Symptoms of Fraud - Higher Education

Document Sample
Symptoms of Fraud - Higher Education Powered By Docstoc
					PART   3

Fraud Detection
5   Recognizing the Symptoms of Fraud   135
6   Data-Driven Fraud Detection 167

CHAPTER            5
Recognizing the Symptoms
of Fraud

LEARNING OBJECTIVES                                                      TO THE STUDENT

After studying this chapter, you should be able to:                      Chapter 5 is the first of two
                                                                         chapters that deal with fraud
•   Understand how symptoms help in the detection of fraud.
                                                                         detection. Although the act
•   Identify and understand accounting symptoms of fraud.                of fraud itself is seldom ob-
                                                                         served, symptoms and indi-
•   Describe internal controls that help detect fraud.
                                                                         cators of fraud are often
•   Identify and understand analytical symptoms of fraud.                observable. In this chapter,
•   Explain how lifestyle changes help detect fraud.                     we discuss several fraud
                                                                         symptoms in an attempt to
•   Discuss how behavioral symptoms help detect fraud.                   help you recognize when
•   Recognize the importance of tips and complaints as fraud symptoms.   fraud is occurring. If these
                                                                         fraud symptoms are recog-
                                                                         nized, many frauds can be
                                                                         detected at an early stage.
                                                                         We share many examples
                                                                         of various real-life frauds
                                                                         and how they could have
                                                                         been detected if the fraud
                                                                         symptoms had led someone
                                                                         to investigate.

136   Part 3: Fraud Detection

      lgin Aircraft had claims processing and       were, a claim was submitted to the in-
E claims payment departments to admin-              surance company.
ister its health care plans. The company        •   Which plan the employee was on, and
was self-insured for claims under $50,000.          that the calculation for payment was
Claims above this amount were forwarded             correct.
to an independent insurance company. The
                                                     After verification of the above facts, the
claims processing department’s responsibil-
                                                claims were forwarded to the claims pay-
ity was to verify the necessary documenta-
                                                ment department, which paid the doctor
tion for payment and then to forward the
                                                directly. No payments ever went to
documentation to the claims payment de-
partment. The claims payment department
                                                     One day, a defense auditor observed the
approved and signed the payment.
                                                manager of the claims payment department
     Elgin employees had a choice between
                                                taking her department employees to lunch
two different types of insurance plans. The
                                                in a chauffeured limousine. The auditor was
first was a health maintenance organization
                                                curious about how the manager could
(HMO) plan in which employees went to an
                                                afford such expensive occasions and was
approved doctor. Elgin had a contract with a
                                                concerned that the cost of the lunch and the
group of medical doctors who treated the
                                                limousine were being paid for by the govern-
employees for a set fee. The second plan al-
                                                ment. In speaking with the vice president of
lowed employees to go to doctors of their
                                                finance, he learned that the manager was
own choice rather than to the HMO, but
                                                “one of the company’s best employees.” He
only 80 percent of their medical bills were
                                                also learned that she had never missed a day
paid by Elgin.
                                                of work in the last 10 years. She was indeed
     Management believed that the company
                                                a very conscientious employee, and her
had an excellent internal control system. In
                                                department had one of the best efficiency rat-
addition, the company continually had var-
                                                ings in the entire company.
ious auditors on its premises: government
                                                     Concerned about the limousine and
contract auditors, defense auditors, outside
                                                other indicators of fraud, the auditor began
auditors, and internal auditors. Health
                                                an investigation that revealed that the claims
claims were processed from an extensive
                                                payment department manager had em-
form filled out by the attending physician
                                                bezzled over $12 million from Elgin Aircraft
and a statement from his or her office ver-
                                                in four years. Her scheme involved setting
ifying the nature of the dollar amount of
                                                up 22 dummy “doctors” who would submit
the treatment. This form was given to the
                                                medical bills for employees who had not had
claims processing department, which
                                                much medical work during the year. Her fic-
would verify the following:
                                                titious doctors would create claims forms
•     The patient was an employee of Elgin      and submit them to the claims processing
      Aircraft.                                 department. The claims processing depart-
•     Treatments were covered by the plan.      ment would send the approved forms to the
•     Amounts charged were within ap-           claims payment department, which would
      proved guidelines.                        then send payment to the dummy doctors.
•     Amount of the claims per individual for        Fraud is a crime that is seldom
      the year were not over $50,000; if they   observed. If a body is discovered and the
                                                                        Chapter 5: Recognizing the Symptoms of Fraud   137

person has obviously been murdered, there                      detail. But first, we illustrate how these symptoms could
is no question whether or not a crime has                      have revealed the fraud at Elgin Aircraft.
been committed. The dead body can be                              Accounting anomalies result from unusual pro-
                                                               cesses or procedures in the accounting system. Several
touched and seen. Likewise, if a bank is                       accounting anomalies resulted from the Elgin Aircraft
robbed, there is no question whether or                        fraud. The fraudulent claims forms from the 22 phony
not a crime has been committed. Everyone                       doctors originated from two locations. One was a post
in the bank, including customers and                           office box, and the other was a business located in a
employees, witnessed the robbery. In most                      nearby city that was owned by the manager’s husband.
cases, the entire episode is captured on                       The checks being paid to the 22 doctors were sent to
                                                               the same two common addresses. Checks were depos-
video and can be replayed. But with fraud,                     ited in the same two bank accounts and contained
it is not usually obvious that a crime has                     handwritten rather than stamped endorsements.
been committed. Only fraud symptoms,                              The likely reasons that none of these anomalies were
red flags, or indicators are observed.                         recognized are that managers trusted the perpetrator
                                                               completely and auditors merely matched claim forms
                                                               with canceled checks. The auditors did not ask ques-
Symptoms of Fraud                                              tions such as the following:
A person’s lifestyle may change, a document may be
                                                               •   Are the payments reasonable?
missing, a general ledger may be out of balance, some-
                                                               •   Do the endorsements make sense?
one may act suspiciously, a change in an analytical re-
                                                               •   Why are the checks going to and the bills coming
lationship may not make sense, or someone may
                                                                   from the same two addresses?
provide a tip that fraud is occurring. Unlike videos in
robbery or bodies in a murder, however, these factors             A major difference between financial statement
are only symptoms rather than conclusive proof of              auditors and fraud examiners is that most financial
fraud. There may be other explanations for the exis-           statement auditors merely match documents to see
tence of these symptoms. Lifestyle changes may have            whether support exists and is adequate. Auditors and
occurred because of inherited money. Documents                 examiners who detect fraud go beyond ascertaining the
may have been legitimately lost. The general ledger            mere existence of documents to determine whether the
may be out of balance because of an unintentional ac-          documents are authentic or fraudulent, whether the ex-
counting error. Suspicious actions may be caused by            penditures make sense, and whether all aspects of the
family dissension or personal problems. Unexplained            documentation are in order.
analytical relationships may be the result of unrecog-            Significant internal control weaknesses were ignored
nized changes in underlying economic factors. A tip            by the Elgin Aircraft auditors. First, the claims payment
may be motivated by an envious or disgruntled em-              department manager had not taken a vacation in
ployee’s grudge or by someone outside the company              10 years. Second, employees of Elgin Aircraft never re-
desiring to settle a score.                                    ceived payment confirmation so they could determine
    To detect fraud, managers, auditors, employees, and        whether the medical claims being paid on their behalf
examiners must recognize these fraud indicators or             were incurred by them. Third, payments to new doctors
symptoms (sometimes called red flags) and investigate          were never investigated or cleared by the company.
whether the symptoms resulted from actual fraud or                Allowing employees—especially those in accounting—
were caused by other factors. Unfortunately, many              to forfeit use of their vacation time is a control weak-
fraud symptoms go unnoticed, and even symptoms                 ness that must always be questioned. Implementing a
that are recognized are often not vigorously pursued.          system of independent checks is one of the most ef-
Many frauds could be detected earlier if fraud symp-           fective ways to deter fraud. Employee transfers, audits,
toms were investigated.                                        and mandatory vacations are various ways of provid-
    Symptoms of fraud can be separated into six groups:        ing independent checks on employees. The Office of
(1) accounting anomalies, (2) internal control weak-           the Controller of the Currency requires all bank em-
nesses, (3) analytical anomalies, (4) extravagant lifestyle,   ployees in the United States to take at least one week
(5) unusual behavior, and (6) tips and complaints. In          of consecutive vacation days each year. Many frauds
this chapter, we discuss these six types of symptoms in        come to light when employees are on vacation and
138   Part 3: Fraud Detection

cannot cover their tracks. In Elgin’s case, if another
                                                              C A U T I O N Analytical anomalies involve unusual
employee had made payments during the manager’s
                                                              relationships in data such as accounting information.
absence, the common addresses or the payments be-
                                                              Be careful not to confuse these with accounting anomalies
ing made to a business may have been recognized.
                                                              which involve unusual processes or procedures in the
   Not confirming payments made to employees is also
                                                              accounting system.
a serious control weakness. In Elgin’s case, doctors
were paid for hysterectomies, tonsillectomies, gallblad-         Several lifestyle symptoms at Elgin Aircraft, such as
der surgeries, and other procedures that were never           taking the employees to lunch in a limousine, should
performed. If employees were aware that payments              have been recognized. The Defense Department audi-
were made for these fabricated services, they probably        tor was told that the manager paid for the limousine
would have complained and the fraud scheme would              from personal funds and that she was independently
have been discovered much sooner.                             wealthy. She claimed that she had inherited a large
   Unfortunately, even if an auditor or manager dis-          sum of money from her husband’s parents. Those
covered the internal control weaknesses, they may still       who worked with her knew that she lived in a very
not have uncovered the fraud. Most likely, they would         expensive house, drove luxury cars, and wore expensive
have recommended that the weaknesses be fixed with-           clothes and jewelry. However, apparently nobody won-
out giving thought to the possibility that the weak-          dered why she worked and never took a vacation.
nesses might have been exploited. A major difference          While wealthy people may be employed because they
between an auditor who uncovers fraud and one who             love their work, rarely is their love so great that they
does not is that the first auditor not only fixes a control   never take a vacation.
weakness, but he or she also immediately enlists proce-          Several behavioral symptoms also should have
dures to determine whether the weakness has been              alerted others that something was wrong. Employees
exploited. The second auditor merely fixes the control        in the department regularly joked that their manager
weakness without investigating possible exploitation of       had a “Dr. Jekyll and Mrs. Hyde” personality. Some-
the weakness.                                                 times she was the nicest person to be around, and other
   Before doctors were cleared for payment, some form         times she would have periods of unexplained anger.
of background check should have been conducted to             Interviews with employees revealed that her highs and
determine whether the doctors were legitimate. Just as        lows had become more intense and more frequent in
Dun & Bradstreet checks should be performed on com-           recent months.
panies with which business is conducted, the validity of         With the Elgin Aircraft fraud, there were no tips or
a doctor who is requesting payment should be verified         complaints. No employees who felt that something was
by checking resources such as state licensing boards,         wrong came forward, and other doctors were still get-
medical groups, or phone listings.                            ting all the legitimate business. They had no reason to
   Analytical anomalies are relationships in financial        complain. Indeed, the only party really being hurt was
or nonfinancial data that do not make sense, such as an       Elgin Aircraft.
unreasonable change in a volume, mix, or price. In the           The Elgin Aircraft fraud was discovered because an
Elgin Aircraft case, several analytical symptoms should       observant auditor noticed a fraud symptom. In this
have alerted others to the fraud. The sheer volume of         chapter, we will discuss how understanding fraud
insurance work performed by the 22 fictitious doctors         symptoms helps us detect fraud much more effectively.
was very high. Why would $12 million be paid to only          We will now discuss in detail the six groups of fraud
22 doctors over a period of four years? None of the           symptoms.
phony doctors were licensed by the state, yet payments
to them exceeded payments to almost all other doctors.
Another analytical symptom was that there were no                 Remember this …
other payments to any of the dummy doctors by out-                Symptoms of fraud can be separated into six
side insurance companies. In other words, none of the             main groups: (1) accounting anomalies, (2) inter-
payments to these doctors were for employees who in-              nal control weaknesses, (3) analytical anomalies,
curred over $50,000 of medical expenses in any year.              (4) extravagant lifestyle, (5) unusual behavior,
Finally, the company’s medical costs increased signifi-           and (6) tips and complaints.
cantly (29 percent) during the four years of the fraud.
                                                                          Chapter 5: Recognizing the Symptoms of Fraud     139

                                                                “manage” his company’s receivable from the customer. In
Accounting Anomalies                                            doing so, Mark permitted the customer to pay later than
Common accounting anomaly fraud symptoms involve                would otherwise have been required. The customer’s pay-
problems with source documents, faulty journal entries,         able was not recognized as delinquent or past due. Be-
and inaccuracies in ledgers. We discuss each of them in         cause the receivable involved millions of dollars, paying
the following section.                                          30 to 60 days later than was required cost Mark’s employer
                                                                $3 million in lost interest. Mark received kickbacks totaling
Irregularities in Source Documents                              $350,000 from the customer. Mark’s fraud was discovered
Common fraud symptoms involving source documents                when an alert coworker realized that the company’s ac-
                                                                counts receivable turnover ratio was decreasing substan-
(either electronic or paper)—such as checks, sales in-
                                                                tially. The coworker prepared an aging schedule of
voices, purchase orders, purchase requisitions, and re-
                                                                individual accounts receivable balances that identified the
ceiving reports—include the following:                          customer as the source of the problem. A subsequent in-
•   Missing documents                                           vestigation revealed the kickback scheme.
•   Stale items on bank reconciliations                             A third fraud was discovered because of excessive credit
                                                                memos. The case involved a fraud of over $5,000 by a su-
•   Excessive voids or credits
                                                                pervisor in the shipping department of a wholesale-retail
•   Common names or addresses of payees or customers
                                                                distribution center warehouse facility. The supervisor was
•   Increased past-due accounts                                 responsible for the overall operations of the warehouse
•   Increased reconciling items                                 and had individual accountability for a cash fund that was
•   Alterations on documents                                    used for collecting money (usually under $500) from custo-
•   Duplicate payments                                          mers who came to the warehouse to pick up cash-
•   Second endorsements on checks                               on-delivery orders. The established procedures called for
•   Document sequences that do not make sense                   the supervisor to issue the customer a cash receipt, which
•   Questionable handwriting on documents                       was recorded in a will-call delivery logbook. The file contain-
•   Photocopied documents                                       ing details on the customer order would eventually be
                                                                matched with cash receipts by accounting personnel, and
   We describe three actual frauds that illustrate how          the transaction would be closed.
document symptoms can signal that embezzlement is                   Over approximately one year, the supervisor defrauded
taking place. The first involves the use of photocopied         the company by stealing small amounts of money. He at-
documents; the second, the recognition of increased             tempted to conceal the fraud by submitting credit memos
past-due accounts receivable; and the third, excessive          (with statements such as “billed to the wrong account,” “to
voids or credits. While we discuss only three frauds,           correct billing adjustment,” or “miscellaneous”) to clear the
                                                                accounts receivable file. The accounts would be matched
many frauds have been detected by using source
                                                                with the credit memo, and the transaction would be closed.
                                                                A second signature was not needed on the credit memos,
                                                                and accounting personnel asked no questions about credit
In the first case, an alert internal auditor detected a fraud   memos originated by the supervisor of the warehouse.
while examining the purchase of new equipment. Further              At first, the supervisor submitted only two to three
investigation revealed a large, collusive fraud. A thin line    fraudulent credit memos a week, totaling approximately
running through a photocopied letter in a vendor invoice        $100. After a few months, however, he increased the
file alerted the auditor to probe further. The photocopied      amount of his theft to about $300 per week. To give the
letter was from a manufacturer who suggested the repair         appearance of randomness, so as to keep the accounting
of machinery parts as a less costly alternative to replace-     personnel from becoming suspicious, the supervisor inter-
ment, which was also set forth in the letter. By cutting out    mixed small credit memo amounts with large ones.
the paragraph pertaining to the repair, the purchase of new         The fraud surfaced when the supervisor accidentally
machinery appeared justified.                                   credited the wrong customer’s account for a cash transac-
    A second fraud was detected by recognizing an increase      tion. By coincidence, the supervisor was on vacation when
in past-due accounts from customers. This fraud was com-        the customer complained and was not available to cover
mitted against one of the largest Fortune 500 companies in      his tracks when accounting personnel investigated the
the United States. Mark Rogers was the accounts receiv-         transaction. Because of his absence, the accounts receiv-
able department manager at XYZ Foods. In his position,          able clerk questioned the manager of the warehouse who
he developed a close relationship with one of the com-          investigated the problem. The manager examined the cash
pany’s largest customers and used the relationship to de-       receipts and determined that fraud had occurred.
fraud his employer. In return for a kickback, he offered to
140      Part 3: Fraud Detection

Faulty Journal Entries                                                                       books. This manipulation of the accounting records
Accounting is a language, just as English and Japanese                                       will be recognized when vendors do not receive pay-
are languages. For example, consider the following                                           ments for amounts owed to them. When the liability
journal entry:                                                                               becomes delinquent, they will notify the company.
                                                                                             Subsequent investigation will usually reveal the
      Legal Expense ...........................................5,000                         fraud.
                   Cash ...........................................5,000                        Smart embezzlers also realize that most equity ac-
                                                                                             counts should not be altered. The owners’ equity bal-
    In the English language, this entry says, “An attor-                                     ance is decreased by the payment of dividends and
ney was paid $5,000 in cash.” In the language of                                             expenses and is increased by sales of stock and by rev-
accounting, this entry says, “Debit Legal Expense;                                           enues. Embezzlers rarely conceal their frauds by ma-
credit Cash.” A person who speaks both accounting                                            nipulating either dividends or stock accounts because
and English will realize that these statements say                                           these accounts have relatively few transactions and al-
exactly the same thing.                                                                      terations can be quickly noticed. In addition, transac-
    The problem with the language of accounting is that                                      tions involving stocks or dividends usually require
it can be manipulated to tell a lie, just as can English or                                  board of director approval, go through a transfer agent,
Japanese or any other language. For example, with the                                        and are monitored closely.
above entry, how do you know that an attorney was                                               Thus, income statement accounts such as revenues
actually paid $5,000? Instead, maybe an employee em-                                         and expenses remain as possible accounts for decreas-
bezzled $5,000 in cash and attempted to conceal the                                          ing the right side of the accounting equation and mak-
fraud by labeling the theft as a legal expense. Smart                                        ing the accounting records balance when stealing an
embezzlers sometimes conceal their actions in exactly                                        asset. Balancing the equation by manipulating revenues
this way, realizing that the fraudulent legal expense will                                   would require that individual revenue accounts be re-
be closed to Retained Earnings at the end of the ac-                                         duced. However, since revenues rarely decrease (except
counting period, making the audit trail difficult to fol-                                    through adjusting entries at the end of an accounting
low. And, if the fraudulent employer routinely pays                                          period), a decrease in a revenue account would draw
large amounts of legal expenses, this small fraud could                                      attention. Therefore, embezzlers who manipulate ac-
easily go unnoticed. To understand whether journal                                           counting records to conceal their frauds usually at-
entries represent truth or are fictitious, one must learn                                    tempt to balance the accounting equation by
to recognize journal entry fraud symptoms.                                                   increasing expenses. Increasing expenses decreases net
    An embezzler usually steals assets, such as cash or                                      income, which decreases retained earnings and owners’
inventory. (No one steals liabilities!) To conceal the                                       equity, thus leaving the accounting equation in balance,
theft, the embezzler must find a way to decrease either                                      as illustrated in Figure 5.1.
the liabilities or the equities of the victim organiza-                                         Recording an expense to conceal fraud involves
tion. Otherwise, the accounting records will not bal-                                        making a fictitious journal entry. Fraud examiners
ance, and the embezzler will be quickly detected.                                            must be able to recognize signals that a journal entry
Smart embezzlers understand that decreasing liabili-                                         may have been manufactured to conceal a fraud.
ties is not a good concealment method. In reducing                                           Manipulating expense accounts also has the advantage
payables, amounts owed are eliminated from the                                               that expenses are closed or brought to zero balances at


                                        Assets                  =          Liabilities   +     Owners' Equity

                                                                                             Stock         Retained Earnings
                                                                                             Dividends     Net Income
                                                                                             Revenues      Expenses
                                                                           Chapter 5: Recognizing the Symptoms of Fraud    141

year-end, thus obscuring the audit trail. The following          entries, Lincoln’s massive fraud might have ended
are common journal entry fraud symptoms:                         much earlier and investors would have been spared
                                                                 losing millions of dollars.
•    Journal entries without documentary support
                                                                     At Waste Management Corporation, the chief finan-
•    Unexplained adjustments to receivables, payables,
                                                                 cial officer realized that their outside auditors only per-
     revenues, or expenses
                                                                 formed audits on the annual financial statements and
•    Journal entries that do not balance
                                                                 that only a cursory review was performed at the end of
•    Journal entries made by individuals who would not
                                                                 each quarter. Therefore, to overstate net income at the
     normally make such entries
                                                                 end of each quarter, he made a simple “topside” journal
•    Journal entries made near the end of an accounting
                                                                 entry that debited or increased Accounts Receivable and
                                                                 credited or increased Revenue. These entries, which cu-
   To illustrate journal entry fraud symptoms, we de-            mulatively got larger each quarter during the year, were
scribe three actual embezzlements. In the first, a               reversed at the start of each successive quarter. Then, at
$150,000 embezzlement was concealed by creating                  the end of the year, the fraud that had been committed
journal entries without support.                                 with the topside entries was buried in complex merger
                                                                 reserve accounts. This type of fraud, where topside en-
                                                                 tries are made without any support, is quite egregious
John Doe was the controller of a small bank. Over a period
                                                                 and was part of the financial statement fraud committed
of several years, he embezzled approximately $150,000 from
his employer by telephoning larger banks and having them
                                                                 at several other companies in the late 1990s.
pay his personal credit card bills. He concealed his fraud by
creating fictitious journal entries to recognize the shortages
                                                                 Inaccuracies in Ledgers
as advertising expense. Because the total advertising ex-        The definition of a ledger is “a book of accounts.” In
pense was large and the increase in expense resulting            other words, all transactions related to specific accounts,
from his fraud was relatively small, no one ever questioned      such as cash or inventory, are summarized in the ledger.
his journal entries. Because he was the bank’s controller and    The accuracy of account balances in the ledger is often
in charge of accounting, he did not even forge fictitious doc-   proved by ensuring that the total of all asset accounts
umentation to support the entries. He was caught when he         equals the total of all liability and equity accounts or, if
deposited a duplicate $10,000 payment from one of the
                                                                 revenues and expenses have not yet been closed out, that
bank’s customers in his personal bank account. When the
customer realized he paid twice, he asked for a refund, and
                                                                 the total of all debit balances equals the total of all credit
the deposit was traced to John’s account.
                                                                 balances. Many frauds involve manipulating receivables
                                                                 from customers or payables to vendors. Most companies
                                                                 have master (control) receivable and payable accounts,
   If anyone had questioned the journal entries that             the total of which should equal the sum of all the indi-
were being made without documentary support, John’s              vidual customer and vendor account balances. Two com-
fraud would have been quickly discovered. In this case,          mon fraud symptoms relating to ledgers are as follows:
however, if John had not been so greedy, his fraud
                                                                 1. A ledger that does not balance; that is, the total of
might have continued indefinitely.
   The manipulation of income at Lincoln Savings and                all debit balances does not equal the total of all
                                                                    credit balances.
Loan illustrates how fraud perpetrators make journal
                                                                 2. Master (control) account balances that do not
entries at the end of accounting periods to artificially
inflate reported net income. For many successive quar-              equal the sum of the individual customer or vendor
ters, large journal entries recorded fictitious revenues
that took Lincoln Savings and Loan from a loss to a                 The first symptom is indicative of a fraud in which
profit position.                                                 cover-up in the accounting records is incomplete. For
   The accounting firm that reviewed Lincoln’s trans-            example, a perpetrator may embezzle inventory (an as-
actions (after the fraud was discovered) concluded that          set) but not reflect the reduction of inventory in the
13 transactions overstated income by more than $100              accounting records. In this case, the actual inventory
million. The investigative auditors called the transac-          balance, as determined by a physical count, is lower
tions the most egregious misapplication of accounting            than the recorded amount of inventory, and the ledger
they had ever seen. If Lincoln’s auditors and regulators         does not balance. Another example of a ledger out of
had recognized the pattern of successive last-minute             balance is the theft of cash accompanied by the failure
142   Part 3: Fraud Detection

to record an expense. In this case, total assets would be       prevent the auditors from discovering the fraud, Marjorie
less than total liabilities plus owners’ equity.                would pull some official bank checks (cashier’s checks)
   The second ledger symptom is indicative of manip-            that had previously been used and send them in the out-
                                                                going cash letter to the Federal Reserve.
ulation of an individual customer’s or vendor’s balance
                                                                    Because the Federal Reserve procedures were auto-
without altering the master receivable or payable ac-
                                                                mated, no one ever personally examined the checks or no-
count in the ledger. In this case, the sum of the indi-         ticed that they had already been processed several times.
vidual customer or vendor balances does not agree with          In fact, some of the checks were totally black from being
the master account balance.                                     processed so many times. Her fraud was assisted by the
   The following example shows how this second led-             Federal Reserve’s policy of giving immediate credit to First
ger symptom revealed a fraud that was perpetrated by            National for the total amount supposedly contained in the
the bookkeeper of a small bank.                                 outgoing cash letter. The next day, as the checks were pro-
                                                                cessed using bank routing numbers, the Federal Reserve
                                                                would realize that the official checks were not drawn on
Using the following schemes, she embezzled over $3 mil-         other banks but were really First National’s own checks
lion from the bank, which had only $30 million in assets.       and would reverse the credit previously given to First Na-
(Note: The Federal Reserve is the “bankers’ bank”; that is,     tional. The reduction would again throw First National’s
every bank has one or more accounts at the Federal Re-          ledger accounts out of balance. But, for one day—the day
serve. When a check drawn on one bank is sent to the Fed-       the auditors examined the records—the bank’s books
eral Reserve by a different bank, the Federal Reserve           would be balanced and the shortage would be “parked”
increases the account of the depositing bank and decreases      at the Federal Reserve. Because the financial statements
the account of the bank on which the check was drawn. The       were prepared for that one day, the bank records balanced
Federal Reserve then accumulates all checks drawn on a          for the auditors and the Federal Reserve confirmed the
given bank and sends them back to that bank in what’s           misstated receivable from them as being correct.
called the incoming cash letter. All checks are drawn on
different banks and sent to the Federal Reserve for credit
in what is called the outgoing cash letter.)                        This fraud could easily have been discovered if
    Using two different schemes, Marjorie defrauded First
                                                                someone had noticed that, although the books balanced
National Bank of Atlanta of over $3 million. Her first
                                                                at month-end, they were out of balance during the rest
scheme involved writing personal checks on her bank ac-
count at First National to pay for art, jewelry, automobiles,
                                                                of the month. Bank managers received daily reports
home furnishings, and other expensive acquisitions. Then,       that showed balances significantly different from the
when her check was sent from the Federal Reserve to the         balances on the financial statements. They never ques-
bank (in the incoming cash letter), she would allow the         tioned these unusual balances. This fraud could also
overall demand deposit account balance to be reduced            have been uncovered if someone had recognized
but would pull her checks before they could be processed        many other control weaknesses and other symptoms.
and deducted from her personal account.                         For example, Marjorie had significant personality con-
    The result of this scheme was that the master demand        flicts with other employees, and she lived a lifestyle far
deposit account balance was lower than the sum of the           beyond what her income would support. In addition,
bank’s individual customers’ demand deposits. The second
                                                                individual accounting records had been altered, and a
scheme involved making deposits into her account by using
                                                                previous fraud at the same bank had indicated a need
checks drawn on other banks and then pulling the checks
before they were sent in the outgoing cash letter to the Fed-
                                                                for reports and procedures that, if implemented, would
eral Reserve. Thus, her checks were never deducted from         have made the fraud impossible. Surprisingly, the fraud
her accounts at the other banks. In fact, her accounts at the   was not discovered until a cashier’s check that Marjorie
banks did not contain sufficient funds to cover the checks if   had reused several times was kicked out of a Federal
they had been processed. The result of this scheme was that     Reserve sorter because it could not be read.
the individual demand deposit balances increased, but the
master demand deposit account balance did not.
    Both of these schemes had the effect of making the              Remember this …
master demand deposit account balances lower than the
                                                                    The three main areas of accounting anomalies
sum of the individual account balances. Over time, as Marj-
orie wrote checks and made fictitious deposits, the differ-
                                                                    include irregularities in source documentation,
ence between the sum of the individual accounts and the             faulty journal entries, and inaccuracies in the
master account balances became larger and larger. At the            ledger.
end of each accounting period, to cover her tracks and
                                                                           Chapter 5: Recognizing the Symptoms of Fraud     143

Internal Control Weaknesses                                      because the manager told him to sign, the assistant had
                                                                 merely followed the manager’s order without questioning
As discussed previously, fraud occurs when perceived             the appropriateness of the request. As a result, the control
pressure, perceived opportunity, and rationalization             requiring two independent signatures was compromised.
combine. Many individuals and organizations have pres-           There were two signatures, but they were not independent.
sures. Everyone rationalizes. When internal controls are         Both the assistant and the manager were quickly termi-
absent or overridden, the risk of fraud is great.                nated, and the assistant wished he had made an indepen-
   As discussed in Chapter 2, internal control is com-           dent, informed decision.
prised of the control environment, the accounting sys-
tem, and control procedures. Common internal control
                                                                    The second example of an internal control weakness
fraud symptoms include the following:
                                                                 fraud is the famous Hochfelder case. This fraud went to
•    Lack of segregation of duties                               the U.S. Supreme Court before it was decided that Ernst
•    Lack of physical safeguards                                 & Ernst (now Ernst & Young), a large public accounting
•    Lack of independent checks                                  firm, had not been negligent in performing an audit.
•    Lack of proper authorization
•    Lack of proper documents and records
                                                                 Leston Nay, the president of First Securities Co. of Chicago,
•    Overriding of existing controls
                                                                 fraudulently convinced certain customers to invest funds in
•    Inadequate accounting system                                escrow accounts that he represented would yield a high re-
   Many studies have found that the element most                 turn. There were no escrow accounts. Nay converted the
common in frauds is the overriding of existing internal          customers’ funds to his own use.
                                                                      The transactions were not in the usual form of dealings
                                                                 between First Securities and its customers. First, all corre-
   Three examples of control weaknesses that allowed
                                                                 spondence with customers was done solely by Nay. Be-
fraud to occur are discussed in the following text. In           cause of a “mail rule” that Nay imposed, such mail was
the first, a control weakness allowed a customer to              opened only by him. Second, checks of the customers
defraud a bank of over $500,000. In the second, a sig-           were made payable to Nay. Third, the escrow accounts
nificant internal control weakness allowed a fraud to            were not reflected on the books of First Securities, nor in
continue over several years.                                     filings with the SEC, nor in connection with customers’
                                                                 other investment accounts. The fraud was uncovered only
                                                                 after Nay’s suicide.
Lorraine was a customer of Second National Bank. She                  Respondent customers sued in district court for damages
opened her account 16 months previously, and she often           against Ernst & Ernst as assisting in the fraud under Section
made deposits and withdrawals in the hundreds of thou-           10b-5 of the 1933 SEC Act. They alleged that Ernst & Ernst had
sands of dollars. She claimed to be a member of a well-          failed to conduct a proper audit, which would have led them
known, wealthy family. She drove a Porsche, dressed very         to discover the mail rule and the fraud. The court reasoned
nicely, and was able to earn the trust and confidence of the     that Ernst & Ernst had a common-law and statutory duty of
bank’s branch manager. One day, she approached the man-          inquiry into the adequacy of First Securities’ internal control
ager and said that she needed a cashier’s check for $525,000.    system, because the firm had contracted to audit First Securi-
The manager, realizing that Lorraine had only $13,000 in her     ties and to review the annual report filings with the SEC.
account, denied the request. Then, deciding that Lorraine was         The U.S. Supreme Court reversed the decision of the
a valued customer, and based on Lorraine’s promise to cover      court of appeals, concluding that the interpretation of Sec-
the shortage the next day, the manager gave Lorraine the         tion 10b-5 required the “intent to deceive, manipulate or
cashier’s check. It turned out that Lorraine was not who she     defraud.” Justice Powell wrote, in the Supreme Court’s
claimed to be. In fact, she was an embezzler who had stolen      opinion: “When a statute speaks so specifically in terms
over $5 million from her employer; all the funds that had gone   of manipulation and deception, and of implementing de-
through her bank account were stolen. Her employer had           vices and contrivances—the commonly understood termi-
caught her and promised not to seek prosecution if she would     nology of intentional wrongdoing—and when its history
repay the company. She was stealing from Second National         reflects no more expansive intent, we are quite unwilling
to repay the money.                                              to extend the scope of the statute to negligent conduct.”
    As it turned out, Second National had a control requir-      The Supreme Court pointed out that in certain areas of
ing two signatures on all cashier’s checks exceeding             the law, recklessness is considered to be a form of inten-
$500,000. However, the bank manager, who was an impos-           tional conduct for purposes of imposing liability.
ing figure, had “ordered” his assistant to sign the cashier’s
check. Without making an independent decision and
144   Part 3: Fraud Detection

   In this case, the mail rule that required that no one       Analytical Fraud Symptoms
except Leston Nay open the mail was an internal con-
                                                               Analytical fraud symptoms are procedures or relation-
trol weakness. Had this weakness not been allowed,
                                                               ships that are unusual or too unrealistic to be believ-
Nay’s fraud would probably have been revealed much
                                                               able. They include transactions or events that happen
earlier and investors would not have lost so much
                                                               at odd times or places; that are performed by or involve
                                                               people who would not normally participate; or that in-
                                                               clude odd procedures, policies, or practices. They also
The third case is a very simple one. A few years ago, one of   include transactions and amounts that are too large or
the authors of this text had a new home built by a building    too small, that are performed or occur too often or too
contractor. Shortly after the home was finished, the author    rarely, that are too high or too low, or that result in too
received a call from the builder whom he had now come to       much or too little of something. Basically, analytical
know quite well. The building contractor told the author       symptoms represent anything out of the ordinary.
that his secretary/bookkeeper had stolen over $10,000 and      They are the unexpected. Common examples of analyt-
he had caught her. When asked how she did it, the builder      ical symptoms include the following:
replied that “she both wrote checks and reconciled the
bank statement.” To steal the money, she had simply            •    Unexplained inventory shortages or adjustments
written checks to herself and then listed the checks as        •    Deviations from specifications
“outstanding” on the bank reconciliation. The builder had      •    Increased scrap
caught her when he had to submit bank statements to a          •    Excess purchases
lender for a loan and the amount shown on the bank state-      •    Too many debit or credit memos
ments was significantly different than what he had been
                                                               •    Significant increases or decreases in account
told it was. After he discovered the theft, he called one of
                                                                    balances, ratios, or relationships
the authors of this book and asked what he should do. The
author told him that people who embezzle and are not
                                                               • Physical abnormalities
prosecuted have a high likelihood of committing fraud          • Cash shortages or overages
again and that he should probably fire her and have her        • Excessive late charges
prosecuted. He didn’t follow this advice. Unfortunately,       • Unreasonable expenses or reimbursements
later the secretary/bookkeeper stole over $25,000.             • Excessive turnover of executives
                                                               • Strange financial statement relationships, such as:
                                                                         Increased revenues with decreased inventory
   There are three simple procedures that small busi-                    Increased revenues with decreased receivables
ness owners should do personally when they can’t af-                     Increased revenues with decreased cash flows
ford sufficient employees to guarantee effective                         Increased inventory with decreased payables
segregation of duties. The first is that they should al-                 Increased volume with increased cost per unit
ways open the bank statement themselves and, if pos-                     Increased volume with decreased scrap
sible, reconcile the bank statement. Second, they should                 Increased inventory with decreased warehousing
pay everything by check so there is a record. Third, they                 costs
should sign every check themselves and not delegate the           An example of fraud detected by considering analyt-
signing to anyone else. These simple procedures, if            ical relationships was the Mayberry fraud.
done on a timely basis, will prevent many frauds.

                                                               The internal auditors for Mayberry Corporation, a conglom-
      Remember this …                                          erate with about $1 billion in sales, were auditing the com-
                                                               pany’s sheet metal division. Every past audit had resulted
      The fraud triangle includes pressure, opportu-
                                                               in favorable outcomes with few audit findings. This year,
      nity, and rationalization. Nearly all individuals        however, something did not seem right. Their observation
      and organizations are subject to pressures and           of inventory had revealed no serious shortages, and yet
      can rationalize. A common element in most                inventory seemed dramatically overstated. Why would in-
      frauds is the overriding of existing internal con-       ventory increase fivefold in one year? Suspecting that
      trols. When internal controls are absent or over-        something was wrong, the auditors performed some “mid-
      ridden, this provides for the opportunity of             night auditing” and found that the company’s sheet metal
      fraud, thus increasing the risk of fraud.                inventory was grossly overstated. The auditors had almost
                                                               been deceived. Local management had falsified the
                                                                            Chapter 5: Recognizing the Symptoms of Fraud    145

inventory by preparing fictitious records. The auditors had       but he still wondered about the transactions. Maybe the
verified the amount of inventory shown during the year-           Oldsmobile dealership was closer, he reasoned. Upon
end count and had deposited their verifications in a box in       checking, he discovered that it was not. Further investiga-
the conference room they were using. A manager at May-            tion by the accountant revealed that, although payments
berry added fake inventory records to the box at night with       had also been made to the Oldsmobile dealership for
some of the records showing unreasonably large amounts            body damage on company cars, no claims had been filed
of sheet metal. The manager had also substituted new in-          with insurance companies. The accountant also noticed
ventory reconciliation lists to agree with the total of the       that payments of exactly the same amount were being
valid and fictitious records.                                     made to the Oldsmobile dealer every month. The combi-
    The magnitude of the Mayberry fraud was discovered            nation of Oldsmobile dealer, body damage without corre-
when the auditors performed analytical tests. First, they con-    sponding insurance claims, expenditures every month,
verted the purported $30 million of sheet metal inventory         and expenditures of the same amount raised his suspi-
into cubic feet. Second, they determined the volume of the        cion. He concluded that the only legitimate explanation
warehouse that was supposed to contain the inventory. At          for these anomalies would be a fixed-fee maintenance
most, it could have contained only one-half the reported          contract with the Oldsmobile dealer to service the com-
amounts; it was far too small to house the total amount.          pany’s Cadillacs. An investigation revealed that no such
Third, they examined the inventory tags and found that            contract existed. Further investigation revealed that Don
some rolls of sheet metal would weigh 50,000 pounds. How-         had a girlfriend who worked at the Oldsmobile dealership
ever, none of the forklifts that were used to move the inven-     and that he was buying her a car by having the company
tory could possibly lift over 3,000 pounds. Finally, the          make the monthly payments.
auditors verified the reported inventory purchases and found          In this case, an alert accountant saved his company ap-
purchase orders supporting an inventory of about 30 million       proximately $15,000. Unfortunately, many accountants and
pounds. Yet, the reported amount was 60 million pounds.           auditors would have missed this fraud. They would proba-
    Faced with this evidence, the company’s managers admit-       bly have seen the check being paid to the Oldsmobile
ted that they had grossly overstated the value of the inventory   dealer, matched it with the invoice that Don’s girlfriend
to show increased profits. The budget for the sheet metal di-     supplied each month, and been satisfied. They would not
vision called for increased earnings, and without the over-       have asked whether the expenditure made sense or why
statement, the earnings would have fallen far short of target.    Cadillacs were being serviced at an Oldsmobile dealership.
    In this case, it was the relationship between amounts
recorded and the weight and volume that the recorded
amounts represented that did not make sense. Unfortu-                 Recognizing analytical symptoms has always been
nately, few managers or auditors ever think of examining          an excellent method of detecting fraud. A successful
physical characteristics of inventory.                            fraud investigator became interested in investigation
                                                                  when he discovered his first fraud. This discovery,
                                                                  which determined his lifelong career, is one of the
                                                                  best examples of the use of analytical symptoms. Here
S T O P & T H I N K What other unusual financial                  is the career-changing experience.
statement relationships may exist in the presence of a
fraud?                                                            It was the summer of 1956. That’s what I remember, at least,
                                                                  though it was a long time ago and things get distorted when
   Sometimes, it is not unusual relationships that signal         you look back. And, I have looked back quite a bit since then,
fraud but transactions or events that do not make                 for the entire episode was quite an eye-opener for an
sense. Such was the case with the following fraud:                18-year-old kid. I was a “numbers man” then and still am.
                                                                  Mathematics is an art to me. I find a beauty in pure numbers
                                                                  that I never see in the vulgar excesses that most of society
Don was the business manager of Regal Industries. In his          chases after. You might wonder, then, what I was doing
position, he often arranged and paid for services per-            working in a movie theater that summer—the summer that
formed by various vendors. An alert accountant caught             Grace Kelly became a princess and the whole country
Don committing a fraud. The first symptom observed by             seemed to worship the cardboard stars on the silver screens.
the accountant was payments made to an Oldsmobile                 Well, the truth is, I spent the summer in a movie theater be-
dealership, though the company only had a few company             cause I needed employment. I’d just graduated from South
cars and all were Cadillacs. The accountant thought it            High and was waiting to begin college. To earn money, I took
strange that the company cars were being serviced at an           a job as a ticket taker at the Classic Theater. As movie
Oldsmobile dealership rather than a Cadillac dealership.          theaters go, the Classic was considered one of the best.
He knew that both cars were made by General Motors,               Not in terms of elegance: it wasn’t one of those gild and
146   Part 3: Fraud Detection

velvet-lined monstrosities with fat plaster babies and faux       probably no way Mr. Smith’s fraud would have been
chandeliers. No! What the Classic had was a certain charm         caught if it had not been for a “numbers man” who saw
in the same way that drive-in hamburger joints of the decade      relationships in the numbers that did not make sense.
did. I think the style was called deco-modern and it made me
feel a bit like I was rushing toward the 21st century. So the
                                                                      Relationships between financial statement numbers
place wasn’t all bad, though it was not the kind of job that a
dedicated numbers man usually sought. But as it turned out,
                                                                  are also predictable. To individuals who really under-
my numbers did come in useful. For that’s how I caught on         stand accounting, financial statements tell a story. The
to him, you see; it was because of the numbers.                   elements of the story must be internally consistent.
    Ticket taking is not the most exciting job there is, and I    Many large financial statement frauds could have
didn’t find it a real intellectual challenge. My mind was free    been discovered much earlier if financial statement pre-
to wander, and I got in the habit of noting the number of         parers, auditors, analysts, and others had understood
each ticket that I tore: 57, 58, 59, 60. The numbers would        numbers in the financial statements the way the ticket
march to me in a more or less consecutive order as they           taker understood his numbers.
came off the roll that the ticket seller sold from: 61, 62, 63,       One of the best examples of financial statement
64. But sometimes, I noticed, the sequence would be off. A
                                                                  numbers that did not make sense was in MiniScribe
whole chunk of numbers would appear that should have
come through earlier: 65, 66, 40, 41, 42. It would happen
                                                                  Corporation’s financial statements. MiniScribe was a
almost every time I worked. I thought it was odd and was
                                                                  Denver-based producer of computer disk drives. Here
curious about what could be disturbing the symmetry of            is a description of the MiniScribe fraud and an analysis
my numbers. The world of numbers is orderly and logical;          of the numbers in the firm’s financial statements that
for every apparent irrationality, there is an explanation.        did not make sense.
I began to use the puzzle as a mental game to occupy my              On May 18, 1989, MiniScribe Corporation announced
working hours. Noting each time the sequence was off,
                                                                     that the financial statements that had been issued for
I came to realize that it always happened after my daily
                                                                     1986, 1987, and the first three quarters of 1988 could
break. The manager, Mr. Smith, would relieve me while
I was on break. I watched closer and noticed another fact:
                                                                     not be relied upon because sales and net income had
the numbers would always be off while the ticket seller,             been grossly overstated. In 1988, Mini Scribe was voted
who had the break after mine, was being relieved. Mr.                the most “well-managed” personal computer disk drive
Smith filled in for the ticket seller, too.                          company in the industry. The company experienced an
    Until this point, the amateur detective work had been            increase in sales from $113.9 million in 1985 (the year
merely a way to pass the time. I began to suspect that some-         it lost its largest customer, IBM) to a reported $603
thing wrong was going on, and it made me uncomfortable.              million in 1988. In April 1985, Quentin Thomas Wiles
After more observation and thought, I solved Mr. Smith’s             was appointed CEO and director of the company, with
scheme. When he relieved me as ticket taker during my                the hope that he might lead the company out of finan-
break, he would pocket the tickets instead of tearing them
                                                                     cial trouble. Under his management, the company’s
in two. Then, when he relieved the ticket seller, he would
                                                                     sales and profits seemed to increase, even though
resell the tickets he had just pocketed and keep the cash.
                                                                     downturns in the market and severe price cutting
Thus, the ticket numbers that I saw coming through out of
sequence were really coming through for the second time.
                                                                     were taking place within the industry. Unfortunately,
    Although this was a small fraud that took place in a little      the financial statement numbers were fraudulent.
theater, it illustrates that when things do not look right,          Wiles had a reputation for using a strict, overbearing
they probably are not right. If the ticket taker had not             management style to reach his goal of turning failing
been fascinated with numbers, the manager probably                   companies into successes. At MiniScribe, he set strin-
would not have been detected. The manager was trusted                gent goals for each manager to increase sales and in-
more than other workers. The number of tickets he                    come and did not tolerate failure to reach these goals.
pocketed was small in relation to the total number of tick-          In an effort to please Wiles, reports were forged and
ets sold in a day, and so management did not see a large             manipulated throughout the company. One marketing
drop in profits. Every night, the bookkeeper computed the
                                                                     manager revealed that division managers were told to
total number of tickets sold, using the beginning and end-
ing ticket numbers, and compared the total to the cash
                                                                     “force the numbers” if they needed to. Thus, the fraud
taken in. Unfortunately, the balance was not wrong. The
                                                                     began with managers simply touching up internal
theater hired separate people to sell and take tickets specif-       documents as they moved up the line. Wiles continued,
ically to avoid this type of fraud. But Mr. Smith was the            however, to push for increases in sales, even during
manager, and no one perceived a problem with letting                 times of recession and price cutting within the industry.
him do both jobs while others were on break. There is                This pressure led managers to invent various schemes
                                                                       Chapter 5: Recognizing the Symptoms of Fraud      147

   to make the company look better than it really was.        relationships with industry trends, and an examination
   Some of the schemes used were as follows:                  of MiniScribe’s customers provided analytical symptoms
                                                              suggesting that something was seriously wrong. Unfor-
   •   Packaging bricks, shipping them, and recording
                                                              tunately, by the time these symptoms were recognized,
       them as sales of hard drives
                                                              investors, auditors, lawyers, and others had been fooled,
   •   Dramatically increasing shipments to ware-
                                                              and many people lost money.
       houses and booking them as sales
                                                                  Several research papers have studied different ana-
   •   Shipping defective merchandise repeatedly and
                                                              lytical “symptoms” to determine if they can be used to
       booking the shipments as sales
                                                              predict fraud. For example, one study examined the
   •   Shipping excess merchandise that was not
                                                              relationship between high management turnover and
       returned until after the financial statements had
                                                              financial distress and accounting fraud. This paper,
       been released
                                                              based on an analysis of SEC Accounting and Auditing
   •   Understating bad debt expense and the allow-
                                                              Enforcement Releases between 1990 and 2000 found
       ance for doubtful accounts
                                                              that fraud firms are more likely to be financially dis-
   •   Changing shipping dates on shipments to over-
                                                              tressed and have higher management turnover (both
       seas customers so that revenues were recognized
                                                              analytical symptoms) than are nonfraud firms.1
       before sales were made
                                                                  Auditors often use analytical procedures to look for
   •   Changing auditors’ working papers
                                                              fraud symptoms. Unfortunately, analytical procedures
       The result of these and other schemes was a signif-    are not always effective because sometimes analytical
   icant overstatement of net income and sales. Inventory     relationships stay the same even when fraud is being
   records as of the end of 1987 revealed $12 million on      perpetrated. Such was the case at WorldCom.
   hand; in reality, it was around $4 million. In 1989, the       In the WorldCom case, significant decreases in the
   company booked a $40 million charge to income to           purchase of fixed assets were offset by improper capi-
   offset these overstatements. On January 1, 1990, the       talization of expenses, thus leaving the relative amount
   company filed for bankruptcy, listing liabilities of       of increases in assets about the same from period to
   $257.7 million and only $86.1 million in assets.           period. Here is a summary of the WorldCom fraud:
    Several analytical symptoms indicated that things
were not right at MiniScribe. First, MiniScribe’s results     On July 8, 2002, Melvin Dick, Arthur Andersen’s former se-
were not consistent with industry performance. During         nior global managing partner for Andersen’s technology,
the period of the fraud, severe price cutting was going       media, and communications practice, testified before the
on, sales were declining, and competition was stiff.          House Committee on Financial Services and stated:
MiniScribe reported increases in sales and profits, while        “We performed numerous analytical procedures … in
other companies were reporting losses. MiniScribe had            order to determine if there were significant variations
very few large customers and had lost several major              that required additional work. We also utilized sophisti-
customers, including Apple Computer, IBM, and Digi-              cated auditing software to study WorldCom’s financial
tal Equipment Corporation. MiniScribe was also falling           statement line items, which did not trigger any indica-
behind on its payments to suppliers. Returns to suppli-          tion that there was a need for additional work.”

ers forced the bankruptcy of MiniScribe’s major sup-             This statement is an acknowledgment that analytical
plier of aluminum disks, Domain Technologies.                 procedures failed to detect the greatest management fraud
    In addition, numbers that were reported at the end        in history. Why?
of each quarter were amazingly close to the projections          While the details of Andersen’s analytical procedures
made by Wiles. Financial results were the sole basis for      have not been disclosed, it would not be unreasonable to
                                                              assume that Andersen used sophisticated procedures. The
management bonuses. There were significant increases
                                                              nature of the problem the firm faced may be illustrated by
in receivables, and yet the allowance for doubtful ac-
                                                              comparing key financial statement ratios for WorldCom
counts was far less than the industry average. An aging       with those of seven other publicly held communications
of receivables revealed that many accounts were old and       companies: Sprint, AT&T, Nextel, Castle Crown, AmTelSat,
probably not collectible. A simple correlation of inven-      U.S. Cellular, and Western Wireless. Five ratios, all related
tory with sales would have revealed that while reported       to revenues, expenses, and (gross) plant and equipment
sales were increasing, inventory was not increasing pro-      are … taken from the company’s SEC filings.
portionately. Indeed, the financial statement numbers            We now know that WorldCom’s revenues, expenses,
did not make sense. Relationships within the statements,      and property and equipment were materially misstated in
148   Part 3: Fraud Detection

2000 and 2001. The first two ratios—cost of revenues to         immediately spend everything they steal. As they be-
revenues and the change in cost of revenues to the change       come more and more confident in their fraud schemes,
in revenues—showed declining trends for WorldCom, but           they steal and spend larger amounts. Soon they are
nothing that would be characterized as unusual. By 2001,
                                                                living lifestyles far beyond what they can afford.
WorldCom was in the middle of the pack.
                                                                    To illustrate how people’s lifestyles change when
    The property, plant, and equipment ratios revealed
greater volatility in the WorldCom values, but normal va-
                                                                they embezzle, consider the following two examples.
lues for the critical years 2000 and 2001. If anything, these
ratios showed unusual changes in the years preceding the        Kay embezzled nearly $3 million from her employer. She
fraud (1996–1998).                                              and her husband worked together to perfect the scheme
    Each of these ratios, or some variation, might have         over a period of seven years. Because they knew they might
been considered by Andersen. Because the ratios are pre-        someday get caught, they explicitly decided not to have
sented at high levels of aggregation, they may not be suffi-    children. With their stolen funds, they purchased a new, ex-
ciently sensitive to display unusual behavior. One can only     pensive home (supposedly worth $500,000) and five luxury
assume that Andersen’s “sophisticated auditing software”        cars—a Maserati, a Rolls-Royce, a Jeep Cherokee, and two
disaggregated the data and analyzed them at a more re-          Audis. They filled their home with expensive artwork and
fined level. Nevertheless, these ratios suggest why no un-      glass collections. They bought a boat and several expensive
usual behavior was revealed to Andersen: management             computers, and they paid cash to have their yard extensively
had manipulated the data to conform to expectations. Writ-      landscaped. They frequently invited Kay’s coworkers to par-
ing in the Mississippi Business Journal (July 22, 2002),        ties at their home and served expensive foods, including lob-
James R. Crockett, an accounting professor at the Univer-       ster flown in from the east coast. Yet none of the employees
sity of Southern Mississippi, noted that “WorldCom had          noticed the change in lifestyle. They did not note, for example,
previously invested heavily in capital equipment and had        that Kay drove a different car to work every day of the week
quit making as much investment. By shifting expenses to         and that all her cars were extremely expensive.
plant and equipment accounts, WorldCom was able to dis-             In the second case, Randy stole over $600,000 from his
guise the changing conditions by meeting expectations.” In      friend’s small company, for which he worked. The business
other words, the historical trend no longer applied, but        constantly had cash flow problems, but Randy drove a
management manipulated the data to make it appear as            Porsche, bought a cabin in the mountains, and took expen-
though that trend continued to be valid.2                       sive vacations. At one point, he even loaned his friend
                                                                $16,000 to keep the business going. Never once did the
                                                                owner question where the money was coming from, even
                                                                though Randy was being paid less than $25,000 per year.
      Remember this …
      Analytical fraud symptoms are anything out of                Embezzlers are people who take shortcuts to appear
      the ordinary. When using analytical procedures            successful. Very few crooks, at least those who are
      to look for signs of fraud, make sure you develop         caught, save embezzled money. The same motivation
      an independent expectation of what the analyti-           for stealing seems to also compel them to seek imme-
      cal relationships should be, based on your under-         diate gratification. People who can delay gratification
      standing of the economics affecting the company.          and spending are much less likely to possess the moti-
                                                                vation to be dishonest.
                                                                   Lifestyle changes are often the easiest of all symptoms
                                                                to detect. They are often very helpful in detecting fraud
Extravagant Lifestyles                                          against organizations by employees and others but not
Most people who commit fraud are under financial                as helpful in detecting fraud on behalf of a corporation,
pressure. Sometimes the pressures are real; sometimes           such as management fraud. If managers, coworkers, and
they merely represent greed. Once perpetrators meet             others pay attention, they notice embezzlers living life-
their financial needs, they usually continue to steal,          styles that their incomes do not support. While lifestyle
using the embezzled funds to improve their lifestyles.          symptoms provide only circumstantial evidence of
Often, they buy new cars. They sometimes buy other              fraud, such evidence is easy to corroborate. Bank re-
expensive toys, take vacations, remodel their homes or          cords, investment records, and tax return information
move into more expensive houses, buy expensive jew-             are difficult to access; but property records, Uniform
elry or clothes, or just start spending more money on           Commercial Code (UCC) filings, and other records are
food and other day-to-day living expenses. Very few             easy to check to determine whether assets have been
perpetrators save what they steal. Indeed, most                 purchased or liens have been removed.
                                                                          Chapter 5: Recognizing the Symptoms of Fraud       149


                   Guilt                            Insomnia
                                                    Increased drinking
                                                    Taking drugs
                                                    Unusual irritability and suspiciousness
                                                    Inability to relax
                                                    Lack of pleasure in things usually enjoyed
                                                    Fear of getting caught
                                                    Inability to look people in the eyes
                                                    Showing embarrassment around friends, coworkers,
                                                      and family
                                                    Defensiveness or argumentativeness
                  Stress                            Unusual belligerence in stating opinions
                                                    Confessing (either to a religious leader, psychologist,
                                                      or other professional)
                                                    Obsessively contemplating possible consequences
                                                    Thinking of excuses and finding scapegoats
                 Behavior                           Working standing up
                 Changes                            Sweating
                                                    Increased smoking

                                                                   Eddie Antar, mastermind of the Crazy Eddie fraud
    Remember this …                                             described in the following text, became very intimidat-
    Fraud perpetrators often live beyond their means            ing and then finally vanished.
    since their income does not support their lifestyle.
    Lifestyle changes are often easy fraud symptoms             Crazy Eddie, Inc., a 42-store retail company located in New
    for coworkers, managers, and other employees to             York, New Jersey, Connecticut, and Pennsylvania, sold enter-
    observe.                                                    tainment and consumer electronic products. Eddie hired his
                                                                father, brother, uncle, cousin, and father’s cousin as officers
                                                                of the company. Allegedly, he overstated inventory by over
                                                                $65 million. As the fraud progressed, he was said to have be-
Unusual Behaviors                                               come increasingly overbearing. Finally, overwhelmed by
Research in psychology reveals that when a person               fears that he would be caught and prosecuted, he skipped
(especially a first-time fraud perpetrator) commits a crime,    the country and ended up in Israel. He has since been extra-
he or she becomes engulfed by emotions of fear and guilt.       dited back to the United States and sent to prison for his fraud.
These emotions express themselves as stress. The individ-
ual often exhibits unusual and recognizable behavior pat-          Two other examples of changes in behavior motivated
terns to cope with the stress, as shown in Figure 5.2.          by the stress caused by committing fraud were the beha-
    No particular behavior signals fraud; rather, changes       viors of Donald Sheelen, CEO of Regina Vacuum Com-
in behavior are signals. People who are normally nice           pany, and Leston Nay, CEO of First National of Chicago.
may become intimidating and belligerent. People who             Although their actions were different, neither was able
are normally belligerent may suddenly become nice.              to cope with the stress. Before his fraud was discovered,
    Even perpetrators recognize their behavioral changes. A     Sheelen went to his priest and confessed his entire scheme.
woman who stole over $400,000 said, “I had to be giving         Nay’s actions were even more dramatic. After penning a
off signals. I could not look anyone in the eye.” A man who     suicide note detailing how he defrauded investors of
embezzled over $150,000 said, “Sometimes I would be so          millions of dollars, he took his life. However a fraud per-
wound up I would work 12 or 14 hours a day, often stand-        petrator copes with the stress caused by guilt—by being
ing up. Other times I would be so despondent I could not        intimidating, by confessing, or by committing suicide—
get off the couch for over a week at a time.”                   stress always seems to be present.
150   Part 3: Fraud Detection

   The following fraud illustrates how stress can               presented this information to the president, who confronted
change the behavior of a perpetrator.                           Joseph. Joseph stalled the president until the next day but
                                                                never came back. An investigation revealed that Joseph
                                                                moved to California, leaving no forwarding address.
Johnson Marine is an industrial diving company that ser-
vices marine-related problems all over the eastern United
States. The firm salvages downed aircraft in oceans, lays          In this case, Joseph’s intimidating personality had
submarine pipelines, inspects dams, conducts insurance          kept the office manager and others at a distance. Al-
recoveries, and performs search-and-rescue missions.            though the office manager seemed to know something
Johnson’s part-time accountant, Rick Smith, uncovered a         was wrong, he had never been given the chance to find
serious fraud perpetrated by Joseph Simons, vice presi-         out. The office manager had always been blamed by
dent of the company. After Rick was hired by the office
                                                                Joseph when petty cash was out of balance, yet he
manager, Joseph told Rick that he was to report only to
                                                                had never been allowed to balance it. In fact, Joseph
him, to pay bills only when he asked, and to ask only him
whenever he had a question. It was apparent to Rick that
                                                                had constantly blamed others for problems. In retro-
the office manager was intimidated by Joseph. Joseph            spect, employees understood that Joseph’s intimidating
not only treated the office manager like a slave but also       behavior was his way of keeping the fraud from being
continually reminded him that if he did not mind his own        discovered and of dealing with the stress he felt from
business, he would no longer be with the company.               committing the crime.
    Rick’s first job was to update all the accounts payable        The largest fraud ever to be perpetrated in Australia
balances. Upon close inspection, he found that very few         was HIH, a fraud that was discovered in 2002. The
of the 120 balances were correct. He spent a week fixing        HIH fraud was concealed for years by an executive
them on the computer, only to be criticized by Joseph. Jo-      who changed his behavior to intimidate others so that
seph said that Rick should spend his time on more produc-
                                                                they did exactly what he wanted. By becoming almost
tive work and not worry about trivial things. When Rick
                                                                totalitarian, he was able to do anything he wanted.
opened the petty cash box and tried to identify the petty
cash system, he found none. He found that no petty cash
                                                                Here is the story.
reconciliation had been done in over five months and that a        HIH was one of Australia’s biggest home-building
negative difference of $13,600 existed between checks writ-     market insurers. HIH was the underwriter for thou-
ten to replenish the cash box and total receipts in the cash    sands of professional indemnity, public liability, home
box. Rick immediately went to Joseph to tell him what he        warranty, and travel insurance policies.3 HIH was
had found and was told to make an adjusting entry on the        started in 1968 by Raymond Williams and Michael
computer to fix the problem.                                    Payne. Michael Payne was chief executive of the UK
    Rick’s next discovery came when he reviewed the com-        operations until 1997, when health problems forced
pany’s life insurance policies, two of which were for over      him to limit his activities in the company. He became
$1 million. Joseph was listed as the beneficiary. Next,
                                                                chairman of the main UK entity in 1999. He was an
Rick noticed that large balances were being accrued on
                                                                executive director of the holding company from 1992
the company’s American Express card. Although overdue
notices were being received, Joseph forbade Rick to pay
                                                                until June 1998 and a nonexecutive director from July
the bill. When Rick asked the president about it, the presi-    1998 until September 2000.
dent informed Rick that the company did not have an                Raymond Williams was the CEO for HIH from its
American Express card. Yet, the balance was over $5,500.        inception in 1968 until October 2000. Other key em-
A similar problem was occurring with the Phillips 66 bill.      ployees were George Sturesteps and Terrence Cassidy,
Again, Joseph told Rick not to pay the bill, even though        who became members of senior management in 1969
final notices were being sent. Rick later learned that the      and 1970, respectively. They both held their positions
company used only Chevron cards.                                until September 2000 and March 2001, respectively.
    Looking back over the accounts payable balances, Rick          Williams was the dominant member of management
noticed an account with TMC Consulting that had an out-
                                                                at HIH. Although many close members of upper manage-
standing balance over 90 days old. He tried to find out more
                                                                ment had been with him for over 25 years, they were
about the account, but there was nothing on file. By coinci-
dence, Rick noticed that the address was 10 Windsor Circle,
                                                                reluctant to tell him how to run the business, give sugges-
the same address to which Rick had sent a diving catalog that   tions, or question Williams’ motives and business deci-
was addressed to Joseph two weeks previously. Upon print-       sions. The Royal Commission report, which summarizes
ing out a history of the company’s transactions with TMC        the Australian government’s investigation of HIH, sug-
Consulting, Rick found a series of five $2,000 payments on      gested that a lack of strategic direction and of questioning
the account spread over a period of several months. He          authority set the stage for the eventual downfall of the
                                                                        Chapter 5: Recognizing the Symptoms of Fraud    151

HIH Insurance group. If asked about the strategic goals or
mission of HIH, the report states that neither Williams       Confessed killer Marvin Harris’s ability to pass a lie detec-
nor the board of directors would have been able to explain    tor test left two nationally known polygraph experts baffled
                                                              and anxious to question the dealer in bogus documents on
them. Although HIH was a public company that had
                                                              how he passed the test. Harris pled guilty to the bombing
grown quickly, the report states that Williams continued
                                                              deaths of two people, which he said he carried out to avoid
to run HIH much like the small company it had been            exposure of his fraudulent documents dealings. He had
when it first started. That is, he made most of the deci-     been judged truthful during an earlier polygraph test and
sions, used business accounts as personal accounts, over-     had denied his involvement with the slayings.
rode internal controls, and so forth.                             What was most puzzling to the polygraph experts was
    Within an environment dominated by a larger-              that Harris did not just sneak by on the tests. On the plus–
than-life CEO, Ray Williams, the board presided over          minus scale used to gauge truthfulness, a score of plus 6
a string of ill-fated expansions—costing HIH more             would have been considered a clear indication that the sub-
than $3 billion—without ever analyzing the group’s            ject was not lying; but Harris had scored twice that—plus 12.
strategy or assessing its risks. Although the Royal Com-      The experts were simply wrong. Apparently, Marvin Harris
                                                              had no conscience and thus felt no guilt about creating
mission report points to many different ancillary reasons
                                                              bogus documents or killing people.
for the HIH downfall, they summed up the main prob-
lem as follows: HIH did not provide properly for future
claims and the failure of all involved to understand the
degree of the shortfall. Apparently, HIH’s financial state-        Remember this …
ments were misstated because of inflated profits, over-
stated accounts, and understated liabilities. According to         No particular behavior signals fraud, but
the report, all other problems were supportive in nature           changes in behavior do. Perpetrating a fraud
and helped to promote HIH’s downfall.                              will often be accompanied by stress brought on
    It has been argued that HIH didn’t fail because of             by fear and guilt. This stress will often cause
any systemic fraud but because of two influences. First,           perpetrators to act in abnormal ways.
HIH had a flawed business model which consistently
underprovided for its claims. Second, HIH’s gover-
nance structures, including the board and senior man-         Tips and Complaints
agement, were ineffective since they allowed Williams         Auditors are often criticized for not detecting more frauds.
to dominate their decisions.                                  Yet, because of the nature of fraud, auditors are often in the
    HIH’s dysfunctional governance structures led to          worst position to detect its occurrence. As we covered pre-
several factors that are common in organizations that         viously, the factors that lead to fraud are depicted in the
are perpetrating massive fraud. First, an insufficient in-    fraud triangle. These factors consist of pressure, opportu-
dependence of mind to see what had to be done and             nity, and rationalization. As you may recall, the elements
what had to be stopped or avoided. Also, risks were not       of fraud can be illustrated as shown in Figure 5.3.
properly identified and managed. Unpleasant informa-
tion was hidden, filtered, or sanitized. Finally, there was
                                                              FI GUR E 5 .3     ELEMENTS OF FRAU D
a lack of skeptical questioning and analysis when and
where it mattered.
    This case brought the effectiveness of regulatory or-
ganizations into serious questioning. Virtually no one
who had any involvement with HIH escaped unscathed.
HIH experienced a near-total breakdown of governance

and supervisory structures. None of the checks and bal-


ances within the systems functioned. The people in-


volved failed to meet their responsibilities.

    Once in a while, someone commits a fraud or an-
other crime and does not feel stress. Such people are
called sociopaths or psychopaths. They feel no guilt
because they have no conscience. The following is an
example of a psychopathic individual.
152   Part 3: Fraud Detection

   The theft act involves the actual taking of cash,               Although coworkers and managers are in the best
inventory, information, or other assets. Theft can occur        position to detect fraud, they are usually the least
manually, by computer, or by telephone. Concealment             trained to recognize fraud or even be aware that it
involves the steps taken by the perpetrator to hide the         can exist. Even so, many frauds are detected when an
fraud from others. Concealment can involve altering             employee, a friend, a manager, a customer, or another
financial records, miscounting cash or inventory, or            untrained person provides a tip or complaint that
destroying evidence. Conversion involves selling stolen         something is wrong. One large company, for example,
assets or transferring them into cash and then spending         which uncovered over 1,500 individual frauds, discov-
the cash. If the asset taken is cash, conversion means merely   ered 43 percent of the frauds on the basis of customer
spending the stolen funds. As we have noted previously,         complaints or employee tips.
virtually all perpetrators spend their stolen funds.
   Fraud can be detected in all three elements. First, in       Tips and Complaints Are
the theft act, someone can witness the perpetrator tak-         Fraud Symptoms
ing cash or other assets. Second, in concealment, al-           Complaints and tips are categorized as fraud symptoms
tered records or miscounts of cash or inventory can             rather than actual evidence of fraud because many tips
be recognized. Third, in conversion, the lifestyle              and complaints turn out to be unjustified. It is often
changes that perpetrators almost inevitably make                difficult to know what motivates a person to complain
when they convert their embezzled funds are visible.            or provide a tip. Customers, for example, may com-
                                                                plain because they feel they are being taken advantage
Company Employees Are in the Best                               of. Employee tips may be motivated by malice, personal
Position to Detect Fraud                                        problems, or jealousy. Tips from spouses and friends
Who in an organization is in the best position to rec-          may be motivated by anger, divorce, or blackmail.
ognize fraud in each of these elements? Certainly, for          Whenever tips or complaints are received, they must
the theft act, it is not the auditors. Auditors are rarely      be treated with care and considered only as fraud
present when funds are stolen or fraud is committed.            symptoms. Individuals should always be considered in-
Rather, they spend a few weeks on periodic audits, and          nocent until proved guilty and should not be unjustly
thefts usually stop during the audit periods. Instead,          suspected or indicted. The following example illustrates
coworkers, managers, and other employees are usually            how tips can be spurious.
in the best position to detect fraud in the theft act stage.
    In concealment, auditors do have a chance to detect
fraud. If audit samples include altered documents, mis-         Joan worked in a bank. One day, Joan approached the
counts, or other concealment efforts, auditors may de-          bank branch’s operations manager and informed her that
tect fraud. Similarly, they may see internal control            two weeks ago she had seen Julie, a coworker, place a
weaknesses or analytical relationships that don’t make          bundle of bills (currency) in her blouse. She said that for
                                                                two weeks she had not been able to sleep, so she had fi-
sense. However, company accountants and even cow-
                                                                nally decided to inform the bank. For several days, auditors
orkers are probably in a better position to detect fraud
                                                                and security people scoured the bank’s records and cash
in concealment since they are exposed to the conceal-           vault. Employees cried, and suspicion and distrust
ment on a regular basis while auditors see only a sam-          abounded. Finally, the fraud investigators discovered that
ple of the activity involving the concealment.                  Julie had been sleeping with Joan’s boyfriend, and Joan’s
    At the conversion stage, auditors are definitely not        tip was false and motivated by jealousy. Joan then re-
in the best position to detect fraud. There is no way, for      signed. Because of the nature of the event that aroused
example, that auditors could recognize certain changes,         the jealousy, branch management could not inform all em-
such as an employee who used to drive a used Ford and           ployees about what had happened.
now drives a new BMW or Lexus. Likewise, auditors
will not recognize a perpetrator’s unusual activities,
                                                                  Several reasons exist why people are hesitant to
such as wearing designer socks or suits, taking expen-
                                                                come forward with knowledge or suspicions of fraud.
sive vacations, buying expensive jewelry, or buying a
                                                                These reasons are as follows:
new home with stolen funds. Auditors do not have a
reference point from which to see these changes in life-        1. It is usually impossible to know for sure that a
style. Again, it is coworkers, friends, and managers who            fraud is taking place.
should detect fraud in conversion.                              2. They fear reprisal for being a whistle-blower.
                                                                        Chapter 5: Recognizing the Symptoms of Fraud   153

3. They are often intimidated by the perpetrator.              working together constituted cheating and would result in
4. They often think that squealing on someone is               an F for the course. One night, Scott informed his dad that
    wrong.                                                     the best grade he could get in word processing was a B
5. It is not easy to come forward within many                  unless he cheated, and then he could probably get an A.
                                                                   “What do you mean?” Scott’s dad asked.
                                                                   “Well,” said Scott, “our grades are mostly based on the
    In most organizations, coworkers and others have           number of jobs we complete. And while we have been told
knowledge or suspicions that fraud is occurring but            we must work alone, a number of student groups have
do not come forward with their information. There              formed in the class. Within these groups, each member
are several reasons for this hesitancy. First, knowing         completes a certain number of projects and then they all
                                                               copy each other’s disks as though they had completed the
for sure that fraud is taking place is usually impossible.
                                                               projects themselves. There is no way I can complete as
Since there are no dead bodies or videotapes of the
                                                               many projects alone as a group of three or four students
crime, all that potential informants see are symptoms.         can. I have been invited to work in a group, but I do not
They may see someone experiencing a changed life-              know whether I should. What do you want me to do,
style, behaving strangely, or stashing company inven-          Dad? Should I cheat and get an A or settle for a B?”
tory in a garage. Because they recognize that they are             Needless to say, Scott’s dad was very frustrated. While
seeing only symptoms, they do not want to wrongly              he did not want Scott to cheat, he did not want him to be
accuse someone. Even when their suspicions are strong,         disadvantaged and earn a B either. His counsel to Scott
the possibility exists that there is a legitimate reason for   was to do neither but to go to the teacher and tell her
the symptom.                                                   what was happening. Scott’s quick reply was “I cannot.”
    Second, informants may be hesitant to come for-            When asked why, Scott said, “These are my friends, and
                                                               it would not be right to squeal on them.”
ward because they have often read or heard horror
stories about what happens to whistle-blowers. Even
though such reports are usually anomalies and are of-             A fifth reason most employees and others have not
ten exaggerated, people often fear that they will suffer       historically come forward with their suspicions or
or undergo some reprisal if they become informants.            knowledge of fraud is that organizations have not
The new whistle-blower protection laws that were               made it easy for them to do so. In most organizations,
mandated by the Sarbanes-Oxley Act, and were dis-              employees do not know to whom they should talk if
cussed earlier, are attempts to eliminate this fear and        they suspect fraud, how the information should be con-
provide protection for whistle-blowers.                        veyed, or what the consequences would be if they did
    Third, employees and others are often intimidated          come forward. In addition, they do not know whether
by perpetrators. Especially when perpetrators are              their tips would remain anonymous or whether their
superiors, subordinates are afraid to come forward             squealing would be exposed.
with their suspicions. For example, one fraud contin-
ued for six years, even though seven coworkers knew            New Laws Protect Whistle-Blowers
about it. The perpetrator had such a dominant person-          and Promote Fraud Detection
ality that he made others afraid of him, and he quickly
                                                               The new whistle-blowing laws have helped make tips
fired people who questioned his integrity.
                                                               and complaints more effective, especially for public
    Fourth, many of us have been conditioned from a
                                                               companies, by mandating that every public company
young age to believe that it is not good to squeal on
                                                               have a whistle-blower system in place and that it be
others, even when they are doing something wrong.
                                                               promoted among employees and others. These new
Technically, one who will not tell on another is an eth-
                                                               whistle-blowing laws should help reveal many frauds
nological liar. Not squealing is the creed of the Mafia. As
                                                               that would not have been discovered otherwise.
an illustration of people’s general reluctance to become
                                                                  Even before these laws were passed, some organiza-
an informant, consider the following actual event.
                                                               tions found that encouraging and dealing with tips
                                                               could make a difference. They found that by giving
Scott, a junior in high school, was enrolled in a word pro-    employees easy avenues for whistle-blowing, they did
cessing class. He was informed that students’ grades for       discover frauds and other problems in the organization.
the class would be mostly determined by how many pro-          For example, for years, Domino’s Pizza has had a hot-
cessed projects they completed. The teacher informed the       line that drivers can use when managers are sending
students that they must work alone, and, in fact, that         them out with so little time that they must speed to
154   Part 3: Fraud Detection

deliver a pizza within the allotted 30 minutes. Com-
                                                             A few years ago, John Michael Gravitt, a machine foreman
plete anonymity is guaranteed. Another company in-
                                                             at GE, stood up at an assertiveness training session and
cluded fraud in a list of such undesirable actions as        told the class that GE was ripping off the government. He
drug use, safety violations, discrimination, and harass-     told approximately 30 colleagues that the time cards going
ment. It trained all employees what to do if they saw        into supervisors’ offices were not the same ones coming
any of these activities. In this company, the training       out. Within a few minutes, several other foremen stood
took the form of seminars for new hires, posters and         up to confirm Gravitt’s story. Even after his outburst in
other periodic reminders, a billfold card that listed al-    the assertiveness class, Gravitt’s superiors still pressured
ternative actions employees could take if they witnessed     him to coax his subordinates to cheat on their time cards.
violations, and videos that were periodically shown.         Gravitt was told that if his subordinates would not alter
Employees were told, and the information was rein-           their own time cards, he was to do so. When Gravitt re-
                                                             fused, his supervisors altered the cards for him. According
forced on the billfold card, that they had five options
                                                             to Gravitt, the process was hardly subtle. “With black or
if they suspected problems in any of these areas:
                                                             blue felt-tipped pens, they (the supervisors) altered the bill-
(1) they could talk to their manager or to their man-        ing vouchers. Usually, they scrawled the number of a proj-
ager’s manager; (2) they could call corporate security       ect safely within cost constraints over the number of a job
at a specified number; (3) they could call internal audit    that was already running over budget.” Foremen who re-
at a specified number; (4) they could call a company-        fused to falsify vouchers had their vouchers sent to the
wide ombudsman, who forwarded the complaint or tip;          unit manager, Robert Kelly. Kelly would then complete the
or (5) they could call an 800-number hotline, which          blank vouchers himself. When Kelly died, his successor,
connected them to an independent monitoring service          Bill Wiggins, continued the falsification of time cards and
that screened the calls, guaranteed anonymity, and for-      billing vouchers. At one time, Wiggins told Gravitt that GE
warded the information to relevant company indivi-           was like a great big pie and that everyone who participated
                                                             (in cheating) got a piece; those who did not participate did
duals who dealt with the problem.
                                                             not get a slice.
    Whistle-blowing systems should not be considered
                                                                 Falsifying at GE had become a way of life. One foreman
substitutes for maintaining an open environment in           confessed to personally altering 50 to 60 percent of his sub-
which employees feel comfortable about reporting             ordinates’ time cards during an eight-month period. Once,
known or suspected fraudulent activities. Employees          when Gravitt told his foreman that he could go to jail for
should be encouraged to first consider reporting such        altering cards, the foreman replied that he was only carry-
activities to someone in their management chain, to an       ing out orders and that there was not any chance of getting
internal auditor, to corporate security, or to legal coun-   caught. Finally, Gravitt decided he needed to alert some-
sel. They should, however, be kept aware of the hotline      one who could do something about the problem. One
option and encouraged to use it if they are not com-         weekend, he slipped into a secretary’s office and photocop-
fortable with other options.                                 ied about 150 altered time cards and billing vouchers. He
                                                             wrote an eight-page letter explaining what had been going
    Companies that provide hotlines have detected nu-
                                                             on. The next week, he delivered the letter and the photoco-
merous frauds that would not otherwise have been de-
                                                             pies to Brian H. Rowe, the senior vice president in charge
tected. These companies have also reported that the          of the engine plant. The same day, Gravitt was dismissed
hotline use is somewhat erratic, with periods of consid-     from GE. A subsequent investigation by the FBI and the De-
erable use and periods of very little use. What is impor-    fense Contract Audit Agency revealed that $7.2 million of
tant is to create a reporting option for employees who       idle time had been falsely billed to the U.S. government.
would not otherwise reveal suspected activities.             They also found that 27 percent of the time-sheet vouchers
    Many organizations have adopted whistle-blowing          in the shop where Gravitt worked had been falsified during
systems that are managed by third parties. Some orga-        the three years Gravitt worked at GE.
nizations have even gone so far as to reward employees           In this case, John Gravitt’s tips were the sole reason
for legitimate tips. While research evidence suggests        fraud was detected. Certainly, GE did not make it easy for
                                                             Gravitt to come forward. GE’s fraud highlights many of the
that hotlines are an excellent fraud detection tool, the
                                                             mistakes that companies make regarding informants. Even
evidence about rewarding employees for tips is mixed
                                                             though Gravitt knew fraud was occurring, the firm’s pun-
at best.                                                     ishment and intimidation of whistle-blowers and its not
    Three frauds that were detected by tips and com-         making it easy to come forward allowed the fraud to be
plaints or that involved whistle-blowers are the GE fraud,   concealed for a long time.
the Revere Armored Car Company fraud, and the fraud              A second fraud revealed by tips was the Revere Armored
at Enron. A description of GE’s fraud follows.               Car case, in which the informants were competitors.
                                                                          Chapter 5: Recognizing the Symptoms of Fraud      155

The revelation of fraud at Revere Armored Car began when        gambling proceeds. Several banks lost considerable
some competitors, tired of losing customers to Revere’s         amounts of money in this fraud. Citicorp’s Citibank lost
cutthroat prices, employed a video camera. In December          more than $11 million, and Marine Midland Bank lost
1992, the competitors taped a Revere delivery of $100 mil-      nearly $34.8 million.
lion to the New York Federal Reserve Bank’s Buffalo
branch. They were hoping for evidence of shoddy security.
They got it. In the parking lot of a highway restaurant, the        This fraud was allowed to continue because banks
tape showed the driver and a guard leaving the truck            and Lloyds of London did not perform adequate due
locked but unguarded, its engine running, while they went       diligence. Neither the banks nor Lloyds were regularly
inside to eat. The competitors presented their tape to          monitoring Revere’s operations. If it had not been for
Lloyds of London, the underwriting group that had insured       the tip from competitors, this fraud might still be going
Revere for $100 million. The tape was aimed at demon-           on today. Revere had been commingling funds of dif-
strating to Lloyds the “ease with which someone could           ferent banks rather than keeping each bank’s funds
whack ‘em.” The video prompted Lloyds to hire an investi-
                                                                separate. Even though large amounts had been stolen,
gator to check out Revere. Among other things, the investi-
gation turned up evidence of past wrongdoings. Based on
                                                                Revere was always able to have enough money on hand
the evidence, federal authorities launched a predawn raid
                                                                to satisfy auditors of any one bank at a given time.
on Revere headquarters and found what could be the big-             Enron is probably the most famous fraud in the his-
gest scandal ever in the armored-truck industry: millions       tory of the United States. While it is famous for many
of dollars missing, allegedly pilfered by Revere owners         reasons, one reason for which it will be forever known
Robert and Susanna Scaretta. Of the $84.6 million that          is the anonymous whistle-blower letter that was sent to
banks said they had in storage at Revere, only $45 million      its CEO, Kenneth Lay, by Sherron Watkins. Sensing
was discovered. Apparently, the Scarettas had run up sig-       that something was seriously wrong at Enron, Sherron
nificant gambling debts. They may have been using Revere        wrote the letter shown in Figure 5.4.
Armored Car as a money-laundering operation for illegal

                 TO E NRO N C HA IRM AN

   Has Enron become a risky place to work? For those of us      percent from $178 million, to $5 million; the New Power
   who didn’t get rich over the last few years, can we afford   Company by 80 percent from $40 a share, to $6 a share.
   to stay? Skilling’s abrupt departure will raise suspicions   The value in the swaps won’t be there for Raptor, so
   of accounting improprieties and valuation issues. Enron      once again Enron will issue stock to offset these losses.
   has been very aggressive in its accounting—most nota-        Raptor is an LJM entity. It sure looks to the layman on
   bly the Raptor transactions and the Condor vehicle. We       the street that we are hiding losses in a related com-
   do have valuation issues with our international assets       pany and will compensate that company with Enron
   and possibly some of our EES MTM positions.                  stock in the future. I am incredibly nervous that we will
      The spotlight will be on us, the market just can’t ac-    implode in a wave of accounting scandals. My eight
   cept that Skilling is leaving his dream job. I think that    years of Enron work history will be worth nothing on
   the valuation issues can be fixed and reported with          my résumé, the business world will consider the past
   other good will write-downs to occur in 2002. How do         successes as nothing but an elaborate accounting
   we fix the Raptor and Condor deals? They unwind in           hoax. Skilling is resigning now for “personal reasons”
   2002 and 2003, we will have to pony up Enron stock           but I would think he wasn’t having fun, looked down
   and that won’t go unnoticed.                                 the road and knew this stuff was unfixable and would
      To the layman on the street, it will look like we rec-    rather abandon ship now than resign in shame in two
   ognized funds flow of $800 million from merchant asset       years.
   sales in 1999 by selling to a vehicle (Condor) that we           Is there a way our accounting gurus can unwind these
   capitalized with a promise of Enron stock in later years.    deals now? I have thought and thought about a way to do
   Is that really funds flow or is it cash from equity          this, but I keep bumping into one big problem—we
   issuance?                                                    booked the Condor and Raptor deals in 1999 and 2000,
      We have recognized over $550 million of fair value        we enjoyed wonderfully high stock price, many execu-
   gains on stocks via our swaps with Raptor. Much of           tives sold stock, we then try and reverse or fix the deals
   that stock has declined significantly—Avici by 98            in 2001, and it’s a bit like robbing the bank in one year and

156   Part 3: Fraud Detection


  trying to pay it back two years later. Nice try, but investors       My concern is that the footnotes don’t adequately
  were hurt, they bought at $70 and $80 a share looking for        explain the transactions. If adequately explained, the in-
  $120 a share and now they’re at $38 or worse. We are             vestor would know that the “entities” described in our
  under too much scrutiny and there are probably one or            related party footnote are thinly capitalized, the equity
  two disgruntled “redeployed” employees who know                  holders have no skin in the game, and all the value in
  enough about the “funny” accounting to get us in trouble.        the entities comes from the underlying value of the de-
      What do we do? I know this question cannot be ad-            rivatives (unfortunately in this case, a big loss) AND En-
  dressed in the all-employee meeting, but can you give            ron stock and N/P. Looking at the stock we swapped, I
  some assurances that you and Causey will sit down and            also don’t believe any other company would have en-
  take a good hard objective look at what is going to hap-         tered into the equity derivative transactions with us at
  pen to Condor and Raptor in 2002 and 2003?                       the same prices or without substantial premiums from
                                                                   Enron. In other words, the $500 million in revenue in
      Summary of Alleged Issues:
                                                                   2000 would have been much lower. How much lower?
  RAPTOR Entity was capitalized with LJM equity. That                  Raptor looks to be a big bet if the underlying stocks
  equity is at risk; however, the investment was completely        did well, then no one would be the wiser. If Enron stock
  offset by a cash fee paid to LJM. If the Raptor entities go      did well, the stock issuance to these entities would de-
  bankrupt LJM is not affected, there is no commitment             cline and the transactions would be less noticeable. All
  to contribute more equity.                                       has gone against us. The stocks, most notably Hanover,
      The majority of the capitalization of the Raptor enti-       the New Power Company and Avici are underwater to
  ties is some form of Enron N/P, restricted stock and             great or lesser degrees.
  stock rights.                                                        I firmly believe that executive management of the com-
      Enron entered into several equity derivative transac-        pany must have a clear and precise knowledge of these
  tions with the Raptor entities locking in our values for         transactions and they must have the transactions reviewed
  various equity investments we hold.                              by objective experts in the fields of securities law and
      As disclosed in 2000, we recognized $500 million of          accounting. I believe Ken Lay deserves the right to judge
  revenue from the equity derivatives offset by market             for himself what he believes the probabilities of discovery
  value changes in the underlying securities.                      to be and the estimated damages to the company from
      This year, with the value of our stock declining, the        those discoveries and decide one of two courses of action:
  underlying capitalization of the Raptor entities is declin-
                                                                   1.   The probability of discovery is low enough and the
  ing and credit is pushing for reserves against our MTM
                                                                        estimated damage too great; therefore we find a
                                                                        way to quietly and quickly reverse, unwind, write
      To avoid such a write-down or reserve in quarter one
                                                                        down these positions/ transactions.
  2001, we “enhanced” the capital structure of the Raptor
                                                                   2.   The probability of discovery is too great, the esti-
  vehicles, committing more ENE shares.
                                                                        mated damages to the company too great; therefore,
      My understanding of the third-quarter problem is
                                                                        we must quantify, develop damage containment
  that we must “enhance” the vehicles by $250 million.
                                                                        plans and disclose.
      I realize that we have had a lot of smart people look-
  ing at this and a lot of accountants including AA & Co.              I firmly believe that the probability of discovery sig-
  have blessed the accounting treatment. None of that              nificantly increased with Skilling’s shocking departure.
  will protect Enron if these transactions are ever dis-           Too many people are looking for a smoking gun.
  closed in the bright light of day. (Please review the late
  90’s problems of Waste Management (news/quote)—
                                                                        Summary of Raptor Oddities:
  where AA paid $130 million plus in litigation re ques-
  tionable accounting practices.)                                  1.   The accounting treatment looks questionable.
      The overriding basic principle of accounting is that if           a. Enron booked a $500 million gain from equity
  you explain the “accounting treatment” to a man in the                   derivatives from a related party.
  street, would you influence his investing decisions?                  b. That related party is thinly capitalized with no
  Would he sell or buy the stock based on a thorough un-                   party at risk except Enron.
  derstanding of the facts? If so, you best present it cor-             c. It appears Enron has supported an income state-
  rectly and/or change the accounting.                                     ment gain by a contribution of its own shares.

                                                                             Chapter 5: Recognizing the Symptoms of Fraud      157


  One basic question: The related party entity has lost $500            Condor and Raptor Work:
  million in its equity derivative transactions with Enron.
                                                                   1.   Postpone decision on filling office of the chair, if the
  Who bears that loss? I can’t find an equity or debt holder
                                                                        current decision includes C.F.O. and/or C.A.O.
  that bears that loss. Find out who will lose this money.
                                                                   2.   Involve Jim Derrick and Rex Rogers to hire a law
  Who will pay for this loss at the related party entity?
                                                                        firm to investigate the Condor and Raptor transac-
     If it’s Enron, from our shares, then I think we do not
                                                                        tions to give Enron attorney-client privilege on the
  have a fact pattern that would look good to the S.E.C. or
                                                                        work product. (Can’t use V & E due to conflict—they
                                                                        provided some true sale opinions on some of the
  2.   The equity derivative transactions do not appear to              deals.)
       be at arms length.                                          3.   Law firm to hire one of the big 6, but not Arthur
       a. Enron hedged New Power, Hanover and Avici                     Andersen or PricewaterhouseCoopers due to their
           with the related party at what now appears to                conflicts of interest: AA & Co. (Enron); PWC (LJM).
           be the peak of the market. New Power and Avici          4.   Investigate the transactions, our accounting treat-
           have fallen away significantly since. The related            ment and our future commitments to these vehicles
           party was unable to lay off this risk. This fact pat-        in the form of stock, NP, etc., For instance: In the
           tern is once again very negative for Enron.                  third quarter we have a $250 million problem with
       b. I don’t think any other unrelated company would               Raptor 3 (NPW) if we don’t “enhance” the capital
           have entered into these transactions at these                structure of Raptor 3 to commit more ENE shares.
           prices. What else is going on here? What was                 By the way: in Q. 1 we enhanced the Raptor 3 deal,
           the compensation to the related party to induce              committing more ENE shares to avoid a write-
           it to enter into such transactions?                          down.
  3.   There is a veil of secrecy around LJM and Raptor.           5.   Develop cleanup plan:
       Employees question our accounting propriety con-                 a. Best case: Clean up quietly if possible.
       sistently and constantly. This alone is cause for                b. Worst case: Quantify, develop P.R. and I.R. cam-
       concern.                                                             paigns, customer assurance plans (don’t want to
       a. Jeff McMahon was highly vexed over the inher-                     go the way of Salomon’s trading shop), legal ac-
           ent conflicts of LJM. He complained mightily to                  tions, severance actions, disclosure.
           Jeff Skilling and laid out five steps he thought        6.   Personnel to quiz confidentially to determine if I’m
           should be taken if he was to remain as treasurer.            all wet:
           Three days later, Skilling offered him the C.E.O.            a. Jeff McMahon
           spot at Enron Industrial Markets and never ad-               b. Mark Koenig
           dressed the five steps with him.                             c. Rick Buy
       b. Cliff Baxter complained mightily to Skilling and              d. Greg Walley
           all who would listen about the inappropriateness
                                                                      To put the accounting treatment in perspective I offer
           of our transactions with LJM.
                                                                   the following:
       c. I have heard one manager-level employee from
           the principal investments group say, “I know it         1.   We’ve contributed contingent Enron equity to the
           would be devastating to all of us, but I wish we             Raptor entities. Since it’s contingent, we have the
           would get caught. We’re such a crooked                       consideration given and received at zero. We do,
           company.” The principal investments group                    as Causey points out, include the shares in our fully
           hedged a large number of their investments                   diluted computations of shares outstanding if the
           with Raptor. These people know and see a lot.                current economics of the deal imply that Enron
           Many similar comments are made when you                      will have to issue the shares in the future. This im-
           ask about these deals. Employees quote our                   pacts 2002–2004 earnings-per-share projections
           C.F.O. as saying that he has a handshake deal                only.
           with Skilling that LJM will never lose money.           2.   We lost value in several equity investments in 2000,
  4.   Can the general counsel of Enron audit the deal trail            $500 million of lost value. These were fair-value in-
       and the money trail between Enron and LJM/Raptor                 vestments; we wrote them down. However, we also
       and its principals? Can he look at LJM? At Raptor? If            booked gains from our price risk management
       the C.F.O. says no, isn’t that a problem?

158    Part 3: Fraud Detection

FI GUR E 5 .4      CON TI NUED

        transactions with Raptor, recording a corresponding              because we do not have to yet. Technically we can
        PRM account receivable from the Raptor entities.                 wait and face the music in 2002–2004.
        That’s a $500 million related party transaction—it’s        6.   The related party footnote tries to explain these
        20 percent of 2000 IBIT, 51 percent of NI pretax, 33 per-        transactions. Don’t you think that several interested
        cent of NI after tax.                                            companies, be they stock analysts, journalists,
  3.    Credit reviews the underlying capitalization of Rap-             hedge fund managers, etc., are busy trying to dis-
        tor, reviews the contingent shares and determines                cover the reason Skilling left? Don’t you think their
        whether the Raptor entities will have enough capital             smartest people are poring over that footnote disclo-
        to pay Enron its $500 million when the equity deri-              sure right now? I can just hear the discussions—“it
        vatives expire.                                                  looks like they booked a $500 million gain from this
  4.    The Raptor entities are technically bankrupt; the                related party company and I think, from all the unde-
        value of the contingent Enron shares equals or is                cipherable half-page on Enron’s contingent contribu-
        just below the PRM account payable that Raptor                   tions to this related party entity, I think the related
        owes Enron. Raptor’s inception-to-date income                    party entity is capitalized with Enron stock.” … “No,
        statement is a $500 million loss.                                no, no, you must have it all wrong, it can’t be that,
  5.    Where are the equity and debt investors that lost                that’s just too bad, too fraudulent, surely AA & Co.
        out? LJM is whole on a cash-on-cash basis. Where                 wouldn’t let them get away with that?” “Go back to
        did the $500 million in value come from? It came                 the drawing board, it’s got to be something else. But
        from Enron shares. Why haven’t we booked the                     find it!” …“Hey, just in case you might be right, try
        transaction as $500 million in a promise of shares               and find some insiders or ‘redeployed’ former em-
        to the Raptor entity and $500 million of value in                ployees to validate your theory.”
        our “economic interests” in these entities? Then
        we would have a write-down of our value in the              SOURCE:,
        Raptor entities. We have not booked the latter,             accessed June 1, 2004.

   This letter, together with whistle-blowing acts by               Review of the Learning
Colleen Rowley of the FBI and Cynthia Cooper of
WorldCom, resulted in the three of them being named                 Objectives
TIME magazine’s 2002 “Persons of the Year.” As TIME
magazine stated, “These three did the right thing by                •    Understand how symptoms help in the detection
just doing their jobs rightly.”                                          of fraud. When unusual symptoms of fraud be-
                                                                         come apparent, a more focused, directed search of
                                                                         where the fraud is originating from should be
      Remember this …                                                    conducted.
                                                                    •    Identify and understand accounting symptoms
      Employees other than auditors (such as cowor-                      of fraud. Knowing how certain accounts interre-
      kers or managers) are usually in the best position                 late is important and can help in determining the
      to detect fraud. Unfortunately, these individuals                  possibility for fraud.
      often lack training in this area. Many reasons                •    Describe internal controls that help detect fraud.
      exist why people do not report fraud, but com-                     Segregation of duties is a key element in reducing
      panies need to set up methods to encourage em-                     the potential for fraud.
      ployees to report suspicious behavior or other                •    Identify and understand analytical symptoms of
      potential signs of fraud.                                          fraud. Knowing relationships within the financial
                                                                         statements regarding separate accounts as well as
                                                                     Chapter 5: Recognizing the Symptoms of Fraud   159

    logically thinking through the implications of the          b.   You notice your coworker has recently been
    reported financials will assist in detecting fraud.              coming to work in a new car and more expen-
•   Explain how lifestyle changes help detect fraud.                 sive clothes and jewelry.
    One strong indicator of the occurrence of fraud is          c.   You are the assistant controller and you notice
    if an employee lives well beyond his or her means.               a control weakness that would allow you to
    If employees suddenly have more extravagant                      embezzle funds from the company.
    lifestyles, auditors may want to assess the source of
    the money.                                              True/False
•   Discuss how behavioral symptoms help detect
    fraud. People who commit fraud usually display           1. Analytical anomalies are present in every fraud.
    unusual changes in behavior.                             2. Recording an expense is a possible way to conceal
•   Recognize the importance of tips and complaints             the theft of cash.
    as fraud symptoms. Most frauds are not detected          3. A check is an example of a source document.
    by auditors. Rather, most are detected by cowor-         4. Internal control weaknesses give employees oppor-
    kers, managers, or other employees. Tips and                tunities to commit fraud.
    complaints are main sources of investigating fraud.      5. Internal control is composed of the control envi-
                                                                ronment, the accounting system, and control pro-
                                                                cedures (activities).
KEY TERMS                                                    6. Analytical fraud symptoms are the least effective
accounting anomalies,          behavioral symptoms,             way to detect fraud.
    p. 137                        p. 138                     7. Most people who commit fraud use the embezzled
internal control               analytical procedures,           funds to save for retirement.
    weaknesses, p. 137            p. 147                     8. As fraud perpetrators become more confident in
analytical anomalies, p. 138   psychopaths, p. 151              their fraud schemes, they steal and spend increas-
lifestyle symptoms, p. 138     elements of fraud, p. 151        ingly larger amounts.
                                                             9. First-time offenders usually exhibit no psychologi-
                                                                cal changes.
                                                            10. Psychopaths feel no guilt because they have no
QUESTIONS                                                       conscience.
                                                            11. It is safe to assume that fraud has not occurred if
Discussion Questions                                            one or more elements of the fraud triangle cannot
                                                                be observed.
 1. How do fraud symptoms help in detecting fraud?          12. The fraud elements consist of concealment, con-
 2. Why do internal control weaknesses help detect              version, and completion.
    fraud?                                                  13. Auditors can best help detect fraud in conversion.
 3. What are accounting symptoms?                           14. Some complaints and tips turn out to be unjustified.
 4. What are analytical symptoms?                           15. Fraud is a crime that is seldom observed.
 5. How can lifestyle changes help in detecting fraud?      16. Because of the nature of fraud, auditors are often in
 6. How can behavioral symptoms help in detecting               the best position to detect its occurrence.
    fraud?                                                  17. Most people who commit fraud are under financial
 7. How can tips and complaints help in detecting               pressure.
    fraud?                                                  18. Studies have found that the most common internal
 8. What is the theft act of a fraud?                           control problem when frauds occur is having a lack
 9. What is conversion?                                         of proper authorizations.
10. What is concealment?                                    19. Fraud perpetrators who manipulate accounting re-
11. How would you react in the following situations?            cords to conceal embezzlements often attempt to
    a. You discover an internal control weakness in             balance the accounting equation by recording
        the company you are auditing.                           expenses.
160   Part 3: Fraud Detection

20. Employee transfers, audits, and mandatory vaca-              b.   Give the embezzled funds to charity.
    tions are all ways to provide independent checks             c.   Experience no change in their lifestyle.
    on employees.                                                d.   Use the embezzled funds to improve their
21. New whistle-blowing laws have helped make tips                    lifestyle.
    and complaints more effective.                          7.   Which of the following is not a reason people are
22. Coworkers are usually in the best position to detect         hesitant to come forward with knowledge or suspi-
    fraud.                                                       cions of fraud?
23. Fraud perpetrators often live beyond their means             a. They often think that squealing on someone is
    since their income does not support their lifestyle.              wrong.
24. Nearly all individuals and organizations are subject         b. They fear reprisal for being a whistle-blower.
    to pressures and can rationalize.                            c. It is usually impossible to know for sure that a
                                                                      fraud is taking place.
Multiple Choice                                                  d. People who report fraud are often rewarded
 1. Which of the following is true regarding fraud?         8.   Which of the following is not one of the categories
    a. It is easily identified.                                  of employee fraud symptoms?
    b. It is seldom observed.                                    a. Accounting anomalies.
    c. When a fraud occurs, there is no question                 b. Analytical anomalies.
         whether or not a crime has been committed.              c. Tips and complaints.
    d. Many witnesses are usually available when                 d. Firm structure.
         fraud occurs.                                      9.   Embezzlement of assets reduces the left side of the
 2. Which of the following is not a fraud symptom                accounting equation. To conceal the theft, the em-
    related to source documents?                                 bezzler must find a way to reduce the right side of
    a. Duplicate payments.                                       the accounting equation. A perpetrator would most
    b. Missing documents.                                        likely reduce the right side of the equation by:
    c. A tip from an employee.                                   a. Reducing accounts payable.
    d. Photocopied documents.                                    b. Paying dividends.
 3. Which of the following is a fraud symptom related            c. Increasing expenses.
    to an internal control weakness?                             d. Altering stock accounts.
    a. Lack of proper authorization.                       10.   Which of the following is not a fraud symptom
    b. Lack of independent checks.                               related to journal entries?
    c. Inadequate accounting system.                             a. Unexplained adjustments to receivables, pay-
    d. Lack of physical safeguards.                                   ables, revenues, or expenses.
    e. All of the above.                                         b. Journal entries that do not balance.
 4. In the three elements of fraud (theft act, conceal-          c. Journal entries without documentary support.
    ment, conversion), who is usually in the best posi-          d. Journal entries made near the beginning of
    tion to detect the fraud?                                         accounting periods.
    a. Coworkers and managers.                             11.   Which of the following is not a common internal
    b. Customers.                                                control fraud symptom or problem?
    c. Owners.                                                   a. Lack of segregation of duties.
    d. Vendors.                                                  b. Unexplained adjustments to receivables, pay-
 5. When a person commits a crime:                                    ables, revenues, or expenses.
    a. He or she usually becomes engulfed by emo-                c. Lack of independent checks.
         tions of fear and guilt.                                d. Overriding of existing controls.
    b. He or she will experience no changes in             12.   Once in a while, someone commits fraud or another
         behavior.                                               crime and does not feel stress. Such people are
    c. He or she usually becomes friendly and nice.              referred to as:
    d. He or she experiences a lower stress level.               a. Psychopathic.
 6. Most people who commit fraud:                                b. Altruistic.
    a. Use the embezzled funds to build a savings                c. Philanthropic.
         account..                                               d. Magnanimous.
                                                                       Chapter 5: Recognizing the Symptoms of Fraud   161

13. Fraud is usually detected by recognizing and              because of over-baking. Despite these problems, Cal
    pursuing:                                                 maintains a clean work environment and is considered
    a. Synonyms.                                              a valuable employee.
    b. Symptoms.                                                 Recently, Cal has yelled at people on shifts before
    c. Equity.                                                and after him for seemingly insignificant reasons. He
    d. Legends.                                               was hired as manager because he gets along with every-
14. A letter is most likely to be fraudulent if:              one and is usually easygoing. His recent irritability
    a. It is signed by only one person.                       could stem from the fact that business is slowing
    b. It is addressed to an individual, rather than a        down and he does not have much interaction with any-
         department.                                          one at night. He also has been complaining that he has
    c. It is a photocopy of an original letter.               not been getting very much sleep. One day, Cal came to
    d. It is written on outdated company letterhead.          work in a new BMW M3, the car of his dreams. Cal
15. If a perpetrator has stolen assets, which of the fol-     said that his dad helped him buy the car.
    lowing is the easiest method for concealing the
                                                              1. What areas of the business are most at risk for
    a. Reduce liabilities (such as payables).
                                                              2. Identify any symptoms of fraud that appear to exist
    b. Manipulate dividend or stock accounts.
                                                                  at the doughnut shop.
    c. Increase other assets (such as receivables).
                                                              3. What steps could be taken to reduce opportunities
    d. Increase expenses.
                                                                  for fraud?
16. Which of the following is a common fraud symp-
    tom relating to ledgers?
    a. A ledger that does not balance.                        Case 2
    b. A ledger that balances too perfectly.                  James Davis owns a small Internet service provider
    c. Master account balances that do not equal the          business. Recently, customers have been complaining
         sum of the individual customer or vendor             that they are overcharged and are not receiving timely
         balances.                                            customer service. Billing rates seem to increase without
    d. Both a and c.                                          notice.
17. Which element is not a common element of fraud?              Five years ago, James used funding from several dif-
    a. Concealment.                                           ferent investors in order to start his Internet service.
    b. Coercion.                                              Currently, he has 17 outstanding bills to be paid, all
    c. Conversion.                                            with late charges. Five of the bills include notices stat-
    d. Theft act.                                             ing that lawsuits are pending. Also, he has not paid
    e. None of the above.                                     dividends to investors in two years.
                                                                 Every day, James drives either his Mercedes Benz or
                                                              his new Lexus to work. Before starting the business,
                                                              James drove only one car, a Suzuki Samurai. James
SHORT CASES                                                   now lives in a palatial home and owns very expensive
Case 1                                                        furniture. Employees constantly ask James for new
Cal Smith Jr. is the night manager at a local doughnut        equipment, but the “boss” refuses to update the old
shop that is doing very well. The shop sells doughnuts        equipment. Two weeks ago, James was irate and fired
7 days a week, 24 hours a day. Cal runs the graveyard         one of his accounting clerks for not depositing some
shift by himself, since none of the other employees           checks on time. James is known for losing his temper.
want to work at night. Since opening six months ago,
                                                              1. Discuss any fraud symptoms that are present in
Cal has not been able to find anyone to work for him
                                                                  this case.
and therefore has never missed one day of work. Cal
                                                              2. Why would complaints from customers be a fraud
makes his deposit every morning before going home.
      Cal feels that he is overworked and underpaid. The
franchise owner, Kenny Jones, has praised Cal for his
hard work and dedication to the company. Kenny’s              Case 3
only concern is that, once or twice a week, an entire batch   Joan Longhurst, along with three of her best friends,
of traditional glazed doughnuts has been thrown away          started her own ranching operation in Hawaii. The
162   Part 3: Fraud Detection

business began with two bulls and 20 heifers. After           risks does this company face? What changes, if any,
their first year, the partners were turning profits, and      should be made?
everything seemed to be going well. The heifers were
bred each year by using a patented new technique, and         Case 7
the steer population grew to 100 in two years. Most           Many people feel that it is the job of auditors to detect
heifers would produce twins, and 90 percent were              fraud. What circumstances make it difficult for audi-
male. This allowed for future breeding of the remaining       tors to detect fraud? Who is more likely to be in a
10 percent.                                                   better position to detect fraud?
    New investment was needed, so limited partners
                                                              Case 8
were invited to join the partnership with an initial in-
vestment of $20,000 each. The partnership interests           1. According to the chapter, which groups (auditors,
were advertised as “hot in the hands” and “very                  managers, coworkers, company accountants, or
exclusive.” In interviews, Joan described the invest-            friends) are in the best position to observe fraud
ments as a “double-your-money, sure thing.” She stated           symptoms in each of the three elements of fraud?
that the best way to get in was to act within 10 days of      2. Which group is surprisingly absent in each
the initial offering of the investment. The annual report        element?
of the company showed enormous growth, with the pro
forma statements predicting phenomenal success. Be-           Case 9
cause of the exorbitant food prices in Hawaii, Joan           Sally was aware of a fraud being committed by one of
says she can demand a premium for all cattle sold.            her coworkers, but she never reported it. What are
Based on this scenario, what symptoms of fraud exist?         some possible reasons for her hesitancy to come
Case 4                                                        forward?
The text states that tips and complaints are not evi-         Case 10
dence of fraud but instead are fraud symptoms. Do             John Adams is the manager at a local store. The store
you agree with this statement? Why?                           opened four years ago and has been doing very well.
                                                              With current business growing, John decided to hire
Case 5
                                                              Peter O’Riley to work as an accountant. When Peter
You are a staff auditor on a very important audit en-
                                                              started working at the store, he found several things
gagement. You are assigned to audit two parts of your
                                                              that appeared unusual. For example, six receiving
client’s purchasing department. After several days of
                                                              documents have been lost, the general ledger is out
studying purchase orders and sales invoices, you notice
                                                              of balance, one customer has complained that he is
that three vendors have identical addresses. After fur-
                                                              continually overcharged, and another customer com-
ther examination, you notice that the documents only
                                                              plains that he does not receive timely service. John
have one of the two required signatures for purchases
                                                              lives in an expensive house and has several beautiful
of those accounts. You decided to interview the pur-
                                                              sports cars.
chasing manager in charge of those accounts, but you
                                                                 Discuss whether fraud could be occurring. Does ev-
discover that he is “out to lunch.” While you are wait-
                                                              idence of fraud exist, or are only fraud symptoms
ing for him, you notice through his office window a
very nice Bose™ stereo system. It’s the same system
you have been wanting, but will only be able to afford        Case 11
after you make partner. What symptoms of fraud exist?         Consider the three aspects of the fraud triangle. If you
Case 6                                                        were hired by the board of directors to tell them what
                                                              they could do to prevent fraud, what general activities
You have been hired by a small firm to analyze its
                                                              would you tell them to engage in? List four or more
accounts receivable department and assess how suscep-
                                                              activities for each of the three dimensions of the fraud
tible it is to fraud. The company operates a table
                                                              triangle listed here.
manufacturing facility. The only employee in accounts
receivable is Joanne, an employee of 10 years. Joanne         •   Attitude/Rationalization
opens all cash receipts, credits the clients’ accounts, and   •   Motivation/Pressure
deposits the money at the bank. What fraud-related            •   Opportunity
                                                                     Chapter 5: Recognizing the Symptoms of Fraud   163

CASE STUDIES                                                    The company allows employees to order an unlim-
                                                            ited amount of software and hardware, at no cost, for
Case Study 1                                                business purposes. Between December 2001 and
The balance sheet and income statement for ABC              November 2002, Jones ordered or used his assistant
Company for the years 2011 and 2012 are as follows:         and other employees (including a high school intern)
                                                            to order nearly 1,700 pieces of software which had very
                                                            low cost but were worth a lot on the street. He then
  BAL A NCE S HEET              201 1             2 012     resold them for reduced prices—reaping millions.
  Cash                         $ 460             $ 300      When items with a cost of goods sold of more than
  Accounts receivable            620               480      $1,000 are ordered, an e-mail is sent to the employee’s
  Inventory                     1,000              730      direct supervisor, who must click on an “Approve” but-
  Total assets                 $2,080            $1,510
                                                            ton before the order is filled. In no individual order was
                                                            the cost of goods more than $1,000—he made sure
  Accounts payable              $580             $ 310
                                                            none of the orders required a supervisor’s approval.
  Notes payable                  500               100
                                                            The loosely controlled internal ordering system reflects
  Common stock                   400               400      the trust the company puts in its employees.
  Retained earnings              600               700          In June, FBI agents said they saw Jones exchanging a
  Total liabilities and        $2,080            $1,510     large box of software for cash in a department store
  stockholders’ equity                                      parking lot. The FBI contacted the company’s security
  Income Statement                                          and began monitoring Jones’ bank accounts. Previously,
  Net sales                    $ 550             $ 840      one account with his bank had an average balance of
  Cost of goods sold             120               160      $2,159. In a short time, however, the average balance
  Gross margin                 $ 430             $ 680      ballooned to $129,775. Another account at another
  Expenses:                                                 bank showed irregular deposits totaling $500,000—
  Salaries                     $ 100             $ 150
                                                            none of which appeared to be from any legitimate in-
                                                            come or other source.
  Warehousing costs               80               120
                                                                Investigators also noted that Jones purchased a Fer-
  Advertising                     60                90
                                                            rari F355 Berlinetta, a Jaguar XJ6, and traded in lesser
  Taxes                           45                75      vehicles for a Hummer, a Mercedes 500SEL, and a
  Total expenses               $ 285             $ 435      Harley-Davidson motorcycle. He also bought an
  Net income                   $ 145             $ 245      $8,000 platinum diamond ring, a $2,230 wristwatch,
                                                            and a $4,000 bracelet. “You figured that I like big
                                                            boy’s toys by looking at some of my pictures,” Jones
Questions                                                   wrote on his personal Web page. “I just can’t resist.”
                                                            The Dude’s Web page includes a camera for monitor-
1. Perform vertical and/or horizontal analysis of the       ing his cat and photos of his yacht, cars, and other
   statements and identify two things that appear to be     treasures. For a relatively low-level manager, it was an
   unusual and could be possible symptoms of fraud.         impressive collection. But at his company, where teen-
                                                            age software engineers can earn more than company
Case Study 2                                                directors, no one batted an eyelid.
In his own words, Daniel Jones was “The Dude.” With his         A neighbor across the street from Jones said that he
waist-long dreadlocks, part-time rock band, and well-paid   was clearly wealthy, but not flamboyant with his
job managing a company’s online search directory—he         money. He described Jones as an intelligent man who
seemed to have it all. Originally from Germany, Jones,      didn’t flaunt his education, would loan neighbors tools,
now age 32, earned his doctorate and taught at the Uni-     and was always friendly. The neighbor was surprised to
versity of Munich before coming to the United States,       hear the accusations against someone he called his
where he started his career in computers. In 1996, Jones    friend. All he knew about Jones was that he was a
started working with the company as a director of opera-    good neighbor who loved cars. “He was very, very help-
tions for U.S.-Speech Engineering Service and Retrieval     ful. The few times I had problems with my PC, he’d
Technology—working on a new, closely guarded search         come and help straighten them out,” the neighbor said.
engine tied to the company’s .net concept.                  “They are just ideal neighbors. I feel terrible for him
164   Part 3: Fraud Detection

and his wife.” Jones and his wife lived in a modest        Naval Criminal Investigative Service was quickly
1960s split-level home.                                    formed to investigate. The task force agreed that the
   In 2001, he joined the city’s Rotary Club, “where he    most effective approach to investigating possible fraud
seemed more outgoing and personable than the stereo-       was the use of an undercover operation utilizing a co-
type techie,” said a local jeweler and immediate past      vert contracting business.
president of the club. “He seemed like what I would
expect a genius software developer to be.”
   The Dude was fired from the company in December
                                                           1. What are some of the symptoms of fraud in this case?
2002, shortly after the fraud was discovered. He has
                                                           2. What questions would you ask yourself about fraud
been charged with 15 counts of wire, mail, and com-
                                                              symptoms that might help you investigate this fraud?
puter fraud—with each count carrying a maximum of
                                                           3. Why would an undercover operation be the most
fives years in prison. He is expected to remain in cus-
                                                              effective approach to investigate?
tody until his preliminary hearing.
                                                           Case Study 4
Questions                                                  MHZ, Inc., is a high-tech company that produces mini-
                                                           ature computer processor chips. The company is one of
1. Describe the symptoms of fraud that might be evi-       the most successful companies in its industry because it
   dent to a fellow employee.                              is always developing faster and more efficient processors
2. Recently, his employer has been putting more empha-     in order to maintain a competitive advantage. Sales and
   sis on controlling cost. With the slowing of overall    earnings have increased significantly in recent quarters
   technology spending, executives have ordered man-       causing the company’s stock price to rise.
   agers to closely monitor expenses and have given vice       Hal Smith was recently appointed to be the new chief
   presidents greater responsibility for balance sheets.   financial officer (CFO) of MHZ. Hal is 45 years old and
   What positive or negative consequences might this       has worked at MHZ for over 15 years. Hal was promoted
   pose to the company in future fraud prevention?         to CFO because he has an excellent understanding of
3. As discussed previously, all frauds involve the fol-    MHZ and the high-tech industry. Hal is well respected
   lowing key elements: perceived pressure, perceived      and knows everyone very well. At the close of the third
   opportunity, and rationalization. Describe two of       quarter, Mark Jones, CEO of MHZ, asked Hal and man-
   the key elements of the Jones fraud— pressure and       agement to meet with him to discuss year-end projec-
   opportunity.                                            tions. During the meeting, Hal noticed that Mark and
4. From the scenario, what measures has the company        other members appeared to be stressed and nervous
   taken to prevent fraud? In what ways could the          that the company might not meet analysts’ expectations
   company improve?                                        because it had lost a contract with one of its major ven-
                                                           dors. In the following weeks, Hal noticed Mark and other
Case Study 3                                               key employees began to appear more stressed and wor-
In June of a recent year, allegations of fraud regarding   ried than normal. In addition, Hal recognized that Mark
repair contracts for work on board U.S. Naval Ships        and one of his internal auditors would work continually
(USNS) were reported to law enforcement agents. The        into the night. At the close of the fourth quarter, every-
allegations indicated that fraud was rampant and could     one cheered when the company managed to meet its
possibly impact the seaworthiness of these vessels. Em-    earnings expectations. Hal was relieved to see that the
ployees from ABC Construction, Inc. (ABC), the entity      company had achieved its goal, but he couldn’t help
in charge of getting contracts for USNS, were demand-      wondering if something suspicious was going on.
ing that a high volume of contracts be processed, and
they were also demanding faster processing time for        Questions
these contracts. When some employees started quitting
because of increased pressure, ABC made sure it did        1. List and briefly describe the   six different types of
not get attention from the federal government. ABC            fraud symptoms.
had close relationships with some of the subcontrac-       2. Describe the different fraud    symptoms present at
tors, but had always kept totally independent from            MHZ, Inc.
these subcontractors. A task force of agents from the      3. Assume that Hal has access      to the company’s in-
FBI, Defense Criminal Investigative Service, and the          come statement and balance      sheet. What types of
                                                                Chapter 5: Recognizing the Symptoms of Fraud   165

  analysis can Hal perform to determine whether
  fraud may be occurring at MHZ?
                                                       END NOTES
INTERNET ASSIGNMENTS                                   2.
1. How many different Web sites can you find dealing        essentials/p32.htm, accessed June 1, 2004.
   with fraud auditing and detection? Try a few dif-   3.   Much of this discussion came from the HIH Royal
   ferent search strings in Google or another search        Commission report and from articles that have
   engine and see what sites are available.                 been written about the report such as those found
2. Locate the Web site of the American Society of           at the following Web site:
   Questioned Document Examiners (ASQDE) at                 2003/04/16/1050172655327.html. What is the ASQDE? What is its

Shared By: