Devise a logical examination process to find fraud committed through general ledger suspense accounts. 

As a new auditor, my supervisor directed me to review general ledger "suspense accounts" in one company division. I dutifully followed the instructions on the audit program but in my naiveté I had no idea that fraud could be occurring through the crafty use of accounting oddities in these accounts.

In completing my review, I first obtained both the division's list of suspense accounts and the details of the open items in the accounts. (Those open items were the original entries that hadn't cleared out of the suspense accounts to a final general ledger account.)
Then, I judgmentally selected (an audit euphemism for picking and choosing by whim) those accounts I wanted to research. Finally, I diligently tried to determine how the items were cleared. What was the worth of my labors? Sadly, my work had little value.
I'll never know if someone was committing fraud under my nose because I didn't know what to look for and how someone could commit the crime. Years later, I'm still examining this type of account but now I know the fraudster's methods and I have little trouble gathering the evidence.

Suspense Accounts Defined

Suspense accounts are places in which entries are held temporarily until they reach their final resting place. Sometimes only the debit side is known at the initial entry and the credit side needs to be booked into suspense until the final account is determined. Other times the credit side is known and the debit goes into suspense.

For example, when a company receives cash via wire transfer but the customer's instructions are incomplete then the wire room operator doesn't know which customer's account to credit. After the debit is booked to cash, the credit is sent to a suspense account. When the customer sends the rest of the instructions and the customer's information is determined to be accurate, then the customer's account is credited and the suspense account is debited and cleared of the credit.

These general ledger suspense accounts, as used above, are often listed in the general ledger chart of accounts as many things including: undistributed debits, undistributed credits, interoffice, and miscellaneous accounts receivable.
These suspense accounts are an unfortunate but necessary part of any general ledger system. Even though they should be the exception, suspense accounts in many organizations are quite common. Because internal controls governing the accounts are often flimsy, a fraudster knows that they are perfect places to hide the trail of his thefts.

In one case, a company had $40 billion of stale or uncleared items in suspense accounts because of a faulty tracking system. Though your organization probably doesn't have that much in stale accounts on the books, you need to complete the necessary research to establish the validity of the stale items that you do have in those accounts. You may just discover that open debits in your suspense accounts could actually point to internal fraud.

How the Fraudster Commits the Crime

The fraudster's purpose is to take cash out of a business while covering his trail long enough to make the enterprise worth the effort. Fraud generally occurs through the use of general ledger suspense accounts when a dishonest individual in your organization:

1) becomes disgruntled for some reason and rationalizes his theft because "the company owes me;"
2) finds the means through a lapse in internal controls surrounding general ledger suspense accounts; or
3) steals the money via a credit to cash and is then left with the open debit to rifle into your organization's suspense accounts.

The fraudster finds a suspense account a useful place to put the open debit because he needs to find an account with high volume that he can stash the debit for more than one month's closing cycle and, of course, the most popular spot is a suspense account. Once the debit is secure in the account, the fraudster devises a method of re-aging the entry (changing the number of days an open item has remained in, or appears to have remained in, a suspense account), or rolling it into various other suspense accounts to avoid detection and stay under the radar of established controls.

Case Study: the Fraudster at Work

Let's look at a fictitious case in which the fraudster, who works for a banking organization, pulls off the scheme. We will use standard accounts to follow the fraudster's scheme.

[Exhibit 1 is no longer available. — Ed.]

In Exhibit 1 the fraudster sets up a demand deposit or checking account within a banking organization to which the fraudster has access. He often does this under a sole proprietorship name or assumed name under his tax ID number. The theft occurs when funds are placed into this account. (This account will eventually show exceptional activity levels as monies flow into the account via the fraudster's theft and monies flow out for his personal use.) 1a. is the initial entry to take the monies, i.e., to deposit company monies into the account for his personal and fraudulent use. The fraudster is left with a debit and needs to balance the entry.

[Exhibit 2 is no longer available. — Ed.]

As discussed, every company has general ledger suspense accounts that serve as temporary resting places until final entries can be made. (See Exhibit 2.) In this case, the fraudster initially uses a suspense account titled "Undistributed Debits." 1b. is the offset to the fraudster's first theft of monies. The fraudster, depending on the aging standard of this account, now waits until he needs to move the amount. The fraudster has begun his enormous shell game.

Most suspense accounts are aged. In this hypothetical case, we'll assume the aging standard is 30 days. (Your company is lacking a basic control point if it doesn't age its suspense accounts and impose an aging standard.) When May 11, XXXX arrives, the amount of $7,354 will show up on the aging report for the fraudster's supervisor. The supervisor, as part of the normal control process, would normally ask the fraudster why the debit entry hasn't been cleared from the suspense account. But before the supervisor can ask, the fraudster has rolled the amount from Undistributed Debits, entry 2a in Exhibit 2, to another suspense account, entry 2b, into Miscellaneous Accounts Receivable in Exhibit 3.

[Exhibit 3 is no longer available. — Ed.]

This account also has an aging standard, which indicates all miscellaneous accounts receivables should be collected in under 30 days.

This aging standard once again forces the fraudster to move his $7,354 within this 30-day time period. Meanwhile, the shell game begins to build as the fraudster has dipped in for another $8,667 as indicated by entry 3a in Exhibit 1. The temptation is too great and the fraudster builds a regular method for not only rolling amounts already taken but also for continuing to augment his personal cash flow through ongoing thefts.

The fraudster has now stolen $16,021 ($7,354 + $8,667) that he needs to roll. I've found that fraudsters who take amounts in the range of four digits generally don't want to overreach and steal five-digit amounts when they're rolling the funds and hiding their trails. Therefore, although the fraudster could simply roll the $16,021 he will likely split this combined amount. (See entries 4a and 4b in Exhibit 3.)
Now the trail becomes muddy. Standard controls won't uncover the scheme because the fraudster keeps the items in the general ledger suspense account for less than the aging standard of 30 days and clears the amount out of one suspense into another at or before the 30-day mark. Even if an auditor were to select one of these items for testing (which is highly unlikely given the volume in most general ledger suspense accounts) and ask about this questionable clearing, an experienced fraudster would probably explain it as a mistake or other doublespeak to an inexperienced auditor.

The control structure is obviously inadequate in this company. The auditor must therefore design a method that goes beyond standard audit testing to uncover this unscrupulous activity.

Controlling and Examining Suspense Accounts

Every organization must first ensure that basic controls are robust and in place. They won't be sufficient to guard against the fraudulent use of suspense but they must be in place to complete the more advanced testing.

Document the current and accepted use of general ledger suspense accounts through a formal and written policy. Everyone should know why the account exists and what's allowed to be entered into the account. Without such a policy, the account will become a dumping ground for every type of entry, which will make reconciliations almost impossible.

Ensure that written reconciliation procedures exist for all general ledger suspense accounts. Require that general ledger accounts be reconciled at least every month and in some cases more than that. The reconciliation should be: 1) formal and written; 2) completed within at least 10 days of the month end; 3) conducted by someone who has no authority to write entries into the account (segregation of duties); and 4) sufficient to contain insights into the balance of the account; for example: "This month's balance is $x.xx and this is in line with the 12-month moving average for the account - no particular risks are noted." Or "This month's balance of $x.xx shows a significant increase over the 12-month moving average, which represents the increased activity due to the merger of the XYZ division into our corporate general ledger. It's anticipated that the balance will be reduced within 60 days and thus be in line with expectations."

Establish aging standards on all general ledger suspense accounts. Aging standards will determine the number of days an open item can remain in a suspense account. The company controller should determine the types and appropriateness of the aging standards for each suspense account. Some accounts, such as those used for clearing foreign exchange or security transactions, will require 10-business day standards. Other standards will be allowed up to 30 days. No suspense account should have an aging standard more than 30 days.

Establish escalation procedures for all entries within a suspense account past the aging standard. Escalation procedures begin with the requirement of a monthly well-formatted report (see Exhibit 4) sent to senior management that shows the activity and outstanding balance in each general ledger suspense account. This report prevents the suspense account from becoming the private domain of any one person in your organization. When a manager sees that amounts in a suspense account with a 30-day aging standard are growing to approach 90 days, those amounts will be escalated to the necessary management level for quick and appropriate attention.

Exhibit 4 

Set a write-off policy once the controller devises aging standards. The write-off deadline is normally 90 days; any open items in the general ledger suspense account are written off to the cost center that was responsible for the original entry.

Document a policy that forbids the rolling of entries within or among suspense accounts. The policy should include specific penalties for rolling entries. First offenses for other than outright fraud should require a written warning. A second offense often warrants termination.

Perform audits at least annually or quarterly depending on the activity and balances in the suspense accounts. These procedures should require sufficient answers to the following questions:

• Who maintains a list of all internal accounts, including general ledger suspense accounts, which must be reconciled to source systems? How often is the list updated? Is responsibility for reconciliation assigned?
• What standards are established to document requirements for reconciliation? What constitutes a good reconciliation? Who documents and then reviews the reconciliation? Are the account owner and reconciler clearly segregated?
• How are open items aged, managed, and cleared? Are there corporate aging standards for open items? Is there a clearly formatted report that reveals total outstanding items, debits, credits, absolute value, and 10-, 30-, 60-, and 90-day aging? How is management informed of open items past aging standards? Is responsibility for clearance assigned per item?
• When are open items finally written off? Does the charge always go to the line of business responsible for the original entry?
• Does the line of business have an adequate segregation of duties for amounts booked to suspense accounts? (The initiator of a transaction is never allowed to record the transaction and the recorder of the transaction is never allowed to reconcile subsidiary systems to books and records.)

Automated Examination Process

After these seven controls are in place, the internal audit group should establish a method of researching all open items, which is the crux of preventing fraud through the use of general ledger suspense accounts. This methodology will examine in detail the most suspicious open items in your general ledger suspense accounts. The examination process should initially be part of the internal audit process but then should become part of the normal line of business control process. Those who are knowledgeable about database programming within your internal audit group can design this automated process. I've found that you'll need help from your information technology department when you dump the data from your general ledger system into your designed data base application.

The automated process follows the following procedures:
1. Select the suspense accounts to be reviewed according to the highest volume.
2. Enter the population of entries within the selected suspense accounts into the database application. All the information attached to the entry (date, cost center, person responsible for the original entry, amount, etc.) must be downloaded.
3. Devise the software to inspect the accounts for rolled entries. The system should search the data to discover if on one given day a certain dollar amount in a suspense account cleared from that account but then reappeared in another suspense account. Hence the item was rolled and is thus suspect and needs detailed research. Therefore we looked at each entry cleared from a suspense account (say $9,568 debit). We then looked at all other suspense accounts to determine if this exact dollar amount reappeared the same day as a debit.
4. The automated system should look for the rolling entries two weeks before and after a month end. You'll most likely find evidence during these times and the volume will be manageable. Though the test should be run quarterly, obviously, more tests will identify more rolling entries.
5. Once all these exact dollar matches are systematically determined, you need to have the computer score the amounts to focus on the most suspicious of the list. At this point, given the volume of entries, it could be purely chance that the same dollar amount was cleared and reappeared elsewhere in another suspense account. Scoring helps to avoid wasting time researching these chance occurrence matches. The following parameters are suggested for scoring the items uncovered in the systematic match (I suggest scoring on a 3-point scale for items b through f: 3 = yes, 2 = unsure, and 1 = no.):
a. First, eliminate all items of even dollar amounts. My experience is that fraudsters don't use exact dollar amounts. Although the fraudster might think that using an even $10,000 amount would look suspicious, actually many even dollar entries do get booked to suspense accounts for quite normal reasons.
b. Items from the same user are scored higher.
c. Items with an exact pennies match are scored higher.
d. If the book date of the original item and the date when the original item was cleared are close to the aging standard on that account then that indicates that someone was watching the item and planning to clear it close to the aging standard. Those items that cleared close to the aging standard are scored more highly. Items that aren't being watched clear more evenly throughout the month.
e. In line with Benford's law, items with a first digit of 7, 8, or 9 should be scored more highly. According to the law, we would expect only 15.49 entries out of 100 to start with those digits. The unsuspecting fraudster, however, will use these digits more frequently because it's easier to roll two $9,000 amounts than six $3,000 amounts for an $18,000 open item.
f. Items that are from the same cost center should be scored higher.
Because the fraudster may have split and combined amounts after he completed the first theft (as described in the T-account examples of Exhibits 1 through 3) you must design the system to account for this. See Exhibit 5. In the first column ["Initial entry(ies) or entry(ies) to be cleared"] , "1" represents an amount of say $5,000 and "2" represents the fact that the $5,000 has been split into two amounts of say $3,000 and $2,000. The previous examples of the T accounts depict four of the possibilities in Exhibit 5.

Exhibit 5 

Once the scoring is completed you'll be left with a manageable list that can be researched in detail as to how and why the items were originally booked to a suspense account, and if they were rolled into another suspense account when cleared, and why.
6. While researching these highly suspicious entries it's better to query a senior vice president (SVP) or division manager rather than the person listed as responsible for the suspense account or even the person booking the entry you're researching. By going directly to the SVP you protect yourself if a fraud has occurred and you'll be able to interview the actual suspect only after you've completed all your research.

By using this examination program you may find accounting personnel rolling bona fide entries because they can't find their final resting places. Though these findings may not indicate fraud, these are still violations of company policy and standard internal controls. You should write the amount off to expense. The individual who rolled the entry should be reprimanded.

Because you've determined a finite list of suspicious entries there's a good possibility that you'll now uncover the fraudster who's using the general ledger suspense accounts to hide and steal money.

Don't allow this type of fraud to exist under your nose. Devise a logical fraud examination program and you won't keep yourself or your company in suspense.

Walter J. Smiechewicz, Associate Member, the former chief risk officer at Old Kent Financial Corporation in Grand Rapids, Mich., is a writer and consultant.