Risky Business: Robert Rudloff Jr., CFE, CIA, Stacks Deck Against Fraudsters at MGM MIRAGE

In May 1978, Robert Rudloff Jr. was at Castleton State College in Castleton, Vt., working toward concurrent degrees in accounting and art (with an advertising focus) when the first casino opened in his hometown of Atlantic City. He didn't expect to be as intrigued as he was. In fact, he'd had no intention to return to the Atlantic City area at all once he got his degree. But still, the glamour and newness was its own draw.

In late 1979, he scored his first interview with a casino - the Golden Nugget Atlantic City, which was set to open the next year.

"I had applied for accounting positions - not knowing what internal auditing was at that time - and was introduced to internal auditing in that first casino-industry interview," Rudloff said. "The work was going to be different every day as compared with a general accounting job that would be routine and repeat each month. Also, the internal audit job was going to let me use a wider array of analytical skills as opposed to straight accounting skills. I was sold at that point and only pursued internal auditing as a career after that."

That decision led to his current role as the vice president of internal audit for MGM MIRAGE - one of the world's leading gaming, hospitality, and entertainment companies. He said he has never regretted his decision to become an internal auditor since he started his gaming career in September 1980.

"I wanted a challenge for a career, but internal auditing became so much more than that," Rudloff said. "I got to see every part of the business and was able to interact with senior executives on a professional basis even when I was a relatively inexperienced auditor, and it exposed me to the world of fraud examination - a dimension of my career that I would never have gotten into except for internal audit."

IT TAKES ALL KINDS ... 

After 29 years of working as an internal auditor in the gaming industry, Rudloff, now a Certified Fraud Examiner and Certified Internal Auditor, has had the opportunity to work through a wide variety of auditing challenges.

"Unlike many other businesses, a substantial part of internal audit's work in the gaming business is just about regulatory compliance," he said. "My department does much more than that. Even to this day we sometimes run into a situation where management is saying 'You can't put that in the report; it's not a compliance violation.' We then have to re-educate them that our reports are not compliance reports; they are internal audit reports."

Frauds and fraudsters run the gamut in the gaming biz, he said.

"There really is no typical fraud in our business," he said. "If that was the case, the frauds would be easy to stop. During my career I've investigated frauds committed by every level in the organization - from the housekeeping and cleaning staffs to executive management. Some fraudsters were astute and had their frauds well concealed; others were not well concealed. And there is no correlation between the level of sophistication of a fraud and the level of the person committing the fraud. In fact, some of the less well-concealed frauds came from the higher-level employees."

Since Rudloff's first fraud examination in the spring of 1981 to the frauds he investigates now for his company's 16-plus properties (See "Common Casino Frauds" sidebar on page 50), you'd think nothing could surprise him anymore. But you'd be wrong.

"There are a lot of things that still surprise me," he said. "Sometimes it's the ease with which the fraudster was able to defraud the company - basic internal controls were circumvented and no one noticed. In some cases it's the surprise in the fraudsters' eyes that they were actually caught. Too often they think they have the perfect scheme that no one will catch on to.

"Another surprise - and this primarily pertains to the casino - is the frauds that get committed despite an area with 1,000 to 2,000 cameras watching every minute of every day. And finally, it's the willingness of employees to come forward to report a fraud, but too often only after they have been cut out of the fraud. Once they lose their opportunity to pocket a few extra dollars, only then do their consciences kick in," he said.

Rudloff said while employees perpetrated a majority of the frauds he and his team examine, they were "not necessarily" to blame for the highest-dollar losses.

"Some of the bigger-dollar frauds have come at the hands of well-trained teams who visit any casino to look for a weak dealer or other employee and then exploit that weakness for as long as they can," he said. "I'm not talking about card counters; I'm talking about cheats who specifically target a casino."

MONITORING THE MASSES 

As an internal auditor for MGM MIRAGE, Rudloff examines more than just casino fraud. There are millions of patrons, hotel and casino staff, vendors, construction workers, and other contract workers who all produce loads of their own paperwork and who need to be monitored carefully.

"In the past several years we've investigated potential frauds by snack bar cashiers and housekeeping attendants, by managers and executives, and by contractors and tenants," Rudloff said.

"Some fraudsters worked alone while others worked with several conspirators. Some were long-running frauds, and some were brand new. Some were found by way of audit, and others by way of anonymous tips. However, the common denominator in every one of the frauds was a breakdown in internal controls. Controls were either ignored because no one was paying attention, or circumvented through collusion. In almost all of the cases though, had the internal controls worked the fraud would have been prevented or detected."

Rudloff said security is tight in all the MGM MIRAGE properties. He said the company invests a lot of money training employees on how to spot scam artists and avoid falling for the frauds that prey on weak links. It has planted cameras everywhere in and around the casino properties, which send real-time video that specially trained surveillance personnel review 24/7. And of course, Rudloff and his team of auditors handle fraud examination, often working with corporate security.

"Any cash-intensive business is at risk, and the more cash on hand, the more susceptible that business will be," Rudloff said. "Because of the design of our industry's regulations and our own internal controls, the cash is relatively secure. The fraud examiner needs to focus on the weaker areas within the organization.

"In many places of our business, exemplary customer service can't always be delivered when controls are too strict. It's that band that spans between the 'controls' and 'customer service' that always concerns me. We have to understand the opportunities that exist for employees, our suppliers, our vendors, and others to make bad decisions," he said.

MGM MIRAGE and Infinity World Development Corp. are building CityCenter on the Las Vegas Strip, set to open in December this year. Rudloff said the new property will be "the largest privately funded construction project in the United States, with a price tag of about $9 billion."

He said this project and several others keep him and his fellow fraud examiners on their toes.

"Construction presents a big vulnerability," he said. "At peak construction [of CityCenter] there will be more than 8,000 trade workers on site in six towers, a retail complex, and a convention center. There are hundreds of individual contracts to monitor, and all of them are subject to audit. And all of this work [has been taking place] in less than five years. That is a monumental task."

Rudloff said there's always a chance an unscrupulous contractor will "overbill for work performed, bill for work not performed, or rig bids for the work done." He said he also worries about the risks involved with tenants who "don't report all their sales and underpay their rent" as well as suppliers "who don't deliver on their commitments or substitute a lesser-quality product compared to what we requested and paid for." It's already a tough job keeping all these outside players in line, but he has to consider scores of additional internal risks.

"The opportunity for management override of controls is a risk for us as each of our casino resort properties operates autonomously," he said. "Each property can choose to do things somewhat differently, so do we see anomalies because things were done differently or because there was fraud?"

MGM MIRAGE is expanding globally. Rudloff might already be a risk juggler, but now he's adding a few more balls to his routine.

"We are diversifying our product portfolio by getting into management contract relationships with partners who build hotels and hotel-casinos that we will then run," Rudloff explained. "Since these arrangements are being made in foreign countries, we could run into FCPA [Foreign Corrupt Practices Act] concerns, as well as language, cultural and other general business-practice differences that we may not be fully prepared to deal with."

A CAUSE FOR ALARM 

It's a risky time to expand - domestically and internationally. Many businesses worldwide are struggling to make ends meet and remain afloat through the recession. But for those in the gaming and entertainment industry, times have been especially tough, and fraud has been rampant.

"Every one of our internal auditors has been put on high alert to be on the lookout for abhorrent behavior or unusual financial results, either of which could be an indicator of fraud," Rudloff said. "With the turning of the economy last year, we have seen an increase in the number of frauds detected."

In times like these, Rudloff said he's grateful the company has implemented certain safeguards like the employee hotline, which allows employees to anonymously report suspicious behavior and possible fraud.

"The company's employee hotline has been a great benefit to the organization," he said. "Incidents reported through the company hotline increased 100 percent from the third quarter to the fourth quarter of 2008, and an additional 80 percent from the fourth quarter of 2008 to the first quarter of 2009. Based on what gets reported, I'm concerned at the many more scams that have not yet been caught."

Rudloff said the internal auditing team manages the company's ethics hotline through a third-party provider. The team decides how each tip will be investigated. Though team members don't participate in all investigations, he said they're responsible for monitoring the cases' progress and reporting results to senior management and the board of directors' audit committee. It's a lot of responsibility, especially now when there are so many more cases than usual to be investigated.

"We encourage the auditors to go beyond the regulators' 'checklists' and ask more deep and probing questions and follow up on whatever just doesn't make sense," Rudloff said. "The Nevada checklists cover hundreds of testing procedures, walk-through questions, and other audit steps, all of which are built around the state's gaming industry regulatory structure. Most of the questions have a yes/no answer. While the yes/no answers satisfy the regulatory aspect of what we must do, it doesn't help the business work more effectively.

"When we have an error, I want the auditors to find out why it happened. It's easy to tell management they had an error, but it's only after we can let them know why the error occurred that they can start to make effective corrections."

Despite the heightened risk for fraud during the recession, and an increase in the demand for fraud prevention and examination, Rudloff said the MGM MIRAGE management and staffs have to walk a fine line between tighter internal controls and good customer service.

"Wherever we have to balance sound internal controls with good customer service we create a gap where fraud could occur," he said. "No customer wants to hear about the rules when having difficulty checking into their hotel room, ordering room service, charging services at the spa, or purchasing merchandise at a retail store. That difference could easily mean the difference between our being awarded three, four, or five diamonds, and we can't charge our customers as much for a three-diamond experience as for a five-diamond experience.

"That gap has always created risk and always will create risk. For that reason the other elements of the internal controls - those that are invisible to the customer - have to be working properly to minimize the opportunity for fraud," said Rudloff.

GO 'ALL IN' FOR FRAUD PREVENTION 

Any business manager who doesn't make fraud prevention a priority during this recession is betting against enormous odds that the business can withstand being defrauded or won't be defrauded in the first place, Rudloff said. He suggests no manager make that gamble.

"Too often management is in denial about fraud," he said. "Because they have never seen it, they doubt it exists."

What's more frustrating to Rudloff, however, is when management won't take action to stop a fraudster in his tracks, even after fraud examiners have presented sufficient evidence.

"While I was working for another company in Atlantic City we had a marketing executive who cost the company more than $10 million," he said. "He personally benefited from some of that amount directly while his customers benefited from the bulk of that amount by way of casino markers that were never collected. It's not just the amount that was shocking but the breadth of the fraud. Most shocking of all was management's denial when all of this was presented to them.

"It took months of persistently applied persuasion to get [management] to see what this marketing executive was costing the company - and in this intervening time the company continued to lose more. Management was too focused on the top-line revenue the marketing executive was producing, not that we were losing money on each dollar in revenue produced."

Management must be sure to hold themselves to the highest ethical standards if they hope to keep their employees honest, Rudloff said.

"An ethical culture starts at the top of the organization and works its way down," he said. "Too often in the past decade there were some very ethical people who worked for executives who were not so ethical. The ethical people were allowed to be swayed for a variety of reasons, and people crossed lines that they never thought they would ever cross.

"You have to know where your line is drawn and you have to be committed to never crossing it," Rudloff said. "I left a job once because I was asked to cross that line. I wouldn't do it, and more importantly, I didn't want to work for an organization that would ask me to cross that line. You can get another job, but you can't get a new reputation."

TO CATCH A CHEAT 

Before a business can implement an effective fraud-prevention plan, Rudloff said each employee must become fully familiar with how the business works.

"If you don't know the business well enough, you can't know the pinch points where fraud can occur or the red flags that may point to fraudulent behaviors," he said. "Sometimes internal controls are bypassed because it's faster to go around the controls just to get the task completed. Or in some cases, controls are designed ineffectively so that there are overly burdensome steps that don't add any real value or don't achieve the intended result. Employees - and sometimes outsiders - figure this out quickly."

At MGM MIRAGE, Rudloff has implemented several anti-fraud procedures that he said have made a significant impact on reducing the occurrence of fraud. Among those procedures was the implementation of the employee hotline. Also, when his team finds a weakness in the processes or controls at one location, they're quick to share it with management at the other MGM MIRAGE locations to prevent any similar weaknesses.

"It won't necessarily involve another audit," Rudloff said. "Rather, we can alert management to the problems we've seen elsewhere so they can take a look on their own without necessarily needing internal audit involvement."

Rudloff said he knows that managers and members of his internal auditing team must work together to prevent fraud from reducing the company's bottom line. That's why he makes sure managers know they can request internal audit to perform special projects.

"If management has a concern, then there is likely a risk that is not yet mitigated," Rudloff said. "By keeping the channels of communication open, management is very willing to invite us in to quickly address whatever issues are found."

Management at MGM MIRAGE has also been very helpful in meeting Sarbanes-Oxley (SOX) compliance standards, Rudloff said.

"Through our company's SOX-related efforts, more and more management have been exposed to fraud risks," he said. "This hopefully keeps them more attuned to problems that may exist and opportunities to improve controls that mitigate the exposures to fraud activity."

To keep his team of internal auditors current on the latest fraud risks, Rudloff said MGM MIRAGE hosts a semi-annual day-and-a-half training program called "Audit Forum." He said the company also sends its auditors to external conferences that emphasize audit and anti-fraud training.

He said it's important for his team members to take advantage of regular training opportunities because they issue more than 400 audit reports a year. They should have specific traits, too.

"A healthy level of skepticism is important," Rudloff said. "Sometimes the work can get tedious, and the auditors can get bogged down in the details of the audit and not keep their eyes open. The same can happen by anyone investigating fraud - particularly those who don't do it on a fully dedicated basis.

"Investigators need to keep an open mind about their business and think about the answers to straightforward questions," he said. "[They] need to think about the answers they are given: Was it a real answer or the answer that the investigator or auditor wanted to hear?"

Rudloff said the best any company can do is to learn the business backward and forward, implement a fraud-prevention plan, train its staff, and open up lines of communication between managers and staff. Once a company has preventive measures in place, the possibility of fraud or theft will be greatly diminished. But Rudloff warns that despite your company's best efforts to prevent fraud, it's so pervasive that it is, of course, impossible to prevent it all.

"No internal control system is perfect - the perfect system would be too costly," he said. "No audit is perfect, either. We just try to get both the controls and the audits to be as good as they can possibly be."

Amy Logan is assistant editor of Fraud Magazine.

Rudloff Lists Common Casino Frauds He's Fought in 29 Years  

Robert Rudloff Jr., CFE, CIA, vice president of internal audit for MGM MIRAGE, has been examining casino fraud for 29 years. He addresses a few common types of casino fraud perpetrated by employees:

Comp Fraud happens when employees misuse authorized complimentary transactions for their personal gain. In simplest terms, imagine two parties dining next to each other in a restaurant. One party has a complimentary service voucher (comp) and the other is paying in cash. The party on the comp spends $100 at dinner, while the party paying in cash spends $300. A restaurant employee - a server or a cashier - switches the two transactions by closing the cash check with the comp, which had more than $300 credit assigned to it, and the comp check with the cash. Then he pockets the $200 difference with no one the wiser.

A front-desk employee can pull the same scheme by transferring charges from a guest's "pay" folio to the "comp" folio and then pocketing whatever was paid to the front-desk employee in cash. A folio is a list of charges that a hotel customer receives under the hotel room door or at check-out. In the casino hotel business, it's common for a guest to receive two folios: One that's comped (such as room and tax) and one that the guest must pay for (such as tip, meals, room service, etc). In both examples, it's that gray area between control and customer service that's the weak point.

In an actual example of refund fraud, an employee in the billing department was refunding customer balances to her own credit card. When some customers checked into the hotel, they placed $50 or $100 on deposit for incidental charges. They checked out without getting a refund of the unused balance. After a few weeks, the employee would refund the balance to herself and then withdraw the credited balance from the ATM in the casino lobby. This fraud could be linked back to several internal control breakdowns.

Not all casino frauds are committed by employees. Rudloff lists examples of common casino frauds perpetrated by outsiders:

Counterfeiters: Customers will try to pass counterfeit currency to employees who, by the nature of the business, are working in low-light conditions. All employees who handle currency and chips receive some training in detecting counterfeit currency. Most currency is not counterfeited well and the employees can often tell by feel alone if a bill is bad. Likewise, counterfeited chips will usually have a different feel, too. Employees who handle real currency and chips all day get very accustomed to what's real and what's not. There's a bigger risk in bill validators on slot machines. Counterfeiters will test machines to see those few slot machines that will accept counterfeit bills so they can pass the bad currency without involving an employee.

Money Launderers: Customers will try to use a casino like a bank to launder money or otherwise try to make dirty money look clean. These customers will try to pump a lot of cash into the system while looking for ways to avoid having the cash reported to the Federal government of currency transaction reports.

Past Posters: Customers will try to place a wager after the winning number on Roulette or the winning combination in craps is already known. It all relates back to employees paying attention and to on-the-floor supervision and surveillance monitoring. Dealers and supervisors have to be on high alert for customers who try to cheat. They're trained to keep their eyes on their games at all times and to resist being distracted - and customers will try to distract dealers.

Credit Fraud: Customers will open a credit line, draw against that line at table games, and repay their credit diligently while increasing that credit line at the same time. Then, they take one last shot at the casino, draw down their credit line, and walk out with the chips to cash later, or they pass the chips to others to cash for them but never repay that final credit amount extended.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.