accounting records: how they are used to conceal fraud ...€¦ · forensic audits and fraud page 5...

Forensic Audits and Fraud

Accounting Records: How They Are Used

To Conceal Fraud

ACFE 2012 Canadian Conference

October 29, 2012

Rosanne Terhart, CA, CFE


Accounting Records

Overview

Summary of Topics

Which records are used to conceal fraud

What evidence of fraud do the accounting records provide

How fraud is concealed in the accounting records

What to look for in the accounting records and financial statements

Examples of successful fraud investigations which relied on accounting records as

evidence

Questions and answers


Accounting Records

Other Examples of Records

•General ledger – this ledger contains all accounting entries by general ledger

account

•Sub ledgers – these ledgers are detailed ledgers that feed into the general ledger

(i.e., Accounts Receivable, Accounts Payable)

•Journal entries – these are the accounting entries to support payments and

receipts of cash

•Support documents (i.e., expense reports, invoices)

•Bank statements, wire transfers, cancelled cheese


Accounting Records

Fraud Investigation

Review of accounting records for:

•Evidence of who was involved

•Evidence of how fraud was concealed

•Determine when fraud started, determine extent

•Likely discover additional fraud

•Many employees can successfully conceal these transactions for up to 18 months

or longer


Accounting Records

Who was involved

In most accounting systems, the users of the accounting system are logged as they

make entries.

The log in and log out timing can provide evidence of who made the false entries.

Logging information has been used to connect fraud to certain people and used as

evidence in Court.

For instance, logging in information helped us determine that there were two and

not one, as suspected, employees involved in a fraud.


Accounting Records

Evidence of motivation/intention to defraud

•If a concealing entry is made relating to a fraudulent transactions, the accounting

entry provides important evidence of intent to conceal.

•It proves that the entry was not just an error.

•A booked transaction that is different from the actual transaction is excellent

evidence of motivation to conceal.

For instance, if a cheese is paid to an employee and booked as an employee loan

or salary, this would be considered normal and accounted for correctly. But, if this

same entry was booked in some other way, as another kind of expenses, that entry

is evidence that the fraudulent transaction is being concealed.


Accounting Records

Timing of fraud

•Accounting records provide good evidence of the timing of the fraud to due the

chronological format of the records.

•When the fraud started and ended, helps determine extent.

For example, a victim organization may be aware of a fraudulent disbursement

from the organization. But in reviewing the accounting records, finds similar

transactions. Therefore, increasing the quantum of the fraud and giving a sense of

timing of the fraud.


Accounting Records

Additional Fraud Schemes

•Often, additional fraud schemes are identified through the review of the

accounting records.

•For instance, many fraudsters conduct numerous schemes at the same time. For

example, if an employee is paying himself or herself excess payroll, he/she may

have a favorite place in the accounting records to records these transactions.

Other schemes may likely be records in the same place.


Accounting Records

Discovery of Repayments

•Accounting records often will show repayments to the organization of fraudulent

amounts taken.

•Most fraudsters take and return for a while until they take and don’t return.

•If only looking at the taking, the quantum of the fraud may be too high.

For instance, if an employee removed funds from an organization and then repaid

the funds, is this considered fraud? Accounting records will show both sides of the

transaction.


Accounting Records

How is the fraud concealed

The initial accounting entry of fraudulent transaction must be made in 30 days of

the transactions. Why? Bank Reconciliation is usually done at the end of each

months and it accounts for all transactions.

The initial accounting entry is usually put into a temporary spot, i.e., suspense

account or other generally unused account.

Subsequent accounting entries are then made to relieve the suspense account and

they are often spread out, moved around until their final resting place, resulting

financial statement misstatement.

A review of the journal entries will reveal these transactions.


Accounting Records

Example #1 – Concealment of Fraudulent

Disbursement

An employee writes himself a cheese of $20,000.

Funds come out of company’s bank account. Needs to be accounted for within 30

days.

Employee temporarily books to the suspense account

Dr. Consulting expense $20,000

Cr. Bank account $20,000

Employee books the transaction to an expense account, say consulting.

Dr. Consulting expense $20,000


Now it appears that the company paid $20,000 to on outside consultant, but it

really paid it to the employee.


Accounting Records

Example #2 – Concealment of Misappropriated

Cash

An employee steals $2,000 cash from a bank deposit.

The bank deposit is short. Employee replaces stolen funds with a fraudulent

cheese to cover up missing funds.

Employee books the transaction to an asset account, say Accounts Receivable.

Dr. Accounts receivable $2,000

Cr. Cash (Company cheese) $2,000

Now it appears that the company has a balance owing from a customer for the

amount of $2,000. If not reconciled to customer payments, amount goes

unnoticed.


Accounting Records

Example #3 – Concealment of A Tampered Cheque

An employee adds $3,000 to a payroll cheese after it was signed but before being

cashed.

Employee books the additional amount of payroll cheese to an expense account,

say miscellaneous expense.

Dr. Miscellaneous expense $2,000


Now it appears that the company paid $2,000 to purchase some miscellaneous

expenses.


Accounting Records

Example # 4 – Expense Account Fraud

An employee claims the same expense twice for an amount of $1,000.

The expense is claimed in two different expense reports.

Expense report conceals the fraud because it is likely not detailed enough and has

not been reviewed sufficiently.

Review of expenses with agenda would reveal the duplication.


Accounting Records

Example # 5 – Payroll Fraud

An employee enters into the payroll system and changes payroll deductions for

federal and provincial payroll tax to zero.

Employee received 100% of pay.

At year end the deduction due to Canada Revenue Agency are paid by cheese from

company, including fraudulent employee’s portion.

Amount is booked to employee benefits.

Unless a reconciliation of employee benefits is done, the fraud is concealed.


Accounting Records

What to look for in the accounting records

Lack of segregation of duties (cheese signing/cash handling and transaction

recording = opportunity, big problem for non-profit organization)

Access to systems and over-ride capabilities

Look for who performs the bank reconciliation

Manual cheese (different controls than regular cheese run)

Cheese that are out of sequence

Missing cancelled/returned cheese

Odd or missing signatures on cheese


Accounting Records

What to look for in the records

Continued…

Electronic transfers/online bill payments (often no controls)

Entries in suspense accounts or other non-regular accounts

Round number entries

Invoices/expense reports lacking details

Odd GST-GST entries

Year-end journal entries (write off accounts)

Income statement reality check


Accounting Records

What to look for in the financial statements

Continued…

Expenses that are inflated from one year to the next

New expense categories

Assets that are inflated from one year to the next

Gross margin percentages that change


ACCOUNTING RECORDS

Fraud Investigation Examples

Airplane Company

Accounting staff discovers $30,000 cheese payable to Bank xx Visa while preparing

a bank reconciliation.

Company discovers Bank xx Visa account is that of Controller. Controller is fired.

CFO puts together evidence, finds additional suspicious cheese made to Bank xx

Visa, quantifies at $600,000. Calls lawyer, insurance company, and police.

Lawyer and insurance company insists on forensic audit. Forensic accountant hired

by company.

Police obtained initial evidence and interviewed staff.


ACCOUNTING RECORDS


Airplane Company

Forensic accountant traced fraudulent cheese to accounting entry. Operator at

time of entry was controller. Traced entry to a temporary inventory account.

Review of temporary account reveals how far back fraud occurred. Reveals

subsequent entries made and accounts affected. Other fraudulent amounts

discovered.

Total misappropriation amounted to $1.4 million. Discovers that $300,000 was paid

back, net misappropriation was $1.1 million.

Accounting Records

ACCOUNTING RECORDS


Airplane Company

Accounting records revealed:

• how fraud was concealed

• connected concealment with fraudster

• extent and timing of fraud: How often, when did it start

• quantified entire completeness of fraud

• determine quantum of financial statement mis-statement

• confirmed amount, if any, repaid

• report was used for insurance recovery, civil and criminal proceedings


ACCOUNTING RECORDS


Non-profit Organization

Organization Director discovers, by accident, frequent unexplained electronic

transfers from bank account.

Finance Manager quits when questioned.

Police called. Police conducted interviews, prepared spreadsheet of all

unexplained electronic transfers, totaled $500,000. Requested bank to provide

trace of transfers.

Police provided report Crown Counsel. Crown Counsel and Police jointly engaged

forensic accountant.


ACCOUNTING RECORDS



Forensic accountant reviewed accounting records. Determined entries made to

consulting expenses.

Traced to invoices, discovered name of consultant. Discovered email

correspondence between finance manager and consultant regarding

misappropriated funds. Discovered that funds were split between two individuals.

Eventually traced both individual accounts. Accounting records show fuller extent

of fraud.

Forensic accountant worked with Police to obtain evidence. No need for forensic

accountant to interviews. Total $900,000 was misappropriated. Both individuals

charged. Both admitted.


ACCOUNTING RECORDS



Accounting records revealed:

• how fraud was concealed

• connected concealment with fraudster

• connected fraud with another individual

• increased total fraud quantification

• resulted in a conviction

• report to be used for criminal proceedings


ACCOUNTING RECORDS


Insurance Company

Organizational controller discovers, by accident, short-fall in daily cash deposit.

Controller discovers that cash count done by one of cash counters. Discovers

several other short deposits. All done when a particular cash counter was working.

Controller puts together all short deposits by one cashier. Amounted to $40,000

short deposits. Organization calls lawyer, insurance company, and police.

Police conducted interviews, summarized evidence, report to Crown Counsel for

charges.


ACCOUNTING RECORDS


Insurance Company

Company hired forensic accountant for insurance report.

Forensic accountant discovers that one other cash counter involved, based on

accounting entry operator information.

Fraud was booked to accounts receivable. Fraud quantum increased to $140,000.

Report prepared by forensic accountant. Used by insurance company and Crown

Counsel. Second individual charged.

Crown Counsel hires forensic accountant to assist in trial.


ACCOUNTING RECORDS

Questions & Answers


ACCOUNTING RECORDS

Contact

Rosanne E. Terhart, CA, CFE

Senior Manager, BDO Canada

[email protected]

T: 604 646 4381

BDO Canada LLP

600 – 925 West Georgia Street

Vancouver, BC V6C 3L2

accounting records: how they are used to conceal fraud ...€¦ · forensic audits and fraud page 5...

Documents