Pay-and-return invoicing: anonymous tips are an important source of information on employee theft.

A philosopher once said the road to hell is paved with good intentions. As all fraud examiners know, given the right circumstances--for example, a personal financial crisis coupled with weak internal controls on the job--many otherwise law-abiding employees will rationalize their way into stealing from the companies they work for.

The following case study illustrates such a situation and shows how CPAs can protect their clients and employers from pay-and-return billing scams. This particular ruse shouldn't have lasted as long as it did; a simple, inexpensive service could've stopped it much earlier.

NO WAY OUT

As Veronica, an accounting clerk at a dental supply wholesaler, hung up the phone, her cheeks reddened with anger and embarrassment. She knew her coworkers at the dozen or so desks nearby had heard everything--as usual. This call had been from yet another of her husband's many frustrated creditors, who demanded money she didn't have. The outstanding debts arose from a business that was operated strictly by her spouse, not her. But as Veronica knew so well, in the community property state where she and Les lived, his debts were her debts, too.

When Veronica married Les eight years ago, he had been a fast-talking hustler. But success had eluded him; one after another his business ventures failed. Then, three years ago, to get a fresh start, the couple filed for personal bankruptcy. Yet, somehow, they again had gotten over their heads in debt. This time, though, because you can declare bankruptcy only once every seven years, they became desperate.

AN APPARENT IMPROVEMENT

In the office, Veronica's colleague, Jenny, had tried not to eavesdrop. But the low partition between their cubicles ensured she would hear most, if not all, of the calls Veronica received from creditors. Since Jenny knew her friend was in trouble, she wasn't surprised when Veronica time and again shared her tale of financial woe. But as the months passed, Veronica simply stopped talking about her debts.

A DIFFICULT CHOICE

More than a year later, Jenny accidentally discovered why Veronica was silent on the subject. At the end of one workday, when no one else was around, Jenny clearly saw Veronica slip a vendor check into her purse. Now it began to make sense: Veronica was stealing from the company. Jenny was incensed and couldn't think of anything else for several days. Still, the thought of turning in Veronica made her ill. But after being with the company nearly 10 years, Jenny had a personal stake in it. However, she reasoned, if Veronica kept stealing, it would only worsen her problems, so Jenny decided to report her friend anonymously. First she thought of phoning her boss but realized he'd recognize her voice. Then it hit her: She would call the company's CPA firm; they surely would want to know about this, and they wouldn't know who she was.

Calling from a pay phone, Jenny was questioned by a manager at the firm.

"How do you know she's stealing?" he demanded.

"Because I saw her," Jenny replied defensively.

"And who are you?" the manager wanted to know.

The conversation ended when Jenny refused to identify herself.

The manager said: "You tell me you witnessed a theft, but you won't say who you are. You could be anybody. I can't take this further unless I have more evidence."

Jenny refused to say anything more and hung up.

Jenny never confronted Veronica with what she knew, but she wanted no more to do with her. Although Jenny saw Veronica steal another check about six months later, she clenched her teeth and kept her mouth shut. That is until several weeks later when Claude, a CPA recently hired as the company's internal auditor, invited her into his office.

ON THE TRAIL TO DISCOVERY

With records in his cubbyhole office already piled high around him, Claude explained to Jenny that--as part of his new responsibilities--he was meeting with a number of employees to get their opinions on the company's accounting operation.

During his discussion with Jenny, Claude wanted to focus on fraud by company employees. So he introduced the subject by asking her if she had known one of the company's purchasing agents took several hundred thousand dollars in kickbacks to award favorable manufacturing contracts. Jenny said everyone in the company had heard the rumor. To avoid publicity, the company had decided not to prosecute. It also hired Claude to help prevent such future incidents.

Finally, he got to the point. "Has anyone in the company ever asked you to do something that you thought was illegal or unethical?" Jenny didn't have to think long about that. "No," she said quickly.

Then Claude asked, "Do you suspect anyone in the company is committing fraud?" Jenny sat silently for a moment. "Should I tell him what I know?" she wondered.

Looking at Jenny's face, Claude didn't need to hear an answer. He knew something was wrong and started digging further. Although Jenny said nothing more, Claude immediately reviewed Jenny's job functions and those of the accounting clerks who worked with her. He found nothing unusual until he came to Veronica's job description, which was disturbing: Her primary responsibility was processing invoices for payment, but she also handled the occasional overpayment received in the mail. This was clearly a breach of security that needed prompt attention.

Claude's subsequent investigation revealed that Veronica was processing certain invoices twice. When confronted, she seemed relieved and confessed everything, admitting her favorite target was her employer's largest supplier, a dental appliance manufacturer that printed its simple invoices in black ink on plain paper. When strapped for money, Veronica said, she'd make a copy of the manufacturer's invoice before stamping the original. The two were almost indistinguishable. Then she'd process the first invoice, send it on for approval, and process the invoice again a few days later using the copy she'd made. To further disguise her scheme, Veronica always put the copied invoice in a stack of others waiting to be processed for payment.

The company would pay the bill twice. When the supplier realized the overpayment, it sent a refund check that landed on Veronica's desk. She in turn slipped the extra check into her purse and later turned it over to Les, who forged her company's endorsement with a specially made rubber stamp and deposited the check in his business account.

In less than two years, Veronica had embezzled more than a quarter-million dollars. True to form, she saved her husband from jail by claiming the whole scheme was her idea. But because Veronica was a first-time offender, She got several years' probation and served only six months in a halfway house.

BETTER LATE THAN NEVER

Claude took some basic steps to prevent such fraud in the future. First, he instructed the accounting department to be on the lookout for copies of original invoices. Poor quality duplicates can be detected with the naked eye, but some reproductions are good enough to escape all but the most detailed inspection. So, as an added safeguard, Claude installed controls that would warn him if the accounting department tried to process the same invoice amount and/or number twice. This required nothing more than adding an automated procedure to the invoice payment system. Before printing a check, the system would scan previous payments to see whether any were issued for the same bill. If questionable items turned up, Claude would review them and determine how to proceed.

Second, he reassigned the responsibility for depositing refund checks to a staff member who didn't deal with invoices, thus separating critical job functions and correcting a serious control deficiency.

Finally, because some of the most valuable information on suspected employee crime comes from workers concerned about reprisals, Claude established a telephone hot line (see "What's So Hot About Hot Lines?") so employees can report suspicions promptly without fear for their personal safety or job security. He also recommended that management instruct the CPA firm to accept and immediately inform the company of all calls and reports of suspected fraud.

What's So Hot About Hot Lines?

From the search for the Unabomber to the Enron inquiry, investigators have found "inside" information from family members and coworkers to be especially valuable. One way to obtain tips from such knowledgeable sources is to establish telephone "hot lines" that are convenient and guarantee callers' anonymity.

To encourage their use, hot lines must let callers furnish information without fear of reprisal. Since many employees who want to report misdeeds may be afraid--for fear of discovery--to call a hot line at work, such services must be available 24 hours a day. Although callers report a wide variety of petty grievances, one simple fact remains: Some crimes are not discovered any other way.

There are three types of hot lines.

Full-time, in-house. The most expensive and effective hot lines are staffed--around the clock--by live personnel who can answer the caller's questions and concerns. Usually only the largest companies maintain fulltime hot lines.

Third-party providers. Many third parties provide hot line services that are available at all times. When an individual calls to make a report, the provider takes down the information and relays it to the client company. Although this type of service is less expensive than an in-house version, the employer--not the service provider--is responsible for informing employees of its availability and contact information.

Part-time, in-house. Many companies have a tip line answered by company employees--usually in the internal audit or security departments--during working hours. At other times, callers are able to leave a voice-mail message. Although inexpensive, this method is not as effective as the other two types of hot line because--as explained above--it isn't sufficiently confidential and doesn't give callers a chance to ask questions before they give information.

Reporting Fraud--Employees Do It Best

                                    Percentage
Source of information                of cases

Tip from employee                     26.3%
Accidental discovery                  18.8%
Internal audit                        18.6%
Internal controls                     15.4%
External audit                        11.5%
Tip from customer                      8.6%
Anonymous tip                          6.2%
Tip from vendor                        5.1%
Notification from law enforcement      1.7%

Note: Total exceeds 100% because
some participants cited more than one
method for initial discovery of fraud.

Note: Table made from bar graph.

Source: Report to the Nation: Occupational
Fraud and Abuse, Association of Certified
Fraud Examiners, Austin, Texas, 2002.

This is the third article in a four-part series on identifying false invoices and their issuers. It explains the pay-and-return billing scheme, in which an employee creates an overpayment to a vendor and pockets the subsequent refund. The other stories focus on shell companies (See JofA, Jul.02, page 76 or www.aicpa.org/pubs/jofa/jul2002/wells.htm), pass-through billing schemes (See JofA, Aug. 02, page 72 or www.aicpa.org/pubs/jofa/aug2002/wells.htm) and personal purchase schemes, which will be the subject of "The Fraud Beat" in October.

JOSEPH T. WELLS, CPA, CFE, is founder and chairman of the Association of Certified Fraud Examiners in Austin, Texas, and professor of fraud examination at the University of Texas. Mr. Wells' article, "So That's Why They Call It a Pyramid Scheme" (JofA, Oct.00, page 91), won the Lawler Award for the best article in the JofA in 2000. His e-mail address is [e-mail].