Global Risks Reduced: International Business Doesn’t Have to Be Risky

My passport was in order. No visa was necessary. And although a safety advisory had been issued to U.S. citizens heading to this small Latin American country, security had been arranged to accompany me from the moment I arrived at the airport. I had reviewed many documents and felt mentally prepared for the assignment – determine whether the foreign subsidiary of a U.S. corporation was misappropriating company funds.

Picture this as a welcoming scene: No lines painted on the roads, no pay phones on the street corners, military police with big guns posted at the airport, and a hotel room with a window facing a shanty town. I suddenly felt not-so well prepared. My only comfort was the security team that escorted me wherever I needed to go.

When traveling to other countries under potentially adverse situations, never underestimate the value of having security. (This may not be true for all foreign engagements, but I’ve found it to be beneficial during my assignments in Latin America.) If local management is under the microscope, chances are they don’t want you there. You’re invading their turf and they likely have connections that could make your life miserable or even put it in danger.

There were other factors I didn’t foresee either, such as a lack of what many of us would consider everyday technology and supplies – photocopiers, reliable telephone service, fax machines, or even an extension cord to set up equipment “in the field.” There also was a language barrier, of course, which impeded matters, not just with the actual business at hand, but also with the everyday routines of living abroad. (My Spanish was limited when I arrived in Latin America. It made even simple tasks, such as ordering lunch, difficult.)

Being aware of and prepared for issues like personal safety, office supply needs, technology, and language barriers will help you adapt more smoothly to a foreign environment. However, I’ve found even more important is understanding the business culture of the country you’re visiting. This will greatly assist you in knowing how to approach an investigation and how to deal with authorities, suspects, informants, and business associates n that country. Some of the cultural issues you may encounter are:

• Relationships can precede business. As a result, it may take longer to obtain the information you request because a relationship hasn’t been established. However, sometimes you may rely upon a liaison that has relationships with others (i.e., bank officials, vendors, and management) for introductions and assistance.
• Nepotism exists. Because relationships often are important, don’t be surprised if business associates are related, have worked together in prior companies, or are close friends. Keep this in mind when asking interview questions, making requests, and commenting to others.
• Deadlines can be flexible. It may take longer to receive information you have requested. Be polite and establish clear timetables without being pushy. You may hear, “We will have that available tomorrow,” when actually “tomorrow” may not mean the next day, but perhaps weeks later.
• Employees are loyal to local management. This shouldn’t be a surprise. Employees often are led to believe that the “big guys” at corporate headquarters are faraway and inaccessible, and could care less about local operations. If local management is suspected of wrongdoing, some employees may elect to stay quiet for fear of reprisal. In countries where employees earn low wages, job preservation may be more important than telling the truth to a stranger. As previously mentioned, learn to establish relationships to create a path of communication with these employees.

For example, in a case we investigated in Mexico, we asked an accountant upon our first meeting if she was aware of some unauthorized transactions. Her initial response was “no” due to her loyalty to local management; however, we knew her answer had to be “yes.” After continuing to establish relationships with the accountant and her co-workers over a period of weeks, she finally admitted she knew something was awry. We fostered a spirit of cooperation that eventually led to recovering thousands of dollars, which persuaded the authorities to file criminal charges against the local management. You may be able to facilitate such a result by conducting interviews off site.

How Well is “Big Brother” Watching? 

Aside from cultural and logistical issues, another concern must be addressed when handling international fraud examinations: Are foreign operations being audited as thoroughly as those at headquarters? The answer is “perhaps.” If the entity is a joint venture or a “smaller piece of a big pie,” only local statutory reporting may be required. Statutory reporting may not be as comprehensive as an audit, and audit scope limitations may have established high-dollar thresholds that exempt many of the accounts from scrutiny.

Some of the red flags that prompted my past investigations into wayward foreign entities include:

• anonymous tips and letters;
• questionable, untimely, or non-existent monthly reporting to corporate headquarters;
• unreconciled account balances (e.g., suspense accounts);
• unexplained/unacceptable spending; and
• delays and lack of answers to questions from both internal and external auditors.

I’ve learned that one of the best ways to identify fraudulent activity within foreign operations is to monitor the entity’s cash flow and payments to vendors. This technique isn’t foolproof, of course, but it may ferret out some of the more typical abuses occurring in foreign offices.

Examining the Cash Flow 

Cash is an area of great exposure with foreign operations. Let’s focus on cash transfers. Unauthorized transactions may occur in the following situations:

1. Funds sent by corporate headquarters to foreign entities aren’t reconciled on a timely basis.
2. Headquarters and overseas branches have separate computer and accounting systems, so transaction details such as payees, check number, amount, and general ledger postings may be manipulated and not reported to corporate.
3. Headquarters doesn’t have on-line access to the foreign entity’s accounting information.
4. A statement of cash flows isn’t required as part of the monthly reporting package to corporate headquarters.

In another case involving a foreign subsidiary, each week the foreign entity would request funds from corporate headquarters, which would then transfer funds into the entity’s “dollar” bank account (an account denominated in U.S. dollars rather than the local currency to maintain the “strength” of the dollar and to avoid currency exchange losses). These funds were held in the “dollar” account until transferred into the local currency account to pay local vendors and employee payroll, as required by local laws. An investigation showed that unauthorized withdrawals were occurring in the “dollar” account in addition to the valid transfers. These withdrawals, previously unknown to corporate headquarters, consisted of fraudulent payments to local management. The withdrawals were never recorded on the general ledger, but the bank account always reconciled. How was that possible?

The subsidiary was in a country with a devaluing currency, thus the local accountant recorded an entry for “exchange loss” each month that equaled the total amount of unauthorized withdrawals. In some cases, there may be a series of accounting entries ultimately resulting in the following:

Debit: Foreign Currency Exchange Loss $XXX,XXX
Credit: Cash: “Dollar” Account $XXX,XXX

Corporate headquarters normally excluded the subsidiary’s “dollar” account from internal audits; however, all that changed after an anonymous call prompted headquarters to hire my company to investigate the subsidiary’s financial activities. The caller had claimed there was phony vendor activity going on at the subsidiary and that the local managers were leading excessive lifestyles. As investigators, our first move was to examine the subsidiary’s “dollar” account. We noticed checks, rather than wire transfers, in the “dollar” account’s bank statements and immediately became suspicious. The account was to be used mainly for wire transfer activity; checks were rarely used on the account to withdraw money.

The check copies we received from the bank confirmed that payments were going to local management rather than to operational expenses. This had gone undetected because corporate headquarters would transfer funds to the subsidiary without ever reconciling how the money was spent. Over the course of a year, nearly $2 million went to the benefit of company employees rather than to pay legitimate expenditures. The only prior testing of the “dollar” account consisted of comparing the subsidiary’s balance sheet to the bank statement. Because the subsidiary’s accountant ensured the two would reconcile with his “exchange loss” alterations, no further review or questions were asked. How could the fraud have been detected?

Generally, the best and most cost-effective weapon against fraud is to provide an ethics “hot-line,” a toll-free telephone number available to all employees, customers, and outside vendors. Other fraud-fighting measures include developing codes of conduct that communicate and sensitize employees to ethical values, and implementing internal controls within operations. Examples of specific internal controls are:

• require foreign entity bank statements to be sent to corporate headquarters directly from the bank;
• reconcile – either monthly or quarterly – the funds transferred from headquarters with the funds spent by the foreign entity (especially if the entity is a “cost center” – a location used strictly for assembly and/or manufacturing that depends on corporate transfers for its source of cash.);
• trace transfers from “dollar” accounts to operating accounts and journal entries; and
• most importantly, establish a corporate contact with local banking officials.

As shown in the earlier example, journal entry adjustments can force bank accounts (or other accounts) to balance. In many cases, corporate offices aren’t completely aware of the journal entry details in the monthly reporting packages sent by foreign operations. If the company doesn’t require the bank to forward canceled checks, the ability to perpetrate the scheme without detection increases. Depending on the situation, consider performing these procedures:

• Using standard bank confirmation forms, periodically canvass all banks in proximity to the foreign entity for the possible existence of unauthorized company accounts and loans. Use all aliases of the company name in the confirmation request. One recent engagement revealed that the local management at a foreign entity had taken out an unauthorized loan at a bank where the company had never done business.
• Where permitted by local laws, payments and perhaps purchasing functions should be handled by corporate.
• Consider using positive pay systems (may not be available in all countries).
• Obtain copies of signature cards and signature authorities. By doing so, you know who has authorization if you should need to change signatories quickly.
• Trace transfers from corporate bank accounts to the local (destination) accounts.
• Identify/request copies of source documentation for all withdrawals or transfers that cannot be traced (especially for transfers occurring between accounts in the foreign country).

Tracking Vendors 

Vendor fraud is common in any business, from establishing ownership in a supplier to creating bogus vendors with accompanying phony invoices or inflating invoices from valid vendors. This can be an area of frequent abuse with international companies due to weak internal controls in overseas operations. For entities that pride themselves on their inventory controls, non-inventory vendors – such as services, leases, credit cards, etc. – are frequent targets for unauthorized transactions.

While you may have a “tip” or anonymous letter alleging that certain vendors may be targets for unauthorized transactions, how can you identify issues when language barriers and cultural differences can impede your progress? In many cases, scanning canceled checks may not be practical, especially because canceled checks may not be returned from the bank, and obtaining copies can take time. Other than interviewing and looking through boxes of documents, are there other procedures that can be performed?

The answer is yes. The value of mining computerized data cannot be overstated especially when vendor fraud is a possibility. While each investigation is slightly different, there are computer queries that can be performed to assist you in determining a future course of action.

First, obtain the computerized vendor master file and computerized check register file for the period under review.

• Sort the check register by payee, summarize by payee (Microsoft Excel’s pivot tables make this a quick and easy task), and sort the results in descending dollar order.
  • Identify top-paid vendors. After performing the computerized sorting, we were surprised to find that a management employee at a foreign entity was also an officer with the entity’s top-paid vendor, a temporary services company. Services were billed nearly 50 percent above market rates.
  • Compare vendor payments for two consecutive years. Are there certain vendors that have dropped or increased significantly in volume?
  • Identify high-dollar suppliers without contracts (oftentimes for services). Even though corporate headquarters may have strict contracting procedures, don’t take it for granted that those procedures are followed by the foreign entity. Remember: relationships rule. This may identify an employee/vendor relationship in which the vendor could be overcharging for services in exchange for kickbacks from the employee.
  • Scrutinize new vendor approval process.
  • Identify payments to new vendors. Many times no approval process exists for establishing a new vendor. In addition, an unauthorized person may be able to “walk” an invoice through the payment process without obtaining outside approval.
  • Identify payments to employees.
  • Identify payments to legal counsel (perhaps headquarters is unaware of the legal services being provided locally). Reviewing counsel’s invoices may identify unknown corporate assets and unrecorded transactions.
  • Is there anything on the check register to indicate inappropriate payments to government officials? If so, you may have FCPA (Foreign Corrupt Practices Act) concerns to convey to headquarters.
   
• Determine whether all payments are accounted for. Keep in mind, some vendors may be paid in cash; are these companies recorded on the check register?
• Using the check register, identify voided or canceled checks. (Find out the local terminology used for these transactions. In our investigations in Latin America, canceled or voided checks were referred to in the books as “cancelado” or “anulado.”) Trace the voided checks to the bank statement to determine whether the items have cleared.
• Identify “gaps” in check sequence on the check register. Trace the gaps to the bank statement to determine whether they’ve cleared. If gaps or voided checks are clearing, examine the supporting documentation and canceled checks. If there are several out-of-sequence or unrecorded checks clearing, someone may be using a stash of manual checks for unauthorized transactions. In one investigation, the local management created bogus vendor invoices for the accounts payable files. When the canceled checks were obtained from the bank, it was apparent the actual payee (an employee) was different from the documentation existing in the files.
• Determine whether wire transfers are recorded on the check register. If the information is in a separate computer file, you may discover that the same vendors are being paid in two ways: what is recorded on the check register in addition to amounts paid by wire transfer. To find the source documentation, you may need to request information from the bank or review correspondence files. By reviewing wire transfers in one recent engagement, we found unauthorized wire transfers to pay employees’ personal credit card bills; payments to vendors for employees’ personal purchases; payments to phony vendors (entered in the accounting records as something different); and pay-offs to certain employees (i.e., payments in addition to bonuses and regular payroll). Don’t be fooled by wire transfers between existing bank accounts. We found additional correspondence to the bank directing them to split the transferred funds into payments to three phony vendors, details that didn’t appear in the books.
• Using the vendor master file, compare vendor addresses to employee addresses. If many vendors are paid in cash or by wire, the company addresses may not exist in the vendor master file.
  • Identify whether multiple vendors are being paid at the same address or nearly the same address. Never underestimate the value of knowing key addresses. In one investigation, we identified nine phony vendors – all with the same address – receiving hundreds of thousands of dollars from the foreign entity – unbeknownst to corporate headquarters.
   

Reviewing computer files and business records prior to landing in the field – if you’re fortunate enough to obtain the information in advance – allows you to be more focused in your document requests and interviews once you arrive in the foreign country.

Keeping cultural differences and logistical issues in mind during international investigations can increase your awareness of the possible schemes covered in this article, as well as other scams, including:

• payments to ghost employees (or continuing to pay someone after termination);
• manipulation of accounting records to meet target or budget profits (on which bonuses and other incentives may be based);
• accounts receivable write-offs (perhaps the customer payments are being directed to other bank accounts);
• inventory discrepancies; and
• missing fixed assets.

Investigations of foreign entities can be challenging as well as rewarding. Increasing your awareness of issues associated with these types of investigations can reduce frustration and help you manage expectations with corporate headquarters, counsel, and foreign operations management. Good luck!

Mona Clayton, CFE, CPA, is a director in the investigations practice at PricewaterhouseCoopers LLP, serving clients in the Midwest. The views expressed in this article are those of the author.