Built-in Glitches

Controls in Accounts Payable Software not Fraudproof

By By Rosemary Wilke, CFE, CIA

Jack had prepared everything. Now he was ready for a little embezzlement. 

An accounts payable clerk at a property management firm, Jack had found a way to worm around the internal controls of his company s accounts payable (A/P) software and write checks to himself. Now he d be able to take care of that pesky gambling debt. Jack told himself he d pay it back when he d hit the big win. "I m due," he thought. "I m due."

* * * * * * * * * * * *

A/P software packages with "built-in controls" promise to streamline financial operations and help prevent fraud within an organization. But like the old Gershwin tune, it ain t necessarily so.

For instance, the check-writing systems of some common business applications allow a clerk to add and delete temporary vendors without leaving an audit trail in the system. And these systems have options that can be turned off so that check numbers aren t monitored and invoices from vendors aren t rejected if the invoice number already has been paid.

These and other accounts payable software weaknesses helped one fraudster steal $14,000 in a recent embezzlement case we investigated. We discovered that the internal control functions in these A/P software packages are far from dependable.

Telltale Canceled Check 

I m an auditor and fraud examiner for the California Public Employees Retirement System (CalPERS), the largest public pension system in the nation with nearly $160 billion in assets. CalPERS provides retirement and health benefits to more than 1 million state and local public employees, retirees, and their families from more than 2,400 employers.

One of CalPERS s investment properties is operated by a separate management company retained by CalPERS (I ll call it Davis Properties), which collects rent and maintains the building. Davis Properties, the fraudster s employer, used a faulty A/P software that permitted the crime.

One Friday morning at Davis Properties, the controller opened a company bank statement and found a canceled check made out to Jack (not his real name), the A/P clerk, who was in charge of the accounting of the property. That weekend, the controller and two other A/P clerks reviewed the bank statements for the year and found more evidence of fraudulent disbursements to Jack.

For full access to story, members may sign in here.

Not a member? Click here to Join Now. Or Click here to sign up for a FREE TRIAL.