Fraudsters with Their Hands in the Till
Bonita K. Peterson Kramer and Thomas A. Buckhoff
- Dishonest employees are increasingly getting caught with
their hands in the till. A 2003 KPMG survey found that 75%
of respondents had experienced at least one instance of employee
theft, a 13% increase over its 1998 survey. The Association
of Certified Fraud Examiners estimated in 2002 that fraud
costs organizations about $600 billion per year, or about
6% of total revenues. A 2003 PricewaterhouseCoopers survey
projected the average fraud loss per company at $2.2 million,
with 60% of the losses resulting from employee theft. These
survey results, although alarming, are based upon those frauds
that were detected. According to fraud experts, about 40%
of fraudulent activity goes undetected.
Key to Fraud Detection
ongoing frauds generate anomalies: transactions, ratios,
records, or actions that are unusual or different from what
one would normally expect. For example, the manager of a
retail store locked his desk every time he left it, even
when going to the bathroom. Such unusual behavior prompted
the owner to use her extra key to open the manager’s
desk, where she found thousands of dollars in invoices for
sales that had not been rung into the cash register. When
questioned about the invoices, the manager admitted to pocketing
the proceeds from these sales.
following case studies illustrate many of the red flags
commonly generated by ongoing frauds.
1: The Cashier Supervisor
15 years, “Debbie Drake” worked as the cashier
supervisor for the state university’s student health
services (SHS), earning an annual salary of $20,000. Years
earlier her husband had permanently injured his back in
a work-related accident and was awarded $13,500 per year
in worker’s compensation benefits. To add to their
financial problems, one of their three children incurred
large medical bills from a serious injury in an uninsured
vehicle accident. Despite Debbie’s personal problems,
she was considered a model employee. She came to work early,
left late, and never took time off. She took vacations only
when the SHS was closed for university breaks. Even when
Debbie was ill, she refused to use her sick leave. To protect
her coworkers from her sickness, she came in at night to
prepare the daily deposit.
the university’s student enrollment increased, so
did the cash flowing through SHS. Eventually, Debbie was
regularly preparing the daily deposit at home in the evenings.
Not only did her supervisor appreciate her dedication, but
Debbie was also well liked and respected by her coworkers.
She always remembered their birthdays, anniversaries, and
other special occasions with gifts or lunches. During these
lunches she would speak fondly of her family and describe
their latest adventures while riding their horses on their
property out of town.
SHS generated only 2% of the university’s total annual
revenues and, due to its relative immateriality, was seldom
audited; the last internal audit had been more than 10 years
ago. To better track revenues, the internal audit department
recommended using a prenumbered multiple-copy receipt form
for services rendered, and Debbie worked closely with internal
auditors to create the new form. Shortly thereafter, the
university suffered serious budget cuts and eliminated two
of the three internal auditor staff positions. Consequently,
no one ever followed up to see if SHS had implemented the
internal audit recommendations. Ultimately, SHS did not
prenumber each of the forms, and Debbie routinely collected
two of the three copies, giving the third copy to the student
patient as a receipt. As a result, there were no independent
checks on Debbie that would have ensured that all of the
money collected for services rendered was properly recorded
and deposited into the bank.
increasing numbers of student-patients served, SHS expenditures
increased at a much faster rate than revenues, thereby creating
unexplained cash flow problems. A newly hired SHS director
suspected that money was missing, but did not know how much
cash was being diverted or how. About this same time, the
state’s criminal investigation division received a
tip from a bank employee that cash deposits into Debbie’s
account greatly exceeded her known sources of income.
investigation revealed that Debbie had been regularly skimming
cash from SHS for the past 13 years. Investigators estimated
her total embezzlement to exceed $757,000. Ultimately, Debbie
was prosecuted, convicted, sentenced to five years in prison,
and ordered to repay the university $208,000 and to perform
250 hours of community service.
2: The Welfare Eligibility Examiner
Jensen’s” responsibilities as the county’s
welfare eligibility examiner included qualifying individuals
for public assistance benefits. Once an individual was approved,
she created the individual’s benefit account in the
agency’s computer and processed the monthly payments.
She was the only eligibility examiner in this particular
field office, and earned a modest $20,000 a year. Her husband
had returned to school in another city to pursue an advanced
degree, while Julie cared for and supported their two young
children. Unbeknownst to the welfare agency, Julie had stolen
$40,000 from a previous employer. In that case, she wrote
checks payable to herself and forged her boss’ signature.
With money borrowed from her parents, Julie paid back the
money, prompting her employer to not press charges.
an employee of the county, Julie was well liked by her coworkers
and worked competently with little or no supervision. She
had a warm smile, a wonderful sense of humor, and a maternal
manner. She was very generous with her coworkers, even renting
a water cooler and purchasing a microwave oven for the office.
Six years into her employment with the county, a quality
assurance inspector for the welfare department selected
Julie’s office for a routine audit. He discovered
that one computer file he selected for review had no supporting
documentation. The inspector further discovered that the
welfare recipient’s name, Deborah Smith, did not correspond
to her Social Security number and that Smith’s payments
were being mailed to a post office box registered to Julie.
investigation revealed that Julie had established accounts
for 17 fictitious families, all using the last name Smith
to help keep track of her false beneficiaries, and sending
the checks to the same post office box. These fictitious
entities received 450 checks, totaling $288,000 over six
first confronted, Julie said that she occasionally endorsed
checks for beneficiaries without checking accounts. Eventually,
the mounting evidence prompted Julie to admit to stealing
the money. Julie was prosecuted, convicted, sentenced to
40 years in prison, and ordered to make restitution for
Red Flags of Fraud
the two schemes described above involved unique frauds,
perpetrators, and organizations, they share common elements.
First, the schemes were relatively simple and exploited
inadequate internal controls over cash (see “Preventing
Employee Fraud by Minimizing Opportunity,” by Thomas
A. Buckhoff, The CPA Journal, May 2002). Second,
in each case, numerous anomalies, or red flags, went unnoticed
by those in the best position to detect the frauds. The
Exhibit summarizes red flags present in these two cases
that are also common to a variety of other fraud schemes.
number of schemes through which dishonest employees can
defraud their employers is almost limitless. Accordingly,
the number of red flags, or anomalies, created by the associated
frauds is also almost limitless. One effective way to identify
red flags is to focus on broader indications of potential
fraud. The following four questions focus on whether observations
are inconsistent with normal expectations, in which case
a rational explanation for the discrepancy should be sought.
This technique could have been useful in the above case
Is the net cash flowing through the organization consistent
Are any transactions, especially those involving cash,
unusual or different from what would normally be expected?
Do expenditures seem reasonable, and does supporting documentation
seem to be in order and consistent with supporting documentation
for other expenditures?
Does the behavior of those working for the organization,
especially those with access to cash, seem reasonable
and consistent with expectations?
flow anomalies. In 2002, the Association of
Certified Fraud Examiners estimated that 90% of asset-theft
fraud schemes involved cash. If there are unexpected cash
flow problems in an otherwise profitable business, a logical
explanation should be found. Inexplicable cash flow problems
should prompt management or auditors to determine whether
dishonest employees are exploiting internal control weaknesses.
Because Debbie’s scheme was relatively simple, it
would have easily been uncovered by an investigation. In
this case, during the investigation auditors discovered
that the cash-to-check ratio of the deposits before and
after Debbie’s suspension differed dramatically. The
ratio was consistently $1 in cash for every $66 in checks
when Debbie prepared the deposit. For several weeks after
her suspension, the ratio was consistently $1 cash for every
$2 in checks. This difference posits a simple explanation
for the cash flow problems the director noticed: Debbie
was stealing most of the incoming cash.
transactions. On the surface, it might appear
that there were no unusual transactions in either of these
two case studies. In Debbie’s case, where the cash
was stolen before it was recorded on the SHS books (i.e.,
skimming), no transactions related to the fraud would be
found. Julie’s fraud scheme, however, required that
the payments to the bogus families be recorded. Her thefts
were increasing over time as she added new fictitious beneficiaries
to the system and didn’t delete earlier bogus recipients.
Considering that the largest amount paid to legitimate beneficiaries
during any of those six years was about $68,000, the scale
of her fraud—averaging $48,000 a year—should
have raised questions about the dramatic increase in benefits
paid over such a relatively short period of time. A review
of a representative sample of new recipients would probably
have included at least one of her “Smith” files,
and the fraud would likely have been uncovered sooner.
supporting documentation. Sometimes fraudsters
will trick the organization into issuing fraudulent disbursements,
as Julie did, leaving a paper trail. In these cases the
documentation supporting the fraudulent expenditure might
contain some anomalies. For example, if an employee is perpetrating
a fictitious-vendor scheme, the invoices will typically
contain several irregularities. These irregularities can
include invoices that are consecutively numbered (suggesting
that the victim organization is the vendor’s only
customer), lacking normal trifold marks (suggesting that
the invoice was not mailed), listing vague services for
even-dollar amounts, or missing normal vendor contact information
(such as a street address or phone number). In a ghost-employee
scheme, the personnel file might contain documents indicating
that the ghost employee has the same Social Security number,
address, or bank account as another employee, or an unusual
employee identification number. Furthermore, canceled paychecks
might contain recurring dual endorsements. In Julie’s
scheme, there was insufficient supporting documentation
for her ghost families. She never bothered to make up phony
files with the required paperwork; instead, the ghost families
existed only on computer.
behavior. In both case studies, the perpetrators
displayed out-of-the-ordinary behavior. In the first case,
Debbie was regularly preparing the bank deposit at home
in the evenings. Such a procedure is certainly atypical;
most employees would rather leave work at the office. Debbie
was also very generous to her coworkers, regularly giving
them small gifts for anniversaries and birthdays. Julie
rented a water cooler for the office, and purchased a microwave
oven. This kind of behavior could indicate someone with
a guilty conscience who is trying to alleviate the guilt
by “giving back” to the organization she has
stolen from. Furthermore, Debbie insisted on preparing the
daily deposit even when she was sick. This is not normal
behavior for an honest person, but it is normal behavior
for fraudsters trying to conceal their tracks.
behaviors should prompt management or auditors to discreetly
investigate whether the cause may be a dishonest employee
exploiting internal control weaknesses and trying to cover
K. Peterson Kramer, PhD, CPA, CMA, CIA, is a professor
of accounting at Montana State University–Bozeman. Thomas
A. Buckhoff, PhD, CFE, CPA, is an associate professor
in the school of accountancy, college of business administration,
Georgia Southern University, Statesboro, Ga.