Preventing Fraud: The Importance of Internal Controls

Transcription

1 Preventing Fraud: The Importance of Internal Controls Presented by: Scott Gold, CPA,BKD, BKDForensics Today s Agenda Faces of fraud Real life examples: The latest schemes Lifestyles of the Rich and Infamous Knowing your vendors Internal Controls Segregation of duties Fraud prevention and detection tips 2 // experience Faces of Fraud Position Amount of Loss Status Bank teller $377, months prison Pastor $230,000 Pending Controller $17 Million Pending Librarian Not disclosed yet Pending CFO $16 million 50 months prison Attorney $2 million 10 years Scout Troop Leader $4,000 5 years probation 3// experience 1

2 Yes, Even the Owner of a Preschool Embezzled $3.0 million in federal funds Funds intended for school lunches Received one year house arrest 4// experience CPAs Gone Really Bad? Accused of embezzlement and murdering a fellow CPA Previously charged with embezzling thousands from a foundation where he served as treasurer (repaid) 5// experience Remember This Greed is a bottomless pit which exhausts the person in an endless effort to satisfy the need without ever reaching satisfaction. Erich Fromm ( ) 6 // experience 2

3 How Occupational Fraud is Committed 7 How Occupational Fraud is Committed 8 Initial Detection of Occupational Frauds 9 3

4 Industry of Victim Organization 10 Schemes by Industry 11 Control Weaknesses That Contributed to Fraud 12 4

5 Perpetrator s Position 13 Perpetrator s Position 14 Recovery of Losses 15 5

6 Importance of Crime Insurance Fidelity bond, employee dishonesty, crime policy Likely only chance at meaningful recovery Conviction not usually necessary to file claim Civil litigation to recover losses often fruitless Stolen funds squandered not in a Swiss bank Verify your coverage 16 // experience Purchasing/Billing Schemes Knowing Your Vendors 17 // experience A Reminder About Lifestyle Clues In 81% of cases, the fraudster displayed one or more behavioral red flags that are often associated with fraudulent conduct. Living beyond means (36% of cases), financial difficulties (27%), unusually close association with vendors or customers (19%) and excessive control issues (18%) were the most commonly observed behavioral warning signs. Source: Source: 2012 Report 2012 Report to the to Nations the Nations - - Association of of Certified Fraud Examiners, Inc. Inc. 6

7 Health Department County health official Former E&Y employee Hard working, smart, trusted Insider knowledge of contracts/bids Declared bankruptcy in 2004 Other officials notice budget discrepancies A little digging reveals big problems IT contractor connected to him - $3.0 million 19 // experience Filed with Missouri Secretary of State Residential Address Fictitious Vendors Fake 20 // experience 21 // experience 7

8 From Google Maps Large IT Contractor?? 22 // experience Movin On Up $1.5 million mansion 23 // experience Red Flags Abound Vendor had no website No one knew the owner (he was fake) Simple address check revealed small home Phone # connected to a cell (no one answered) Executive living beyond means 24 // experience 8

9 A Few Vendor Verification Tips A fake company might be a real company (registered w/secretary of state) Free and easy internet resources use them Secretary of State websites are great Google Maps/Streetview Hit the vendor website Look at the principals behind the company Use caution with fee based searches on internet 25 // experience Corruption and Kickbacks Yes, Kickbacks Happen in Healthcare! 9

10 Let s See How Kickbacks Really Work Large organization Several s from whistleblower Allegation: senior executive receiving kickbacks Organization unsure what to believe Obstacles and Allegations Vendor is overseas Language barriers Ex wife gets involved Special backdoor account Money laundered through brother or ex Communications are in code His cut = 20% Our Tasks Attempt to verify authenticity of s Computer forensics Talk those who might know something 10

11 Flow of Funds Vendor (or ex-wife of Vendor) Wires funds to an account in Dubai - Brother of Employee Executive Receives Funds in his Bank Account in U.S. Thoughts on Kickback Schemes Approach is different than others frauds Can be very difficult to uncover Computer forensics essential Need cooperation of whistleblower & others Understanding relationships is key Know employment history, connections, etc. Credit Card and Personal Purchases Medical Clinic and a Nursing Home 11

12 Common Fraud Paying Personal Bills Electronically 12

13 The Rita Crundwell Case Rita Crundwell Case Summary Comptroller in Dixon, IL (pop. 15,000) Sole control of accounting $9 million annual budget First employed in 1970 worked her way up Was earning $80,000 salary Living the good life.but how?? 39 // experience 13

14 40 But How? The Secret Bank Account RSCDA special bank account Opened the account in 1990 She was only signor on account There she disbursed to live a lavish lifestyle 41 // experience A Pretty Easy $53 Million Fraud General Operating Bank Account Transfers funds to another account: Capital Improvement Fund Capital Development Fund Bank Account RSCDA Bank Account her secret account (off books) Writes check payable to treasurer and deposits in her secret account. Creates fake invoice Checks for personal use 42 // experience 14

15 15

16 Others Suffers for Years Clip art on budget documents would depict people drowning and scissors in reference to budget cuts Police department denied critical requests Told one employee if you know where the money tree is, I ll give you a dump truck 46 // experience 16

17 17

18 Among the Damage Done 19 ½ years in prison for Rita 400 horses sold at auction Auditors sued settled for $35 million Bank sued settled for $3.5 million 53 // experience The Fraud Triangle You can control this! Perceived pressure facing individual Exacerbated in economic downturn Perceived opportunity to commit fraud Person s rationalization or integrity 18

19 Understanding Segregation of Duties Why? Decreases the risk of fraud Fraud is caught more quickly Catches errors & protects employees Not for efficiency Access ability to get to something worth stealing Recording documenting activity, think rights to the general ledger and/or practice management system Monitoring review, reconciliation, follow up Separate these category of duties Segregation of Duties Lack of segregation of duties was cited as the biggest deficiency in internal controls in 38% of the cases, and it was higher at 50% in business with fewer than 100 employees 19% of the cases internal controls were overridden Do not wait for fraud to tighten up these things Organizational discussion & acceptance of risk including at the Board level Segregation of Duties 3 Primary Cycles: Receivables, Accounts Payable, Payroll Think what can they do versus normally do What system or IT rights does an employee get Often grant too many rights for poor reasons Saying a person does not know how is not the same as saying that they cannot do something 19

20 AR Conflicting Duties Access examples Receive cash/check or custodian of payments cash/check Provide EFT information to third party payers Admit and/or discharge patients Recording & monitoring examples Record bad debt or contractual adjustments Prepare the billing document Record journal entries Issue patient statements Agreeing cash receipts list to the bank deposit AR Schemes False non company accounts when setting up the EFT accounts for insurance payers Receiving cash or check & posting adjustments & not payments Not recording or altering bank deposits & stealing cash receipts Altering credit card receipts Granting bogus credits that could be positive Lapping Improving AR Controls Utilize AR & GL system controls & rights. Review periodically. Update timely as changes occur. Develop a formal & clear process for setting up EFT s from 3 rd party payers & conduct follow up audits. Do not give cashiers the ability to post adjustments or shut off patient statements. Cashiers should only post payments. Give receipts when payments are received. Consider formal System Generated Receipts. 20

21 Improving AR Controls Separate who opens mail payments from Billing consider utilizing a payment lock box Reconcile bank deposits to practice management system credit card payments reconciled to what? Keep in mind who is taking deposits to bank Billing Manager is high risk if access duties 61 Improving AR Controls Involve different people non accounting? Receptionist: open mail, prepare cash receipts list & deposit slip, and restrictively endorse checks Creative Monitoring Reports from AR System Adjustment report by person by payer Payments posted by site by day Any report for exceptions or additional analysis AP Conflicting Duties Access examples Issue a check or purchase order, authorize EFT Sign or access to checks or signature plate/stamp Recording & monitoring examples Recording functions in the AP and/or GL System Changing the vendor master files Reconcile and review the bank or the AP balance 21

22 AP Schemes Fictitious suppliers Kickbacks Credit cards Employee expense accounts Petty cash funds Personal bills or ordering personal items Improving AP Controls Use AP module & GL system controls & rights Review bank transactions on the statement or online Really perform the controls in place Securing the checks before & after they are written Follow up on check sequence & voided checks Be cognizant of fake documents, easy to fake Master vendor list is very important, control it No signature stamp, plate, etc. Using Positive Pay Process Improving AP Controls Reviewing expenses who can spot the anomaly Consider carefully who is the most effective Credit Cards Do you need them? Who? Is the CFO going to be Access or Recording and Monitoring? Is CEO going to be involved? Do not forget about EFT s What protection? Be careful on the duties split with AP/payroll process Ask a lot of questions Be obvious that you are involved & looking 22

23 Payroll Conflicting Duties Access examples Issue a check or purchase order, authorize EFT Sign or access to checks or signature plate/stamp Add an employee to the payroll master file Recording & monitoring examples Recording functions in the payroll and/or GL System Changing the employee payroll master files Reconcile & review the bank balance Review payroll information for accuracy prior to payment Review the payroll paid to the payroll authorized Time card authorization Payroll Schemes Ghost employees Manipulated time records Unclaimed payroll checks Writing extra payroll or bonus checks Withholding fraud W 2 fraud Improving Payroll Controls Use Payroll module & GL system controls & rights Direct deposit HR/Payroll personnel cannot review their own work If multiple personnel are available then the roles must be clearly defined & distinct Reconcile details to the final reports Find the gaps supervisors sign time cards, but how do we monitor if hours are later changed in system? Review the payroll for accuracy before submitting 23

24 Improving Payroll Controls Utilize system reports run by reviewer themselves Employee or pay rate change reports Better than reviewers memory If full reconciliations or audits are not possible Internal audits & spot checks of key data 3 rd Party Payroll Companies cannot prevent all fraud Get and review Service Organization Control (SOC) Report which identifies many, but not all Entity Controls Grants & Contributions Risks Cash receipts risks Track accepted grants, but unexpected contributions are a bigger risk Good communication is key between the development/fundraising person & accounting Improvements Set expectations for payment, but not by person opening mail Good mail & cash receipts processes Inventory & Fixed Assets Employees have access to fixed assets & inventory Schemes: theft of items master lists could be tampered with Improvements: Physical Controls Inventory Process Asset Tags Understand priority items what is likely to be stolen How would you know if something walked out the door? What would you do? 24

25 Segregation of Duties Not Enough Remember that some controls prevent & some detect fraud Management can override controls Collusion between 2 or more employees Awareness is everyone s job Cost versus benefit factors into decisions Both efficiency & personnel Often someone has a role they do not want Don t forget fidelity (employee dishonesty) insurance Tone at the top Five Ideas to Shut the Door on Fraud 74 // experience 1. Fraud Awareness Training Targeted training for employees & managers Can t solve fraud from accounting department Organization wide awareness is critical Lower losses & shorter duration can be correlated to awareness training for employees At a minimum, staff members should be educated regarding what actions constitute fraud, how fraud harms everyone in the organization and how to report questionable activity. Association of Certified Fraud Examiners 25

26 2. Establish Good HR Practices Initial background checks Updated background checks after a few years Credit checks (with consent) Some believe credit checks are better predictor Ethics surveys how does staff see leadership? Exit interviews 3. Mandatory Vacations Someone must fill in for employee on vacation Do not just fill the inbox while out of office Employees who come back to check on things Job rotation can also be used Amazing how many frauds are identified during absences 4. Special Procedures in High Risk Areas Deeper dive focused on specific issues Could be internal audit or outsourced to firm Conduct in high risk/operational areas of interest to you Review of controls over vendors, disbursements Credit cards Expense reimbursements Payroll history analysis Pick one or two new areas a year for review 26

27 5. Establish a Hotline Tips are # 1 way frauds are uncovered Employees are your eyes and ears Open door policies not enough Used to report other problems too Make it confidential Encourage employees to report concerns 79 // experience 6. Set a Good Example Do the Right Thing Rationalizing can be easy we all do it Grey areas can quickly turn black Your gut often tells you right from wrong I knew it was wrong.i knew that what I was doing was misleading. But I didn't think it was illegal. I thought: That's how the game is played. You have a complex set of rules, and the objective is to use the rules to your advantage. And that was the mistake I made. Andrew Fastow, Former Chief Financial Officer of Enron 80 // experience Closing Thoughts Fraud is among us right now People involved not hardened criminals Fraud has a ripple effect Devastates companies, families and careers You can play a part in stopping it! 81 // experience 27

28 Fraud Resources Managing the Business Risk of Fraud: A Practical Guide (AICPA & IIA) BKDForensics.com QUESTIONS? Jeffrey Roberts BKD, LLP 910 E St. Louis Street, Suite 200 Springfield, MO jroberts@bkd.com Blog: bkdforensics.com 83 // experience 28