Honest people steal. Nice, innocent looking people take money that’s not theirs. How? One way is expense fraud.
The Honest Person’s Fraud
Expense fraud is one of the most common frauds. While the damage is usually low, this theft is pervasive in most businesses.
I teach a college Bible study, and in it, I sometimes talk about “acceptable sins,” things like gossip, impatience, anger. My point is they are all issues and not acceptable, but we like to pawn them off as being okay–especially when it’s me that’s angry.
Likewise, expense report fraud is often viewed as acceptable, at least when it’s within bounds. But we all know fraud is fraud. The taking of something that does not belong to us is theft. But, I must say, it is so human to fudge on expense reports. We think things like: If I drove 355 miles, isn’t it okay to round up to 375? After all, I forgot to turn on my distance gauge until I was at least three miles out of town. Such rationalizations are easy to come by.
It always amazes me that executives–making six figures–are willing to jeopardize their positions for a few measly dollars. But C-suite employees commit expense report fraud just like new-hires. You might remember the Health and Human Services Secretary once resigned over questions about travel. While the Secretary was not accused of expense report fraud, it’s an example of how powerful people can abuse the use of travel privileges and, in this case, cost his employer (the federal government) money.
So how do people inflate their expense reports?
Filing the same receipt multiple times
Asking for advances and then requesting a second payment after returning from the trip
Submitting receipts of a nonemployee (e.g., spouse)
Submitting hotel reservation printouts (with projected cost) but not spending the night there
The Control Weakness
Usually, the weakness is that no one is properly reviewing the expense reports. Also, the company may not appropriately communicate the penalties (what happens when fraud is detected) for false reporting.
Correcting the Control Weakness
Create a written expense report policy that all employees sign, acknowledging their agreement to abide by the guidance.
The person reviewing the expense reports should be trained. He needs to know what is acceptable–and what is not. And most importantly, the person reviewing expense reports must be supported by the leadership of the entity–he has to know that the CEO or board chair has his back. (It’s difficult to stand up to high-level employees unless the reviewer knows the leader supports him.)
Brainstorming and planning your response to fraud risk
Auditor’s Responsibility for Detecting Fraud – AU-C 240
I still hear auditors say, “We are not responsible for detecting fraud.” But are we not? The detection of material misstatements whether caused by error or fraud is the heart and soul of an audit. So writing off our responsibility for fraud is not an option. We must plan to look for material fraud.
Audits will not, however, detect every material misstatement—even if the audit is properly planned and conducted. Audits are designed to provide reasonable assurance, not perfect assurance. Some material frauds will not be detected. Why? First, an auditor’s time is limited. He can’t audit forever. Second, complex systems make it extremely difficult to discover fraud. Third, the number of potential fraud schemes (there are thousands) makes it challenging to consider all possibilities. And, finally, some frauds are so well hidden that auditors won’t detect them.
Even so, auditors should not turn a blind eye to fraud.
Turning a Blind Eye to Fraud
Why do auditors not detect fraud?
We don’t look for fraud because we don’t understand it
Think of these reasons as an attitude—a poor one—regarding fraud. This disposition manifests itself in the audit file with signs of disregard for fraud.
Signs of Auditor Disregard for Fraud
A disregard for fraud appears in the following ways:
Asking just one or two questions about fraud
Limiting our inquiries to as few people as possible (maybe even just one)
Discounting the potential effects of fraud (after known theft occurs)
Not performing walkthroughs
We don’t conduct brainstorming sessions and window-dress related documentation
Our files reflect no responses to brainstorming and risk assessment procedures
Our files contain vague responses to the brainstorming and risk assessment (e.g., “no means for fraud to occur; see standard audit program” or “company employees are ethical; extended procedures are not needed”)
The audit program doesn’t change though control weaknesses are noted
In effect, auditors—at least some—dismiss the possibility of fraud, relying on a balance sheet approach.
So how can we understand fraud risks and respond to them? First, let’s look at fraud incentives.
Incentives for Fraud
The reasons for theft vary by each organization, depending on the dynamics of the business and people who work there. Fraudsters can enrich themselves indirectly (by cooking the books) or directly (by stealing).
Fraud comes in two flavors:
Cooking the books (intentionally altering numbers)
Cooking the Books
Start your fraud risk assessment process by asking, “Are there any incentives to manipulate the financial statement numbers.” For example, does the company provide bonuses or promote employees based on profit or other metrics? If yes, an employee can indirectly steal by playing with the numbers. Think about it. The chief financial officer can inflate profits with just one journal entry—not hard to do. While false financial statements is a threat, the more common fraud is theft.
If employees don’t receive compensation for reaching specific financial targets, they may enrich themselves directly through theft. But employees can only steal if the opportunity is present. And where does opportunity come from? Weak internal controls. So, it’s imperative that auditors understand the accounting system and—more importantly—related controls.
Discovering Fraud Opportunities
My go-to procedure in gaining an understanding of the accounting system and controls is walkthroughs. Since accounting systems are varied, and there are no “forms” (practice aids) that capture all processes, walkthroughs can be challenging. So, we may have to “roll up our sleeves,” and “get in the trenches.”
For most small businesses, performing a walkthrough is not that hard. Pick a transaction cycle; start at the beginning and follow the transaction to the end. Ask questions and note who does what. Inspect the related documents. As you do, ask yourself two questions:
What can go wrong?
Will existing control weakness allow material misstatements?
In more complex companies, break the transaction cycle into pieces. You know the old question, “How do you eat an elephant?” And the answer, “One bite at a time.” So, the process for understanding a smaller company works for a larger one. You just break it down and allow more time.
Discovering fraud opportunities requires the use of risk assessment procedures such as observations of controls, inspections of documents and inquiries. Of the three, the more commonly used is inquiries.
Inquiries Required by Audit Standards
Audit Standards (AU-C 240) state that we should inquire of management regarding:
Management’s assessment of the risk that the financial statements may be materially misstated due to fraud, including the nature, extent, and frequency of such assessments
Management’s process for identifying, responding to, and monitoring the risks of fraud in the entity, including any specific risks of fraud that management has identified or that have been brought to its attention, or classes of transactions, account balances, or disclosures for which a risk of fraud is likely to exist
Management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity
Management’s communication, if any, to employees regarding its views on business practices and ethical behavior
The auditor should make inquiries of management, and others within the entity as appropriate, to determine whether they know of any actual, suspected, or alleged fraud affecting the entity
For those entities that have an internal audit function, the auditor should make inquiries of appropriate individuals within the internal audit function to obtain their views about the risks of fraud; determine whether they have knowledge of any actual, suspected, or alleged fraud affecting the entity; whether they have performed any procedures to identify or detect fraud during the year; and whether management has satisfactorily responded to any findings resulting from these procedures
Notice that AU-C 240 requires the auditor to ask management about its procedures for identifying and responding to the risk of fraud. If management has no method of detecting fraud, might this be an indicator of a control weakness? Yes. What are the roles of management and outside auditors regarding fraud?
Management develops control systems to lessen the risk of fraud.
Auditors review the accounting system to see if fraud-prevention procedures are designed and operating appropriately.
So, the company creates the accounting system, and the auditor gains an understanding of the same. As auditors gain an understanding of the accounting system and controls, we put together the pieces of a story.
The Accounting Story and Big Bad Wolves
Think of the accounting system as a story. Our job is to understand the narrative of that story. As we describe the accounting system in our work papers, we may find missing pieces. Controls may be inadequate. When they are, we ask more questions to make the story complete.
The purpose of writing the storyline is to identify any “big, bad wolves.”
The threats in our childhood stories were easy to recognize. The wolves were hard to miss. Not so in walkthroughs. It is only in connecting the dots—the workflow and controls—that the wolves materialize.
So, how long should the story be? That depends on the size of the organization. Scale your documentation. If the transaction cycle is simple, the documentation should be simple. If the cycle is complex, provide more details. By focusing on control weaknesses that allow material misstatements, you’ll avoid distracting details.
I summarize the internal control strengths and weaknesses within the description of the system and controls and highlight the wording “Control weakness.” For example:
Control weakness: The accounts payable clerk (Judy Jones) can add new vendors and can print checks with digital signatures. In effect, she can create a new vendor and have a check sent to that provider without anyone else’s involvement.
Highlighting weaknesses makes them more prominent. Then I can use the identified fraud opportunities to brainstorm about how theft might occur and to develop my responses to the threats.
Brainstorming and Planning Your Responses
Now, you are ready to brainstorm about how fraud might occur and to plan your audit responses.
Armed with knowledge about the company, the industry, fraud incentives, and the control weaknesses, we are ready to be creative.
In what way are we to be creative? Think like a thief. By thinking like a fraudster, we unearth theft schemes. Why? So we can audit those possibilities. This is the reason for risk assessment procedures in the first place.
What we discover in risk assessment informs the audit plan. Now we are ready to perform our fraud risk assessment. With the information gained in from the risk assessment procedures, we know where the risks are. If, for example, there is a risk that fictitious vendors are present, we might assess the risk of material misstatement at high for the expense occurrence assertion. (Our risks of material misstatement should be assessed at the assertion level.) Then we plan our response which might be testing new vendors added to determine if they are legitimate. So the fraud risk assessment occurs after we perform our risk assessment procedures. This tells us where the risks of material misstatement are.
The Auditor’s Responsibility for Detecting Fraud – AU-C 240
In conclusion, I started this post saying I’d answer the question, “What is an auditor’s responsibility for detecting fraud?”
Hopefully, you now better understand fraud procedures. But to understand the purpose of them, look at a standard audit opinion:
The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud or error. In making those risk assessments,the auditor considers internal control relevant to the entity’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal control. Accordingly, we express no such opinion.
The purpose of fraud risk assessmentsis not to opine on internal control systems or to discover every fraud. It is to assist the auditor in determining where material misstatements—due to fraud—might occur.
Additionally, even well-performed audits will not detect all material fraud. As we saw above, some frauds are extremely difficult to detect. Audits are designed to provide reasonable assurance, not perfect assurance. The standard audit opinion states:
Our responsibility is to express an opinion on these financial statements based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free from material misstatement.
In summary, the auditor should conduct the audit in a manner to detect material fraud. But it is possible that some material frauds will be missed, even when we perform the audit correctly.
The Why and How of Auditing: A Blog Series About Audit Basics
You’ll see how to audit cash, receivables/revenues, payables/expenses, investments, and other transaction cycles. You’ll also see how to perform risk assessment procedures before you plan your further audit procedures.
Is it possible for one person to steal over $53 million from a city with an annual budget of less than $10 million? Yes. The Rita Crundwell story provides a cautionary tale for small businesses, governments, and nonprofits.
The Rita Crundwell Theft
Rita Crundwell, comptroller, and treasurer of Dixon, Illinois stole $53 million over a twenty-year period. The city of 16,000 residents held Crundwell in high esteem. One friend described her as “sweet as pie.” Another said: “You could not find a nicer person.”
So why did she steal? It appears Rita just enjoyed the good life. She used the money to fund one of the top quarter horse ranches in the country, and she did it with style: Some of the funds were used to purchase over $300,000 of jewelry and a $2.1 million motor coach vehicle.
Her annual salary? $80,000.
The city’s annual budget? $6 to $8 million
Were yearly audits performed? Yes.
Were budgets approved? Yes.
But even with budgets and audits, the Dixon, Illinois scandal happened.
Too Much Trust
So how did this happen? Rita Crundwell won the trust of those around her—especially that of mayor and council. In April 2011, finance commissioner and veteran council member, Roy Bridgeman, praised Crundwell calling her “a big asset to the city as she looks after every tax dollar as if it were her own.” Too much trust in a bookkeeper can lead to huge problems.
It was a disturbing moment when Dixon Mayor James Burke presented the FBI with evidence of Crundwell’s fraud. Burke later recalled his emotions and words: “I literally became sick to my stomach, and I told him that I hoped my suspicions were all wrong.” Such a response is understandable given that Crundwell had worked for the city for decades. She had fooled everyone.
Secret Bank Account
According to the mayor, the city’s annual audits raised no red flags, and the city’s primary bank never reported anything suspicious. So how did she steal the money? In 1990, Crundwell opened a secret bank account in the name of the city (titled the RSDCA account: the initials stood for reserve sewer development construction account). Crundwell was the only authorized check signer for the account, and the RSDCA bank account was never set up on the city’s general ledger. The City’s records reflected none of the RSDCA deposits or disbursements.
Crundwell would write and sign manual checks from a legitimate city capital project fund checking account, completing the check payee line with “Treasurer.” (Yes, Crundwell had the authority to issue checks with just her signature—even for legitimate city bank accounts.) She would then deposit the check into her secret account. From the bank’s perspective, a transfer had been made from one city bank account to another (from the capital projects fund to the reserve sewer development construction fund).
While the capital project fund disbursement was recorded on the city’s books, the RSDCA deposit was not. A capital project fund journal entry was made for each check debiting capital outlay expense and crediting cash. But no entry was made to the city’s records for the deposit to the RSDCA account. Once the money was in the RSDCA account, Crundwell wrote checks for personal expenses—and she did so for over twenty years.
To complete her deceit, Crundwell provided auditors with fictitious invoices from the Illinois Department of Transportation; these invoices included the following notation: Please make checks payable to Treasurer, State of Illinois. (So the canceled checks made out to Treasurer agreed with directions on the invoice, but the words “State of Illinois” were conveniently left off the check payee line.) Remember Crundwell was the treasurer of Dixon.
Those invoices and the related checks were often for round dollar amounts (e.g., $250,000) and most were for more than $100,000. In one year alone, Crundwell embezzled over $5 million.
Vacation Leads to Arrest
So how was she caught? While Rita was on an extended vacation for horse shows, the city hired a replacement for her. For some reason, Crundwell’s substitute requested all bank account statements from the city’s bank. As the bank statements were reviewed, the secret bank account was discovered. And soon after that, the mayor contacted the FBI.
Multiple people should perform accounting duties, not just one.
Moreover, accounting employees should annually take a one-week vacation (or longer). And while they are gone, someone else should perform the vacant person’s duties. The vacation itself is not the key to this control. The performance of the absent accountant’s duties is. Why? Doing so allows the replacement person to understand the work of the vacant employee. But, more importantly, the substitute can note any unusual or fraudulent activity.
Here’s another action to take: Periodically contact your organization’s bank and ask for a list of all bank accounts. Then compare the list to the bank accounts in your general ledger. If a bank account is not on the general ledger, see why. And request a copy of the related signature card from the bank.
Kelly Richmond Pope has masterfully captured the Rita Crundwell tale in the movie All the Queen’s Horses, available on Amazon. Think auditing is boring? Then watch the movie. It does a better job of explaining the psychological and financial damage of fraud than any textbook.
Earnings manipulation is easy with the right–or should I say wrong–accounting tricks such as cookie jar reserves. In this article, we explore how businesses inflate profits and sometimes decrease the same, depending on what the company desires. Financial statement fraud is common, so let’s see how these schemes work.
One Wall Street Journal article said a California company used “a dozen or more accounting tricks” including “one particularly bold one: booking bogus sales to fake companies for products that didn’t exist.” These machinations inflated earnings, making the company look more profitable than it really was.
Today I show you how fraudsters use financial statement fraud to magically transform a company’s appearance. Then you will better know how to prevent these earnings manipulations.
What does it mean to inflate earnings? Inflating earnings means a company uses fraudulent schemes to make their earnings look better than they really are.
Financial Statement Fraud
Companies can magically create earnings by:
Accruing fictitious income at year-end with journal entries
Recognizing sales for products that have not been shipped
Inflating sales to related parties
Recognizing revenue in the present year that occurs in the next year (leaving the books open too long)
Recognizing shipments to a re-seller that is not financially viable (knowing the products will be returned)
Accruing projected sales that have not occurred
Intentionally understating receivable allowances
Think about it: A company can significantly increase its net income with just one journal entry at the end of the year. How easy is that?
You may be thinking, “But no one has stolen anything.” Yes, true, but the purpose of manipulating earnings is to increase the company’s stock price. Once the price goes up, the company executives sell their stock and make their profits. Then the company can, in the subsequent period, reverse the prior period’s inflated entries.
Earnings Manipulation Control Weakness
Such chicanery usually flows from unethical owners, board members, or management. The “tone at the top” is not favorable. These types of accounting tricks usually don’t happen in a vacuum. Normally the top brass demands “higher profits,” often not dictating the particulars. (These demands are typically made in closed-door meetings with no recorders or written notes.) Then years later, once the fraud is detected, those same leaders will plead ignorance saying their lieutenants worked alone.
The fix is transparency. This sounds simple, but transparency will usually remove the temptation to inflate earnings. If you work for a company (or a boss) that is determined to “win at any cost,” and repeatedly hides things (“don’t tell anyone about what we’re doing”), it is time to look for another job. When people hide what they are doing, they know it’s wrong–otherwise, why they wouldn’t hide it?
A robust internal audit department can enhance transparency. The board should hire the internal auditors. Then these auditors should report directly to the board (not management). The company’s internal auditors should know that the board has their back. If not, then you’ll continue to have opaque reporting processes. Why? The internal auditors’ fear of reprisal from management (or the board itself).
And what if the leaders of an organization won’t allow transparency? If possible, remove them. Unethical leadership will destroy a business.
Deflating Earnings (Cookie Jar Reserves)
Though much less likely, some businesses intentionally decrease their earnings with fraudulent accounting. Why would they do so? Maybe the business has an exceptionally good year, and it would like to save some of those earnings for future periods. For instance, management bonuses might be tied to profit levels. If those thresholds have already been met, it’s possible that the company will defer some current year earnings in order to ensure bonuses in the following year.
Deferring earnings is often called a cookie jar reserve. For example, if a company’s allowance for uncollectibles accounts is acceptable within a range (say 1% to 2% of receivables), it might use the higher percent in the current year. The higher reserve decreases current year earnings (the allowance is credited and bad debt expense is debited, increasing expenses and decreasing net income). Then in the following year, the company might use 1% to increase earnings (even though 1.75% might be more appropriate). This is called smoothing.
Honest companies record their numbers based on what is correct, not upon desired results. But not all companies are honest.
Some fraudsters funnel money into fake bank accounts. Today, I show you how one controller did so and walked away with millions—and then hid on the Appalachian Trail.
Fake Bank Account
In May 2015 James Hammes was arrested for the theft of $8.7 million from his former employer, G&P Pepsi-Cola Bottlers. After Mr. Hammes was confronted about the theft in February 2009, he left his home and hid on the Appalachian Trail, which runs from Georgia to Maine. Hammes assumed a hiking name of “Bismarck” and spent several years on the popular trail. Fellow hikers enjoyed Bismarck since he seemed to be one of them.
Court documents show that Hammes’ embezzlement began around 1998. As a controller, he was responsible for all financial accounting and internal controls for his division, including supervising accounts payable to several hundred outside vendors. He carried out the fraud by establishing a new bank account for an existing vendor at a different bank. He then deposited hefty payments to that vendor—often $100,000 at a time—in the phantom account that he alone controlled. He then could transfer money from the phantom account to his personal accounts.
“He knew how to cover his tracks by manipulating audits and ledger entries,” Jones said. “He got away with it for so long because he knew how to manipulate his subordinates and how not to raise accounting red flags.”
So, Hammes opened a fraudulent bank account at a bank that the vendor did not use and deposited vendor checks into that account. Then he transferred funds out of the fraudulent bank account to himself. Since he opened the account, he was the authorized check signer. Simple but effective.
You may be wondering how the theft could occur so long without detection.
Vendor Payment Controls Lacking
If extra payments were made to vendors (and it appears that occurred), then the company may not have been reviewing vendor payments. If appropriate controls are not in place, it’s easy for a fraudster to make fraudulent vendor payments without detection, especially if hundreds of monthly checks are processed.
Also, it appears the company may have lacked sufficient segregation of duties since Hammes was able to disburse extra vendor payments without detection.
Vendor Payment Controls
Periodically, review the total payments made to each vendor. For example, generate the total monthly payments made to XYZ Company. Then compare the monthly payments over a two to three year period. If payments increase greatly, then someone within the company may be making additional payments and stealing those checks. Or there may a legitimate reason for the increase. Either way, it’s wise to review vendor payments for anomalies.
Another test you can perform is to look for multiple addresses for the same vendor. There may be legitimate reasons for more than one address, but you want to create a list of vendor addresses and verify that they are appropriate. The same is true for electronic vendor payments: see if there are multiple bank accounts you are wiring payments to. Then determine if these are appropriate. Additionally, obtain the physical address of each vendor and determine if the company is real. Do not accept P.O. Box addresses for verification purposes; again, you need to know if the company exists. (See my article Fictitious Vendor Fraud: Preventing It.)
If your company pays hundreds of vendors, you may want your internal audit (or external auditors) to periodically test vendor payments for appropriateness. Tell your payables personnel this will be done from time to time on a surprise basis. This will help keep them honest.
Maybe with these controls, you can prevent payments to fake bank accounts and keep your employees off the Appalachian Trail.