Fraud's Finer Points

The highest-risk employee: Skimming revenue, part one

Please sign in to save this to your favorites.
Written by: Joseph R. Dervaes, CFE, CIA
Date: January 1, 2005
read time: 7 mins
Asset Misappropriation Fraud Schemes
After a lengthy discussion of accounts receivable fraud, it's time to focus our attention on other prime areas where fraudsters abuse the systems of internal control to raid organizations' treasuries for their own personal benefit. With this column, we begin a journey through the many facets of cash receipting and types of fraud that occur in every organization. Our first step involves skimming: removing funds prior to recording accountable transactions in the accounting system.
 
Blind trust
Employees are tempted and even put at risk in work environments where internal controls are weak or aren't properly monitored to ensure that management's expectations are being met. Managers tell employees what to do and expect them to do it, but then don't subsequently review their work once the job is done. This lack of monitoring is called "blind trust." This issue is at the heart of many fraud cases and often rears its ugly head in cash receipting frauds. The organization must use the "trust but verify" concept to deal with this common failing. A wise yet unknown Chinese fortune cookie writer recently captured this concept nicely by stating: "Trust others, but still keep your eyes open!"
 
The highest-risk employee
Who could this employee be? That's a trick question because this employee isn't just one person or only one position. The highest-risk employees in any organization are the last ones to prepare the deposits before they go to the bank. These employees usually are supervisors who occupy key positions of trust.
 
Managers expect supervisors to review the work of their subordinates. But I've found that few managers review the work of supervisors in the same way the supervisors monitor subordinates. As a result, supervisors become the highest-risk employees who can perpetrate and conceal frauds for long periods without detection by managers. The largest fraud cases that have occurred in the past, that are occurring right now, and will occur in the future involve these key supervisors. Remember that concept!
 
Supervisors have the opportunity to manipulate the contents of bank deposits without detection. They operate at decentralized or departmental locations as well as at the central treasury function. The most common type of fraud I've seen in this situation is a check-for-cash substitution scheme. (I described this scheme in greater detail in the article, "Big Switch: The Check for Cash Substitution Scheme," in the July/August 1996 issue of The White Paper.)
 
When it's not possible to segregate duties for supervisors (or others) who make bank deposits without hiring additional employees, the organization still must independently monitor their work.
 
The best way to do this is to monitor critical tasks such as the check-and-cash composition of the daily bank deposit. An individual who's independent of that function must periodically verify the work of the supervisor. Change your procedures immediately if your organization isn't doing this now.
 
Omitting this critical "last look" procedure has been the reason for some of the largest cash receipting fraud cases in my state. Over the past 17 years, there have been at least 19 major cash receipting fraud cases totaling losses of $3.8 million perpetrated by the highest-risk employee - the person who prepares the organization's bank deposit. While these losses represent only 3.2 percent of our fraud cases during this period, they represent 31 percent of all dollar losses. These statistics clearly tell us why we must pay attention to these supervisors.
 
You may first want to inquire about the source of the revenue checks that are used in a check-for-cash substitution scheme. These funds include all types of miscellaneous revenue from various parts of the organization. No one monitors these sources of revenue because they usually aren't included in accounts receivable systems or in the organization's budget. Targets of opportunity, for example, are vulnerable "orphan checks" that drop out of the sky unannounced. Because no one expects them, no one misses them.
 
Check-for-cash substitution case studies

A city clerk/treasurer supervising cashiers misappropriated $800,000 over an eight-year period of time by laundering local improvement district payments through the daily bank deposit. While a stand-alone computer maintained account balances for citizen accounts, it wasn't used for billing purposes. The supervisor sent manual statements to citizens each year billing them for current period assessments only. The city didn't foreclose on delinquent accounts. The fraud was detected during verification procedures for a new bond issue. She was sentenced to 8 1/2 years in the state penitentiary.

A supervisory account clerk of a water utility district misappropriated $357,000 over many years by laundering miscellaneous revenue from the sale of a vehicle and operating a lapping scheme for customer payments in an accounts receivable system. This supervisor received all customer feedback and circumvented internal controls to conceal this activity from managers. The fraud was detected during a routine audit. The supervisor was sentenced to 2 3/4 years in the state penitentiary.

A hospital supervisory cashier misappropriated $213,000 over many years by laundering unrecorded revenue checks from sources throughout the hospital through the daily bank deposit. The fraud was detected during a routine audit. The supervisor was sentenced to one year in the state penitentiary.

A property tax accountant misappropriated $185,000 over three years by laundering personal property tax payments from citizens through the daily bank deposit. He manipulated the content of the deposit while delivering it to the bank. The fraud was detected during a routine audit. He committed suicide during the investigation.

Internal controls

When we study the systems of internal controls during audits, we find that cashiers at an organization's central treasury function collect funds from customers and receive funds transmitted from decentralized departments in the organization. Accountability for the funds associated with these transactions is then established when the cashiers issue manual cash receipts or record the activity on manual or computer cash registers. Finally, a supervisor reviews the work of the cashiers and prepares the daily bank deposit. It's at this final step that we often miss the whole point of this process. We make a big mistake if we assume that all is well once the supervisor takes control of the money. But it's simply not true. This flow chart depicts the cash receipting flow from time of receipt until time of bank deposit.

CASH RECEIPTING 

BANK 

 

A check-for-cash substitution fraud occurs here when the
supervisor's work is not monitored by an independent party.

 

SUPERVISORY CASHIER
(prepares the daily bank deposit)

 

The supervisory cashier verifies the work of subordinate cashiers here.

 

CASHIERS
(records transactions from customers and from decentralized departments)

Not only should a manager independently monitor the work of the supervisory cashier but auditors and fraud examiners should perform audit tests of the daily bank deposits prepared by this supervisor. We should ask at least three important questions when evaluating if the organization is adequately protecting its resources from loss:

  Who monitors the work of the supervisor that prepares the daily bank deposit?
  How frequently does this monitoring take place?
  What steps are taken during the review?

An independent party should periodically monitor the work of the supervisor by comparing the check-and-cash composition of the actual bank deposit with the mode of payment of the cash receipts issued each business day. Variances must be promptly investigated. If employees are cashing checks from cash receipts, correct this internal control weakness immediately. And if employees are misappropriating your organization's revenue checks by using the daily bank deposit to convert stolen checks into cash, you should stop the fraud promptly to keep losses low.

But how does an organization actually do this? Here are at least five ways in priority order.

  Obtain a bank-validated deposit slip showing the actual check-and-cash composition of the daily bank deposit. If your bank provides only the total amount of the bank deposit, ask the bank to validate a duplicate deposit slip showing this information or periodically obtain a sample of the bank deposit slips from the bank's microfilm records.
  If your bank provides on-line banking services, access your depository bank account information and verify the check-and-cash composition of the actual bank deposit using the bank's records. Print a copy of the bank deposit slip from the on-line banking system to provide evidence of your monitoring activity.
  Visit the supervisor's office location periodically and unannounced after the bank deposit has been prepared but before it has been taken to the bank.
  Make arrangements with your bank to have the bank deposit returned to the organization unopened. The bank could return the bank deposit to an independent party at a designated location, or the organization could pick up the bank deposit at the bank. Either procedure will work.
  Make arrangements with your bank to process the daily bank deposit normally, but make copies of the deposit slip as well as the checks and any other documents included with the deposit for the organization.

Learning objectives

(1) Ensure that all miscellaneous income sources are included in the budget.
(2) Require that cashiers record all transactions immediately upon receipt by mode of payment and prepare the daily activity report in the same way.
(3) Ensure that the work of supervisory cashiers is independently monitored.

More to come

We're just beginning an interesting study. I'll be illustrating learning objectives from additional fraud schemes where perpetrators skim cash receipts from the organization. Stay tuned for more bulletins.

Regent Emeritus Joseph R. Dervaes, CFE, CIA, ACFE Fellow, is audit manager for special investigations for the Washington State Auditor's Office.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.  

Ad

Begin Your Free 30-Day Trial

Unlock full access to Fraud Magazine and explore in-depth articles on the latest trends in fraud prevention and detection.

Learn More Already a member? Sign In

You May Also Like