: How They Are Used To Conceal Fraud ACFE 2012 Canadian Conference October 29, 2012 Rosanne Terhart, CA, CFE
Overview Summary of Topics Which records are used to conceal fraud What evidence of fraud do the accounting records provide How fraud is concealed in the accounting records What to look for in the accounting records and financial statements Examples of successful fraud investigations which relied on accounting records as evidence Questions and answers Page 2
Other Examples of Records General ledger this ledger contains all accounting entries by general ledger account Sub ledgers these ledgers are detailed ledgers that feed into the general ledger (i.e., Accounts Receivable, Accounts Payable) Journal entries these are the accounting entries to support payments and receipts of cash Support documents (i.e., expense reports, invoices) Bank statements, wire transfers, cancelled cheese Page 3
Fraud Investigation Review of accounting records for: Evidence of who was involved Evidence of how fraud was concealed Determine when fraud started, determine extent Likely discover additional fraud Many employees can successfully conceal these transactions for up to 18 months or longer Page 4
Who was involved In most accounting systems, the users of the accounting system are logged as they make entries. The log in and log out timing can provide evidence of who made the false entries. Logging information has been used to connect fraud to certain people and used as evidence in Court. For instance, logging in information helped us determine that there were two and not one, as suspected, employees involved in a fraud. Page 5
Evidence of motivation/intention to defraud If a concealing entry is made relating to a fraudulent transactions, the accounting entry provides important evidence of intent to conceal. It proves that the entry was not just an error. A booked transaction that is different from the actual transaction is excellent evidence of motivation to conceal. For instance, if a cheese is paid to an employee and booked as an employee loan or salary, this would be considered normal and accounted for correctly. But, if this same entry was booked in some other way, as another kind of expenses, that entry is evidence that the fraudulent transaction is being concealed. Page 6
Timing of fraud Accounting records provide good evidence of the timing of the fraud to due the chronological format of the records. When the fraud started and ended, helps determine extent. For example, a victim organization may be aware of a fraudulent disbursement from the organization. But in reviewing the accounting records, finds similar transactions. Therefore, increasing the quantum of the fraud and giving a sense of timing of the fraud. Page 7
Additional Fraud Schemes Often, additional fraud schemes are identified through the review of the accounting records. For instance, many fraudsters conduct numerous schemes at the same time. For example, if an employee is paying himself or herself excess payroll, he/she may have a favorite place in the accounting records to records these transactions. Other schemes may likely be records in the same place. Page 8
Discovery of Repayments Accounting records often will show repayments to the organization of fraudulent amounts taken. Most fraudsters take and return for a while until they take and don t return. If only looking at the taking, the quantum of the fraud may be too high. For instance, if an employee removed funds from an organization and then repaid the funds, is this considered fraud? Accounting records will show both sides of the transaction. Page 9
How is the fraud concealed The initial accounting entry of fraudulent transaction must be made in 30 days of the transactions. Why? Bank Reconciliation is usually done at the end of each months and it accounts for all transactions. The initial accounting entry is usually put into a temporary spot, i.e., suspense account or other generally unused account. Subsequent accounting entries are then made to relieve the suspense account and they are often spread out, moved around until their final resting place, resulting financial statement misstatement. A review of the journal entries will reveal these transactions. Page 10
Example #1 Concealment of Fraudulent Disbursement An employee writes himself a cheese of $20,000. Funds come out of company s bank account. Needs to be accounted for within 30 days. Employee temporarily books to the suspense account Dr. Consulting expense $20,000 Cr. Bank account $20,000 Employee books the transaction to an expense account, say consulting. Dr. Consulting expense $20,000 Cr. Bank account $20,000 Now it appears that the company paid $20,000 to on outside consultant, but it really paid it to the employee. Page 11
Example #2 Concealment of Misappropriated Cash An employee steals $2,000 cash from a bank deposit. The bank deposit is short. Employee replaces stolen funds with a fraudulent cheese to cover up missing funds. Employee books the transaction to an asset account, say Accounts Receivable. Dr. Accounts receivable $2,000 Cr. Cash (Company cheese) $2,000 Now it appears that the company has a balance owing from a customer for the amount of $2,000. If not reconciled to customer payments, amount goes unnoticed. Page 12
Example #3 Concealment of A Tampered Cheque An employee adds $3,000 to a payroll cheese after it was signed but before being cashed. Employee books the additional amount of payroll cheese to an expense account, say miscellaneous expense. Dr. Miscellaneous expense $2,000 Cr. Bank account $2,000 Now it appears that the company paid $2,000 to purchase some miscellaneous expenses. Page 13
Example # 4 Expense Account Fraud An employee claims the same expense twice for an amount of $1,000. The expense is claimed in two different expense reports. Expense report conceals the fraud because it is likely not detailed enough and has not been reviewed sufficiently. Review of expenses with agenda would reveal the duplication. Page 14
Example # 5 Payroll Fraud An employee enters into the payroll system and changes payroll deductions for federal and provincial payroll tax to zero. Employee received 100% of pay. At year end the deduction due to Canada Revenue Agency are paid by cheese from company, including fraudulent employee s portion. Amount is booked to employee benefits. Unless a reconciliation of employee benefits is done, the fraud is concealed. Page 15
What to look for in the accounting records Lack of segregation of duties (cheese signing/cash handling and transaction recording = opportunity, big problem for non-profit organization) Access to systems and over-ride capabilities Look for who performs the bank reconciliation Manual cheese (different controls than regular cheese run) Cheese that are out of sequence Missing cancelled/returned cheese Odd or missing signatures on cheese Page 16
What to look for in the records Continued Electronic transfers/online bill payments (often no controls) Entries in suspense accounts or other non-regular accounts Round number entries Invoices/expense reports lacking details Odd GST-GST entries Year-end journal entries (write off accounts) Income statement reality check Page 17
What to look for in the financial statements Continued Expenses that are inflated from one year to the next New expense categories Assets that are inflated from one year to the next Gross margin percentages that change Page 18
ACCOUNTING RECORDS Fraud Investigation Examples Airplane Company Accounting staff discovers $30,000 cheese payable to Bank xx Visa while preparing a bank reconciliation. Company discovers Bank xx Visa account is that of Controller. Controller is fired. CFO puts together evidence, finds additional suspicious cheese made to Bank xx Visa, quantifies at $600,000. Calls lawyer, insurance company, and police. Lawyer and insurance company insists on forensic audit. Forensic accountant hired by company. Police obtained initial evidence and interviewed staff. Page 19
ACCOUNTING RECORDS Fraud Investigation Examples Airplane Company Forensic accountant traced fraudulent cheese to accounting entry. Operator at time of entry was controller. Traced entry to a temporary inventory account. Review of temporary account reveals how far back fraud occurred. Reveals subsequent entries made and accounts affected. Other fraudulent amounts discovered. Total misappropriation amounted to $1.4 million. Discovers that $300,000 was paid back, net misappropriation was $1.1 million. Page 20
ACCOUNTING RECORDS Fraud Investigation Examples Airplane Company Accounting records revealed: how fraud was concealed connected concealment with fraudster extent and timing of fraud: How often, when did it start quantified entire completeness of fraud determine quantum of financial statement mis-statement confirmed amount, if any, repaid report was used for insurance recovery, civil and criminal proceedings Accounting Records Page 21
ACCOUNTING RECORDS Fraud Investigation Examples Non-profit Organization Organization Director discovers, by accident, frequent unexplained electronic transfers from bank account. Finance Manager quits when questioned. Police called. Police conducted interviews, prepared spreadsheet of all unexplained electronic transfers, totaled $500,000. Requested bank to provide trace of transfers. Police provided report Crown Counsel. Crown Counsel and Police jointly engaged forensic accountant. Page 22
ACCOUNTING RECORDS Fraud Investigation Examples Non-profit Organization Forensic accountant reviewed accounting records. Determined entries made to consulting expenses. Traced to invoices, discovered name of consultant. Discovered email correspondence between finance manager and consultant regarding misappropriated funds. Discovered that funds were split between two individuals. Eventually traced both individual accounts. Accounting records show fuller extent of fraud. Forensic accountant worked with Police to obtain evidence. No need for forensic accountant to interviews. Total $900,000 was misappropriated. Both individuals charged. Both admitted. Page 23
ACCOUNTING RECORDS Fraud Investigation Examples Non-profit Organization Accounting records revealed: how fraud was concealed connected concealment with fraudster connected fraud with another individual increased total fraud quantification resulted in a conviction report to be used for criminal proceedings Page 24
ACCOUNTING RECORDS Fraud Investigation Examples Insurance Company Organizational controller discovers, by accident, short-fall in daily cash deposit. Controller discovers that cash count done by one of cash counters. Discovers several other short deposits. All done when a particular cash counter was working. Controller puts together all short deposits by one cashier. Amounted to $40,000 short deposits. Organization calls lawyer, insurance company, and police. Police conducted interviews, summarized evidence, report to Crown Counsel for charges. Page 25
ACCOUNTING RECORDS Fraud Investigation Examples Insurance Company Company hired forensic accountant for insurance report. Forensic accountant discovers that one other cash counter involved, based on accounting entry operator information. Fraud was booked to accounts receivable. Fraud quantum increased to $140,000. Report prepared by forensic accountant. Used by insurance company and Crown Counsel. Second individual charged. Crown Counsel hires forensic accountant to assist in trial. Page 26
ACCOUNTING RECORDS Questions & Answers Page 27
ACCOUNTING RECORDS Contact Rosanne E. Terhart, CA, CFE Senior Manager, BDO Canada rterhart@bdo.ca T: 604 646 4381 BDO Canada LLP 600 925 West Georgia Street Vancouver, BC V6C 3L2 Page 28