For auditors and fraud examiners, it's often difficult to determine when seemingly "normal" conditions transition to suspicious. The fraud triangle (motive, opportunity, and rationalization) provides guidance for the elements of fraud, but no single source of evidence gives us assurance that a fraud has occurred. We must be aware of the differing red flags of fraud, waste, and abuse (FWA), and interpret these often subtle warning signs.
Fraud occurs with an intentional act committed for personal gain. However, waste and abuse involve the mismanagement or misuse of resources. Abuse also includes using a position of authority for personal gain. Conclusions drawn as a result of interviews, document reviews and data analysis determine whether controls exist to detect, prevent, and deter FWA and the extent to which identified risks and vulnerabilities affect an entity.
Sometimes it can be easy to confuse FWA. The goal is to follow the facts and let them speak for themselves. Let's consider these cases.
CASE NO. 1: THREE STRIKES
Low-income persons were eligible for health-related financial assistance based upon program requirements. Auditors reviewed their applications, which contained approval signatures from the authorized supervisor responsible for overseeing program eligibility. However, the supervisor's name was signed in three distinctly different ways among all the applications the auditors reviewed.
Initially, it appeared that employees forged their supervisor's signature during an absence (opportunity) to gain financial assistance for medical care (rationalization), for the low-income persons whom those employees may have been friends with or related to (motive). Additional review determined that:
- There was no cash flow in or out of this department.
- Patients approved for financial assistance met the eligibility requirements.
- Conflict of interest wasn't identified.
Interviews revealed that staff thought the forms required an authorizing signature, so they signed the documents on behalf of the absent supervisor. Management stated that the forms weren't used in eligibility or payment disbursement decisions.
Although evidence at first prompted a suspicion of fraud, the facts revealed that there was no FWA. Subsequently, management trained staff in the eligibility determination and document preservation processes and eliminated the use of these forms — an inefficiency identified in the process.
CASE NO. 2: GAME DAY
An organizer of a youth art contest solicited and collected prizes from local-business sponsors. This contest coordinator mailed the solicitations, tracked sponsorships and assigned prizes to the winners. Mailroom staff, under video surveillance, date stamped and photocopied incoming mail, which included mailed prizes from the sponsors. In this small entity, employees quickly learned about the received prizes, so auditors initiated a security review.
Sponsorships were valued at approximately $10,000 total (motive), kept in an unlocked drawer (opportunity), and the coordinator admitted to taking home the most coveted prizes, including 10 tickets to a double-header baseball game, "for the good of the organization (rationalization)." It first appeared the coordinator had stolen many of the sponsorships, despite the rationalization.
Auditors conducted staff interviews. Staff members reported that the department supervisor had directed the coordinator and other employees to give him the sporting event tickets for his personal use. Employees didn't initially report the supervisor's direction because they were afraid he would retaliate, and there was no anonymous reporting mechanism. The supervisor never actually committed fraud because he never took possession of the tickets. Management, which found that the supervisor had abused his authority, created written policies for the art contest and incorporated procedures for soliciting, monitoring and securing sponsorships.
CASE NO. 3: PICTURE PERFECT
An entity hosted an annual recognition event for community volunteers. Honorees received photographs of the event. During an annual financial review, the auditors found the film development expenses were unusually high — approximately $3,500 for the entire fiscal year. (This was before the digital revolution.) However, receipts proved that the recorded amount was accurate. An anonymous tipster suggested that the financial analyst look beyond "ticking and tying" the receipts to the general ledger.
The analyst learned that the employee charged with taking pictures had a part-time photography business (motive) and had dropped off and picked up the developed film (opportunity). Receipt totals were less than $20 for each time film was dropped off and picked up, an immaterial amount (rationalization). Further review revealed that:
- The number of rolls of film on file was less than the quantity listed on the receipts, for an estimated discrepancy of $1,000.
- The employee stated that management had approved some of the developed film for his homework at a private-university photography course. Auditors uncovered tuition reimbursement for the photo course at an amount $2,500 greater than a similar course at a public institution.
- Policy allowed for tuition reimbursed but disallowed reimbursement for any other expenses associated with the cost of attendance.
Management referred the matter to the human resources department for investigation. Although it appeared the employee had misappropriated resources for personal gain, investigators were unable to obtain sufficient evidence to support this conclusion. Instead, investigators concluded that management wasted resources by approving higher than reasonable tuition reimbursement plus expenses not allowed by policy. Ultimately, the entity changed its tuition reimbursement policy to include three levels of approval: department, human resources and finance.
CASE NO. 4: FREE RIDE
An entity's health care program entitled eligible persons to transportation assistance in getting to and from medical appointments. Patients requested services via telephone, and entity employees verified patient eligibility and made transportation arrangements via telephone. In most cases, the entity paid third-party vendors to provide transportation services. Some patients, however, requested that a friend or family member provide transportation services for payment. Data analysis revealed a high incidence rate for advance payments when friends or family members provided transportation.
For some employees, the incidence rate for advance payment distribution was significantly higher than others. It seemed that several staff members authorized advance payments for unnecessary services and shared earnings with each other (motive). Policies and procedures were inadequate or non-existent, training was limited and supervisory review was inconsistent (opportunity).
Interviews with management and staff revealed significant communication gaps, pay dissatisfaction and low morale (rationalization). Further review determined that select employees used existing patient information to generate transportation requests that weren't needed or delivered. Employees generated advance payment requests, supervisors authorized them and the staff members sent them to their family and friends, who shared the earnings.
Auditors initially hypothesized a fraud; facts demonstrated that multiple employees colluded with friends and family to defraud the organization for an estimated combined amount exceeding $50,000 spanning several months. The entity referred cases to an investigating agency and temporarily appointed a new manager to operate the program while executive management reviewed the organizational, operational and personnel structure of the responsible department.
Deciding if an irregularity is fraud, waste, abuse or nothing takes prep work. Clearly communicate your information requests to management and staff verbally and in writing. Complete the following preliminary work so you understand the necessary information:
- Perform background research on the program or operation under review, including its information systems so you can identify potential opportunities or motives.
- Evaluate key processes from start to finish so you'll have a framework for risks and controls.
- Compare and contrast management and staff interviews to identify inconsistencies, corroborate responses and ensure reliability of testimony.
- Conduct due diligence during hostile or evasive interviews to uncover red flags and sources of angst. Consider, though, that not all antagonistic interviewees committed wrongdoing.
Fraudsters succeed by hiding their misdeeds, and to find them requires consideration of the control environment:
- What is the ethical tone set by management and how is it cascaded throughout the organization?
- Are policies and procedures formalized and communicated?
- Are resources sufficiently allocated to ensure qualified staff members are assigned to their jobs and trained in their areas of responsibility?
- Are job duties appropriately segregated? If not, are mitigating controls in place?
- How does management address wrongdoing committed within the entity?
- "Ticking and tying" often fails to get below the surface. However, data analysis detects many fraudsters:
- Determine the level of necessary evidence to discover if recorded transactions are accurate. Consider if the data is complete; inaccurate and incomplete data also tells a story.
- Simple statistics in data fields of names, addresses, dates, payments and services can reveal irregularities, patterns and trends.
Lastly, an anonymous FWA reporting system promotes the identification and deterrence of wrongdoing. Employees have an opportunity to submit anonymous allegations, and the ethically challenged may be deterred by knowing that someone may report their questionable behavior or practices.
BE SAVVY AND SURE-FOOTED
Savvy auditors and anti-fraud professionals recognize the subtleties that will translate irregularities into fraud, waste or abuse, or none of the three. Make your hypotheses, but make sure that your processes are thorough enough to guide you to the truth.
Rachel A. Snell, CFE, CIA, is assistant city auditor with the City of Austin, Texas.
Read more insight and discuss this article in the ACFE's LinkedIn group.
The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to FraudMagazine@ACFE.com.