It was 6 on a winter's evening in Albuquerque. I was in the office of a small business, Fuselton Manufacturing, performing some bookkeeping duties. My day job was auditing financial institutions, but freshly out of school, married for less than three years, and with a new baby on the way, I needed extra money.
John Fuselton, the company's sole proprietor, walked into my cubicle and sat down. He looked concerned. John said quietly, almost in a whisper, "My office manager has taken some money from the company and I would like to know how much is missing." My first question was, "How did you find out?" He said he was working late a few months earlier when the phone rang. An American Express customer service rep told him that the last payment made on the company's account had bounced. However, the account number she gave didn't match the company's credit card. She said the bill had been paid with a Fuselton Manufacturing company check.
The company was a mildly successful manufacturer of small metal parts for the aerospace industry. But as with many small businesses, the company struggled with cash flow and, without a bank line of credit, occasionally bounced a check. The customer rep told John the check number was 19932. He put her on hold and found the copy of the check with that number, which had "void" written across its face with no payee or amount listed on the appropriate lines.
CONFRONTING HELEN
The canceled checks for the previous month hadn't yet arrived at the offices of Fuselton Manufacturing. (Back in 1988, when this case occurred, banks were still sending all canceled checks back to businesses and individuals.) The credit card's holder was a "Helen Allen." John was stunned. Helen, his office manager, had been with him from the beginning when he was a one-man operation and was machining all the parts by himself. She ran the front office and handled the daily operations including writing most of the daily checks and processing the biweekly payroll. Helen also handled the handwritten check register, which identified deposits to and payments from Fuselton Manufacturing.
John didn't confront Helen for two weeks while he waited for the bank to send the canceled checks. When they arrived, he waited till the end of the day before looking for check No. 19932. "American Express" was written on the front of the check as the payee and the description field had an account number that didn't match the Fuselton Manufacturing account number. The back had been endorsed by American Express.
The next morning John called Helen into his office. He showed her the actual check and the copy and asked her to explain the discrepancy. She sobbed as she confessed to using some company checks to pay her American Express bill that had gotten out of hand. Helen said that she had stuck with him through thick and thin. She believed in the company and had given her blood, sweat, and tears to help it grow. But she was a single mother raising a teenage daughter and found herself short on funds; she had rationalized that she could "borrow" a little for all the extra work she had done. She said she meant to pay it back as the company grew and when John could afford to pay her a little more. Helen begged for her job and John relented. She said she thought that she had taken about $25,000 over a three-year period from 1984 through 1987. That wasn't exactly small change for extra compensation.
After the discovery, John asked his CPA what he should do. The CPA said three words: "segregation of duties." John and I were acquaintances and he knew that I was an auditor, so he had asked me to work part time a few hours each month to complete the company's bank reconciliation.
THE EXAMINATION BEGINS
Now he was sitting at my desk asking if I could perform a fraud examination of Helen's activities over the past three years. In my zeal to make some side money, I agreed. As I drove home I began to feel ill because I realized that I might have bitten off more than I could chew. I was an auditor, but my most prolific skill seemed to be tick-marking work papers correctly. But the next day John gave me my own key and the building's alarm code. Twice a week, I would come in at 7 p.m. and work until 9 p.m.
As I began the examination, I knew two things: some of the check copies didn't match the canceled checks, and the handwritten check register didn't "foot" properly on some pages. (The footing process verifies that all amounts on a page are accounted for.) There were thousands of checks to review. John told me he thought that checks made out to cash and voided checks might be the culprits, but I should review everything. I began in the prior month and worked backwards through each month reviewing the front and back of all the canceled checks along with the payee and endorsement. I then re-footed each page of the check register for each month to verify the beginning and ending balances.
Night after night I toiled away. I was frustrated. After three weeks, I had only managed to validate six months of canceled checks, check registers, and bank reconcilements. One night, I laid out the check register, a suspect check and its copy, and the bank statement. Then something on the check register caught my eye. I saw two very small faint dashes in pencil on the upper-right corner of the suspect check line. I pulled up the previous suspect check and thumbed through the check register until I found the entry. There it was again -- two very faint dashes in the upper-right corner of the suspect check entry. That's how she had kept track of each embezzled check and made sure the bottom of each check register page would balance to the bank statement each month.
In two weeks, I identified each fictitious entry and all the defalcations in the other 30 months. The total amount of the embezzlement was not $25,000 but $58,000! Approximately, $1,600 was absconded each month over the three-year period. The fraud apparently began with a 1984 check made out to cash but endorsed by Helen; the check copy had "void" written across the payee line. The check register was off by $20, but the footed balance at the bottom of the page showed the extra amount.
As part of the reporting process, I included a graphical timeline by month with dollar amounts and frequency of occurrence by month. The pattern was typical of most embezzlements: from 1984 the frequency and amount had grown steadily. The first amounts were small -- $20 and $30 -- and occurred once or twice per month. But by 1987, she was stealing from $100 to $200 two to four times a week.
I completed my report and gave my narrative to John. He was extremely disheartened but Helen remained employed. We set up a procedure in which I completed the bank reconciliation each month and reviewed all the monthly canceled checks for payee, endorsement, and signature. Even after I moved out of New Mexico, I continued to remotely monitor the monthly transactions.
LESSONS TO LEARN
What can we learn from this tale of deceit? Through the years, I've thought about the things that John could have and should have done to prevent this seemingly simple embezzlement. (It's simple until it happens to you!) Any small-business owner can do some basic things to mitigate some of the fraud risks.
Understand Your Vulnerability
As you're read many times in these pages, small businesses are typically more vulnerable to fraud because of a lack of segregation of duties, job rotation, and good internal controls. The risk and opportunities to commit fraud and embezzlement increase quite dramatically in small businesses. The 2006 Association of Certified Fraud Examiners report on occupational fraud bears this out: Small businesses continue to suffer disproportionate fraud losses. The median loss suffered by organizations with fewer than 100 employees was $190,000 per scheme. This was higher than the median loss in even the largest organizations. The most common occupational frauds in small businesses involve employees fraudulently writing company checks, skimming revenues, and processing fraudulent invoices.
Review Your Digital Check Copies
This might seem obvious, but periodically review on your bank Web sites the digital fronts and back of all canceled checks. Look especially for voided checks and checks made out to cash. Pay particular attention to the payee and description on the fronts and the endorsement stamps and/or signatures on the backs.
Voided Check Policy and Procedure
Devise a policy and procedure on the proper way to void a check. The check should be defaced with "void" written across the whole check and the signature line should be torn off and destroyed. Then attach the defaced, voided check to the check copy to complete the audit trail.
Don't Sign Blank Checks
Believe it or not, some small business owners still sign checks with the payee areas blank. Don't do it! Also, tell your bank to notify you if any employees are attempting to withdraw monies.
Segregation of Duties
An employee who doesn't handle the deposit or payment process should perform the monthly bank reconciliation, to not only protect the company but also to protect those who perform disbursement or cash receipt functions. (You could hire an independent contractor to perform the monthly bank reconciliation.)
Duplicate Payment Review
Perform a quick, semi-annual duplicate payment review using Microsoft Excel and its sorting and conditional formatting functions. Many small companies use QuickBooks, which can easily be downloaded into an Excel spreadsheet. Following is a step-by-step guide to sorting in Excel, which places a conditional format on certain cells to quickly review data for duplicate payments.
1. Download a set of invoice data - (normally from QuickBooks).
2. Determine Absolute Invoice Amount values. - In the spreadsheet, highlight a column next to the invoice amount column and choose Insert, Column. This will insert a blank column. In that blank column enter the formula =abs(E2) or the invoice amount cell. Select the cell and choose Edit, Copy and copy the formula down to the bottom of the data. This will produce a number field that doesn't have negative numbers. Name the column INV_AMT_ABS. Go back to the top of the column and select the whole column. Again chose Edit, Copy, and Edit, Paste Special. A dialog box will appear. Select Paste Values. This will remove the formula from the column and replace it with Absolute Invoice Amount (INV_AMT_ABS) values.
3. Sort the Columns. - Highlight the whole data set and go to the toolbar under Data, Sort, and then sort the INV_AMT_ABS descending. Then sort by Vendor Name ascending. This procedure will sort the amounts from largest to smallest. You then want a way to pick the duplicate invoice amount visually using a conditional format.
4. Determine Conditional Formatting Cell Values. - Select the first cell of the INV_AMT_ABS amount. Chose Format, Conditional Format from the toolbar. A dialog box will appear. Set to "cell value" and "equal to" from the drop down menu. Put the cursor in the third box and select the cell directly above the first INV_AMT_ABS dollar amount (typically E1). Once you select that cell, there will be a formula in the box that is =$E$1. The "$" sign is hardcoded in that cell reference and must be taken out manually to be able to copy the conditional format throughout the column. To take out the "$," place the cursor in front of the "$" and press the delete button. Then put the cursor in front of the other "$" sign and press delete. The formula should now read =E1. Once completed, click on format and a new dialog box will appear with three tabs. Select the Patterns tab and select a color. Click OK and then OK again to leave the conditional format tool.
5. Put the conditional format in every cell in the column. - Select the first cell that includes the conditional format -- the first INV_AMT_ABS number. Chose Edit, Copy and highlight the column. Return to Edit, Paste Special and select Formats and then OK. This will put the conditional format in every cell in the column. If the cell above equals the cell underneath, the cell underneath will be highlighted with a color, which makes it easy to review duplicated numbers quickly.
HELEN WASN'T FINISHED
There is one last surprising addition to this story. Five years later, I moved back to New Mexico to work for John as the chief financial officer for his company. Helen was still the office manager! Before I came back, she had handled his accounts receivable agings and the banking relationship for the company's line of credit. But as CFO, I now assumed those duties.
As I prepared for my first meeting with our banking contact, I received an accounts receivable aging report from Helen. The report didn't match the information in the accounting systems. Dates on certain invoices weren't as outstanding as was showing in the accounting system. So, in effect, the bank was lending the company more money than it should have. When I confronted Helen, she said it wasn't that big a deal and that the company needed the additional capital. The bank never questioned the significant differences between the deceptive receivables report and the correct report from the system. However, two weeks later, our banking contact came to our offices unannounced and informed us that our line of credit was cut off. Although Helen was no longer writing company checks for personal use, she had continually put the company at risk by modifying accounting records. We eventually let her go, and I took over all her accounting duties including accounts receivable, and we moved forward. Small business owners: Always be aware.
This occasional column reviews basic tenets of fraud examination for the practitioner regardless of age or experience.
Send potential material to FraudMagazine@acfe.com.
Gregory Taylor, CFE, vice president and Chief technology officer at Corporate Audit Partners, a global audit recovery firm, is this issue's columnist. he has changed the names and locations in this cautionary tale of a "loyal" office manager.
The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.fraud-magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be e-mailed to: FraudMagazine@ACFE.com.