How to spot fraud.

Putting a squeeze on theft.

While there is no sure-fire way to eliminate fraud and if there were, the cost probably would be prohibitive with proper attention by management it can be minimized. This article explores the various ways CPAs in industry and in public practice can sharpen their fraud-detection and -prevention skills.

Part of the fraud problem is perception. For example, one controller recently said that "2% shrinkage is normal in our industry; we are pleased that our experience is just under that amount." When asked what caused the shrinkage, she had no idea. She had already decided not to worry about it--even though the loss totaled about $1.5 million a year--because the unstated assumption was that it wasn't possible in her industry to reduce shrinkage below the 2% "normal" range. When it was pointed out that the real issue was acceptable theft levels rather than acceptable shrinkage levels, she changed her thinking. After an investigation, she discovered that the inventory was systematically being stolen from the warehouses.

The fact is few cases of fraud are uncovered by external auditors. The most effective sleuths are the people who handle a business's day-to-day transactions. Sampling, by itself, is not always an effective way to uncover fraud. When auditors rely on sampling, which they almost always do, they see only a few' transactions. As a result, the odds are against the likelihood they will stumble on a fraudulent transaction. But those on staff who review transactions and maintain the relationships with external parties are in the best position to notice when something is fishy As a result, effective managers should issue policy guidelines that, in effect, tell each employee, "You are responsible for being aware of what can go wrong in your area. You also are responsible for detecting wrongdoing when it does occur." Everyone--including auditors-- should be on the alert and at least look for those frauds that only he or she is in a position to detect.

To get better at finding fraud, auditors and employee managers should follow the following four-step approach:

1 FOCUS ON THE POSSIBILITIES

Before getting down to the detailed job of devising controls, do some research on what can go wrong. Most financial and operating professionals have only a passing knowledge of the specific cons used by white-collar thieves. We hear about schemes involving credit cards, fake vendors, inventory theft, kick-backs, bad loans and other cases, but few executives really know the details of the deceptions.

Managers who have been defrauded often say, "But we had controls in place to prevent this from happening!" Hard as it is to accept, most preventive controls can be beaten by a motivated thief. And when thieves are inside the organization, they may be part of the control effort itself.

So, find out how past defrauders pulled off their crooked acts. What was the thief's role m the organization that gave him or her the freedom to commit the act? Ask yourself how management steps such as reengineering, downsizing, outsourcing, computerization and globalization affect the reliability of controls--as well as the attitudes of those who have access to the assets.

Other places to look are industry resources. Many industry organizations maintain data on fraud cases. Since banks, insurers and others all support fraud prevention, they keep useful information on the subject. In addition, contact your industry association's security professionals for guidance.

Keep files of news reports of fraud. These articles often contain enough detail to allow you to understand how the deed was done. But be careful not to get caught up in the drama of the fraud: Put less emphasis on the thieves and their reasons for stealing, focusing instead on the modus operandi.

Certainly take advantage of any formal training on fraud detection that's available. The American Institute of CPAs, the Institute of Internal Auditors and other professional associations frequently sponsor educational programs on this subject.

To begin the research in your own company, first check the departments in your organization that might have been involved in handling fraud: security, audit, legal, information systems, human resources and any other pertinent user department. Confidentiality of past cases can be maintained because you do not need to know who did what. All you want to know is what happened and how.

Next examine potential fraud exposures by functional area. Start with current job positions in each area. Include external parties. Then brainstorm with colleagues how individuals in each of these positions could defraud the organization-focusing on the opportunities presented by the position, not on the identity of the individual who currently occupies the position.

Typical questions you should ask:

* What jobs are likely to provide opportunities for fraud?

* What opportunities exist for employees, executives, vendors, contractors' agents, customers and others?

* How could they get around approval or transaction confirmation controls?

* What general ledger account and cost center could the fraud be charged to?

* How could the thief deceive the manager in charge of those cost centers when the monthend reports are reviewed?

After completing such research and brainstorming, begin to look at the controls that are in place. Make sure the current ones go beyond preventing fraud. Tell employees who to contact within the company should they suspect fraud.

2 KNOW THE SYMPTOMS

Fraud symptoms--the specific, observable signs that fraud might be present--may be of the actual fraud or of the cover-up attempt. The easiest symptoms to spot involve cash and inventory shortages. But even there, clever thieves find ways to obscure the symptoms. For example, it's hard to tell immediately whether missing original documentation may be due to filing errors or because someone destroyed the documents to cover up a theft.

Here's a short list of some fraud symptoms:

* Multiple endorsements on commercial checks.

* The use of common or repetitive names for refunds--such as Smith or Jones or a commercial name that is very similar to one in your industry but is spelled slightly differently.

* Line items in standard reconciliations that don't go away.

* Customer complaints about having paid invoices for which they are being dunned.

* Adjustments to either inventory records and customer accounts.

* The addresses of vendors that are the same as employee addresses.

* No proceeds from the disposition of used assets.

When one of these symptoms appears, use caution. Often there are reasonable explanations and they usually don't lead to a thief--just an error or an ill-designed process. So don't jump to conclusions. Instead, track down the cause for the symptom.

Be especially cautious when reacting to a person's suspicious life-style. While such signs should sound an alarm, by themselves they prove nothing, but certainly more investigation is warranted.

3 DESIGN CONTROLS AND AUDIT PROCEDURES

The conventional control procedures used to identify errors or irregularities include quality assurance programs, sampling and reperforming the work of subordinates, review of unusual transactions on edit and cost center reports and detail review and approval of reconciliations. When segregation of duties is impractical, and in areas offering high opportunity--such as cash handling, funds transfer and reconciliation of inventory--pay extra attention, asking detailed questions about the process and the controls.

In developing such procedures, be sure to include specific steps calculated to look for fraud symptoms. And while measuring fraud exposure, assess the reliability of such controls.

Likewise, auditors should include steps in their programs designed both to identify fraud symptoms and to bring them to the surface. Sampling plans should consider the fraud exposures and the reliability of internal controls. Building audit programs to look for symptoms includes selecting large samples for limited fraud tests and using computer retrieval and matching techniques.

Auditors must remember that in deciding sample sizes, they are also deciding the probability of having the opportunity to detect fraud. The probability depends on the amount of the fraud, the size of the population and the number of sample items selected. Stratification of the population, directed sampling and discovery sampling may prove helpful.

4 FOLLOW THROUGH ON ALL SYMPTOMS OBSERVED

Whoever finds a symptom of fraud--the external or internal auditor or a company manager--should resolve the situation before going on. Operate with an attitude of healthy professional skepticism. Beware of pressures to complete work within unreasonable deadlines. Be aware that the single symptom you are looking at may not be an isolated occurrence; it may be one of many.

If you believe the follow-up is beyond your capabilities, consider giving the problem to a professional investigator. There are legal liability dangers inherent in mishandling possible fraud cases.

The bottom line is this: The only way to protect against fraud is to be sure that the company's managers stay alert to the possibilities and maintain a proactive role.

Fraud Nomenclature 

In accounting circles, the word fraud has long been missing from the lexicon and it is used rarely in polite conversation when referring to a dishonest financial practice. Even the official pronouncements avoided the term, using instead expressions such as material misstatements, irregularities, misappropriation of assets, defalcations and misrepresentations.

But that may be changing. The just-released exposure draft of a proposed Statement on Auditing Standards, Consideration of Fraud in a Financial Statement Audit (JofA, June96, page 17), uses the word prominently. That small linguistic move may be a positive step in dealing with fraud at the workplace. By calling it by its real name, the accounting profession may be taking steps to address the issue with vigor.

The AICPA is sponsoring a conference on fraud December 4-6 in Las Vegas. The program will focus on ways to detect, investigate, report and prevent fraud. For more information and to register for the $625 program, call 800-862-4272.

EXECUTIVE SUMMARY

* WHILE THERE IS NO SURE-FIRE way to eliminate fraud--and if there were, the cost probably would be prohibitive--it can be minimized with proper attention by management.

* PART OF THE FRAUD PROBLEM is perception. Once a controller sees shrinkage (which at low levels is often considered "normal") as theft, management will take steps to put an end to it.

* MOST CASES OF FRAUD aren't uncovered by auditors. The most effective sleuths are static people who handle a business's actual transactions.

* SOME OF THE SIGNS that indicate fraud may be occurring:

* Multiple endorsements on commercial checks.

* The use of common or repetitive names for refunds--such as Smith or Jones or a commercial name that is very similar to one in your industry but is spelled slightly differently.

* Line items in standard reconciliations that don't go away.

* Customer complaints about having paid invoices for which they are being dunned.

* Adjustments to inventory records and customer accounts.

* Vendor addresses that are the same as employee addresses.

* No proceeds from the disposition of used assets.

JOHN J. HALL, CPA, is a consultant with Courtenay Thompson & Associates, Dallas. He specializes in fraud awareness and facilitates seminars on the subject for executives, operating managers and auditors.

CASE STUDY

The Rebate Scam

A construction company's project manager engineered a simple scam that earned him about $250,000 before he was unmasked. Here's how he did it--and how he was tripped up:

The project manager opened a bank account using a name very similar to the name of the construction project he was managing. He then approached three major suppliers and requested cash rebates m excess of normal industry practice. In exchange, he guaranteed each would be the sole source for their respective products. In addition, he promised they would be paid promptly for all materials delivered. He told them the rebates were due on the first of each month for all transactions of the proceeding month. The checks were to be made payable to the name on the bogus bank account.

The suppliers agreed to the unusual terms in order to secure the business. None questioned the name on the checks because it was close enough to the actual project name.

The arrangement worked smoothly for several months. Rebate checks were delivered to the project manager each month and he deposited them into his account. After the checks cleared, he withdrew most of the funds using cashier's checks.

The scheme came to light when a supervisor in the construction company's accounts payable department questioned why prompt-payment discounts weren't being made to the three suppliers. She had just attended a fraud-awareness seminar and remembered that such an unusual arrangement might be a symptom of fraud. Rather than question either the project manager or the suppliers, she correctly referred the matter to the corporate audit department for investigation.

The auditors made simultaneous unannounced visits to all three suppliers. Two wouldn't talk, but the third explained the relationship and provided copies of the canceled rebate checks.

Lessons learned from the case:

* It's relatively easy to open unauthorized bank accounts because most banks have limited ability to verify the identity of the person opening an account.

* Scam artists know how to cash checks--to any payee, in any amount.

* Schemes that involve relationships with suppliers are particularly hard to prevent and detect.

* When contracting with suppliers, try to secure the right to review any appropriate records. While this is fairly common in the contracting environment, it's also something to consider for other relationships in which purchase orders are used.