Five-Step Approach to Fraud Detection: #1 Know the Exposures

Risk: Employees Misusing Accounts Payable Checks or Wire Transfers

Whether I am performing a tactical review of an area or discussing fraud-prevention strategy with executives, I always begin with a "What Can Go Wrong" list, in which I list potential perpetrators and fraud acts. Considering the risk of employees using company money to fund personal expenditures, here is a list of what can go wrong:

Former CFO of Patterson-UTI Energy, Inc. admits to embezzling more than $77 million from employer … Between 1998 and 2000, [the CFO] forged approximately 38 checks, totaling approximately $4,639,750.00. Each check was made payable to [the CFO] or … an entity created and controlled by [the CFO]. ¹

An Information Technology Director in charge of purchasing expensive network hardware established a shell company to stand between his employer and their legitimate network hardware vendor. The Director would make a legitimate purchase from the vendor, and the vendor would ship the product to the employer. However, the Director instructed the vendor to invoice his shell company, which would in turn mark-up the true cost of the hardware and invoice his employer for the higher amount. The employer thus paid $5 million extra for the products, which the Director kept and used for personal purchases.

In the latest setback for the corporate governance movement, Yale University's School of Management is quietly forcing out the prize-winning head of its International Institute for Corporate Governance … [The perpetrator] allegedly double-billed Yale for about $150,000 in business travel expenses since mid-2001. ²

Top Roslyn school officials and their friends and family siphoned off more than $11 million of district money … revolved around the abuse of district credit cards originally issued to [the perpetrators who] in turn handed out the cards to family and friends until 74 cards were circulating among 13 people. Between 1997 and last year, they charged $5.9 million for personal use. ³

Typically, my "What Can Go Wrong" documents for a particular area will list at least two or three dozen frauds stated in a single sentence or two. My lists typically do not elaborate the frauds to the extent you see above, but for our purposes here it was necessary for you to see some details about the frauds. For instance, I might state the first fraud above as follows: "The CFO forged checks made payable to himself or an entity controlled by him."

It is important to list both the perpetrator and the fraud act when you create your own exposure lists. Resist the urge to eliminate the perpetrator; their inclusion in your list brings the fraud to life, gives your list a sense of action.

As you can see, these are big frauds perpetrated by high-level folks. Too often we focus on the easy targets—the clerk in the corner rather than the company's rainmakers. Your most dangerous frauds will be those perpetrated by your executives, so be sure to include them as potential perpetrators.

Symptoms

The next step in the process is to list the symptoms, or what these frauds would look like in the books and records. Here is a short list derived from the frauds listed above—you are likely to come up with many more symptoms:

• One vendor whose name no one recognizes received an unusual amount of funds from Accounts Payable relative to other vendors in the past quarter.
• A vendor address, tax ID, or contact phone number matches that of one of the company's employees.
• A canceled check is double-endorsed on the back.
• The CEO's signature on a large check does not match the signature on other checks he has signed, and he has never seen the checks he supposedly signed.
• There is no approved purchase order, no packing slip for received goods, and no indication of a received service for an invoice that was paid.
• A manager's cost center is way over budget.
• Expenses are being coded to a "miscellaneous" or "black hole" account which no one is reviewing.
• An employee is submitting multiple expenses for the same amounts.
• An employee is submitting photocopied receipts on their expense reports.
• Several company credit cards have been issued to the same employee.
• Some of the credit cards contain far more purchases than the company average.

Again, these are just a few, but you will notice that I did not list a single control weakness. A control weakness is not a symptom of fraud. Just because a control is present, does not mean a fraud is not occurring. Conversely, just because a control is absent does not mean a fraud is occurring. Just because someone smokes does not mean they have lung cancer, and just because they do not smoke does not mean their lungs are clear. A doctor must look for the symptoms.

In each of the frauds listed above, it can be assumed that some controls were present. In the first fraud, the company had a control in which the CEO signed checks above a certain amount—the CFO simply forged the signature. So if we ignored the area just because we heard proper controls existed, then we would have missed a massive fraud.

Build Audit Programs/Detective Processes to Look for Symptoms

This is the last step I will discuss in the five-step approach to fraud detection; the other two are self-explanatory. If you perform audits, your step here is to include symptom detection in your audit programs. Auditors: look for symptoms of fraud! Quit looking for approval signatures and thinking your work is done; every fraudulent disbursement or expense report I have seen in my career had an approval signature on it. This does not mean someone approved the frauds, it just means the approver failed to pay attention, did not take their authority seriously, did not have time to properly review the item, or did not understand (or care about) what they should have been looking for.

If you manage an operational or finance/accounting unit, design processes to detect symptoms. Managers generally understand how to establish preventative controls: approval signatures for checks over a certain amount, requiring original receipts on expense reports, three-way matching approved purchase orders to invoices to packing slips. What managers are not so good at are establishing processes to detect frauds after the perpetrator has run the gauntlet of front-end controls. It is like a rancher who builds a fence around his livestock but has no way to catch the thief who has jumped the barrier.

Following are some audit tests/detective processes designed to catch the symptoms listed above.

• Using system queries or data analysis software such as Idea^®, periodically summarize your top 25 vendors both by the amount of money and by the number of payments they receive. Review the list, focusing on vendors whose names you do not recognize. Starting with the largest, review the supporting documentation and verify receipt of a product or service of that vendor's invoices.
• Use data analysis to join a check register or vendor master file with an employee database (such as a payroll listing or headcount report). Seek vendors with the same address, tax ID, or contact phone number as an employee.
• Review canceled checks for double endorsements, especially those with check requests labeled as "rush jobs, please hurry."
• Review large and unusual expenditures with the approving executive, ensure the approver fully understood what they were approving, and determine whether the documentation adequately supports the expense (missing or inadequate documentation is the number one symptom of fraud).
• Analyze total expenditures by cost center, particularly focusing on those with increasingly higher spending month after month. Starting with the largest, most unusual expenditure amounts, pull all supporting documentation, including the check, purchase order, invoice, and proof of receipt of a good or service. Ensure all data matches, pay attention to details on the support, and use data analysis to seek duplicate expense submissions or multiple company credit cards issued to the same employee.
• Pull expense reports for your top 25 travelers over a period. Look for large and unusual expenses, particularly odd miscellaneous expenses and high airfare submissions. Confirm whether the expense was legitimate, the flight actually taken. Seek inadequate documentation, such as photocopied receipts or credit cards statements as support.
• Perform the previous procedure with the top 25 spenders on your company credit card.

Of course, the descriptions of these tests are too general to properly implement, but they should provide you with an idea about how to construct detective procedures within your own environment. Good luck in finding employees who use company money for personal reasons!