Missing Disbursement Documents (Part 2)

In my previous column, I discussed fraud case studies that revealed some of the problems fraud examiners can encounter when supporting documents for disbursement transactions are missing. Here we conclude by discussing alternative procedures you can use to determine if the transactions were made to valid vendors for authorized business purposes.

HOW EMPLOYEES DESTROY RECORDS 

Unscrupulous employees usually become desperate if they think their carefully concealed disbursement frauds are about to be discovered. They often remove the irregular documents from the office files, burn them in their home fireplaces or barbecue grills, shred them, or discard them in the trash or landfill.

But some fraudsters will go even further. I've investigated a few cases in which the culprits tried to cover up their crimes with arson. Employers can lose accounting records and sometimes the entire office building to fire. Every time I see a newspaper article about a fire at a state agency or local government I wonder where the fire began and the type of accounting records that might have been destroyed. Here are two cases that will show why I'm often suspicious.

Case 1: Living The Good Life On The Town's Tab  

In an earlier column I discussed the case of Beth, a small-town clerk-treasurer who, for 20 years, had almost complete control of every one of the town's financial transactions.

Fraud investigators proved for certain that she embezzled $90,256 in three years by issuing checks to herself, to petty cash, or to a bank, and by using the town's credit card to make unauthorized purchases for herself.

Beth probably embezzled much more, but the fraud examination was hampered by a fire that started one night in the rear of the town hall building where all the accounting records were stored. Authorities suspected arson, but they weren't able to develop a sufficient amount of evidence to pursue criminal charges.

If Beth had been stealing before the fire, the proof was gone. But she did prepare and file false documents for unauthorized disbursement transactions after the fire. Beth tried to cover her tracks by removing and destroying most of these false documents from the office files, including all the supporting documents for the unauthorized credit card purchases. However, she neglected to destroy some of the other disbursement documents in the scheme, which eventually led to her downfall.

Case 2: Things Get Heated At City Hall 

Janice was a clerk-treasurer of a small city for more than 13 years. Even though the city was audited annually, the external auditors didn't encounter any irregularities during disbursement transaction testing until after a seasoned auditor with fraud experience happened to perform the testing. This auditor found different results and eventually discovered that Janice had embezzled $47,762 in the last six years of her employment.

The auditor asked Janice about some of the confusing findings, but Janice was vague and not very helpful.

However, the auditor knew the manually prepared check register had been falsified in at least two ways. First, the check register indicated that disbursement amounts were greater than the supporting documents on file for the transactions. The supporting documents weren't destroyed, even though the differences in the amounts were obvious. Next, the check register column for total disbursements was mathematically inaccurate; the total amount shown on the check registers was always greater than the amount of the individual disbursements listed. Also, some blank checks were missing from the city's files and were presumed to be voids.

When the auditor presented her findings to Janice the first time and asked for an explanation, Janice said inexperienced staff had probably made mistakes recording the information on the check register. But as the number of irregularities increased, Janice became noticeably irritated by the auditor's continued inquiries and finally stopped talking to her. The work environment became hostile as Janice evaded both the employees and the auditor. She attempted to deflect attention from herself to the "incompetent" office staff and demanded the auditor talk only to the staff. Janice's conversations were brief and terse, and her tone of voice became harsh and derogatory.

The auditor was concerned about the safety of the accounting records and began taking home the documents for the irregular disbursement transactions each night. It's a good thing she did; a huge fire destroyed the upper floor and attic of city hall soon after Janice stopped talking with the auditor. Additional auditors were assigned to the investigation at this point. City staff members told the auditors they were lucky because only prior-year accounting records were supposed to be stored in this location. However, partially burned checking account records from the current year were found on the lawn the following morning, which indicated that someone had taken the current-year records upstairs and torched them. Authorities suspected arson, but they weren't able to find enough evidence to pursue criminal charges.

The auditors then obtained copies of all the city's redeemed checks for the previous seven years, the maximum length of time banks are required to retain this financial information. The auditors determined the amount of the loss by listing all checks issued to Janice and then eliminating all payroll and travel checks that represented legitimate payments the city made to her. The remaining amount of the payments to Janice represented the total amount of the loss in the case. All of these unauthorized disbursement transactions used the missing blank checks that were presumably voided but which had actually cleared the bank. The amount of each check was approximately the amount of her normal payroll check.

Janice destroyed the extra payroll checks to herself after they were redeemed by the bank, but she didn't destroy the supporting documents for the irregular disbursement transactions in which she had inflated the individual line items on the check register. When the auditors compared the redeemed checks to the actual disbursement documents they had removed from city hall, they discovered the amount of these unauthorized checks always equaled the amount of the increase in the disbursements listed on the falsified check registers. Janice hoped her supervisor wouldn't notice the extra payments she was making to herself as he hurriedly signed all the disbursement checks, and she was lucky because he didn't.

We'll never know how much Janice actually stole, but she pleaded guilty to misappropriating funds from the city, made full restitution for the amount of the loss documented by the external auditors plus audit costs and was sentenced to 30 days in county jail. Her husband was a wealthy contractor and the family didn't need the funds she stole. This was simply a case of greed.

ALTERNATIVE WAYS TO SOLVE THE CASE 

If you're unable to locate the missing documents for transactions included in the disbursement tests you perform during an audit or fraud examination, the investigation probably will be incomplete, and you won't be able to make strong recommendations to improve the organization's internal controls. But don't despair; you have other options.

Confirming Vendors - You can avoid failed disbursement test results by confirming if the suspect payments were made to valid vendors for official business purposes. Review the information in the organization's vendor file. Then contact the bank and request copies of the organization's redeemed checks from its microfilm records. These are the most critical supporting documents for all disbursement transactions because they show you important details about the actual withdrawal of funds from the organization's treasury.

If the information on the faces of the checks or the endorsements on the backs of the checks have been falsified, the redeemed checks should tell you who received the proceeds from the disbursements, their bank account numbers if the checks were deposited in a bank account, and other personal identification information about the individual if the checks were cashed at a financial institution. Organizations shouldn't conclude that the intended vendors have received the payments until they've reviewed the fronts and backs of all redeemed checks.

Of course, even though the checks have cleared the bank and the organization's bank statements list the checks' numbers, dates, and amount of transactions, there's no guarantee that the original payees actually received the funds. An organization will often assume everything is fine if vendors don't complain about not receiving payments.

If the organization doesn't obtain its actual or electronic redeemed checks from the bank, you should verify the information for all redeemed checks in one accounting period from the bank's microfilm records or selectively verify this same information for certain transactions.

The method of selecting checks for this test will vary depending on the nature of the work. For example, if you suspect irregularities with checks from a particular vendor, you might request all the checks issued to that vendor. Or you can request that the bank submit either some or all the checks that cleared the bank during the period shown on the organization's bank statement.

In the near future, banks will begin to expand the services they provide to clients by charging organizations for the payee information shown on periodic bank statements. Organizations will be able to quickly see the information on the faces of checks, but they still won't see irregular check endorsements. In the United States, banks must keep microfilm records of these financial transactions for seven years. In my state, Washington, local governments and state agencies by law must obtain copies with their bank statements of all redeemed checks in actual or electronic form, such as a CD-ROM, or a pdf attachment with the bank statement, or in an e-mail.

Reviewing Vendors' Invoices - Review the invoice from a valid vendor for the month following a payment associated with the missing document. If the payment involving the missing transaction document is reflected on that invoice, then you can be less concerned about the missing documents because the appropriate vendor actually received the payment and credited it to the organization's account. But still be alert for document alterations.

Contact the vendor, either by telephone, by visiting the business location, or by writing a letter or sending a fax to confirm the payment associated with the missing transaction documents was actually received and properly credited to the organization's account. Don't rely on contact information in the invoice because it could be doctored. Find the vendor's number on the Internet, in the telephone book, or in other documents on file. Obtain a copy of the missing invoice from the vendor for your audit or investigative file.

Review the endorsement on the redeemed check for the payment associated with the missing documents to determine if the appropriate vendor actually received the payment and endorsed it. The receiving organization might even be able to provide you with a copy of the check from its records. If the redeemed check is also missing, which usually happens when disbursement fraud is involved, request that the organization obtain a copy of the redeemed check from its bank microfilm records.

When the bank performs these procedures, request that it transmit the redeemed check information directly to you rather than to an employee within the organization. I know of one case in which the bank mistakenly sent redeemed checks to the organization. An unscrupulous employee then falsified the bank records for the fraud examiners to try to avoid detection. The investigators quickly identified the false information because there was no bank processing information on the front of the checks directly under the signature areas. A second bank request for the redeemed checks yielded valid information that was needed to prove disbursement fraud had occurred.

FRONTS AND BACKS OF CHECKS 

The alternative procedures listed here are designed to discover if the disbursement associated with missing documents is an actual payment to a valid vendor for official business purposes. If you encounter only a few suspect transactions, immediately request that the bank send copies of the redeemed checks directly to you and not to the organization.

If you suspect a large number of transactions, use the steps in this column to reduce the size of your request for copies of redeemed checks from the bank's microfilm records. For example, in Beth's case this alternative research method resolved many of the questioned disbursement transactions with missing documents and saved a huge research expense. It also narrowed the scope of the review to only those transactions in which the disbursement fraud risk was highest. The external auditors were then able to pursue bank confirmation procedures for these remaining transactions.

Ultimately, the attributes on the front and back of the redeemed checks should provide all the information you need to identify who actually received the proceeds from the suspect transactions. Follow those leads to resolve the case by determining if the disbursement was to a valid vendor for a legitimate business purpose or if a fraud occurred.

LESSONS LEARNED 

Let's review some of the finer points of fraud detection from the two fraud cases in this column. When supporting documents for disbursement transactions are missing or have been destroyed, you should:

• Determine if the payments were made to valid vendors for official business purposes.
   
• Know that common staff responses for missing documents are: "an employee is probably using them for research purposes" or "they might have been misfiled."
   
• Always compare check register entries for agreement and make sure payees and amounts match the information shown on the supporting documents for the transactions.
   
• Always verify the mathematical accuracy of column total amounts on accounting records – particularly check registers.
   
• Always account for all issued checks and specifically look for "voids." (Fraud is always present when voided checks actually clear the bank.)
   
• Look at the next monthly vendor statement to determine if the payment was properly recorded, contact the vendor to confirm receipt of the payment, and review the endorsement on the redeemed check to determine if the disbursement is valid.
   
• Obtain a copy of the missing invoice for your audit or investigative file.
   
• As a last resort, use the bank's microfilm records to ensure the validity of any questionable disbursement transactions.

IS THERE MORE? 

Absolutely! In a new series, We'll continue our discussion about altered supporting documents for fictitious disbursements in the next column. This presentation should be an eye-opener for everyone.

Regent Emeritus Joseph R. Dervaes, CFE, CIA, ACFE Fellow, is retired after more than 42 years of government service. He remains the vice chair of the ACFE Foundation Board of Directors. 

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.