The Whole, Not the Parts: Discovering fraud with outcome-oriented auditing

Outcome-oriented fraud auditing - looking at a situation as a whole rather than its individual parts - will help you think like a fraudster and find deeply embedded crimes.

A retired federal auditor's instruction to focus on the whole and not just the parts of a fraud audit has helped me find fraud in numerous situations that I probably would have overlooked. Let me tell you about one case in which the auditor's advice helped me find thousands of dollars in well-hidden overcharges.

Early in my career, as a lowly staff auditor working for a municipality, I was assigned to an operational review of the convention and visitor's bureau (CVB). The project's leader - the assistant to the budget director - wasn't an auditor. In fact, I was the only auditor on the review team, which made the experience very interesting to say the least.

The team leader's efforts to obtain information from the CVB to review the advertising contract for compliance were totally ineffective. In desperation she said to me, "You review the contract. You have more power than I do!" I really had no power, but I did have auditing skills. Within a few hours, I had generated a report extrapolated from the municipality accounting information system that listed all the payments the municipality made to the advertising consultant going back several years. The report immediately identified that the municipality had made payments that exceeded the authorized contract amount by several million dollars. The budget director and team leader had suspected something was wrong for years. They weren't surprised by what I'd found but at the magnitude of it, how it was hidden, and how quickly I had found it. After they picked themselves up off the floor, they excitedly asked me to take a closer look at the contract.

In 1995, I attended a weeklong class sponsored by the U.S. Department of Agriculture taught by a retiree of the General Accounting Office (now the Government Accountability Office). When this instructor walked into the classroom, he looked older than dirt! I thought to myself, "What have I done? He can't possibly teach me anything state of the art!" I couldn't have been more wrong. He called his style of auditing "outcome oriented." Instead of looking at separate elements (such as each individual internal control in a transaction) and testing each individually, you look at the transaction or activity as a whole. You ask yourself these questions:

Who are the customers (internal and external)?
 

What are the customers' expectations?
 

What would happen if expectations weren't met?
 

If something were to go wrong, what would you expect to go wrong?
 

As has been written so often in this magazine, you need to think like a fraudster and then follow your nose. I've found that this approach has never failed to identify problems - an internal control weakness or fraud - in each and every project I've conducted since taking this class.

In the convention and visitor's bureau case, I determined the CVB's customers (internal and external), its customers' expectations, what I would see if controls had been circumvented, and how I would theoretically circumvent those controls. I sorted and analyzed the data on the report. I looked at expenditures around Thanksgiving, Christmas, and during the summer. I looked for patterns and questionable dollar amounts. (A critical aspect of any investigation or audit is to adequately prepare and plan yet avoid tunnel vision.)

I pulled all support documentation in the accounts payables files. I started a spreadsheet that helped me gather specific data on each transaction such as looking for ways to group the charges, account numbers to which the charge was booked, etc. As I progressed with my analysis, my observations led me to additional testing procedures.

I found that the CVB made inappropriate charges during the Thanksgiving and Christmas holiday seasons. The charges were for food delivered by an expensive hotel to the CVB on December 24, catered parties with no justification that entertained CVB staff and friends, bar tabs in the hundreds of dollars, travel expenses for a consultant that actually was a vacation, terribly expensive restaurant bills with 30 percent to 35 percent tips, etc. Also, the CVB charged to the city vacation expenses for one of the consultants during the summer.

As I analyzed the support documentation, I noted there were no third-party invoices to support charges passed through to the municipality. A review of the contract indicated the consulting firm was required to provide third-party invoices. I requested copies but it took four months for the firm to produce them, which was an obvious red flag. (This is the reason for a strong internal audit department chartered by the board or city council. If the internal audit function is weak within the organization it can and often does result in significant delays.)

A review of the third-party invoices revealed that a subconsultant was billing for advertisements in the same magazines as the prime consultant. When I would call one of the magazines to confirm the costs and ads, the magazine's accounts receivable clerk was frustrated because they would send a bill to the prime consultant who would then call and tell them that the bill needed to go to the subconsultant (or vice versa).

Based on this I was able to determine that some advertisements in magazines were billed twice to the municipality through the prime consultant and then the subconsultant. I wondered if the subconsultant was related in any way to the prime consultant. I called the secretary of state's office, obtained a copy of the articles of incorporation, and found the name of the registered agent for the subconsultant. I thought I had hit a dead end because the family names were different. Then it hit me that if there were a female married relative such as a sister or daughter the family name would be different.

A search of the county's vital statistics department revealed that the owner of the prime consulting firm had a sister whose first and middle name matched the first and middle name of the subconsultant. However, there were no marriage license records for the sister in the county.

The internal investigations department stopped my efforts to link the owner of the subconsulting firm to the owner of the prime consulting firm. The department didn't give any viable reasons just constant delays. I finally dropped my requests.

I also found the same third-party invoice was used as support for charges on multiple invoices and I noted that invoices from another third party only reflected a post office box in its address. Furthermore, there was no telephone number. The phone book didn't list the firm. Another call to the secretary of state's office revealed that the owners of the prime consultant owned this third-party company. The legal address of the company was the same as the prime consultant. I also identified about 15 other companies owned by the same people.

The contract allowed for a 15-percent markup on third-party charges passed on to the municipality. This meant the prime consultant was charging the municipality for doing business with itself and paying itself a commission to boot. The charges were nominal (usually under $100) but appeared on each and every invoice as "archival fees." Small amounts add up to big amounts.

The last two lines on page 28 of the 30-page consultant's proposal vaguely identified the method used for calculating the 15-percent markup. That's called creative accounting and it resulted in an actual markup of 17.65 percent. They accomplished this by considering the third-party charge to be passed through as only 85 percent of an unknown number. To illustrate, if they had a third-party bill (such as the archival fee) for $100, they would divide $100 by .85, which equals $117.65. Compare this to the more traditional 15 percent markup of $100, which is $115.

I figured the consultant's attorney was much smarter than the municipality's attorneys. The municipality had allowed this calculation to go for years. And remember - the subconsultant that I thought was the consultant's sister had been paid more than $1 million, which was subject to this calculation as well.

When I discussed the issues with the CVB Director, he got excessively agitated. I don't believe I told him anything he
didn't already know. The overcharges had been hidden in accounts unrelated to the contract such as postage, communications, etc. Municipalities are terrified of media exposure so the city swept the $11 million plus contract under the carpet. The municipality terminated the consulting contract and the CVB director was encouraged to move on. The contractor, subcontractor and the CVB director escaped litigation but sometimes our accomplishments can only be measured by what we can stop rather than what we can recoup.

The ticket: outcome-oriented auditing

I conduct all my audits and investigations by analyzing activities (usually expenditures) overall and looking for clusters and/or patterns that could indicate anomalies. I pull my samples from the suspected anomalies. Every transaction is evaluated from the perspective of who the customers are, their expectations, what would happen if their expectations weren't met, and - if I wanted to perpetrate a crime - how I would go about it. Then I look for evidence that someone may have followed this course of action. Once I find the first indication that someone has, in fact, attempted to perpetrate a fraud scheme, I dig even deeper. I've observed the same conditions (and more) described in this article in other consulting contracts.

Even if there is no indication of fraud, this approach still points to a problem that could result in future fraud if not corrected. It's only a matter of time before someone will see the hole in the armor and try to take advantage of it. Traditional testing of internal controls isn't adequate to determine if those controls are working. That's when outcome-oriented auditing should be the course of action.

Bonita Warnell, CFE, CPA, CIA, CFSA, is a senior auditor in the public sector.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.