Fashioning a fraud: analysis of expense patterns exposes crime.

[ILLUSTRATION OMITTED]

EXECUTIVE SUMMARY

* Businesses must clearly define the roles and responsibilities of employees who sign expense reports and those who process the reports. That should eliminate confusion about whether a manager's signature means that the individual is authorizing the expenses as reasonable business expenses or signifies that the manager reviewed the report and supporting detail and attests to the validity of the expenses.

* Travel and expense transactions should be reviewed randomly for evidence of compliance with corporate policy, proper authorization and approval and the overall reasonableness of expenses. Internal auditors should also conduct periodic reviews of the activities of employees with the highest expense reimbursement totals.

* Duties such as signing expense reports and monitoring /managing the budget should be segregated, A fraudster given both of those responsibilities can attempt to bury questionable expenses in under-budget categories.

**********

This is the story of how a travel and expense report audit exposed a fraudster who siphoned money from the fashion company where she worked to fund her own lavish spending.

The fraudster, Bobbie Jean Donnelly, had taken advantage of a lack of adequate controls over her division's budget and a lax system for reviewing expenses. The company's internal audit team detected her crime by analyzing patterns in a year's worth of reports from employees with the highest travel and expense bills.

Donnelly was hired as an administrative assistant to the manager of a Los Angeles-based design division for a multibillion-dollar retail corporation. Based on her strong performance, she was quickly promoted to office manager for the division.

In addition to managing her boss's needs, she supervised support personnel and prepared and oversaw the design department's budget. Her manager gave her the responsibility to provide the first level of expense report review. He relied on her to ensure that the expenses were valid before he signed them. On a few occasions, he even asked her to sign the expense reports on his behalf.

As the business grew, management decided it was time to build a traditional internal audit department. That's where I came in. My internal audit team was conducting a routine travel and expense audit. We developed an audit program designed to ensure that employees were following the corporate travel and expense policy and that adequate internal controls for the processing and payment of expense reports were in place and operating effectively

The team assembled a sample of individuals and transactions to test. The individuals were selected from the population of employees who submitted the highest dollar amounts over the course of the year for reimbursement. The transactions were selected randomly across the total population of submitted expenses.

The approach and criteria used to audit the individuals differed significantly from the approach used to audit the transactions. The transactions were reviewed for compliance with the policy, proper authorization and approval, and overall reasonableness of the expense. That work yielded some audit exceptions--mostly small and isolated--but no major surprises.

The more interesting results of the work came from the review of individuals. We looked at the reasonableness of the expenses based on the employee's role in the company and searched for any patterns of activity that seemed unusual.

We quickly identified a group of individuals who routinely submitted their American Express bills for reimbursement instead of submitting detailed receipts of individual expenses. A closer look revealed that many employees were submitting expenses twice. The bills began to show a pattern--one month of charges, the next month a late fee with old charges and new charges combined. It didn't take long for us to determine that the activity was coming from one area of the business--the design department. Several individuals had devised very inventive ways of submitting expenses for reimbursement.

In some cases, employees submitted the same receipt multiple times but altered the size of the tip and total amount on each of the documents to make the duplication less obvious.

I asked my lead auditor to gather all the expense reports for employees in that division. Several of the Los Angeles-based employees routinely traveled to New York on business and submitted New York City taxi receipts for reimbursement, a legitimate expense. Upon examination of the actual taxi receipts, we noticed multiple receipts that appeared to come from the same taxi on the same day. New York City taxis are regulated and have electronic meters that print receipts. The receipts all show the taxi medallion number and the trip number. We found multiple receipts had sequential trip numbers from the same day. This seemed suspicious. The time stamps had small gaps between the end time of the receipt first in sequence, and the start time of the receipt next in sequence.

The employee who had run up the highest expenses was the office manager, Bobble Jean Donnelly. She had charged about $115,000 over the previous year, while her manager had submitted about $40,000 in expenses. It seemed strange that Donnelly's expenses would be so much higher than her manager's.

I met with our general counsel and informed him of what we had identified in the audit. He agreed that we needed to conduct a thorough investigation of the design team's expenses, especially Donnelly's activities.

To search for red flags in the expense reports, my lead auditor and I used data analysis software to sift through the data. The software allowed us to identify duplicate amounts and isolate the expense reports that we needed to review in tandem.

The expense reports were on paper and were voluminous, but we believed it would be worthwhile to invest the time of some members of our team to help build a database of the expense detail to facilitate the review.

That investment paid off. Without the software we would never have identified that many of the expenses submitted multiple times for reimbursement were filed over the course of many months.

Tools that could be used to examine and parse such data include IDEA Data Analysis Software, Audit Command Language (ACL), Excel, Access, SQL, SAS--generally any database or query software.

We separated the duplicates and, in some cases, expenses that were submitted numerous times. We found that Donnelly and four other design division employees were routinely submitting expenses multiple times for reimbursement. Our review linked Donnelly to about $12,000 in false expenses. But I had a nagging feeling about the sheer amount of expenses she was submitting, so I ran additional analyses on her expenses to aggregate them by category.

I was surprised to see that the majority of her purchases were samples, items that design team members, who traveled extensively searching for inspiration for new product lines, purchased as part of their research and development. Using the audit software, I extracted all travel-related expenses Donnelly submitted to see if the sample purchases correlated to trips that other design team members took. I found that they did.

It also appeared that her manager had sent her to Italy to recruit interns for the company Donnelly had submitted more than $6,000 in expenses for this one-week trip. It seemed that she had wined and dined the students at the finest restaurants in Italy. In reality, there was no recruiting trip. Those expenses coincided with a vacation that Donnelly and her husband took to Italy

FLAWS IN THE SYSTEM

The company's expense reporting process required individuals to describe the business purpose of an expense and have their manager sign off on the actual expense report. Donnelly's boss was amazed by how accurately Donnelly forged his name on her fraudulent expense reports.

Given the nature of its work, the design department's budget was made up of broad estimates of the types of expenses it would incur throughout the year. Some projects were specifically identified in the budgeting process, but there were general categories described only as "other" or "miscellaneous." Donnelly used these general categories to pad the budget in the planning process.

By signing the expense reports on her manager's behalf and monitoring budget-to-actual variances each month, she could submit her fraudulent expenses coded to a budget line that was running below budget so that her manager would never detect the activity

The final tally of Donnelly's fraud was approximately $275,000 over two and a half

Editor's Note: This article is an excerpt from Fraud Casebook: Lessons From the Bad Side of Business, a collection of case studies edited by JofA contributing editor Joseph T. Wells and published in July by John Wiley & Sons Inc. Identifying characteristics, including the names of individuals and organizations involved in this case, have been changed or omitted.

years. Almost 95% of her submitted expenses were false. The biggest category of her fraudulent expenses was samples, which she was not authorized to buy. Donnelly's manager recognized many of her expensed purchases as items that she wore regularly to work. Her purchases included a pair of $750 Jimmy Choo shoes, $875 for a Hermes scarf and $1,250 for a Prada wallet.

Donnelly and other design department employees who had abused the expense report system were terminated. Our investigation was unable to determine if a link existed between Donnelly's actions and the travel and expense fraud of other employees in the department.

The company's general counsel and I took our findings to the district attorney's office, which agreed to prosecute Donnelly. At first, she was adamant about her innocence and refused to consider a plea agreement. Donnelly's manager and I testified before a grand jury that indicted her. Ultimately, she accepted a plea to a charge of grand larceny, a felony that came with a sentence of one to three years in prison. Donnelly served approximately three months of that time in jail.

CORRECTIVE ACTION 

When the case was over, I worked with the management team to recap the breakdowns in our systems and examine the lessons learned. Some changes the company made in the wake of the findings included:

* Modifying travel and expense policies to be more detailed with respect to sup porting documentation for expenses. The company now requires original documentation and prohibits credit card statements and photocopies. Such requirements prevent employees from submitting duplicate expenses for reimbursement.

* The company also now requires all employees to use a corporate credit card for business expenses. This significantly reduces the amount of expenses for which people claim to have paid cash and reduces their ability to split the credit card receipt from the detailed receipt and submit both for reimbursement.

* Both the internal audit team and the travel and expense team within accounts payable have expanded the use of audit software to proactively look for warning signs of fraud in T&E data. The T&E team also developed auditing protocols to increase efficiency in auditing T&E data. Quarterly, team members separate big spenders from the rest of the population to look for patterns that appear odd. Weekly, they randomly select expense reports to review against a set of audit criteria.

Practical Tips

* Never ask anyone in a business setting to reproduce your signature on any kind of document, even something as seemingly benign as a birthday card. Such a request can trigger claims that the individual was authorized to sign documents for you and can undercut your legal standing if the individual forges your signature in the course of a fraud.

AICPA RESOURCES

CPE 

* Auditing for Internal Fraud, a CPE self-study course (#730278).

* Fraud and the Financial Statement Audit: Auditor Responsibilities, a CPE self-study course (#731814JA).

For more information or to make a purchase, go to www.cpa2biz.com, or call the Institute at 888-777-7077.

Web site

The Antifraud Resource Center, http://antifraud.aicpa.org.

OTHER RESOURCES

Web site

The Association of Certified Fraud Examiners Fraud Resource Center, www.acfe.com/fraud/fraud.asp.

RELATED ARTICLE: Assessing fraud risk.

by Joseph T. Wells and John D. Gill

Every organization faces some risk of fraud from within. Fraud exposure can be classified into three broad categories: asset misappropriation, corruption and fraudulent financial statements.

Answering the following 15 questions is a good starting point for sizing up a company's vulnerability to fraud and creating an action plan for lessening the risks. The questions are based on information from the 2007 edition of the Fraud Examiners Manual published by the Association of Certified Fraud Examiners. 1. Do one or two key employees appear to dominate the company?

If control is centered in the hands of a few key employees, those individuals should be under heightened scrutiny for compliance with internal controls and other policies and procedures.

2. Do any key employees appear to have a close association with vendors?

Employees with a close relationship to a vendor should be prohibited from approving transactions with that vendor. Alternatively, transactions between these parties should be reviewed on a regular basis for compliance with internal controls.

3. Do any key employees have outside business interests that might conflict with their job duties?

Take the example of a 32-year-old sales representative who started a software company using his employer's time, equipment and facilities. The software company he worked for discovered that the employee demonstrated his own products to the company's customers. Ultimately, the employee diverted $500,000 in business away from his employer.

The example illustrates why key employees should provide annual financial disclosures that list outside business interests. Many companies, particularly publicly traded companies, require such disclosures. Interests that conflict with the organization's interests should be prohibited. Organizations should implement an explicit policy that forbids employee business activities that directly compete with the operations of the organization.

Employees who have something to hide may lie or omit key facts on the disclosure form, but requiring the step still has advantages, such as making it easier to fire workers who fail to reveal potential conflicts. If an employer can show that an employee had such an interest and failed to disclose it on an annual reporting form, the employee can be fired simply for failing to follow company policy.

4. Does the organization conduct pre-employment background checks to identify previous dishonest or unethical behavior?

Organizations should conduct pre-employment background checks before offering employment to any key applicant. The scope of a background check varies by position, but a general list to consider includes: criminal records and convictions; Social Security number verification; credit history; previous employment; employment references; personal references; education verification; professional license verification; driver's license verification and driving history check; and civil records and judgments. Employers should ensure that legal requirements are met for the use of and access to the information.

For companies that have failed to do background checks, post-hire screenings may be appropriate in some cases, but should be conducted on the advice of legal counsel. A number of legal issues come into play when employers consider screening workers who are already on the job.

5. Does the organization educate employees about the importance of ethics and anti-fraud programs?

All employees should receive training on the ethics and anti-fraud policies of the organization. The employees should sign an acknowledgement that they have received the training and understand the policies.

6. Does the organization provide an anonymous way to report suspected violations of the ethics and anti-fraud policies?

Organizations should provide employees, vendors and customers with a confidential system for reporting suspected violations of the ethics and antifraud policies. According to the 2006 ACFE Report to the Nation on Occupational Fraud and Abuse, frauds are most commonly detected by a tip. The greatest percentage of those tips comes from employees of the victim organization.

In one instance, an anonymous tip received by a fraud hotline thwarted a fraud scheme that had drained approximately $580,000 from a business. The caller reported that the company's accounts payable manager was approving fictitious invoices from his own outside company. The tip clued in company management to the scheme and brought an abrupt end to the manager's windfall. The fraudster was terminated and arrested. The company ultimately recouped most of its losses.

7. Is job or assignment rotation mandatory for employees who handle cash receipts and accounting duties ?

Job or assignment rotation should be considered for employees who work with cash receipts and accounting duties. The frequency of the rotation depends on the individual's responsibilities and the number of people available for the revolving duties.

8. Has the company established positive pay controls with its bank by supplying the bank with a daily list of checks issued and authorized for payment?

One method for a company to help prevent check fraud is to establish positive pay controls by supplying its banks with a daily list of checks issued and authorized for payment. Banks verify items presented for payment against the company's list and reject items that don't appear on the list.

The use of those controls foiled a fraud attempt by an employee and his accomplice, who worked for a check-printing company. The accomplice printed blank checks with the account number belonging to the perpetrator's employer. The perpetrator then wrote more than $100,000 worth of forgeries on the counterfeit checks.

When the checks were presented to the bank for payment, they did not appear on the organization's list of expected payments. The bank refused to cash them. The organization was notified, and the fraudsters were arrested.

9. Are refunds, voids and discounts evaluated on a routine basis to identify patterns of activity among employees, departments, shifts or merchandise?

Companies should routinely evaluate those transactions to search for patterns of activity that might signal fraud.

10. Are purchasing and receiving functions separate from invoice processing, accounts payable and general ledger functions ?

Segregation of duties is an important control. The failure to segregate these duties allowed one large, publicly traded company to be duped by a member of its managerial staff. The individual managed a remote location of the company and was authorized to order supplies and approve vendor invoices for payment. For more than a year, the manager routinely added personal items and supplies for his own business to orders made on behalf of his employer. The orders often included a strange mix of items. For instance, technical supplies and home furnishings were purchased in the same order.

In addition to ordering personal items, the employee changed the delivery address for certain supplies so they were shipped directly to his home or side business. Because the manager was in a position to approve his own purchases, he could get away with such blatantly obvious frauds. The scheme cost his employer approximately $300,000 in unnecessary purchases.

11. Is the employee payroll list periodically reviewed for duplicate or missing Social Security numbers?

Organizations should check the employee payroll list periodically for duplicate or missing Social Security numbers that may indicate a ghost employee or overlapping payments to current employees.

12. Are there policies and procedures addressing the identification, classification and handling of proprietary information?

To help prevent the theft and misuse of intellectual property, the company should implement policies and procedures addressing the identification, classification and handling of proprietary information. 13. Do employees who have access to proprietary information sign nondisclosure agreements?

All employees who have access to proprietary information should sign nondisclosure agreements. It is easier to sue for breach of a nondisclosure agreement than it is to sue for theft of information. Nondisclosure agreements afford companies legal options for the use of nonpublic information, not simply for information that is considered a trade secret.

In most states, companies without nondisclosure agreements may be limited to suing for theft of trade secret information. 14. Is there a company policy that addresses the receipt of gifts, discounts and services offered by a supplier or customer?

Organizations should implement a policy that sets ground rules about employees accepting gifts, discounts and services offered by a supplier or customer. If no explicit policy is in place, employees may find themselves in ambiguous situations without clear ethical guidelines.

For example, a city commissioner negotiated a land development deal with a group of private investors. After the deal was approved, the commissioner and his wife were rewarded by one of the investors with an all-expenses-paid international vacation.

While the promise of the trip may have influenced the commissioner's negotiations, this would be difficult to prove. However, had a clear policy regarding the receipt of gifts been implemented and enforced, the commissioner would have known that accepting the free vacation was a violation of the rules. The ambiguity of the situation would have been avoided.

15. Are the organization's financial goals and objectives realistic?

Closely monitor compliance with internal controls over financial reporting if the financial goals and objectives appear to be unrealistic. Establish realistic financial goals and objectives for the organization. Common justifications for financial statement fraud include a desire to obtain bonuses linked to goals or frustration with objectives that were unachievable through normal means.

Joseph T. Wells, CPA, CFE, is founder and chairman of the Association of Certified Fraud Examiners and a contributing editor to the JofA. His e-mail address is [e-mail]. John D. Gill, J.D., CFE, is research director for the Association of Certified Fraud Examiners. His e-mail address is [e-mail].

Bethmara Kessler, CFE, CISA, leads enterprise business risk management for Limited Brands Inc. Her e-mail address is [e-mail].