Skimming Some off the Top

Randy was a manager of a small sporting goods store that always turned a tidy profit. He was a perfect employee — a little too perfect. He thought no one would notice that he was skimming from the cash register. Learn how to catch a fraudster in this classic scheme and how to set up internal controls so it never has to happen.

Sam and Karen owned a small chain of about 20 sporting goods stores on the East Coast of the U.S. They acquired their latest store in a small suburban town of 40,000 residents. The market base of this successful little store grossed $750,000 yearly in total sales. Many of its customers included military personnel from a nearby base, so a major part of the store’s market continually changed. 

The manager of the newly acquired store, Randy, was a model, stable employee with a strong work ethic. His employment history was impeccable, he was dependable and generally pleasant, and he was knowledgeable about the products. 

Sam and Karen believed that the store would continue to be viable. However, after about a year, the store’s profit appeared to be slipping. Sales remained strong, but repair and/or installation of sporting goods were decreasing. 

The store was about 100 miles from the chain’s home office and 60 miles from the chain’s closest store, so it was difficult for management to conduct hands-on supervision. It was time for a visit.

Sam and Karen arranged a dinner meeting with Randy and his wife. They discussed concerns about the slipping sporting goods repairs but also praised him for his accuracy. His store was the only one in the chain at which the cash registers’ total numbers, the bank deposits and the change till never varied. Randy said there was no secret to the exact balancing; he just made sure he and the employees who had access to the cash registers were exacting and accurate in their change-making. Sam and Karen asked Randy to document his procedures so they could give them to the other stores for guidance. 

After the meeting, Sam and Karen noticed a distinct increase in the sales category of service labor (sporting goods repairs and/or installations) with a commensurate decrease in parts and accessories. They then contacted me for help. After the initial meeting with the owners, I asked to see the individual bank deposit records and the complete cash register records that included the cash register “Z” tapes, which recorded all sales and transactions for each shift and working day. I quickly developed my theory of fraud, which I was able to prove through an extended records examination, fraud operational tests and, ultimately, a confession-seeking interview with Randy, the manager.

Investigation Findings 

1. I found significant “no sale” register opening events during an analysis of the cash register transaction tapes.

2. My examination of the bank deposit records, the cash register “Z” tapes and the records of the cash drawer reconciliations indicated there was never a shortage or overage in the register change fund.

3. The cash register transaction tapes indicated a gradual decrease in the sales category of “service labor” in relation to the other sales categories. However, that category dramatically increased the next day after the owners’ dinner meeting with the manager and his wife.

4. The cash register transaction tapes indicated a dramatic decrease in the sales category of “parts and accessories” the day after the owners’ dinner meeting with the manager and his wife, as compared to previous days and reporting periods.

5. Separate records of the service labor and parts category were available in the form of service work orders. When a customer presented an item needing service, an employee filled out a service work order by hand with the requested service and/or repair work. The employee used the order to estimate labor and charges for parts, marked it paid in full, dated it, gave a copy to the customer and retained a carbon copy at the store. The service work orders, filed in boxes in the basement by month, were not used for record-keeping purposes. I reviewed these orders and reconciled them to the cash register tapes, and I found the orders indicated greater labor amounts than the tapes. 

6. I analyzed a six-month period of the service labor amounts as recorded on the service work orders instead of the cash register and bank deposit records, and I found that service labor amounts were generally consistent with prior periods.

The evidence indicated that the manager was diverting the service labor receipts for personal gain; he was skimming money from the register. (Skimming is a subset of cash schemes, which is a subset of asset misappropriations on the ACFE’s Occupational Fraud and Abuse Classification System — the Fraud Tree.)

A customer would not be suspicious because he or she received a hand-written receipt — a service work order — that was marked “paid in full” and dated. Randy then opened the cash register with a “no sale” opening, inserted the payment and made change. 

At the end of a day, Randy ran the “Z” total for the register, counted out the cash and checks, re-supplied the register with the required $140 in change in various coin and bill denominations and deposited the exact amount identified on the “Z” tape as expected. Because the “no sale” openings occurred to make change for unrecorded receipts, Randy simply pocketed or skimmed the difference.

My theory of fraud was supported by the “no sale” openings of the register, the conspicuous lack of change-making errors or variances in the register amounts and the analyses of the service work orders.

The owners, Sam and Karen, bristled at the evidence supporting the theft, which, admittedly, was not overly creative. It was a simple cash register receipt-skimming scheme that was quite brazen in its execution. They were anxious to conclude the investigation work and dismiss Randy. However, I suggested additional due diligence. I convinced Sam and Karen to secretly place $125 cash in the cash register without an associated sale. I convinced them that if Randy was so conscientious about the accuracy of his register duties, the additional money in the register would be a major issue to him, and they would certainly hear from him about the money.

So, one day Sam and Karen visited the store unannounced. Sam discussed technical aspects of some of the products with Randy, and Karen surreptitiously slipped $125 into the cash register. As I predicted, the overage did not prompt a response from Randy. The daily deposit and reconciliation of the cash drawer and “Z” tape was once again to the penny.

I recommended a second fraud operational test by inserting another random amount in the cash register. The owners complied, and again Randy expressed no concern and showed a perfectly accurate, to-the-penny daily deposit and reconciliation of the cash drawer and “Z” tape. It was time for an on-site investigation and a confession-seeking interview.

CALLED ON THE CARPET 

The “Z” tapes indicated the manager totaled out the cash register each evening as part of his daily store closing routine. He prepared the deposit some time during the next morning, and he made the previous day’s deposit just prior to noon. 

The chain owners and I entered the store at about 11:30 a.m. Sam engaged Randy and the employees; Karen and I searched Randy’s office. We found three distinct caches of money. The first was a deposit with an attached bank deposit form. This pile of cash also included some checks and credit card transactions. 

The second pile of money, which obviously was Randy’s change fund, consisted of rolled coins, singles and fives. The third stack of cash was intriguing: $269 with a deposit slip to a bank account that I ultimately determined to be the manager’s personal account. 

The owners asked all the store employees, except for Randy, to leave for an extended lunch break. We locked the doors, and Sam, Karen, Randy and I sat down to discuss the fraud. I confronted Randy with the theory of fraud, the facts from my analyses and fraud operational tests and, finally, the pile of cash in his office. He said nothing.

I told him we just wanted to get to the bottom of the problem. I asked him whether he had deposited all the money to his bank account. He said the third pile of cash we had found in his office was “extra cash” from the register, and he rarely deposited it to his personal account. He said he mostly used it to buy lunch for the store employees or for personal pocket cash.

The owners addressed Randy with prepared statements, which I had insisted that I review prior to the meeting. He wrote a quickly prepared resignation letter, which included a tenuous confession regarding “extra cash” and “wrongdoings on the job,” gathered his personal property and departed. The locks were changed, and the owners declined my offer to continue my services to ascertain the full scope of the fraud. They were just happy to have resolved the issue and had no intention to involve the authorities. I calculated that the manager probably skimmed from $15,000 to $20,000 in about 10 months. There was no evidence that he ever had an accomplice.

The fraud ended when Randy left. Sam and Karen instituted my recommended improved internal controls:

1. The service repair records were now reconciled to the cash register tapes.

2. The owners created manager and assistant manager positions. These two employees rotated and split all duties so that the daily register “cash out” duties and the preparation of the deposit plus the accounting for the receipts were segregated.

3. The owners paid surprise visits to the store to perform unannounced register reconciliations.

Regardless of the new internal controls, Sam and Karen eventually closed and sold the store because they could not hire a dependable and reliable manager, and they believed that the store was too far away from their headquarters. The new owners have converted it into a storefront church. 

Sadly, this was a classic example of the fraud triangle, in which fraud results from the juncture of motivation, opportunity and rationalization. In this case, Randy might not have had a dramatic motive to skim. However, the opportunity of lax controls and inadequate managerial oversight coupled with Randy’s rationalization that it was only “extra cash” was sufficient to compensate and compel him to commit the fraud.

LESSONS LEARNED 

I learned in this case — my first — that everybody, especially those you least suspect, are capable of fraud. In the years since, I have investigated other cases of retail skimming. All of them have the common thread of a concentration of authority over the cash register reconciliation (cash-out) procedures in one individual, a lack of macro-level reconciliation and removed or distant owners.

I wished I had pushed the owners harder to prosecute. Randy is working in a sporting goods store 40 miles away. As far as I know, he has kept his nose clean.

All case-history names have been changed in this article. – ed.

John W. Marinucci, Ed.D., CFE, CIA, operates Insight Financial Investigations Service in Delaware, Maryland, Pennsylvania and New Jersey.

Sidebar: Skimming Schemes — ‘Off-book’ Frauds — Leave No Direct Audit Trails

Skimming is the removal of cash from a victim entity prior to its entry in an accounting system. Employees who skim from their companies steal sales or receivables before they are recorded in the company books. Skimming schemes are known as “off-book” frauds — money is stolen before it is recorded in the victim organization’s accounts, and the crimes leave no direct audit trails. A victim organization might not be aware that the cash was ever received because the stolen funds are never recorded. Consequently, it might be very difficult to detect that money has been stolen. 

Skimming is one of the most common forms of occupational fraud. It can occur at any point in which cash enters a business, so almost anyone who deals with the process of receiving cash might be in a position to skim money, including salespeople, wait persons and others who receive cash directly from customers.

Employees whose duties include receiving and logging payments sent by customers through the mail perpetrate many skimming schemes. These employees slip checks out of the incoming mail instead of posting them to the proper revenue or receivables accounts. Those who deal directly with customers or who handle customer payments are obviously the most likely candidates to skim funds.

SALES SKIMMING 

The most basic skimming scheme occurs when an employee sells goods or services to a customer, collects the customer’s payment but makes no record of the sale. The employee simply pockets the money received from the customer instead of turning it over to the employer.

Consider one of the simplest and most common sales transactions — a sale of goods at the cash register. In a normal transaction, a customer purchases an item and an employee enters the sale on the register. The register tape reflects that the sale has been made and shows that a certain amount of cash (the purchase price of the item) should have been placed in the register. It might be possible to detect thefts by comparing the register tape to the amount of money on hand. For example, if there was $500 worth of sales recorded on a particular register on a given day, but only $400 cash in the register, it would be obvious that someone has stolen $100 (assuming no beginning cash balance).

However, if the employee is skimming money it will be impossible to detect theft simply by comparing the register tape to the cash drawer. Returning to the example above, assume that an employee wants to make off with $100. Through the course of the day, there is $500 worth of sales at his register; one sale is for $100. When the $100 sale is made, the employee does not record the transaction on his register. The customer pays $100 and takes the merchandise home. The employee pockets the money instead of placing it in the cash drawer. The employee might ring a “no sale” or some other non-cash transaction to create the appearance that the sale is being entered in the register. At the end of the day, the register tape will only reflect $400 in sales because the employee did not record the sale. There will be $400 on hand in the register ($500 in total sales minus the $100 that the employee stole) so the register will balance. Thus, by not recording the sale, the employee is able to steal money without the missing funds appearing on the books. Of course, the theft will show up indirectly in the company’s records as inventory shrinkage. But the books will provide no direct evidence of the theft.

The most difficult part in skimming at the register is that the employee must commit the overt act of taking money. If the employee takes the customer’s money and shoves it into his pocket without entering the transaction on the register, the customer will probably suspect that something is wrong and might report the conduct to another employee or a manager. It is also possible that a manager, a fellow employee or a surveillance camera will spot the illegal conduct. Therefore, it is often desirable for a perpetrator to act as though he is properly recording a transaction while he skims sales.

REGISTER MANIPULATION 

Some employees might ring a “no sale” or other non-cash transaction to mask the theft of sales. The false transaction is entered on the register so that it appears as if a sale is being rung up. The perpetrator opens the register drawer and pretends to place the cash he has just received in the drawer, but in reality he pockets the cash. To the casual observer it looks as though the sale is being properly recorded.

Some employees might also rig their registers so a sale can be entered in the register keys, but it will not appear on the register tapes. The employee can then safely skim the sale. Anyone observing the employee will see the sale entered and the cash drawer open, yet the register tape will not reflect the transaction.

When the ribbon is removed from the register, the result is a blank space on the register tape where the skimmed sale should have been printed. Unusual gaps between transactions on a register tape might mean that someone is skimming sales.

SKIMMING DURING NON-BUSINESS HOURS 

Some employees will open stores on weekends or after hours without the knowledge of the owners and pocket the proceeds of all sales. For example, a manager of a retail facility opened his store at 8 a.m., instead of the posted time of 10 a.m. He pocketed all the sales made during those two hours. He rang up sales on the register as if it were business as usual, but then he removed and destroyed the register tape and all the cash he had accumulated. At 10 a.m. the manager started from scratch as if the store were just opening.

Excerpted and adapted from the Fraud Examiners Manual ©2011 Association of Certified Fraud Examiners. 

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.