,000. My first thought was, “Not Susan, I’ve known her too long. No way. ” But then there was another and another…

The Weakness

The weakness was a lack of segregation of duties. Susan did the following:

  • Keyed payables into the general ledger
  • Created checks for signing
  • Had signature authority on the bank account
  • Reconciled the bank statements
  • Created the monthly financial statements

Are you noticing a recurring theme in the 30 Days of Fraud? Yes, a lack of segregation of duties. It’s fundamental. One person should not be allowed to do everything.

The Fix

Segregate the accounting duties. Most importantly, Susan should not have been on the bank’s signature card. Additionally, someone other than Susan should have been reconciling the bank statement and examining cleared checks. For small organizations, have the bank statements mailed to someone outside the accounting department (e.g., a board member). This outside person should open the statements and review the cleared checks—then the statements should be sent to accounting.

Ghost Employee Fraud: How to Understand It and How to Prevent It

Day 4 of 30 Days of Fraud

The Theft

Last year I received a phone call. The payroll clerk of a local business had been monkeying around with the company’s direct deposits. As employees left the business, the payroll clerk left them in the system. Why? To steal those continuing payments. Auditors refer to this as ghost employee fraud–the employees are in the system, but they are not real.

Ghost employee fraud

The picture is courtesy of AdobeStock.com

Knowing no one was paying attention, the clerk changed the terminated employees’ direct deposit bank account numbers to her own. The result?She received multiple direct deposits each payroll. The clerk was able to steal over $800,000 before the theft was detected. 

Also, the payroll clerk had not filed tax returns, so the Internal Revenue Service rubbed salt into the wound by levying fines.

The Weakness

The owners trusted the payroll clerk too much and did not monitor her work. The clerk performed all payroll services with no supervision. While the owners were aware of the lack of segregation of duties, they took no steps to prevent the theft. (Even when a business doesn’t segregate its accounting duties, there are ways to lessen the threat of theft.)

The Fix

Export all direct deposit bank account numbers along with employee names into an Excel spreadsheet and sort the bank account numbers. (The bank account numbers should be in one column and the employee name in a separate column.) Sort the bank account numbers, and the duplicate numbers will appear in adjacent rows. So once you sort the bank account numbers, see if there are any duplicates. If there are, see why.

Another fix is for the owners to review a list of all employees paid (just request a list of all employees paid for one or more payrolls). Since the owners normally know which employees have left, they will know if payroll payments are made beyond the departure dates.

How to Lessen Segregation of Duties Problems in Two Easy Steps

Fraud prevention in two easy steps

Darkness is the environment of wrongdoing.

Why?

No one will see us–or so we think.

As you’ve seen many times, fraud occurs in darkness.

In J.R.R. Tolkien’s Hobbit stories, Sméagol, a young man murders another to possess a golden ring, beautiful in appearance but destructive in nature. The possession of the ring and Sméagol’s hiding of self and his precious (the ring) transforms him into a hideous creature–Gollum. I know of no better or graphic portrayal of how that which is alluring in the beginning, is destructive in the end.

Fraud opportunities have those same properties: they are alluring and harmful. And, yes, darkness is the environment of theft. What’s the solution? Transparency. It protects businesses, governments, and nonprofits. And while we desire open and understandable processes, often businesses have just a few employees that operate the accounting system. And many times they alone understand how it works.

It is desirable to divide accounting duties among various employees, so no one person controls the entire process. This division of responsibility creates transparency since multiple eyes see the accounting processes–but this is not always possible.

Lacking Segregation of Duties

Many small organizations lack appropriate segregation of duties and believe that solutions do not exist or that fixing the problem is too costly. But is this true? Can we create greater transparency and safety with simple procedures and without significant cost?

Yes.

Below I propose two processes to reduce fraud:

  1. Bank account transparency and
  2. Surprise audits.

1. Bank Account Transparency

Here’s a simple and economical control: Provide all bank statements to someone other than the bookkeeper. Allow this second person to receive the bank statements before the bookkeeper. While no silver bullet, it has power.

Persons who might receive the bank statements first (before the bookkeeper) include the following:

  • A nonprofit board member
  • The mayor of a small city
  • The owner of a small business
  • The library director
  • A church leader

What is the receiver of the bank statements to do? Merely open the bank statements and review the contents for appropriateness (mainly cleared checks).

In many small entities, accounting processes are a mystery to board members or owners since only one person (the bookkeeper) understands the disbursement process, the recording of journal entries, billing and collections, and payroll.

One set of eyes on an accounting process is not a good thing. So how can we shine the light?

Fraud Prevention

Picture courtesy of DollarPhoto.com

Second Person Sees the Bank Statements

Allow a second person to see the bank statements.

Fraud decreases when the bookkeeper knows someone is watching. Suppose the bookkeeper desires to write a check to himself but realizes that a board member will see the cleared check. Is this a deterrent? You bet.

Don’t want to send the bank statements to a second person? Request that the bank provide read-only online access to the second person, and let the bookkeeper know that the other person will review bank activity.

Even the appearance of transparency creates (some) safety.

Suppose the second person reviewer opens the bank statements (before providing them to the bookkeeper) and does nothing else. The perception of reviews enhances safety. I am not recommending that you don’t perform the review, but if the bookkeeper even thinks someone is watching, fraud will lessen.

2. Surprise Audits

Another way to create small-entity transparency is to perform surprise audits. These reviews are not opinion audits (such as those issued by CPAs) but involve random inspections of various areas such as viewing all checks clearing the May bank statement. Such a review can be contracted out to a CPA or performed by someone other than the bookkeeper–such as a board member.

Segregation of Duties

Picture courtesy of DollarPhoto.com

Adopt a written policy stating that the surprise inspections will occur once or twice a year.

The policy could be as simple as the following:

Twice a year a board member (or designee other than the bookkeeper) will inspect the accounting system and related documents. The scope and details of the inspection will be at the judgment of the board member (or designee). An inspection report will be provided to the board.

Why word the policy this way? You want to make the system general enough that the bookkeeper has no idea what will be inspected but distinct enough that an actual review occurs with regularity (thus the need to specify the minimum number of times the review will be performed).

Sample Inspection Ideas

Here are some sample inspection ideas:

  • Inspect all cleared checks that clear a particular month for appropriate payees and signatures and endorsements
  • Agree all receipts to the deposit slip for three different time periods
  • Review all journal entries made in a two week period and request an explanation for each
  • Review two bank reconciliations for appropriateness
  • Review one monthly budget to actual report (to see that the report was appropriately created)
  • Request a report of all new vendors added in the last six months and review for appropriateness

The reviewer may not perform all of the procedures and can perform just one. What is done is not as important as the fact that something is done. In other words, the primary purpose of the surprise audit is to make the bookkeeper think twice about whether he or she can steal and not be caught.

Again multiple people seeing the accounting processes reduces the threat of fraud.

Shine the Light

The beauty of these two procedures (bank account transparency and surprise audits) is they are straightforward and cheap to implement but nevertheless powerful. So shine the light.

What other procedures do you recommend for small entities?

For more information about preventing fraud, check out my book: The Little Book of Local Government Fraud Prevention.

How to Capture and Communicate Control Deficiencies

Capturing and reporting internal control weaknesses

We’re concluding another audit, and it’s time to consider whether we will issue a letter communicating internal control deficiencies. A month ago we noticed some control issues in accounts payable, but presently we’re not clear about how to describe them. We hesitate to call the client to rehash the now-cold walkthrough. After all, the client thinks we’re done, and quite frankly, they are tired of seeing us. We know that boiler-plate language will not adequately apprise the client of the weaknesses nor will it provide corrective steps. Now we’re kicking ourselves for not taking more time to document the control deficiencies.

Here’s a post to help capture and document internal control issues as we audit.

Today, we’ll take a look at the following control weakness objectives:

  1. How to communicate them
  2. How to discover them
  3. How to capture them
Internal Controls

Picture is courtesy of AdobeStock.com

Before we get started, let’s define three types of weaknesses:

  • Material weaknesses – A deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis.
  • Significant deficiencies – A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance.
  • Other deficiencies – For purposes of this blog post, we’ll define other deficiencies as those less than material weaknesses or significant deficiencies.

As we look at these definitions, we see that categorizing control weaknesses is subjective. Notice the following terms:

  • Reasonable possibility
  • Material misstatement
  • Less severe
  • Merits attention by those charged with governance

Categorizing a control weakness is not a science, but an art. With this thought in mind, let’s start our journey with how control weaknesses should be reported.

1. How to Communicate Control Weaknesses

Material weaknesses and significant deficiencies must be communicated in writing to management and those charged with governance. While other deficiencies don’t have to be writing, they should nonetheless be disclosed to management and documented in the work papers.

2. How to Discover Control Weaknesses

Rather than trying to recall control weaknesses at the end of the audit, capture them as you perform the audit. You might see control problems in the following stages:

  • Planning – Risk assessment and Walkthroughs
  • Fieldwork – Transaction-level work
  • Conclusion – Wrapping up

Planning Stage

You will discover deficiencies as you perform walkthroughs which are carried out in the early stages of the engagement. Correctly performed walkthroughs allow you to see process shortcomings and where duties are overly concentrated (what auditors refer to as a lack of segregation of duties). Are functions appropriately segregated concerning:

  • Custody of assets
  • Reconciliations
  • Authorization
  • Bookkeeping

Notice the first letters of these words spell CRAB (I know it’s cheesy, but it helps me remember).

Within each transaction cycle, these functions–if possible–need to be performed by different people. Doing so lessens the possibility of theft. If one person performs multiple duties, ask yourself, “Is there any way this person could steal funds?” If yes, then the client should add a control in the form of a second-person review. If possible, the client should have someone external to prior accounting processes (usually a supervisor) examine daily reports or other supporting documentation. How often should the review be performed? Daily, if possible. If not daily, as often as possible. Regardless, the client should not allow someone with the ability to steal to work without reviews by a second person. As we saw in my recent post, the fear of detection will lessen fraud.

If a transaction cycle lacks segregation of duties, then consider the potential impact from the control weakness. Three possibilities exist:

  • Theft that is material (material weakness)
  • Theft that is not material but which deserves the attention of management and the board anyway (significant deficiency)
  • Theft that is so small that you don’t have to communicate the issue to the board but will do so to management (other deficiency)

My experience has been that if any theft potential exists, those charged with governance want to know about it, but this too is a subjective decision.

Too often auditors make blanket statements that the client lacks appropriate segregation of duties, and then practically excuse the weakness with words such as, “Segregation of duties is not possible due to the limited staff.” I fear such statements are made to protect the auditor (should fraud occur in the future). It is better to be specific about where the weakness lies and what the potential impact might be. For example:

The accounts payable clerk can add new vendors to the vendor file. Since checks are signed electronically as they are printed, there is a possibility that fictitious vendors could be added and funds stolen. Such amounts could be material.

Such a statement tells the client where the problem is and the potential damage. Be prepared to provide a recommendation to remediate the problem.

While I just described how a lack of segregation of duties may allow theft to occur, the same applies to financial statement fraud (or cooking the books). When one person controls the reporting process, there is a greater risk of financial statement fraud. Appropriate segregation mitigates the risk that someone will manipulate the numbers.

Fieldwork Stage

While it is more likely you will discover process control weaknesses in the planning stage of an audit, the results of control deficiencies surface during fieldwork. How? Audit journal entries. What are journal entries but corrections to results (from the accounting system)? The stronger the system, the fewer the journal entries in number and size. Not that all journal entries are evidence of internal control weaknesses, but consider why the errors occurred. If the corrections are the result of control weaknesses, then consider if the client has a material weakness.

A material weakness is defined as:

  • being reasonably possible,
  • material in amount, and
  • [will not be] prevented on a timely basis

When the auditor makes a journal entry for a material amount, it’s difficult to argue that a material weakness does not exist. We know the error is “reasonably possible.” It occurred. We also know it was not “prevented on a timely basis.”

Conclusion Stage

When concluding the audit, review all of the audit entries to see if any are indicators of control weaknesses. Also, review your internal control deficiency work papers (more on this in a moment). If you have not already done so, discuss the noted control weaknesses with management. In particular, it is wise to communicate any potential significant deficiencies or material weaknesses. As you already know, management may oppose these since they are reported to the board–and can cast a poor light on the accounting staff. So be prepared to explain your determination. Your firm may desire to have a policy that only managers or partners make these communications since they are sensitive.

It is a good practice for your company to designate a particular location in your audit files for internal control deficiency documentation. Let’s discuss the appearance of these controls evaluation work papers.

3. How to Capture Control Weaknesses

Create a standard form (if you don’t already have one) to capture control weaknesses. The main point I am stressing is to document the internal control deficiency when you see it.

Internal Controls

Picture is courtesy of AdobeStock.com

Too often auditors don’t write the weakness down, thinking they will remember the issue at the conclusion of the audit. Be disciplined in documenting on the go. Why?

Two reasons:

  1. You may not be on the engagement when it concludes (you are transferred to another audit) and
  2. You may not remember the issue (weeks later).

The audit standards require that we document our internal control weakness communications–either in a letter (for significant deficiencies and material weaknesses) or another way such as a memorandum (for control weaknesses we verbally communicate). Either way, the communication should be documented.

Think of the internal control communication process as follows:

  1. Capture the control deficiency on your firm’s form
  2. Later, determine whether the weakness if a significant deficiency or a material weakness
  3. If the deficiency is a significant deficiency or a material weakness, create your written letter to management and those charged with governance
  4. If the deficiency is not a significant deficiency or a material weakness, then you have already met the documentation requirement for this type of control issue (you’ve already completed your firm’s form to capture the control problem)
    • Note – You can include these other deficiencies in your written letter, but you are not required to; the communication can be verbal.

What should be on the internal control capture form? At a minimum include the following:

  1.  Check-mark boxes for:
    1. Significant deficiency
    2. Material weakness
    3. Other control deficiency
    4. Other issues (e.g., violations of laws or regulations) — this general category has no relation to internal control weaknesses
  2. Whether the probability of occurrence is at least reasonably possible and whether the magnitude of the potential misstatement is material
    • If the probability of occurrence is at least reasonably possible and the magnitude of the potential misstatement is material, then the client has a material weakness
  3. Description of the deficiency and verbal or other communications with the client about the issue (at the time the problem was identified or later); also the client’s response
  4. The cause of the condition
  5. The potential effect of the condition
  6. Recommendation to correct the issue
  7. Person who identified the issue and the date the issue was noted
  8. Whether the issue is a repeat from the prior year
  9. An area for the partner to sign off that he or she agrees with the description of the deficiency and the category assigned to it (e.g., material weakness)
  10. Reference to related documentation in the audit file

How Do You Capture and Report Control Deficiencies?

Whew! We’ve covered a lot of ground today. How do you capture and report control deficiencies? I’m always looking for new ideas: Please share.