Fraud Fables Nancy Wonderlich Koonce, CPA, MBA, CVA, CFE   I don't know about you, but I've always found it easier to learn and remember things when a story or example is used.  Maybe all the fables I heard as a child made me connect a story with learning a lesson.  Maybe I just need to be entertained while I learn.  At any rate, I believe the easiest way to learn how to prevent fraud is to hear about actual cases and then figure out what could have been done to prevent them in those situations.  Following is the second of my Fraud Fables - I hope you like a story with your lessons!   The Fable of Fraud in a Government Office   Kenny Dean was elected to the office of County Tax Assessor in 1989.  At that time, the Assessor's office had a contract with Computer Support Services (CSS) for software and related materials.  Dean signed a new contract and, beginning in January 1991, the contract called for a monthly charge of $2,500, with updates and development of additional software to be billed at $175 an hour.   During the period from January 1991 through July 2002, CSS was paid a total of $1.6 million.  It was later determined that Dean received $640,000 of that as kickbacks.   The Scheme - Lynn Thompson, the owner of CSS, was having cash flow problems.  He mentioned this to Dean at a Christmas party in 1990 and, after a drink or two, the conspirators agreed that the Assessor's office would pay a monthly charge of $2,500, and Dean would receive 40% of that.  To help disguise the kickback, Dean formed a company called CompTech to receive the payments from CSS.  Since Dean was the elected official for the department, he approved payment of all invoices.  The money flowed to CSS, which passed it on to Dean.   After a year or so, Dean started to get greedy.  He instructed Thompson to inflate CSS's invoices for updates and new software.  There were minimal descriptions on the invoices, and they were only in general terms, but since Dean approved the invoices, this wasn't a problem.  Dean spent the money on entertainment and would eat out often, but that wasn't enough.  He wanted to travel overseas and enjoy life.   Dean wondered how aggressive he could get.  The same CPA firm had performed the annual audit for several years and he had gotten to know the audit team pretty well.  He decided it was time to use that friendship to assess his risk.  During the next audit, through discussions with various team members, he learned what amount was considered material, how the random sample was chosen, what test work was performed, and how exceptions were handled.  He learned that, because the County didn't want to pay very much for the audit, test work was minimal.  Dean felt that as long as he kept below the materiality level, he would be able to handle any question that might come up concerning a CSS invoice.  He would increase his budget annually for the increasing costs of computer technology, and then take home as much as he wanted.  After all, it wasn't like he was stealing from anyone personally.  And he paid taxes, too, so some of the money was his anyway.   The Discovery - Dean was writing his response to the Management letter received from the auditing firm.  It was all minor stuff, including concerns about the descriptions on the CSS invoices, but he had received an unqualified report, so he wasn't concerned.  This was the third year CSS had been mentioned in the Management letter, but it was the Audit Report that mattered, and that was clean.    What Dean didn't realize was that the State Auditor required copies of the Management letter as well as the Audit Report, or that the State Auditor had decided to aggressively pursue suspected fraudulent activity as a way to further his political career.   CSS's mention for a third year in a row was a red flag, and the State Auditor decided to check it out.  An investigation of CSS showed a pattern of payments to CompTech made the same day payments were received from the Assessor's Office.  An investigation of CompTech led to Dean and the $640,000 embezzlement.   Dean was never charged by state or federal authorities for taking the illegal kickbacks; however, he was convicted and sentenced for tax evasion.   Lessons Learned   According to Donald R. Cressey's theories on fraud, [1] there are three elements present in every fraud that are known as the "fraud triangle."  These are:   Motive - a non-shareable need or pressure.  This could be caused by things such as gambling or substance abuse, a personal failure, a need for status, or poor employer-employee relations.  The fact that it is non-shareable in the eyes of the perpetrator means that it also has to be resolved in secret. Opportunity - having the general information and technical skill to commit the violation.  Generally the perpetrator is in a position of trust. Rationalization - this occurs before the crime takes place.  Because perpetrator does not think of himself as a criminal, he must justify his actions.  He may say it is just a loan, or that his employer doesn't pay him what he is worth.   For Dean, the motive was his desire for the better things in life.  He was an elected official, and he felt he deserved them.  He had the opportunity because of his ability to approve invoices for payment, and also through his ability to gather information from the auditors.  His rationalization was two-fold.  First, he was helping a small business stay open.  His kickback was simply a payment for his share of the risk.  Second, the money was in his budget, so if it wasn't spent otherwise, it belonged to him.   What lessons did the county learn?  They have started bidding out contracts for computer services with detailed invoicing.  They have also made it policy that only bills with detailed and valid invoices will be paid.  To me, this just means that the fraudsters will get more creative in their invoicing.  The real problem is with the nature of government itself:   There is lots of money; Audits usually go to the lowest bidder; Materiality levels on governments audits are high; There is little oversight on many elected officials; and There is the perception that the money doesn't really belong to anyone. [1] Donald R. Cressey, Other People's Money (Montclair: Patterson Smith, 1973)

The Fable of the Embezzling Bookkeeper During the annual audit of a company that administered pension and benefit plans for eight different labor unions, the random sample of disbursements produced something interesting.  The luck of the draw produced two checks to the same company for the same amount - not interesting in itself, but the endorsements on the checks were different.  The checks were dated a month apart, and both were charged to the insurance expense account for one of the union funds.  Monthly insurance payments made sense, but the endorsements were troubling.  Tracing the payments back to the invoice produced identical invoices.  Checks were pulled from some of the other unions' funds, and others matching the suspect endorsement with duplicate invoices were found.  At this point the FBI and the U.S. Department of Labor were brought in, and a warrant was acquired for information from the bank on the account matching the suspect endorsement.  The bank information led to the bookkeeper.  The bookkeeper was interviewed by the FBI, confessed, and later pleaded guilty in U.S. District Court.   How much had she taken?  Her estimate was about $30,000.  (The investigation showed that it exceeded $75,000).  Two previous audits had failed to uncover evidence of the fraud.   How long had it been going on?  She knew the exact date of the first check written - April 15, two-and-a-half years earlier. She used the money to pay her taxes.   How did she do it?  It was simple, really.  She typed the check on her correcting typewriter and presented it with the invoice to the owner with all the other checks for signature.  After it was signed, she removed the company name, typed her own, and deposited it in the bank.  When the bank statement came in, she removed her name and put the insurance company's name back on it.  The following month the invoice was presented again with another check for payment.  There were several other clerks in the office, but she was the only one who dealt with accounts payable, plus she reconciled the bank statement.  The others handled medical claims, retirement benefits, etc.  The owner dealt with so many checks for the eight different funds that she never noticed the duplication.   During the investigation, fellow employees stated that they had noticed a change in the bookkeeper's spending habits.  She went from being barely able to pay her bills to paying cash for her daughter's extravagant wedding.  She bought a new car and wore expensive clothes.  They thought something was wrong, but didn't know what to do about it.   A member of one union's Board - one who had been in charge of soliciting and reviewing bids for insurance - had noticed that the insurance expense exceeded what he thought it should be, but he never mentioned it.   The bookkeeper was sentenced to 13 months in prison and three years' supervised release.  She was also ordered to pay restitution to the embezzlement victims.  All but one of the labor unions eventually withdrew their business from the company, and the company later closed and filed bankruptcy.    The owner thought she knew better than the auditors.  She understood what separation of duties meant and told the auditors she had multiple employees performing the functions the bookkeeper performed.  Actually she felt it was less risky to have one person with access to the general ledger and the bank account than to have multiple people handling different parts of the process.  She equated fewer people with less risk.   Lessons Learned   The obvious lesson in this case is separation of duties.  The person cutting the checks should not be the person mailing them.  And that definitely should not be the person receiving and reconciling the bank statement.  Additionally, notations of payment should be made on the original invoice.  If the owner felt she could not assign these duties to others, then at a minimum she should have mailed the checks herself.  With or without separation of duties, she should have had the bank statement mailed to her home for review prior to reconciliation.   There are other lessons, too:   If the company had subscribed to a hotline and educated employees about its availability, a tip from one of the fellow employees may have uncovered the fraud earlier.    If the union Board had been reminded about their responsibilities for the prevention of fraud and possible indications thereof, that Board member might have questioned the amount of insurance expense.   If the owner had understood the "why" of separation of duties, and not just the "what," she may still be in business today.

The Fable of the Traveling Salesman Accounts Payable - Sharon just sat there staring at the expense report and feeling helpless. The expense report had been submitted by Bob, a salesman for the Northwest Region, but one of the receipts attached to the report was for a dinner at a local restaurant.  Additionally, the date on the receipt was her birthday, and she had seen Bob at the restaurant that night with his family when she was there celebrating her birthday with her family.  It was wrong, but she didn't know what to do about it.    In the past Sharon had pointed out similar problems and discrepancies to her boss, but he had refused to act on it.  Bob was the company's top salesman, the "Golden Boy" who was going to bring the company out of its financial troubles.   Top management loved him, and Sharon's boss was not about to rock the boat and put his own job in jeopardy.  Besides, what was a few dollars of expense money compared to the hundreds of thousands of dollars that Bob brought it?   And Sharon had noticed that the problem was spreading.  Other salesmen had started submitting questionable expense reports.  She knew it was wrong, but she wasn't going to get them in trouble if nothing was going to be done about Bob.  She processed Bob's expense report for payment.   Sales Department - Mike looked at the latest sales figures and was very pleased.  Gross sales for the past quarter were up 65% over the same quarter last year.  The best thing he had ever done was implement the incentive program.  His sales people were working harder than ever - as evidenced by the increase in travel costs - and they were producing results.  Especially Bob.  Bob's sales had more than doubled, and his sales alone made up the bulk of the increase.  His incentive payment for the quarter would exceed $55,000, but he was worth every penny.   CEO's Office - Linda looked at the financial statements for the past quarter and was more frustrated than ever.  Sales were great, but the bottom line was still in the red.  The problem appeared to be retention.  The sales force was making the sales, but the company was losing customers almost as fast.  The confusing thing was that it didn't appear to be anything the company was doing wrong.  She had checked the reasons given for cancellation, and they were things like a fire in a factory, the death of an owner, or poor economy in the area.  There had to be a solution, but she was stumped.   Accounts Receivable - Lonnie was perplexed.  The street address on the customer information sheet couldn't be right, so he called the 1-800 number on the form to verify it.  Then he called his mother.   Lonnie had moved here from Everton, Washington to attend college.  He was working for a temp agency to pay living expenses, and the temp agency had placed him with this company to fill in for the regular A/R clerk while she was on maternity leave.  His primary job was to setup new customers in the accounts receivable program.  He was perplexed because the address on the customer information sheet was his parents' address.  He took the form to the head of the department.   The Fraud - Bob couldn't believe it.  A temp employee had brought him down.  Things were working so well, and it had been so easy to do.  He would fly to Seattle to see his mistress every week, then travel around the Northwest and enjoy the sights.   And the company was picking up the tab.  All he had to do was open a few P. O. Boxes along the way and rotate the 1-800 numbers at his mistress's apartment.  He would drive around a town looking for an interesting street name, then make up an address and company to go along with it.  He would submit the sales orders, and then his mistress would call and cancel them.  He would keep the 1-800 number for another month - in case of a callback from the company - then replace that with a new one and start again.  He had to make some real sales calls, but he didn't have to work too hard at it.  His "incentives" had exceeded $300,000, and his costs were less than $5,000.  And the $300,000 didn't include travel expenses reimbursed that weren't even traveling expenses, like dinner out with his family.    The Costs - After a complete investigation of the sales department, it was determined that the cost of Bob's fraud was over $500,000.  Another salesperson had started down the same path as Bob and his fraud cost an additional $10,000.  Fraudulent travel expenses reports from several sales persons cost the company another $6,000.   Lessons Learned   The most recent Report to the Nation from the Association of Certified Fraud Examiners shows that 90% of frauds are found by accident.  That was the case here, but there are some things we can learn from this company:   This company operated as individual departments rather than a team.  The sales department was only responsible for sales, customer service department for customer service, etc.  Because of this, management couldn't see the connection between the increase in sales and the retention problems, and placed the blame for financial problems on the wrong department.   Incentive programs seem to be an invitation to fraud.  I realize their purpose, but it is almost impossible to design an incentive program that accurately rewards realized results. Even then the results can be tampered with if the incentive is right.   Bob counted on the fact that the company's policy was to use P. O. Boxes for mailing (for security reasons), and 1-800 numbers for telephone calls (to save money on phone bills).  A random check needs to be done to verify that customer companies actually exist.   A company hotline would have given Sharon somewhere to turn when her boss refused to act on the fraudulent expense reports.   A passive acceptance of fraud is the same as encouraging it.  The rest of the sales force knew that Bob was submitting fraudulent expense reports, and yet he was being rewarded as the biggest sales producer each quarter.  They figured if he could do it, so could they.  Management needs to be vocal and inflexible when it comes to fraud.  It should be made clear that there are no exceptions.     Check back soon for more Fraud Fables by Nancy Wonderlich Koonce.