Liquid Embezzlement

When Washoe County Water Resources implemented new business software replacing its legacy system, a trusted employee of nearly 20 years managed to override the controls in the new software and embezzled more than $2.2 million in just one year. Here’s how his scheme was uncovered.

On April 25, 2008, a 4.7-magnitude earthquake struck the Highland Canal, northwest of Reno, Nev., substantially damaging the old wooden water Flume 14 and cutting off the area’s water supply to the regional Chalk Bluff Water Treatment Plant.

After the water was flowing again, the county conducted an audit of water rights and resources, which revealed a multimillion-dollar fraud that had been craftily executed by Paul Orphan, a longtime water engineer who worked in the Washoe County (Nevada) Water Resources (WCWR) department.

Jaclyn O’Malley of the Reno Gazette Journal reported on Oct. 14, 2008 that Orphan had successfully embezzled more than $2.2 million in just one year.

MODERNIZING COMPUTER SYSTEMS 

Before the earthquake, Washoe County wanted to modernize its internal business processes, improve data sharing among departments, and update services to its citizens, according to Cory Casazza, the manager for the county’s new network. In 2003, the county implemented new, state-of-the-art business software to replace its more than 20 outdated and expensive payroll, financial accounting, and human resources “stand-alone” computer systems. All systems now were connected to each other in one network.

The new software is structured on three essential elements: master data that are relatively fixed, transactional data, and business rules. Master data include information about vendors, customers, and materials such as name, address, phone, and identification number. Transactional data represent the information used or gathered when sales, purchases, payments, or other events occur. Business rules include what’s necessary for the organization, limits of financial transactions, and other controlling metrics.

When the county implemented the new software, it reviewed WCWR’s business rules, internal controls, and procedures to see what should be included in the new system. One rule stipulated that the chief water engineer could authorize unplanned purchases for repairing broken water mains in emergencies. For example, if a major water main ruptured over a weekend and water service ceased to citizens, Orphan could independently authorize a repair and get service restored quickly.

The county retained this emergency purchase business rule and configured it into the new system. Orphan could then override the computer’s checks and balances to approve emergency purchases up to $5,000. For purchases greater than $5,000, Orphan needed permission from his supervisors, Bill Hutchins, county finance director, and Rosemary Menard, WCWR director. For expenditures greater than $25,000, the county’s purchasing department approval was required, and the legal department or district attorney might review purchases.

In May 2006, the county asked Orphan to explore well capacity purchases in two areas south of Reno. Every well has a certain volume it can produce. The purchaser of the well water capacity owns a pre-determined quantity of water from that well.

Orphan created two bogus companies, D&B Enterprises and PKE Holdings, and opened bank accounts for each. He now had a scheme for embezzling funds.

From August 2006 through March 2007, Orphan produced false agreements between the county and his two bogus companies for water rights that didn’t exist. Because of his authority as water engineer, Orphan was able to authorize checks written by the county for water rights as long as they were under the $25,000 limit with his supervisor’s unauthorized and falsified approval.

Orphan would approve checks through the county’s new computer systems. Business rules required developers and other vendors receiving checks to appear, provide identification, and sign for receipt. But Orphan was able to bypass this control by instructing clerical personnel in WCWR to pick up the fraudulently generated payments from the accounts payable department at the same time they picked up regular payroll checks. He then deposited the checks into the D&B Enterprises or PKE Holdings bank accounts.

SHAKE-UP CAUSES REVIEW 

After the earthquake, the WCWR audited its inventory of purchased water-well capacity rights and discovered inadequate documentation and discrepancies. Bill Mikawa, the county internal auditor, said the records were so convoluted he wasn’t even sure which well-capacity rights the county owned.

In March 2008, an alert WCWR accounts payable employee told Hutchins, Orphan’s supervisor, that Orphan had approved a request to purchase well-capacity rights without proper permission. Hutchins confronted Orphan, who denied any wrongdoing.

Then, on May 12, 2008, Hutchins received an e-mail from Orphan asking him to approve a water capacity purchase for $48,500. In the e-mail, Orphan suggested the water rights might be resold for $110,000 and that it would be in the county’s best interest to complete the purchase. Hutchins was suspicious, so he had Orphan’s office computer searched and discovered that Orphan had been creating fraudulent purchases of water rights to his bogus companies.

The county notified law enforcement authorities of its suspicions and the legal case was made against Orphan on May 27, 2008.

On June 10, 2008 KOLO 8 TV reporter Ed Pierce reported that a county clerk had suspected that Orphan might have committed a fraud. By that time, Orphan had been employed with WCWR for 20 years and was the utility division’s engineering manager.

The suspicious clerk had a relative working at John Ascuaga’s Nugget Casino and Resort in Reno. The relative mentioned that Orphan was a frequent gambler who received spa treatments and concert tickets because of his “high-roller” status.

It was discovered later that Orphan was able to commit the fraud that helped him maintain that status by hijacking the computer identities of his supervisors to override the computer system and approve the fraudulent transactions, according to Jaclyn O’Malley’s June 20, 2008 report in the Reno Gazette Journal. The county did have a strict policy requiring password secrecy, which Orphan had been able to circumvent.

EXTERNAL FRAUD EXAMINATION 

Almost immediately after the authorities had been contacted, Katy Simon, the county manager, requested an external fraud examination and issued a memo to county employees on June 10, 2008, explaining that “this has been devastating to our Dept. of Water Resources employees as well as the rest of our county family.

“While more details answering the obvious question of ‘how did this happen’ can’t be answered until the criminal investigation is completed,” Simon wrote, “I can tell you that Washoe County takes its financial accountability and responsibility very seriously and has been increasingly aggressive over the years in implementing accounting controls to prevent and uncover such improprieties... . This is a serious situation that not only has financial implications, but also employee trust and integrity issues associated with it.”

According to a June 18, 2008 article by Susan Voyles of the Reno Gazette Journal, Washoe County Commissioners subsequently approved an amount to exceed $100,000 and hired Grant Thornton to provide forensic accounting services focusing on 41 transactions amounting to more than $2.2 million that dealt with Orphan and his fabricated companies. Also, the county contracted the forensic auditors to investigate sales of water well capacity or other intangible assets to WCWR.

Simon then initiated an administrative investigation into all business processes. She publicly stated at an organizational effectiveness committee meeting of Washoe County on June 11, 2008, that the county recently had strengthened controls by approving a policy requiring the review of all transactions in all departments. Nevertheless, she said, employees who have inside knowledge and criminal intent can misuse systems for a long time.

She said the prior internal audits of WCWR had focused on a sampling of procedures and that Orphan’s transactions had been compliant with policies and procedures at that time.

NUMEROUS DEFICIENCIES, LESSONS LEARNED 

After Simon’s report, the audit committee pushed for a review of purchasing practices; more checks on transactions; and verification that goods were real including checks on business licenses, Internal Revenue Service records, and business addresses.

Ron Nicholson, CFE, the county audit committee chair suggested that WCWR: 1) use an escrow agent for future capacity purchases 2) implement an automated software monitor to report suspicious and repetitive issues and 3) create a fraud hotline for employees.

This case clearly revealed major internal control deficiencies in handling of water right intangible assets, creation of new vendor accounts, and violations of policies and procedures on issuing checks.

Orphan was given the authority to purchase well-capacity water rights, an intangible capital asset. He was then able to create documents representing the sale of bogus water rights by a fictitious company. The transactions were processed through the county’s financial reporting system and approved by multiple levels of management.

How could this happen? Inadequate internal control procedures validated the receipt and authenticity of the water rights by someone other than the person initiating the purchase – Paul Orphan. There was no second-party verification that these water rights, as well as the vendor contract, were, in fact, valid.

In Nevada, this should have been a simple procedure because there are a limited number of water rights. The Nevada Division of Water Resources, which facilitates the purchases and sales of all water rights, maintains a water rights database for the entire state. The data includes information about current ownership, the point of diversion, place of use of the water right, diversion rates, manner of use, well log information, protest and ruling information, as well as dates required for filing various proofs.

Forensic internal auditors performing the Washoe County Annual Report dated June 30, 2008, recommended that internal control procedures include the validation of these water rights by someone other than the person initiating the purchase of these rights, and the county should consider obtaining an independent appraisal of value for assets in the purchasing process.

Orphan not only created the two fictitious companies, he also set up bank accounts in which he could wire or deposit checks from the county for payments of the water rights. He created these shell companies, so, obviously, he also had signing rights to withdraw funds.

When Orphan approved the purchase of water rights from his fabricated companies, the contracts passed through the financial reporting system; the accounts payable department then created accounts for the companies in the vendor master file. Orphan wasn’t required to prove physical verification of existence, and he gave the department false IRS documentation.

The auditors believed that verification of the contract information would have prevented this scheme and exposed the fake vendors. Regardless, creation of fictitious vendors is a common fraud scheme. An argument can be made that an employee who isn’t directly involved in the creation of vendors should perform a double check of all new vendors.

When the organization has inadequate staff to verify every new vendor, it would be appropriate to develop vendor verification criteria. Common approaches are 1) to verify existence of all vendors that are paid more than a certain dollar amount, or 2) to make a random sample of all new vendors. Also, all vendors receiving payments to post office boxes must provide physical addresses and phone numbers that can be verified.

Orphan pleaded guilty to stealing $2.2 million from Washoe County and said he was sorry. On Oct. 14, 2008, he was sentenced to 30 years for embezzlement.

Alexander J. McLeod Jr., Ph.D., is an assistant professor in the Accounting and Information Systems Department in the College of Business at the University of Nevada-Reno. 

John R. Mills, Ph.D., CPA, is a professor in the Accounting and Information Department in the College of Business at the University of Nevada-Reno. 

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.