Managing betrayal: a case study of employee dishonesty.

A step-by-step account of a major embezzlement offers insights into pitfalls to avoid.

In early May 1996, staff of our national association discovered an embezzlement within the headquarters office. By the time we concluded our investigations, we had identified approximately $265,000 in check theft through forgery. Within four months, we recovered virtually all of the lost funds through both insurance coverage and formal negotiations with our bank. The employee confessed and was later arrested. We made a number of changes in internal controls.

This is the story of an embezzlement scheme by a staff member of a national nonprofit association. The experience is not all that uncommon, but it is rarely heard about because of its embarrassing nature. This article discusses in detail what went wrong in our organization, how we handled the situation, and what we learned.

Who we are

Our association is a 501 (c) (3) tax-exempt organization with a $2.5 million annual budget, 7,000 members, and 20 staff. Our business year runs April 1 - March 31. Our primary purpose is continuing education for members.

The management model we have developed reflects a balance of responsibility between volunteers and national office staff. The mutual respect between these two entities is well-developed and provided a strong foundation for the investigative work conducted in the aftermath of the embezzlement. Our organization had long ago established the principle that volunteer leaders need to be fully informed at all times about any issue of importance to the organization, including mistakes.

Accounting management

An accounting manager (Mary) and an accounting assistant (Bob) carried out our accounting function. At the time of the check theft, we observed the following internal controls:

* All checks required supporting documentation - either formal check request or an invoice.

* The accounting manager reviewed and approved a report showing all checks scheduled to be paid.

* Two senior staff people and two officers had sole check-signing authority.

* Checks amounting to greater than 1 percent of the budget had to be countersigned by an officer.

* Signed checks were not returned to the accounting department but were given to the receptionist for mailing.

* The receptionist received the bank statement in the mail and usually hand-delivered the unopened document to the executive director for a quick scan of signatures and payees. Occasionally, the statement was put into a mail cubby if the executive director was not present.

* The assistant reconciled the statement.

* The accounting manager prepared financial reports and confirmed cash and investments once reconciliation was completed.

* Our outside auditing firm of 15 years conducted comprehensive annual audits.

Discovery of theft

In April 1996 our bank called Mary to report that our operating checking account was overdrawn. Also during that month, bank employees asked Bob, who was responsible for cash deposits, when money was expected to be transferred into the operating account. Bob never told Mary of these inquiries.

Bob had demonstrated outstanding accounting skills and a capacity to complete work in a speedy but accurate manner. Outgoing and friendly, he built friendships both at the bank and in the office. As time passed, we disregarded two key existing internal controls to give Bob more and more responsibility because of his abilities and positive attitude. We allowed him to handle payables and daily deposits, as well as to reconcile monthly bank statements. Trusting the quality of his work, we also did not carefully monitor the reconciliation process.

After a second call from the bank about low funds in the operating account, Mary became concerned and told Bob that the account had to be reconciled to determine the problem. Bob left the office after lunch that day - Thursday - professing to have a headache.

Later that afternoon, Mary reconciled the account and found checks on the bank statement that had cleared the account but did not appear in the monthly check register. Mary called the bank only to learn that copies of the checks in question would not be available for 24 hours. The next morning, Friday, May 3, Bob did not show up for work.

On that day the bank reported it had received copies of two of the three checks in question. The payee on each check was Bob. Each of the two checks was for $3,200. After the initial shock of the discovery wore off, staff began to review prior bank statements for any irregularities, eventually producing a list of questionable transactions. At that point, staff had reviewed bank statements from December 1995 through April 1996 and identified approximately $60,000 in questionable transactions.

The initial response

After we discovered the theft, we focused on three areas:

* collecting facts about the loss and ensuring that the theft had stopped;

* assessing the meaning of the facts; and

* ensuring continued trust between staff and voluntary leadership, as well as the organization and its membership.

With respect to facts, we sought to identify the extent of the loss and to determine how and why it happened. Our assessment sought to determine what could be done to prevent an embezzlement from ever happening again. Finally, the national office wanted to preserve its credibility by supervising the investigation in a manner that would absolutely guarantee maintenance of trust, including informing the voluntary leadership completely and regularly. We sought to conduct the investigation in such a way that if any single member of the association wanted information about the theft, he or she would be completely comforted by our actions.

On Friday, when we identified the first suspicious checks, I, as executive director, called our treasurer to inform her of these interim findings and our attempts to assess the damage. In addition, on that same Friday, I called the association's auditors, advised them of the situation, and notified them that they would receive within moments a written request that their firm supervise our investigation to determine what had happened. We asked that a report be prepared for the treasurer and me. I also called our corporation counsel and informed her of our findings to date. We reached our president two days later at home.

On Monday morning, I called the chief partner of the auditing firm, asking that as a part of the assessment it review the auditing firm's audits of us to see if previous audits had failed to notice weaknesses in our accounting system. (See further discussion later.) Staff then discussed options with our auditor and our attorney and agreed to close our checking, payroll, and credit card accounts immediately. By 9:45 a.m., both bank accounts were closed. In an attempt to minimize disruption and to ensure that the theft had stopped, we instructed the bank to honor checks from the old account only if they appeared on a list approved by us.

Also on Monday, Mary called Bob at home, ostensibly to find out why he did not come to work. In a somewhat emotional state, Bob asserted that we knew the answer, and then he confessed to the crime. Subsequently, we called him back and asked for some details about how he stole funds from the association.

We had additional conversations with Bob that week through his newly acquired attorney. We discovered later that some of the information he gave us was self-serving and inaccurate, even though he appeared to be genuinely interested in helping us understand the magnitude and mechanics of the theft.

Our attorney advised us to call the police. We gave the county police a brief oral report, and they asked us to complete the accounting process and document everything we could before filing a formal complaint. The police explained that once a complaint has been filed, the clock begins ticking toward a "speedy" trial. The police recommended that we have all our information together before we filed the complaint - explaining that doing so would greatly reduce the chances of the thief getting off on a technicality.

From that point on, the auditors spent a considerable amount of time in our office supervising up to three staff in an exhaustive, check-by-check review of our checking transactions for the 30-month period that we had employed Bob. Through this analysis, we identified 65 forged checks worth about $265,000. Bob cashed virtually all of these checks at a local branch of our bank where we regularly did business, although he converted some checks into cashier's checks and wire transfers or deposited checks into his personal savings account. He had carried out this theft for more than two years without being detected.

On the afternoon of the discovery, we also notified our insurance agent because we were covered by an employee dishonesty provision within our business owner's liability insurance. The amount of the insurance at that time appeared to be $175,000, but the language of the policy itself provided additional inflation coverage.

The agent told us that we would have to file a claim within 120 days from discovery of the crime and be prepared to release the insurance company to sue the thief and the bank, in return for our reimbursement under the policy. After several weeks of tedious work, we accumulated in great detail several three-inch binders with evidence demonstrating our loss and how it had occurred. (Curiously enough, however, we were never able to figure out one step in the theft process - how Bob gained access to the monthly bank statement before the executive director scanned it.)

The evidence we did gather provided detailed information to the insurance company and to the police. The former approved our claim, and the latter processed our evidence (characterizing it as very comprehensive) and presented the evidence to the state's attorney, who charged Bob with eight felony counts. Bob arranged with the state's attorney to turn himself in, and after being detained for several hours, was released on bond. At this writing, Bob has pleaded guilty to three felony counts - one for each year that he committed the crime - and is scheduled for sentencing this year. The state has asked for up to three years in jail plus fines, probation, and restitution.

In return for the insurer's check, we signed a release stating that we would not file another claim based on this event. The insurance company then began to take legal steps against both the thief and the bank, the latter being charged with gross negligence (for failing to verify signatures on our checks). These legal steps sought to obtain for us, at no expense, the final $15,000 loss not covered by our insurance policy.

Somewhat surprisingly, two irritating personnel issues arose. The first was whether we were obligated to extend health insurance (COBRA) benefits to the thief even though he had been dismissed for obvious gross misconduct. We ultimately concluded that because he had not yet been convicted of the crime, the prudent step to take was to offer Bob the benefits, but he has never asked for them.

Second, we had to determine whether to pay him his last paycheck. Just considering this option was an irritant and in the end we decided to play out our anger, concluding that we would not send him the check but give him the option of getting the check from us. (He never inquired.)

Lag time in discovery

Why it took more than two years to uncover Bob's theft was an issue that confounded all of us. We concluded that Bob started forging checks at the end of a fiscal year in relatively small amounts with increasing frequency and amount - that's a common pattern in check theft. Most of the forged checks were written in the third fiscal year of this event.

Each annual audit reviewed a random sample of approximately 30 checks, but the small number of forged checks - 3 the first year and 16 the second - was too small to be discovered. The actual discovery occurred just as we were preparing for the audit of the third fiscal year.

It is interesting to note that the auditors had provided us with a list of the randomly selected checks Bob had pulled in preparation for the third-year audit. The special internal investigation took place immediately after the discovery and prior to the formal, routine audit of the third fiscal year. When the routine audit was finally conducted, we found that several of the sample checks were forged.

It took more than two years to discover this theft because, in addition to the situation explained earlier, Bob wrote bad checks during the period in the fiscal year when the association received much of its income, which meant the money wasn't easily missed. The auditors had questioned in the second year relatively large pending cash deposits. The amount of money we normally keep in our cash account made it less likely that Mary would have intuitively sensed a change in the flow of money. Moreover, more forged checks were passed in the final five-month period than was the case in the previous 25-month period. Finally, our slide into weak controls as a result of trusting Bob's work and skills minimized our chances of catching the fraud as a result of routine bank reconciliations.

Conflicts of interest

A couple of weeks after we formally requested that our auditors supervise an internal investigation, we notified them that we were going to ask a second auditing firm to review the first audit report. We did this to ensure that the first auditing firm was preparing a comprehensive and honest report that did not minimize its own potential involvement as an outside agency that might have discovered the theft much earlier. Our regular auditors were quite comfortable with this approach, which we believed had a positive effect on their work.

We informed the second firm that if it performed the audit, it would be unable to do any work for us in the future. This step eliminated the possibility that the second firm would unfairly criticize our regular accounting firm in the hope of securing our future business.

Yet we found the experience with the second auditors to be strange and frustrating. The second auditor provided us with oral as well as written reports, which essentially endorsed the work of the first auditors. However, the firm wrote its report with such obscure accounting verbiage that it seemed intent on protecting both audit firms. I concluded its value would have been limited had the second auditing firm not confirmed orally that no significant weaknesses existed in the first report. Indeed, the second auditors seemed reluctant to criticize our association as well, and I found myself demanding that they be critical if that was justified by their analysis.

In hindsight, we concluded that while our trust in the competence and integrity of our own accounting firm was well-placed, we might have been better off with a single, special outside audit with a completely new firm. That certainly would have removed any question of conflict.

By this time, our corporate counsel had removed itself from representing us because it had also represented our bank, one of the country's largest. We located new lawyers familiar with our state's uniform commercial code, and they immediately began an analysis of the insurance policy and the inflation provision in particular. Within a couple of weeks, our new attorneys concluded that the policy clearly provided a much more generous inflation provision than anyone had anticipated (including the insurance company) because the insurance policy was written poorly and gave us a windfall. The insurance company concluded that we were correct about the inflation provision and reimbursed us for approximately $250,000, or about 94 percent of our loss.

Where we went wrong

In the end, I was more critical of office operations (and my own oversight as executive director) than either of the two audit reports. The first report concluded that while we could have had greater segregation of accounting functions, our procedures did not differ significantly from those followed by nonprofit organizations of similar size. The second audit report did not significantly criticize the first.

Our own assessment concluded that we had disregarded two key existing internal controls in an attempt to keep our "rising star" challenged and ease some of Mary's heavy workload. First, we had given Bob responsibility for both the payables and daily deposits, and for reconciling the monthly bank statements. Secondly, we did not carefully monitor his reconciliation work.

During the course of the investigation, we found out how Bob obtained blank checks. When we run checks for payables, our printer spoils one or two blank checks. Bob tore off these spoiled checks from the printer and used them by forging signatures. In addition, by virtue of his payables responsibility, he had unrestricted access to the supply of blank checks held in the office.

In short, we allowed our internal controls to develop into a system based on trust rather than a system based on proven accounting and business principles. Our board of directors concurred in this conclusion. In other words, we tried to be brutally honest about what we had done that contributed to the embezzlement, regardless of the findings of outside auditors.

Impact on staff

Within several days of the discovery, and after consulting legal counsel to avoid slander, we had a staff meeting during which everyone learned what had happened. Staff were encouraged to express their thoughts. By that time, rumors had become widespread.

The discussion was serious and emotional. Several people had developed close friendships with Bob and were devastated; they felt mixed feelings of anger, betrayal, and shock. More than one said, "We don't really know who he was." The meeting took about an hour, during which there were moments of silence in which the staff absorbed the comments of their colleagues. In the end, the meeting turned out to be cathartic and well worth the time it took.

As for our accounting manager, she was not fired for failing to monitor the reconciliation handled by the accounting assistant. Some will criticize that decision. We based our decision on both business and humanitarian grounds. In our situation, little would have been gained by firing Mary. The manager is and always has been scrupulously honest. We reprimanded her for her failure to exercise oversight and she took it to heart. She has the virtues as well as the vices of one who has worked for one organization for a long time.

Observations and suggestions

Based on our experience, we offer the following observations and suggestions to other association executives:

* Acknowledge that employee theft can happen in your association. Organizations large and small have demonstrated that it is virtually impossible to prevent the first theft by a willing criminal.

* Segregate accounting functions, and don't let internal control procedures fall into disuse. In our relatively modest-sized, generally friendly organization, it is not particularly easy to segregate accounting functions. Nevertheless, it's critically important to do so. Allowing some of our key internal controls to lapse almost certainly led to the theft.

* Review your insurance coverage for employee dishonesty. Make sure you are adequately covered for a loss. No standard exists to guide you, but the marginal cost for adding an additional $1,000 of coverage decreases as the coverage increases. Consult your insurance agent and err on the side of caution.

* Gain an understanding before any theft occurs what state law governs the liability of banks for forged checks and other fraudulent acts that could lead to theft from your accounts. In our state, banks can claim they are not liable if they have not been informed within 30 days of a monthly statement that theft has occurred. However, state law also extends liability where the bank has been grossly negligent. Our insurance company is intent on proving the latter through an attorney who works on a contingency basis.

* Consider periodic risk assessments of your association's financial and accounting processes and controls. It may save you grief later on.

Should a theft occur:

* Document every conversation you have about the matter. Re-create the evidence of the theft in ruthless detail.

* Close your operating accounts immediately, but find out if your bank will cooperate in paying approved checks one by one. We did not close the accounts until first thing the Monday morning following our discovery of the theft. That did not injure us, but it would have been better to close the accounts immediately following the discovery.

* Communicate with the board. To minimize legal exposure, our attorneys advised us to communicate with the board orally rather than in writing.

* Conduct an honest, thorough investigation. Our staff was involved in the internal investigation and, through me, was significantly involved in reporting to volunteer leadership. A different approach could have been taken: For example, the executive committee could have foregone any staff involvement and called in outside auditors with no history with us. However, we were able to conduct an honest and helpful investigation partially because the volunteer leadership and the staff enjoy a high degree of mutual respect.

* Acknowledge failures forthrightly if staff is responsible, even in part, for failing to carry out their duties effectively.

* Allow workers an opportunity to express their feelings and ask questions. The personal impact of employee dishonesty on staff colleagues can be substantial.

* Work with an insurance company that has a good payout history - ask your colleagues about their experiences. Two claims made under our Travelers policies were both handled expeditiously and fairly.

* Prepare a statement that you can use for possible press inquiries - particularly if your loss is significant. Keep the statement brief and positive. Report that a theft that appears to be the work of an employee has occurred and give the approximate amount. State that the association expects to recover most if not all of the loss through insurance and that the association's board of directors is being kept regularly informed .of developments in the case. Mentioning the board's oversight role communicates to the press and to members that the association answers to a higher authority. It also builds confidence in the conduct of the investigation. Although we developed a press release - anticipating that either police or the state's attorney would leak the story because of the size of the theft - we did not get any calls, so did not send it out.

* Finally, establish a standard not only for investigating the theft but also for communicating about it to members. We established the following: If any single member of our organization inquired about the theft at our annual business meeting, the thoroughness and forthrightness of the information we provided in that setting needed to make the member confident that all efforts had been made to recover the loss and all appropriate action had been taken to minimize the recurrence of a theft in the future. Mild disagreement surfaced on our board about reporting everything to the membership. Most believed that the board met its fiduciary responsibilities by handling the situation professionally and responsibly. Moreover, most believed it to be less imperative to report on the events when the loss appeared as if it were going to be substantially recovered. Yet, most board members also believed that if information about the thefts became widespread among the members, a full report needed to be made public.

Editor's note: This article was written by an association executive director and an executive assistant. The byline is a pseudonym used by the executive director, and the names appearing in the article also are