Who Do You Trust?

IMAGINE THE HORROR OF HAVING TO REPORT TO YOUR BOARD OF DIRECTORS that the chief financial officer has been stealing from your association for years, undetected. If you're in the position of being someone who should have known" the embezzlement was taking place, you may quickly find yourself-under a cloud of suspicion-or viewed as incompetent. After all, people will ask, "How could you not have known what was going on?"

Think your association is immune to embezzlement? Think again. In fact, fraud can strike any business organization, regardless of size, structure or mission. When an insider perpetrates the fraud, the havoc wreaked is particularly insidious. Just consider how much the reputation of the Ohio Division of the American Cancer Society has been tarnished by the news reports hat one of its senior employees allegedly embezzled nearly $8 million.

When insider fraud is discovered, few even ask, "How did this happen?" Rather, they say, "I can't believe that 'John' did this to us," This reaction reflects human nature to trust people, not systems. Appropriate anti-fraud systems, however, are your association's best anti-crime defense.

Outlined below are some common embezzlement schemes along with suggested internal controls that may reduce the possibility of such crime.

How does insider fraud happen?

In the typical scenario, the perpetrator either seizes an unexpected opportunity to steal, finds a system weakness and takes advantage of it, or creates the means by which to accomplish the crime. (See sidebar, "Five Frequent Fraud Schemes.") The following real-life crimes--cases that either I or a colleague have prosecuted as an assistant U.S. attorney--illustrate the point.

Seizing the opportunity. Shirley Marie Smith worked as a publications order clerk for the American Association of State, Highway, and Transportation Officials (AASHTO), Washington, D.C. For some time, she had been diverting, to her personal benefit, cheeks in amounts less than $100 that came across her desk.

One day, the government of Canada sent a check for $130,000 with an order for publications. Smith simply erased "AASHTO" from the payee line, typed in her own name, and took the check to the bank. The bank teller knew Smith, who did the banking for AASHTO and also had a personal account at that branch. The teller asked, "Shirley, where did you get this money?" She replied, "My mother has been saving nickels since the day I was born."

Although the check bore an obvious alteration, the teller accepted it for negotiation. Smith promptly withdrew and spent all the money. The fraud was discovered during a review by AASHTO of what appeared to be a delinquent accounts receivable. When payment verification was requested from the government of Canada, a copy of the original check was forwarded. It showed the alteration with Smith's name.

Outcome: In a civil action between the bank and AASHTO's insurer, the bank ultimately bore the financial loss. Smith was prosecuted and pleaded guilty to the federal charge of money laundering. The court sentenced her to 25 months in jail and ordered her to pay $130,000 in restitution.

Finding and taking advantage of the system's weakness. Dorothea Marbury and Phelicia McCain worked for Academic Search Consultation Service, (ASCS), Washington, D.C., as the administrative assistant and office administrator, respectively. In total they embezzled more than $75,000 by using credit card cash-advance checks and making unauthorized charges on employee credit card accounts.

Various ASCS employees held VISA credit cards for business-related travel. Although the credit cards were in the names of the various employees, the account statements were mailed directly to ASCS, to the attention of McCain. McCain and Marbury were responsible for reviewing all account statements and authorizing reimbursement for the charges. The fraud was discovered when another employee received a statement, reviewed it, and saw the unauthorized charges.

Outcome: Marbury and McCain pleaded guilty to the federal crime of credit card fraud. Both women were ordered to make full restitution. Marbury was sentenced to six months of home detention and McCain, Marbury's supervisor, was sentenced to four months in jail and four months of home detention.

Creating the means by which to commit the crime. John O'Connell, the former chief financial officer of the Rubber Manufacturers Association, Washington, D.C., made all the decisions regarding what audit firm to hire and when to conduct the organization's audit. With this control, he was able to move $200,000 he had stolen from an RMA investment account back into RMA's account to cover for the theft. He also ensured that account verification letters, which the audit firm gave to O'Connell to complete and mail, were sent to a post office box that he controlled. As soon as the audit was over, the money went back into O'Connell's pockets.

Even though the audit firm recommended tighter controls to safeguard RMA's assets and investments, O'Connell put off action by the board of directors for several years, telling them that he was "working on it." The fraud was discovered when O'Connell took a vacation and the employee covering his duties couldn't locate documents supporting a balance in an RMA investment account. Subsequent investigation revealed a web of fraud that included numerous altered and false documents.

Outcome: O'Connell repaid the $200,000 after being confronted by RMA management and having a civil law suit filed against him. O'Connell was prosecuted and, following a jury trial, was sentenced to 51 months in jail for the federal crimes of money laundering and wire fraud.

Constantine "Gus" Gekas, the former executive director of the American Hellenic Educational Progressive Association, Washington, D.C., and Wanagan Hairabedian, AHEPA's former chief in-house accountant, ran an elaborate fraud scheme between 1991 and 1996 that netted the men approximately $1 million. The two men used their positions to obtain loans, lines of credit, and credit cards in the name of AHEPA from various financial institutions. In most instances, they pledged AHEPA's assets as collateral.

To obtain the loans the men misrepresented their authority to enter into the transactions and provided the banks with false documents that contained the forged signatures of AHEPA's officers. Thereafter, they drew on the lines of credit, transferred funds to their own personal benefit, and ran up credit card debt. The money was used, among other things, to purchase real estate. The various lenders forfeited AHEPA's assets to pay off the debts.

Outcome: AHEPA sued Gekas and Hairabedian and obtained a default judgment in excess of $3 million. The two men were also prosecuted federally. Gekas pleaded guilty to interstate transportation of stolen property, cooperated with the authorities, and was sentenced to 36 months of incarceration and $981,000 in restitution. Hairabedian pleaded guilty to the same crime and was sentenced to 57 months in jail and $1,309,000 in restitution.

Emery Bobo, former office manager and bookkeeper for the National Lumber and Building Materials Dealers Association (NLBMDA), Washington, D.C., diverted more than $1 10,000 in member donations, which were earmarked to help rebuild headquarters destroyed by fire, into a secret bank account he controlled. The account was opened in the name "New Life Business Management and Development Association"--also known as NLBMDA.

Bobo eventually was fired for inability to produce financial statements on a timely basis. The fraud was discovered when a contributor noted that he was not acknowledged in a thank-you letter printed in NLBMDA's magazine. A review of the contributor's cancelled check disclosed the secret bank account.

Outcome: Bobo pleaded guilty to interstate transportation of stolen money and was sentenced to 15 months in jail and $142,000 in restitution (including $31,000 he had embezzled from a subsequent employer).

Common motivations for committing fraud

What prompts someone to concoct or participate in a fraudulent scheme? Here are the main reasons.

* Greed. This is the number one reason people embezzle. They want everything right now, without working for it. This is not just the attitude of the person who has a low level of income. Even high-level employees who are, by ordinary standards, handsomely compensated commit fraud.

* Anger and resentment. This is the motive for people who have an attitude of "they owe me." Often, such disgruntled employees express feelings of being unappreciated, unrecognized for their work, and underpaid. In many cases, the employee's behavior seems to say: "I'll show them what I can get away with."

On a related note, fraudsters often believe that they are smarter than everyone else. Getting away with the crime over a period of time can reinforce their feelings of superiority.

* Financial problems. Embezzlers may be experiencing problems with gambling, drugs, or alcohol usage or may have a spouse or family member with these problems. Or, people might be living beyond their means or facing a desperate situation, such as losing a house to foreclosure.

Embezzlers motivated by financial problems generally intend to pay the money back when their situation improves. However, such situations rarely get better; they tend to spiral downward as the debts pile up.

* Desperation. The image of a family with a sick child and insurmountable medical bills may come to mind. This scenario, however, is extremely rare.

* Mental health issues. After the fraud is discovered, some perpetrators blame their actions on mental problems. Usually, however, such employees are fully functional and able to perform their jobs. Otherwise, they would not have remained employed for very long. Therefore, it's difficult to understand how a mental problem could cause someone to commit a crime.

In any event, people who have mental illness almost always know the difference between right and wrong--and they know that stealing from an employer is wrong.

Getting caught

A fraud scam is not like fine wine; it does not improve with age. The longer the fraud takes place, the more likely it will be discovered.

Regardless of the duration of the embezzlement activity, fraud is often discovered in fairly common ways:

* The perpetrator has a family emergency and must leave town quickly. The employee covering the duties discovers missing revenues or assets.

* A third-party vendor calls the association to verify receipt of payment after receiving what appears to be an incorrect billing statement. A review of the back of the cancelled check reveals a secret bank account controlled by the perpetrator.

* Suddenly, there are no funds in a particular account that affects operations, such as meeting payroll. An account analysis shows unauthorized transfers of funds to an account controlled by the perpetrator.

The essence of fraud is the believable lie: Embezzlers use a hint of the truth to disguise and cover what they are doing. They deceive co-workers and supervisors with a web of lies that grows exponentially as time goes by. For example, if the office fax machine was out of service in recent memory, that will be the claimed day an important document was transmitted.

Fortunately, most insider frauds are not crimes of "Who done it?" There is always a paper trail leading in some way to the perpetrator. Even in the computer era, in order for funds to find their way to an account controlled by the perpetrator, records of account transfer are created and maintained by the various financial institutions involved.

A number of warning signs may alert you to the possibility of fraudulent activity. (See sidebar, "Warning Signs of Insider Embezzlement.") Most often, the perpetrator has a sudden and significant lifestyle change. One minute he is driving a Ford Escort; the next minute, a BMW. One week she is shopping at Sears; the next week, she has a personal shopper at Nordstrom's.

Thieves love to brag about their new acquisitions, either verbally or simply by showing what they have. In other words, they will wear the expensive clothing and jewelry, show colleagues photos of their recent island vacation or new home, and drive the new car to work. After all, what fun would it be to have the ill-gotten gain if you couldn't show it off?

Fraud prevention

Pay attention to the warning signs, and investigate when something seems suspicious. Do not always give an employee the benefit of the doubt when he or she is unable to promptly produce financial statements, original records, or documents.

Other recommended measures include the following:

Split certain duties that, in combination, could facilitate fraud. For example, the person who signs checks should not also review the bank statements and balance the accounts each month. The person in charge of recording accounts receivables should not also be responsible for making the association's bank deposits. Nor should the employee who maintains the original account statements for investments be the sole person to assist in the audit processes concerning those accounts.

Never leave blank checks unsecured. Surprisingly, organizations often do this, and it is fraud waiting to happen.

Avoid the use of signature stamps. These stamps often wind up in the hands of unauthorized users.

Use a lock box for the deposit of receivables. Having checks sent directly to your financial institution reduces the possibility of having funds diverted from your organization.

Eliminate association credit cards. Instead, reimburse employees for business charges on credit cards issued in their own names. This measure helps safeguard the organization from fraud and abuse. An account in the employee's name will more likely be scrutinized each month for unauthorized charges and is more likely to be used more cautiously. An added benefit: Employees will promptly prepare expense reports, because they will want to be reimbursed quickly.

Always verify references and professional credentials of prospective employees. A person who would deceive co-workers and supervisors daily would have little compunction about inflating a resume with fictitious or expired credentials. Many fraudsters have perpetrated crime at other places of employment. This, unfortunately, happens when an organization simply terminates such a person's employment without reporting the crime to law enforcement.

Once employed in the association industry, a person can usually find other work in the same field, especially with a smaller association. Watch out for unexplained gaps in employment and past employers who will only verify dates of employment.

Don't rely on the yearly audit as your only safety net. Most audit contracts state something such as, "This is not a forensic audit. However, if we find evidence of fraud, and if it is substantial, [emphasis added] we will bring it to the attention of management." Make sure your audit team agrees to bring all evidence of suspected fraud to the attention of management. Management can then make an informed decision about how to proceed.

Require all employees to take annual vacations. These vacations should last between five and ten consecutive business days. It is often during such absences that fraud comes to the surface.

Display a banner on every computer's opening screen. Use it to inform employees that the computer is association property; emphasize that they should have no expectation of privacy regarding any communication or information stored within the system, including on the computer hard drive or any other media. Such a banner may deter employees who might use their computers in perpetrating crime.

Establish a mechanism for anonymous reporting of suspected fraud and abuse. Managers may fear that an anonymous system will make it easy for disgruntled employees to lodge false allegations against supervisors. But if no fraud exists, the allegations will prove unfounded.

On the other hand, without a confidential reporting system in place, lower level employees who discover fraud by the higher-ups are unlikely to report their concerns for fear of reprisal.

Ensure your association has defined policies and procedures for the transfers of funds and related investment decisions. If feasible, set a dollar limit on investments; over that amount, the approval of the board of directors is required.

Review your association's insurance coverage. Make sure your insurance policies include adequate coverage for employee dishonesty. (See sidebar, "Have They Got You Covered?")

Reporting a crime

As uncomfortable as it may be to publicly admit that fraud occurred within your association, it's important to report the crime to law enforcement officials. Otherwise, the thief may continue to steal from your association. Even if fired, he or she may simply go on to victimize another unsuspecting employer.

In addition to stopping the wrongdoer immediately, calling the authorities enables you to hold the offender accountable for his or her illegal actions. Plus, there is value in general deterrence: Your actions may stop others in the workplace who might be similarly motivated to steal.

Employees who see the wrongdoer avoiding any serious consequences are then more likely to perceive their own chances of getting caught as low. Conversely, they may be deterred by your association's zero tolerance for fraud.

From a financial perspective, your insurance company may not cover the loss unless it is reported to law enforcement. This will depend on your insurance coverage. But don't assume your insurance company, even if notified, will report the crime to law enforcement for you.

Finally, reporting the crime and following through with the justice system helps address the victimization of colleagues who were the unknowing dupes of the fraudster. Fraud is accomplished through a series of lies and deceptions. It often leaves co-workers feeling betrayed, violated, and demoralized. Consider, for example, the treasurer who embezzles and causes the unsuspecting controller to make false entries in the books and records.

Following through on a criminal case can give your other employees a sense of justice and closure. In addition, the confidence levels of the association's members and leaders, plus the general public, are enhanced when a perpetrator is held accountable.

What to expect

If a criminal case is filed, be aware that your association, as a victim of federal crime, has a number of rights. Those include the right to

* be notified of court proceedings;

* confer with the prosecutor;

* request and receive an order of restitution;

* prepare a victim impact statement concerning the crime's emotional, financial, and physical effects, for consideration by the court in determining the appropriate sentence in the case; and

* receive information about the conviction, sentencing, imprisonment, and release of the perpetrator.

On the alert

How vulnerable is your association to insider fraud? How many of the suggested fraud prevention measures does your association currently have in place? Put yourself in the position of the embezzler, and consider the weaknesses in your financial systems. Next, implement changes to close the loopholes in your systems.

Keeping your eyes open for the warning signs of fraud and implementing some basic internal controls today may save you time, energy, and significant financial losses in the future.

Sherri L. Schornstein, is an assistant U.S. attorney in the U.S. Attorney's Office for the District of Columbia's Economic Crimes Section. She leads the Association Fraud Prevention Initiative, a public/private partnership with her office, ASAE, and the FBI. She is also an adjunct professor at the American University. E-mail: [e-mail]. The views reflected in this article are those of the author and do not necessarily reflect the views of the U.S. Department of Justice.

Tempering High-Tech Check Fraud

RICHARD TEDRICK

With the fast and furious evolution of technology, businesses are constantly challenged to keep pace with their competitors. While embracing technological advancements, both companies and nonprofit organizations should be aware of the vulnerability these new, improved business practices can create. Continual changes in workplace technology mandate that strong internal controls be a major consideration, particularly with respect to cash disbursements.

No organization is free from check fraud. More than 1 million fraudulent checks enter the banking system each day. The amount of check fraud losses is more than 15 times greater than losses due to credit card fraud, automatic teller machine fraud, and bank robbery combined. According to a study conducted by Ernst & Young LLP, an international professional services firm headquartered in New York City, 500 million checks are forged annually in the United States, resulting in losses of $10 billion.

Various studies report that check fraud is growing more than 20 percent annually: it affects an estimated 60 percent or more of U.S. corporations. Losses and expenses related to check fraud will continue to increase the cost of doing business, unless banks and their customers form a strong partnership to prevent and control the problem.

WHY THE INCREASE IN CHECK FRAUD?

The combination of technology and regulatory changes has made the crime relatively easy to commit. Laser printers, scanners, color copiers, and desktop publishing have made it possible to produce counterfeit or altered checks that are identical to the actual checks. The tools used to produce these imitations are inexpensive, portable, and available at the person's place of employment. Software allows individuals to print checks from their accounts or the accounts of others.

Changes in the Uniform Commercial Code increased the problem by re-directing responsibility for check fraud from the banks to both banks and customers. In addition to this shared responsibility, regulatory changes have resulted in cash being made available before the related checks have actually cleared. Such regulations have forced banks to develop technologically advanced systems and services that can help lower the number of fraud cases affecting customers and banks.

WHAT TO DO?

No system can completely eliminate check fraud. However, certain practices can significantly reduce exposure to it by complicating the criminal's task. Using selected bank services, in combination with highly secure checks, increases control over check payments.

Banks offer several cash management services for detecting and preventing unauthorized payments from corporate checking accounts. One of those services is Positive Pay, an automated check-matching service. This is how Positive Pay works:

* The customer sends information (check number, amount, and date) via a file to the bank each day that checks are issued.

* The bank matches the checks presented for payment (check number and amount) to the file of issued checks maintained at the bank.

* If the Positive Pay file transmission matches the check details, the check will be honored.

* If the bank has no in-file match for the item presented, it contacts the customer to determine the check's authenticity.

* The customer instructs the bank to pay or return any exceptions.

* If fraud is found, the bank will return the check unpaid, and the counterfeiter is defeated.

"Positive Pay is probably the single most effective bank service that the customer can implement to ensure that fraudulent checks are not paid against their account," says Dan Fullenkamp, senior vice president, tax-exempt group, First Union National Bank, McLean, Virginia. "With the great advances in computers and scanners, and the creation of facsimiles, even the most inexperienced individual intent on committing fraud can create a check that would pass almost any physical inspection."

Timothy Lee, senior vice president, not-for-profit division, SunTrust Bank, Washington, D.C., agrees. "Counterfeit and fraudulent check losses are growing exponentially every year with the use of sophisticated automated equipment," he says. "One of the best tools to combat fraud is the use of an Account Reconciliation/Positive Pay service. It provides the only certain way to stop fraudulent checks from clearing through the Federal Reserve System."

Other types of check fraud prevention are Reverse Positive Pay and Maximum Dollar Positive Pay. Although these provide timely and manageable information, they are not as effective as Positive Pay.

Reverse Positive Pay allows an organization to conduct its own daily check-file matching to identify exception items. Most banks offer a daily transmission of paid items that can be compared with the issued-check files maintained by their customers. The organization must research each suspect check and advise the bank which items to return.

Maximum Dollar Positive Pay allows an association to set a limit on the dollar amount of any check to be paid against its account. When a check exceeding the established limit is presented, the bank will notify the association.

Although Positive Pay represents just one way to enhance internal controls, it is one of the best control mechanisms for reducing the opportunity for fraud. It provides complete and timely information, reduces stop-payment costs, and can reduce accounting and staffing costs associated with monthly account research and reconcilement.

Richard Tedrick is managing director, finance, National Rifle Association of America, Fairfax, Virginia.

Have They Got You Covered?

JOE DUNN 

Whether we like to admit it or not, white-collar crime and theft in the work place are problems facing nonprofit trade and professional associations today. They come in many forms that can include everything from the theft of your organization's laptops to embezzlement, computer fraud, common burglary, and forgery.

Complicating the matter further--and increasing the probability of loss--is the ongoing advancement of information technology. In fact, the very advancements designed to promote productivity make the threat of employee theft more ominous than ever before. This means that protecting your association's assets from employees who embezzle--or commit other forms of crime--requires the implementation of proper internal controls. [See main article, "Who Do You Trust?").

Beyond the implementation of controls, one of the most important tools available to help protect your association from crime is a fidelity bond. Such insurance protection provides coverage that guarantees that the insurance company will pay the insured business, association, or individual for money or other property lost because of dishonest acts of its bonded employees, who are identified in the language of the bond either by name or by position. Given the current dynamics of the economy and the nature of association operations, it is important for nonprofit organization leaders to verify that their bond coverage include a broad definition of employee, making sure to include temporary help, non-compensated officers, and so on.

Depending upon the nature of your association's total insurance coverages, it may not be necessary to obtain a standalone fidelity bond. Crime protection may be afforded in a package policy, which may specify coverage for crime, forgery, and theft of money and securities. It is wise to contact your insurance agent in researching the amount of protection your association may already have in place-- and what additional coverage might be recommended.

Also, you should be aware that if your association offers employee benefit plans, fidelity coverage becomes mandatory as required by federal statute. In short, Title 1 of ERISA (the Employee Retirement Income Security Act of 1914) requires fidelity bonding of all fiduciaries administering employee benefit plans. ERISA also stipulates that the amount of the bond be fixed at the beginning of each fiscal year of the plan. The limit should not be less than 10 percent of the total amount of funds handled, subject to a minimum of $1,000 and a maximum required limit of S500,000. Since the amount of "funds handled" can be difficult to determine, it may be safe to assume that a bond in the amount of at least 10 percent of the plan's total assets would meet the legal requirement.

Remember: Use proper internal controls, common sense, and the tools available to you--such as fidelity bonds--to help protect your association from crime.

Joe Dunn is vice president, Aon Association Services, Washington, D.C., an insurance firm specializing in association insurance needs.

Five Frequent Fraud Schemes

Typically, fraud schemes involve the following activities:

* diversion of checks received or checks disbursed;

* misappropriation of investments or other assets;

* credit card fraud and identity theft;

* ghost vendors; or

* theft of equipment and supplies.

Warning Signs of Insider Embezzlement

Be on the alert if an employee does any of the following:

* never takes a vacation;

* unreasonably insists on maintaining all original documents and records or on maintaining a system in a particular way;

* unreasonably refuses to delegate ordinary business tasks to others;

* is unable to promptly produce original checks, account statements, invoices, vouchers, records, receipts, or financial reports upon request;

* lives beyond his or her means, such as suddenly taking an expensive vacation or buying a new home, a luxury car, or expensive jewelry and clothing; or

* is perpetually disgruntled and complains about being underpaid and unappreciated.

The Next Step

What should you do when you detect insider fraud? Here are the steps to take.

1. Document findings, including statements made by the suspected embezzler when lie or she is confronted by management.

2. Gather all relevant evidence documenting the crime.

3. Limit the handling of the original documents; they could he subject to forensic analysis for handwriting or fingerprints.

4. Report the crime to law enforcement. If the crime involves the use of the mail, fax machines, telephone lines, the Internet, or the transfer of funds across state lines, the fraud will likely involve a federal violation. The Federal Bureau of Investigation (FBl) investigates violations of federal law involving most white-collar crimes. Contact the FBI by calling 1-800-FBI-HELP. Note, however, that the FBI only accepts cases that exceed a certain dollar loss. Cases that fall below the threshold will he referred to local law enforcement authorities.

5. Report the crime to your association's insurance company.