St. Valentine's Day massacre (revisited)

As we discussed in part 1 of "St. Valentine's Day Massacre (revisited)" in the July/August issue, Alex was the assistant operations manager of a sports dome in a large Washington city. Because of his key position in the organization, he was able to compromise the internal control system by acting in collusion with a legitimate vendor to manipulate purchasing transactions and cause his employer to issue disbursement checks for personal benefit. This scheme resulted in losses of US$491,829 for 10 years.

FALSE INVOICE

Below, see a copy of one of the actual false vendor invoices from this fraud (Figure 1 below). This invoice contains several "red flags" that went undetected by the sports dome, the city and the city's external auditors. Would you have been able to spot these clues before the city's police department detected the fraud by other means? Once again, review this invoice carefully, and let's find out.

Here's the most important red flag on the vendor invoice — the confusion over whether an employee picked up the item purchased from the vendor or whether the vendor delivered the item purchased to the sports dome's central delivery destination. Were you able to identify this red flag?

While the invoice indicated that the vendor delivered the merchandise to the sports dome, it also showed that the transaction was placed in "will call" status, meaning that the assistant operations manager would pick up the merchandise at the vendors' business. Obviously, both actions can't be true. Since Alex received the item and signed the invoice rather than a staff member at the central delivery destination, this proved that he actually picked up the merchandise at the vendor's business. This issue could also be resolved through a quick telephone call or a brief visit to the vendor.

[Figure 1 is no longer available. — Ed.] 

Once you have the answer to this first question, the other two red flags quickly present themselves. First, why does this purchasing transaction circumvent the sports dome's receiving procedures and its central delivery destination? Second, why did Alex order the merchandise, pick it up from the vendor and then authorize the transaction for payment? It should now become very obvious that Alex is definitely overstepping his normal job boundaries. However, none of these three red flags were discovered until the fraud investigation began, and this was about 10 years too late to prevent this huge loss from occurring at the city.

ONE COMPLETE PURCHASING TRANSACTION FROM THIS CASE

Figure 2 (below) shows a copy of one complete purchasing transaction from this fraud. Study it carefully to see exactly how the scheme was perpetrated. This example includes the original delivery ticket for the fixed asset actually purchased and the three false invoices for consumable items that the vendor sent to the city for payment. In figure 1, the false purchasing invoice is the first invoice shown in the middle of the table. (The other two false purchasing invoices were very similar and aren't presented here.) 

[Figure 2 is no longer available. — Ed.]

THE CONCEPT OF OVERSTEPPING JOB BOUNDARIES

Every now and then a key fraud concept will pop out of nowhere. I first recognized the concept of "overstepping job boundaries" when I was working on this investigation. I knew then that I would never forget it. In fact, the concept appeared again in another case later that same year. And now that I reflect back on my prior experiences in purchasing fraud cases, I can see the concept in operation in those cases as well. This stresses the importance of matching real faces with the names recorded on purchasing documents to help determine if the transactions are valid. (I first discussed this idea in the September/October 2003 issue of The White Paper, the predecessor to Fraud Magazine.)

Employees often perform tasks outside their job descriptions or positions. When they're trusted employees, no one within the organization questions what they do or why. When their signatures appear on purchasing documents, auditors and fraud examiners may not realize the true identities of the persons behind the transactions. This is especially true if the signatures aren't even legible, as they often were in this case.

There are three key components on each purchase invoice document — a narrative description of the item being purchased, the signature of the person performing the receiving function and the signature of the person authorizing accounts payable to make the payment.

Depending on the size of the organization, there could also be several documents involved in a single transaction. For example, there could also be a requisition form, a purchase order, a receiving report or a vendor's invoice.

SUSPICIOUS SIGNATURES

The purchasing internal control checklists I've seen through the years usually ask if two individuals have signed the supporting documents — the person receiving the merchandise and the person authorizing the payment. While I followed these steps early in my career, I eventually realized that this work was just not good enough to find fraud. Fraud examiners often assume that the individuals signing these documents occupy a position in the organization that is authorized to perform these functions. Since that isn't always the case, making this mistake can lead to tragic consequences and perhaps even a failed audit. The false billing scheme case above caused me to permanently alter my audit approach to the purchasing function. I hope you, too, will learn from this experience.

Alex was the assistant operations manager, the third in command at the city's sports dome. Although it wasn't his normal job to initiate purchase transactions for the facility, he was in a position to falsely order merchandise, sign all the supporting documents, take possession of the assets and provide the authorization to accounts payable to make payments to the vendor. He then sold the assets for personal benefit. He was able to conceal this irregular activity from view by others for two reasons. First, he was a high-level manager and a trusted employee. Thus no one questioned his actions. Second, because of his position and job duties, and because of increasing business at the sports dome, he was able to up the facility's annual budget to accommodate the increased expenditures and conceal the false transactions from view by others. A fraud examiner may have difficulty detecting fraud under these circumstances because financial activities appear to be normal and meet everyone's expectations.

ASSISTANT OPERATIONS MANAGER'S SCHEMES

Fraud perpetrators often use more than one scheme to defraud their employer, such as in this case. Here's a summary of what happened.

Scheme No. 1.
Acting in collusion with two vendors, Alex ordered approximately 200 chain hoists valued at US$336,444 that normally would have been included in the city's fixed asset accounting system. One interesting point about this particular asset is that the sports dome didn't have any legitimate chain hoist replacements during its 14-year history. Alex picked up these items at the vendor's locations even though all the purchases were supposed to be delivered to the sports dome's central delivery destination for receipt processing. The two vendors concealed the identity of the merchandise by splitting the transactions into several smaller invoices for consumable items and then submitting them to the city for payment over several weeks. Following Alex's instructions, the vendors prepared invoices indicating that the sports dome had purchased consumable items (i.e.; chains, shackles, rings, wire, rope, etc.) rather than fixed assets. If these invoices had indicated the true identity of the fixed assets purchased, city managers and the city's external auditors might have detected this scheme much earlier because the fixed assets would be missing from inventory. In addition, the number of chain hoist replacements also would have been suspicious.

The scheme ended when Alex began fencing stolen property in scheme No. 3 described below. During the police investigation, one vendor supplying assets to the sports dome in the above example actually told police investigators that he believed his billing practices were an acceptable way of doing business. Can you believe it? The vendor appeared to make the statement in an attempt to avoid prosecution as an accessory in the case. And ultimately he wasn't prosecuted because he was a material witness in the case against Alex. While the city considered disbarring one of these vendors, it didn't do so because the vendor was a prime supplier of material for many other departments.

Scheme No. 2.
Acting in collusion with a third vendor, Alex prepared false invoices for completely bogus purchases valued at US$134,554, which the vendor then submitted to the city for payment. The facility never received any goods or services from these transactions. Alex and the vendor then split the proceeds of this scheme.

Scheme No. 3.
Alex ordered small tools and other equipment valued at US$20,831 through the city's business charge accounts and picked up these items directly from the vendors. He then sold the merchandise at pawn shops or traded them for drugs. This element of the scheme caused the demise of the manager's scheme. Pawn shop owners routinely report key information from sales transactions to police departments to help them identify individuals trafficking in stolen property. Undercover police observed Alex visiting various vendors to make purchases on behalf of the city, selling the merchandise at pawn shops for personal benefit, and then returning to his office. He broke the pattern of his successful 10-year fraud in scheme No. 1 above, not because he was greedy, but because he was an addict who needed more and more money to buy drugs. If this change in his modus operandi hadn't occurred, who knows how long this scheme would have continued or how big the loss would have become.

Scheme No. 4.
Alex worked in collusion and partnership with one vendor and used his position to influence the competitive bid process and to obtain contracts for the vendor. He and the vendor then split the profits from these contracts. While the true amount of loss from these activities will never be known, the vendor received US$199,478 in city business.

PROSECUTION AND SENTENCING

Alex was the only person prosecuted in this case. In a plea bargaining agreement with the county prosecuting attorney, the court ordered the assistant operations manager to make full restitution of the loss amount plus audit costs. He was then sentenced to five years in the state penitentiary for this crime.

LESSONS LEARNED

Let's review some of the finer points of fraud detection that we've learned from this false billing scheme case study. 

• Entities should always establish an appropriate segregation of duties between employees in the purchasing cycle who order merchandise, sign the receiving reports and approve vendor invoices for payment.
• Fraud examiners should look beyond the signatures on purchasing documents and determine the true identity of the individuals behind the transactions to identify employees who may be overstepping their job boundaries.
• Fraud examiners should carefully review purchase invoices to identity red flags, such as the pick up and delivery issues and illegible receiving signatures noted in this case that make certain transactions worthy of additional audit research.
• Entities should establish hotlines for employees and others to report any suspicious purchasing activity.

NEXT UP: TELEPHONE FRAUD

The next column wraps up our current discussion about disbursement fraud by covering employee telephone fraud and abuse. While not normally a serious area of risk, fraud can and does occur in this area too. Stay tuned …

Regent Emeritus Joseph R. Dervaes, CFE, CIA, ACFE Fellow, is retired after more than 42 years of government service. He is president emeritus of the ACFE's Pacific Northwest Chapter.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.