By Mary Breslin, CFE, CIA
President, Empower Audit
Other than spiders, one of my greatest fears is hearing that I taught someone to commit fraud. One of the challenges auditors face is persuading management to implement preventive fraud controls without inadvertently teaching them how to commit the fraud. Unfortunately,
sometimes we have to explain in great detail, or worse, show how a fraud can be committed. We worry about this. Well, I worry about this. A lot. Occasionally we find blatant opportunity that we are stunned to realize no one has exploited. The most frequent reasons: ignorance and luck. Not exactly the best
controls. Unlike fraud examiners who are called in after a fraud is suspected or has occurred, auditors are frequently identifying the potential for fraud and it is our job to convince management to implement effective controls to ensure that opportunity never manifests into an actual
fraud scenario. Here is our dilemma: how do we effectively convince management of the significance of the opportunity for fraud without teaching anyone how to commit the fraud we are working to prevent? The struggle is real.
Several years ago, I worked for an organization that was referred to as having “a very large footprint,” which means we operated in approximately 40 countries on six continents. We had approximately 6,000 cars, trucks and other very large rolling assets all over the world.
The company had just hired a new Director of Fleet Management tasked with implementing standard policies and procedures and standardizing and right-sizing the global fleet to meet the needs of the organization. The company knew that it had an aging fleet which meant disposing of approximately
half the fleet and replacing about a third of those disposed assets with new vehicles. There was a lot of moving parts, literally. These expensive assets were constantly moving, oftentimes across international borders and even from one continent to another.
In conjunction with his hiring, my team conducted an entity-wide fixed asset audit for the organization. We wanted to arm him with all the information he needed to improve the operations. Our audit revealed several significant opportunities for waste, fraud and abuse. I personally sat
down and went through the entire audit and all of our findings, both significant and not. I spent hours with this individual. My team met with him repetitively. He asked a lot of questions. He was routinely surprised about what we thought was an issue and wanted to know “how” something could be a problem or potential
for fraud. We were thrilled that he was so interested with the work we had done and thought it was wonderful that our work was going to strongly contribute to the improvements he was there to make.
In hindsight I now realize he was very curious about “why” we thought there could be a problem in the various areas. We obligingly explained everything. Yay us. Foolish, foolish us.
One of the biggest problems caused by having “a very large footprint” is how long it takes to implement change. More than a year later, operations and management were “still working on it.” Most of those opportunities for fraud still existed. But that was okay, right? After all, we had explained
everything to the Director of Fleet Management, and he was aware of all that potential for fraud. Surely he was keeping an eye on everything, right?
One day something happened that sent my fraud red flag senses into hyperdrive. I pulled into the parking lot after traveling for a couple weeks and spotted a brand new Audi A8. And it wasn’t in the executive parking area. Now, I’m not a car expert, but I’m fairly sure those are expensive. So, I asked the receptionist whose car it was. By the way, make friends with the receptionists — they know everything! She quietly informed me that the beautiful car was a recent acquisition of the Director of Fleet Management. That was what I like to call … a clue. As a function of being in audit, I know how much everyone makes. Sorry, but that’s the truth. Generally, we don’t care. But this time I did the mental math. That car was pretty expensive for someone at his salary, unless he was living in a box on skid row and the car was his only expense. I instantly begin connecting dots as I head to my office. My gut tells me we have a problem and that there is a very high potential for fraud. My professionalism tells me a new car is not a reason to start investigating someone. So I come up with a plan.
Once a month we have a birthday celebration complete with a Costco cake for everyone who had a birthday during the month. Cake day is only a couple of days away and the Director of Fleet Management never misses cake day. So, I wait. And then I casually bump into him on cake day. I mention that I saw his beautiful new car and jokingly wanted to know when he was going to let me take it for a spin “in the parking lot of course.” Every ounce of color immediately drained from his face and he immediately launched into a story about an inheritance his wife had received from some long lost relative. Two things about this inheritance story were immediate red flags. First, he claimed it came from a relative his wife didn’t even know she had. Really? I’m sorry, but receiving money from a previously unknown relative just doesn’t happen, not even in the movies. Second issue: he claimed his wife received approximately $250,000.This would have meant she allowed him to spend more than half that money on a fancy sports car for himself. Again, really? Anyone think a wife would really be that generous?
So there we are standing face to face. He looks like he might be physically ill any second and he knows he just told me a story that there is no way I believe. And he knows I know that he knows this. And yet we are both standing there with those awkward smiles, eating cake.
I practically run back to my office. My instincts tell me he is committing fraud, but all I currently have is my gut and my “clue.” But now I feel I can start to investigate. I gather my team that conducted the fixed asset audit. They know all the opportunities. And I bring in my data analyst. It takes us less than two days to have enough evidence to prove he has committed more than a million dollars in fraudulent activities. What is he doing? Well, he has an extensive fraud scheme around the disposal of assets. Why was it so easy for us to find the fraud scheme and obtain substantial evidence in only two days? Because we started by looking specifically at all the opportunities for fraud we had so carefully laid out and explained to him. That’s right, we taught him how to commit the fraud … and he was a REALLY good student.
While half of me is thrilled we caught him, the other half of me is totally humiliated that we taught him. We taught him! And now I have to go explain to my boss, who just so happens to be the General Counsel for the organization, that we not only found this fraud, but might have actually caused it.
Needless to say, we have him arrested. We caught him, but my team and I are moping around like a kid that just dropped his ice cream cone. We were so very proud of that audit and so sure of all the good that would come out of it. A million-dollar fraud loss was not on the list of the “recommendations” we hoped to see come out of that effort.
I’d love to end this story saying we recovered the money, but we didn’t. Although something interesting did happen after we had him arrested.
Shortly after his arrest, our General Counsel, and my boss, got a phone call from the New York State Attorney General. They were looking for and had an arrest warrant for our now former Director of Fleet Management. He was wanted for a fraud he committed at his last organization: a fraud scheme around the disposal of assets. Wait…what? He did the same thing before? So maybe we didn’t teach him. Maybe we only expedited his timeline. Not exactly something to put on the résumé, but there was some comfort knowing that he probably would have committed a fraud with or without the information from us. Fortunately, because he used our findings as a road map, he made it very easy for us to figure out how the fraud was committed and catch him.
The lesson: the vast majority of individuals who commit fraud do so because they see an opportunity, have real or perceived pressure and are able to rationalize the fraudulent activity. Very few fraudsters take a new job with the clear intention to defraud the organization. It appears that this time, that is exactly what happened. I will forever be worried about teaching fraudsters how to commit fraud “accidentally” after that experience, but I am glad we caught him when we did and the losses weren’t worse.
For more information, contact Sarah Hofmann, Public Relations Specialist, at (512) 478-9000 ext. 324 or