Catching Fraudsters with Their Hands in the Till

By Bonita K. Peterson Kramer and Thomas A. Buckhoff

E-mail Story Print Story

The Key to Fraud Detection

Most ongoing frauds generate anomalies: transactions, ratios, records, or actions that are unusual or different from what one would normally expect. For example, the manager of a retail store locked his desk every time he left it, even when going to the bathroom. Such unusual behavior prompted the owner to use her extra key to open the manager’s desk, where she found thousands of dollars in invoices for sales that had not been rung into the cash register. When questioned about the invoices, the manager admitted to pocketing the proceeds from these sales.

The following case studies illustrate many of the red flags commonly generated by ongoing frauds.

Case 1: The Cashier Supervisor

For 15 years, “Debbie Drake” worked as the cashier supervisor for the state university’s student health services (SHS), earning an annual salary of $20,000. Years earlier her husband had permanently injured his back in a work-related accident and was awarded $13,500 per year in worker’s compensation benefits. To add to their financial problems, one of their three children incurred large medical bills from a serious injury in an uninsured vehicle accident. Despite Debbie’s personal problems, she was considered a model employee. She came to work early, left late, and never took time off. She took vacations only when the SHS was closed for university breaks. Even when Debbie was ill, she refused to use her sick leave. To protect her coworkers from her sickness, she came in at night to prepare the daily deposit.

As the university’s student enrollment increased, so did the cash flowing through SHS. Eventually, Debbie was regularly preparing the daily deposit at home in the evenings. Not only did her supervisor appreciate her dedication, but Debbie was also well liked and respected by her coworkers. She always remembered their birthdays, anniversaries, and other special occasions with gifts or lunches. During these lunches she would speak fondly of her family and describe their latest adventures while riding their horses on their property out of town.

The SHS generated only 2% of the university’s total annual revenues and, due to its relative immateriality, was seldom audited; the last internal audit had been more than 10 years ago. To better track revenues, the internal audit department recommended using a prenumbered multiple-copy receipt form for services rendered, and Debbie worked closely with internal auditors to create the new form. Shortly thereafter, the university suffered serious budget cuts and eliminated two of the three internal auditor staff positions. Consequently, no one ever followed up to see if SHS had implemented the internal audit recommendations. Ultimately, SHS did not prenumber each of the forms, and Debbie routinely collected two of the three copies, giving the third copy to the student patient as a receipt. As a result, there were no independent checks on Debbie that would have ensured that all of the money collected for services rendered was properly recorded and deposited into the bank.

Despite increasing numbers of student-patients served, SHS expenditures increased at a much faster rate than revenues, thereby creating unexplained cash flow problems. A newly hired SHS director suspected that money was missing, but did not know how much cash was being diverted or how. About this same time, the state’s criminal investigation division received a tip from a bank employee that cash deposits into Debbie’s account greatly exceeded her known sources of income.

A subsequent investigation revealed that Debbie had been regularly skimming cash from SHS for the past 13 years. Investigators estimated her total embezzlement to exceed $757,000. Ultimately, Debbie was prosecuted, convicted, sentenced to five years in prison, and ordered to repay the university $208,000 and to perform 250 hours of community service.

Case 2: The Welfare Eligibility Examiner

“Julie Jensen’s” responsibilities as the county’s welfare eligibility examiner included qualifying individuals for public assistance benefits. Once an individual was approved, she created the individual’s benefit account in the agency’s computer and processed the monthly payments. She was the only eligibility examiner in this particular field office, and earned a modest $20,000 a year. Her husband had returned to school in another city to pursue an advanced degree, while Julie cared for and supported their two young children. Unbeknownst to the welfare agency, Julie had stolen $40,000 from a previous employer. In that case, she wrote checks payable to herself and forged her boss’ signature. With money borrowed from her parents, Julie paid back the money, prompting her employer to not press charges.

As an employee of the county, Julie was well liked by her coworkers and worked competently with little or no supervision. She had a warm smile, a wonderful sense of humor, and a maternal manner. She was very generous with her coworkers, even renting a water cooler and purchasing a microwave oven for the office. Six years into her employment with the county, a quality assurance inspector for the welfare department selected Julie’s office for a routine audit. He discovered that one computer file he selected for review had no supporting documentation. The inspector further discovered that the welfare recipient’s name, Deborah Smith, did not correspond to her Social Security number and that Smith’s payments were being mailed to a post office box registered to Julie.

A subsequent investigation revealed that Julie had established accounts for 17 fictitious families, all using the last name Smith to help keep track of her false beneficiaries, and sending the checks to the same post office box. These fictitious entities received 450 checks, totaling $288,000 over six years.

When first confronted, Julie said that she occasionally endorsed checks for beneficiaries without checking accounts. Eventually, the mounting evidence prompted Julie to admit to stealing the money. Julie was prosecuted, convicted, sentenced to 40 years in prison, and ordered to make restitution for her theft.

The Red Flags of Fraud

Although the two schemes described above involved unique frauds, perpetrators, and organizations, they share common elements. First, the schemes were relatively simple and exploited inadequate internal controls over cash (see “Preventing Employee Fraud by Minimizing Opportunity,” by Thomas A. Buckhoff, The CPA Journal, May 2002). Second, in each case, numerous anomalies, or red flags, went unnoticed by those in the best position to detect the frauds. The Exhibit summarizes red flags present in these two cases that are also common to a variety of other fraud schemes.

The number of schemes through which dishonest employees can defraud their employers is almost limitless. Accordingly, the number of red flags, or anomalies, created by the associated frauds is also almost limitless. One effective way to identify red flags is to focus on broader indications of potential fraud. The following four questions focus on whether observations are inconsistent with normal expectations, in which case a rational explanation for the discrepancy should be sought. This technique could have been useful in the above case studies.

• Is the net cash flowing through the organization consistent with expectations?
• Are any transactions, especially those involving cash, unusual or different from what would normally be expected?
• Do expenditures seem reasonable, and does supporting documentation seem to be in order and consistent with supporting documentation for other expenditures?
• Does the behavior of those working for the organization, especially those with access to cash, seem reasonable and consistent with expectations?

Cash flow anomalies. In 2002, the Association of Certified Fraud Examiners estimated that 90% of asset-theft fraud schemes involved cash. If there are unexpected cash flow problems in an otherwise profitable business, a logical explanation should be found. Inexplicable cash flow problems should prompt management or auditors to determine whether dishonest employees are exploiting internal control weaknesses. Because Debbie’s scheme was relatively simple, it would have easily been uncovered by an investigation. In this case, during the investigation auditors discovered that the cash-to-check ratio of the deposits before and after Debbie’s suspension differed dramatically. The ratio was consistently $1 in cash for every $66 in checks when Debbie prepared the deposit. For several weeks after her suspension, the ratio was consistently $1 cash for every $2 in checks. This difference posits a simple explanation for the cash flow problems the director noticed: Debbie was stealing most of the incoming cash.

Abnormal transactions. On the surface, it might appear that there were no unusual transactions in either of these two case studies. In Debbie’s case, where the cash was stolen before it was recorded on the SHS books (i.e., skimming), no transactions related to the fraud would be found. Julie’s fraud scheme, however, required that the payments to the bogus families be recorded. Her thefts were increasing over time as she added new fictitious beneficiaries to the system and didn’t delete earlier bogus recipients. Considering that the largest amount paid to legitimate beneficiaries during any of those six years was about $68,000, the scale of her fraud—averaging $48,000 a year—should have raised questions about the dramatic increase in benefits paid over such a relatively short period of time. A review of a representative sample of new recipients would probably have included at least one of her “Smith” files, and the fraud would likely have been uncovered sooner.

Odd supporting documentation. Sometimes fraudsters will trick the organization into issuing fraudulent disbursements, as Julie did, leaving a paper trail. In these cases the documentation supporting the fraudulent expenditure might contain some anomalies. For example, if an employee is perpetrating a fictitious-vendor scheme, the invoices will typically contain several irregularities. These irregularities can include invoices that are consecutively numbered (suggesting that the victim organization is the vendor’s only customer), lacking normal trifold marks (suggesting that the invoice was not mailed), listing vague services for even-dollar amounts, or missing normal vendor contact information (such as a street address or phone number). In a ghost-employee scheme, the personnel file might contain documents indicating that the ghost employee has the same Social Security number, address, or bank account as another employee, or an unusual employee identification number. Furthermore, canceled paychecks might contain recurring dual endorsements. In Julie’s scheme, there was insufficient supporting documentation for her ghost families. She never bothered to make up phony files with the required paperwork; instead, the ghost families existed only on computer.

Out-of-the-ordinary behavior. In both case studies, the perpetrators displayed out-of-the-ordinary behavior. In the first case, Debbie was regularly preparing the bank deposit at home in the evenings. Such a procedure is certainly atypical; most employees would rather leave work at the office. Debbie was also very generous to her coworkers, regularly giving them small gifts for anniversaries and birthdays. Julie rented a water cooler for the office, and purchased a microwave oven. This kind of behavior could indicate someone with a guilty conscience who is trying to alleviate the guilt by “giving back” to the organization she has stolen from. Furthermore, Debbie insisted on preparing the daily deposit even when she was sick. This is not normal behavior for an honest person, but it is normal behavior for fraudsters trying to conceal their tracks.

Unusual behaviors should prompt management or auditors to discreetly investigate whether the cause may be a dishonest employee exploiting internal control weaknesses and trying to cover it up.