Reducing Fraud WithReducing Fraud WithImproved Internal Improved Internal

ControlsControls

Dr. Raymond S. Kulzick, CPADr. Raymond S. Kulzick, CPASt. Thomas UniversitySt. Thomas University

Miami, FloridaMiami, Florida

Copyright 2004 R. S. KulzickCopyright 2004 R. S. Kulzick

Internal ControlInternal Control

Definition and Purpose Definition and Purpose of Internal Controlof Internal Control

Process designed to provide Process designed to provide reasonable assurance that the reasonable assurance that the entity objectives are metentity objectives are met

Primary goal of internal control is Primary goal of internal control is to provide assurance that errors to provide assurance that errors and fraud may be prevented and and fraud may be prevented and if not, discoveredif not, discovered

SAS 78 - Elements of SAS 78 - Elements of Internal Control Internal Control

(CRIME)(CRIME) C = Control ActivitiesC = Control Activities R = Risk AssessmentR = Risk Assessment I = Information & CommunicationI = Information & Communication M = MonitoringM = Monitoring E = Control EnvironmentE = Control Environment

Who is responsible for Who is responsible for internal control?internal control?

Management is Management is primarilyprimarily responsible for internal controlresponsible for internal control

The board is The board is ultimately ultimately responsible responsible for internal controlfor internal control

Auditors can assist others to meet Auditors can assist others to meet their responsibilities, but they their responsibilities, but they cannot assume those cannot assume those responsibilities themselvesresponsibilities themselves

Types of Internal Types of Internal ControlsControls

Preventive controlsPreventive controls Detective controlsDetective controls Corrective controlsCorrective controls

It is much more costly to discover It is much more costly to discover errors and frauds with detective and errors and frauds with detective and corrective controls than it is to corrective controls than it is to discourage them with preventive discourage them with preventive controlscontrols

Internal Control Internal Control ActivitiesActivities

Independent VerificationIndependent Verification Access ControlAccess Control Segregation of DutiesSegregation of Duties Accounting RecordsAccounting Records SupervisionSupervision Transaction AuthorizationTransaction Authorization

Independent Independent VerificationVerification

Reconciliations performed by Reconciliations performed by third partiesthird parties

Regular inventories of physical Regular inventories of physical assetsassets

Confirmations of receivables and Confirmations of receivables and payablespayables

Segregation of DutiesSegregation of Duties

Authorization separate from Authorization separate from processingprocessing

Custody of assets separate from Custody of assets separate from the record keepingthe record keeping

Successful fraud should require Successful fraud should require collusion between two or more collusion between two or more individuals with incompatible individuals with incompatible responsibilities.responsibilities.

Alternatives to Alternatives to Segregation of DutiesSegregation of Duties

Mandatory rotation of dutiesMandatory rotation of duties Mandatory vacation Mandatory vacation Analytical reviewAnalytical review

Properly Designed Properly Designed RecordsRecords

Sequential numbering of Sequential numbering of documentsdocuments

Spoiled documents voided and Spoiled documents voided and retainedretained

Automatic duplicates of Automatic duplicates of documents sent outside the documents sent outside the originating dept.originating dept.

Effective AuthorizationEffective Authorization

Written policies and procedures Written policies and procedures governing who may authorize governing who may authorize transactionstransactions

““Authorization” must be obtained Authorization” must be obtained beforebefore, not after the fact, not after the fact

Internal Control Internal Control Inherent LimitationsInherent Limitations

Only reasonable assuranceOnly reasonable assurance Inadvertent errors can occur due Inadvertent errors can occur due

to carelessness or to carelessness or misunderstandingsmisunderstandings

Fraud or intentional Fraud or intentional misstatements can occur due to misstatements can occur due to collusion or management overridecollusion or management override

Internal Control Internal Control Cost-Benefit Cost-Benefit ConstraintsConstraints

The cost of an entity’s internal The cost of an entity’s internal control should not exceed the control should not exceed the benefits derived from the control.benefits derived from the control.

Common Schemes &Common Schemes &Prevention ApproachesPrevention Approaches CashCash Accounts ReceivableAccounts Receivable InventoryInventory PurchasingPurchasing Fixed assetsFixed assets PayrollPayroll Expense ReimbursementsExpense Reimbursements

Cash SchemesCash Schemes

Voids & under-ringsVoids & under-rings Alteration of cash receipts Alteration of cash receipts

documentsdocuments Fictitious refunds & discountsFictitious refunds & discounts Theft from depositsTheft from deposits KitingKiting

Cash SchemesCash SchemesMethods of ConcealingMethods of Concealing

Out of balanceOut of balance False debits – example paid outsFalse debits – example paid outs False debit to asset - inventoryFalse debit to asset - inventory Forced balance – incorrect creditForced balance – incorrect credit Omitted credit – don’t count saleOmitted credit – don’t count sale

Cash SchemesCash SchemesPreventionPrevention

Segregation of dutiesSegregation of duties– Receipts, deposits, reconciliations & Receipts, deposits, reconciliations &

disbursementsdisbursements Job rotation & mandatory Job rotation & mandatory

vacationsvacations Surprise cash countsSurprise cash counts

Accounts Receivable Accounts Receivable SchemesSchemes

LappingLapping Fictitious Accounts ReceivableFictitious Accounts Receivable Old or written off A/ReceivableOld or written off A/Receivable Borrowing against A/ReceivableBorrowing against A/Receivable

Accounts Receivable Accounts Receivable Schemes - ConcealingSchemes - Concealing

Destroyed recordsDestroyed records LappingLapping False statements to customersFalse statements to customers Write-offsWrite-offs Shift to inflated inventoryShift to inflated inventory

Accounts Receivable Accounts Receivable Schemes PreventionSchemes Prevention

Segregation of dutiesSegregation of duties– Cash collection, posting A/R, writing Cash collection, posting A/R, writing

offoff Lock-boxLock-box Eliminate sales-based Eliminate sales-based

compensationcompensation

Inventory SchemesInventory Schemes

Appropriating for personal useAppropriating for personal use Theft of scrap or proceedsTheft of scrap or proceeds Charging embezzlements to Charging embezzlements to

inventoryinventory

Inventory SchemesInventory SchemesPreventionPrevention

Proper documentationProper documentation Segregation of dutiesSegregation of duties

– Requisition, disbursement, Requisition, disbursement, conversion to scrap, receipt of scrap conversion to scrap, receipt of scrap proceedsproceeds

Independent checksIndependent checks Physical safeguardsPhysical safeguards

Purchasing SchemesPurchasing Schemes

Fictitious invoicesFictitious invoices Over-billingOver-billing Checks payable to employees, Checks payable to employees,

including duplicate paymentsincluding duplicate payments Conflicts of interestConflicts of interest Payment of personal expensesPayment of personal expenses

Purchasing SchemesPurchasing SchemesPreventionPrevention

Training within purchasingTraining within purchasing Proper documentationProper documentation Proper approvalsProper approvals Segregation of dutiesSegregation of duties Job rotation & enforced vacationsJob rotation & enforced vacations Written policiesWritten policies HotlinesHotlines Competitive biddingCompetitive bidding

Investments & Fixed Investments & Fixed Asset SchemesAsset Schemes

Use as collateralUse as collateral Borrowing to earn interestBorrowing to earn interest Theft of assetsTheft of assets Personal use of assetsPersonal use of assets

Fixed Asset SchemesFixed Asset SchemesPreventionPrevention

Segregation of dutiesSegregation of duties– Custody, approval to sell, control of Custody, approval to sell, control of

physical disposition, receipt of physical disposition, receipt of proceedsproceeds

Periodic physical countsPeriodic physical counts

Payroll SchemesPayroll Schemes

Ghost employeesGhost employees Commission schemesCommission schemes Overtime abuses & falsified Overtime abuses & falsified

wageswages Workers compensation schemesWorkers compensation schemes Withholding tax schemesWithholding tax schemes

Payroll SchemesPayroll SchemesPreventionPrevention

Segregation of dutiesSegregation of duties– Payroll preparation, disbursement, Payroll preparation, disbursement,

distribution, bank account distribution, bank account reconciliationreconciliation

Periodic payroll review & analysisPeriodic payroll review & analysis

Expense Expense Reimbursement Reimbursement

SchemesSchemes Overstatement of expensesOverstatement of expenses Duplication of expensesDuplication of expenses Fictitious expensesFictitious expenses Personal expenses charged to Personal expenses charged to

organizationorganization

Expense Expense Reimbursement Reimbursement

Schemes PreventionSchemes Prevention A strong ethics policyA strong ethics policy Require detailed expense reports Require detailed expense reports

with original receiptswith original receipts Use per diemsUse per diems Expense approval processExpense approval process

Importance of Importance of Maintaining Adequate Maintaining Adequate

Internal ControlsInternal Controls Management is responsible for Management is responsible for

maintaining adequate internal controls maintaining adequate internal controls not the independent auditor.not the independent auditor.

Fraud detected with preventive controls Fraud detected with preventive controls is less expensive. Don’t wait for fraud is less expensive. Don’t wait for fraud to happen before taking action.to happen before taking action.

Sufficiently designed, implemented, and Sufficiently designed, implemented, and monitored internal controls can reduce monitored internal controls can reduce the risk of loss by limiting opportunities the risk of loss by limiting opportunities and requiring collusion between two or and requiring collusion between two or more individuals.more individuals.

Some Common Some Common Red Flags for FraudRed Flags for Fraud

Lifestyle changesLifestyle changes Significant personal debt and credit Significant personal debt and credit

problemsproblems Behavioral changesBehavioral changes

– Drug or alcohol relatedDrug or alcohol related– GamblingGambling– Fear of losing jobFear of losing job

High employee turnoverHigh employee turnover Refusal to take vacation or sick leaveRefusal to take vacation or sick leave Lack of segregation of duties or other Lack of segregation of duties or other

internal control weaknessesinternal control weaknesses

Some Simple Things Some Simple Things ForFor

a Small Business 1a Small Business 1 Pre-number & reconcile formsPre-number & reconcile forms Screen prospective employeesScreen prospective employees Segregate cash-related functions Segregate cash-related functions

as much as possibleas much as possible Implement controls over checksImplement controls over checks Limit computer accessLimit computer access

Some Simple Things Some Simple Things ForFor

a Small Business 2a Small Business 2 Match invoices with checksMatch invoices with checks Periodically review Accounts Periodically review Accounts

Receivable and Accounts PayableReceivable and Accounts Payable Receive unopened bank and Receive unopened bank and

credit card statementscredit card statements Be a good exampleBe a good example Be aware for red flagsBe aware for red flags

Questions?Questions?

Thanks for your attention.Thanks for your attention.

Ray Kulzick – 305.235.2154Ray Kulzick – 305.235.2154

rkulzick@stu.edu orrkulzick@stu.edu or

rkulzick@kulzick.comrkulzick@kulzick.com