Collusion in the workplace

Poor internal controls resulted in fraud in excess of $500,000 for a newly acquired division of a publicly traded Fortune 500 Company. The culprits included an hourly line clerk, human resources clerk, an administrative assistant and the human resources manager. Investigators detected the fraud while implementing the existing sound internal control system into the newly acquired division.

The authors obtained the details of this actual case of a Fortune 500 corporation from its director of internal auditor. Names and details have been changed. — ed.

One of Alpha Company's goals was to grow through mergers and acquisitions, so it acquired Baker Division of Charlie Corporation, which doubled the size of operations to $5.5 billion. The initial combined numbers were staggering — predicted to be in excess of $50 million with this new relationship — Alpha and Baker.

Years earlier, Alpha Company had integrated its business processes by implementing a popular enterprise resource planning system. At the time of the Baker acquisition announcement, the company had maintained a consolidated, centralized, corporate system of internal controls for all departments. These strong controls and separation of duties ensured smooth operations and early fraud detection.

However, the situation was exactly the opposite at Charlie Corporation. Almost all its locations throughout the U.S. were individualized systems. Also, Charlie Corporation managed each location with a decentralized mentality. Baker Division had its own business processes and management information systems. Therefore, Alpha's acquisition of Baker was an accounting challenge.

Each location complex manager, including Baker, was in charge of accounting, inventory, procurement, human resources, leasing, fixed asset management, etc. As long as each location met the required budget and profit expectations, corporate office didn't interfere in its business processes. Also, Charlie Corporation had determined that Baker Division was insignificant and immaterial for its SOX 404 internal control assessment, so they excluded it from their documentation and testing scope. Moreover, the audits that the Charlie corporate audit team had performed were stale; it hadn't conducted any follow-up reports in the two years preceding the acquisition.

The work environment to assess the consolidation plan was turbulent from the beginning. Employees knew that jobs at Baker were being eliminated. Alpha needed to keep the business running through the integration plan, identify those needed in key positions and also manage employee turnover. Management held town-hall meetings to try to make sure that everyone knew upfront that Alpha was built on integrity and ethics. The management team presented a clear message that all things must be done in the proper way and that cost wasn't an issue.

WIDELY DIFFERENT TUITION REIMBURSEMENT PROGRAM

Mergers and acquisitions drove Alpha's growth over the past decade. Policies and procedures were well-defined and clearly in place at the time of the Baker acquisition. However, the Securities and Exchange Commission took significantly longer to review the acquisition because it had to abide by the Hart-Scott-Rodino Antitrust Improvements Act, which requires pre-merger notification. (The act requires that both parties file a Notification and Report Form with the Federal Trade Commission and the assistant attorney general in charge of the Department of Justice Antitrust Division.) This delay contributed towards Baker employees' increased anxiety about their uncertain future.

Alpha was founded on a "continuous improvement operating" philosophy. This philosophy included offering a tuition reimbursement program for its employees, which its corporate continuous improvement department (CI) managed. An employee had to file an approved degree plan with the assigned CI advisor prior to the employee enrolling in the program.

Alpha's reimbursement was capped at $15,000 per employee ($3,000 payable per year over five years), based on approved documentation, which included receipts for tuition payments, campus fees, books, transcripts and grade postings. If employees didn't provide valid receipts that tied into approved degree plans, Alpha wouldn't approve the reimbursements.

Charlie Corporation's education policy was quite different than Alpha's. Each location, which managed its policy, didn't require uniform documentation and had no limits on reimbursement amounts. Charlie's corporate office didn't manage the program, except it ran tuition reimbursements through the payroll department, along with timekeeping entries.

INVESTIGATION TRIGGER

As part of the year-end payroll reporting process, Alpha conducted an entity-level payroll control review to ensure that it correctly identified all highly compensated employees and verified proper deferred compensation amounts and documentation.

Control systems had been in place for years at Alpha to ensure consistency with benefit distribution. However, they weren't sure about the recently acquired Baker Division because it had its own legacy system, and Alpha was still integrating the two systems. Therefore, it requested that the vice president of human resources of the Baker Division have the IT team run the same queries from Baker's legacy system to conduct the review. The HR vice president told the internal audit department that several employees definitely didn't fall into the highly compensated employees' category and requested more time to review this matter. This required follow-up and triggered an internal investigation.

The corporate office of Charlie Corporation stored the detailed data files required for this review in a facility across the country. Because the acquisition had already closed, Alpha had to comply with detailed legal formalities to request the data dump files for Charlie Corporation's review.

INTERNAL AUDIT DIRECTOR GETS BRUSH-OFF

Alpha's internal audit department immediately began the process to request the files and also contacted a complex manager of Baker Division, Mark, to request a review of the initial information. Despite several messages, Mark didn't return internal audit's calls. Therefore, Barb, director of internal audit at Alpha, decided to visit Mark onsite to review the issues.

When she arrived, Anna, Mark's administrative assistant, told Barb that Mark wasn't available and didn't have any time to review such tedious issues. Barb persisted and soon managed to meet Mark in his office. Initially, Mark was very defensive. He said that his employees worked long hours and performed all the necessary duties. He claimed that it was his complex to manage, and he didn't need any help from the corporate office to do his job. Mark appeared to be closed-minded and wouldn't listen to any of Barb's fact-based concerns.

During this same time period, Barb received a call from Alpha's corporate office saying that one of Baker Division's facility accountants, Nicole, wanted to schedule a meeting as soon as possible to share her concerns about the timekeeping and payroll controls. Barb called Nicole. Nicole said that she had been telling the complex manager for a long time that the time reports weren't correct for the administrative office and that she needed to review the items prior to submission for payment.

Nicole said that Mark continually ignored her warnings. This conversation strengthened Barb's suspicion; she returned to Alpha headquarters to develop a plan and gather additional information. Two weeks went by and Charlie Corporation finally delivered the data files Barb had requested. Also, Barb sent an email to Mark saying that her team would be performing a limited scope review for overtime, tuition reimbursement documentation and payroll files. She also left four voice-mail messages at his office; however, she never received a response.