Using analytical tests to zero in on possible fraud

Xyz Inc. had a fraud problem — it just didn't know where. The author's team used analytical tests — including the Beneish M-Score Model — to construct a road map for further investigation. The result? The prosecution and conviction of a fraudulent office manager.

The company (we'll call it Xyz Inc.) knew it had a problem. It had detected a possible embezzlement and a suspected fraudster. But the company had to prove it and determine damages. What to do? Xyz used a combination of analytical tests to find enough anomalies among financial statements to warrant a full fraud examination. Eventually, the office manager was accused and convicted of embezzling $433,659.

Fraud examiners use a variety of analytical tests. The trick is to determine if a case presents sufficient data to analyze and to choose the analytic that meets the specific needs of the engagement. While analytical tests by themselves aren't enough for prosecution, they provide effective and efficient road maps to areas that require further investigation. These tests identify anomalies flowing through financial statement transactions — particularly in embezzlement cases.

Xyz had a specific niche in the market as the sole source provider of parts for excavators, wheel-loaders and other large construction equipment. The company had a select customer base and maintained a good working relationship with its clients. Xyz had little, if any, bad debt on the books. Cost of sales and gross margins were consistent among its product lines.

After Xyz first detected the embezzlement, it employed our firm to conduct several analytical tests, including the Beneish M-Score Model. I then calculated the analyticals and discovered discrepancies that spurred a fraud examination that I conducted. Apparently, the fraud had lasted for some time, but we limited its examination to the previous five years for litigation purposes and because it detected the fraud in Y 5.

RATIONAL RATIOS

When developing analytical tests, it's important to discuss current and past events within the company so you'll be able to isolate anomalies from known events. In the Xyz case, another CPA firm compiled annual financial information and presented a schedule of financial ratios to management. (Ratio analysis, a method to measure the relationship between two different financial statement amounts, can be an optimal way to discover anomalies. See the sidebar at bottom.)

The financial information compiled for management's review consisted of specific ratios concerned with liquidity, such as the current ratio, quick ratio, income before tax to net worth, debt coverage ratio and the leverage ratio. The first CPA firm didn't perform any ratios relating to gross margins and measurements of profitability.

Xyz first suspected possible fraudulent activity when the office manager posted a transaction to a fixed asset account in the general ledger, and the CFO wasn't aware of any capital expenditure projects occurring at that time. The office manager maintained the financial records of the company, so my main issue was figuring out how to find the fraudulent transactions to determine how much she embezzled from the company. See Figure 1 for the condensed version of the basic financial information. 

[Figure 1 is no longer available. — Ed.]

Most fraud examiners begin a case by looking at the numbers. However, sometimes a better way is to view financial information as a graph. I used the information in Figure 1 to create a simple linear graph. (See Figure 2.) Training the eye to see slight variances takes some practice. But over time, you should be able to decipher these well. 

[Figure 2 is no longer available. — Ed.]

The graph tells us that sales steadily increased from Y 1 through Y 3, with only a slight decline in Y 4. Remember, the fraud was uncovered in YR 5 and the financial statements corrected in that year reflect this by recording a bad debt loss. Sales, general and administrative costs (SGA) appear reasonably consistent with little change occurring between these costs and net income.

The cost of sales (COS) area stands out — we would expect it to follow along similar trends of sales. Yet we see here that cost of sales changes somewhat differently compared to sales. Notice in Figure 2 the changes in the gap between sales and cost of sales and the non-parallel lines. The gap represents the gross profit margin. The margin is normally stable because any increase in costs of sales is usually passed to customers, unless the increase in production costs are minimal. Xyz didn't have an unusually high increase in production costs; it did pass cost increases to customers rather than absorb them to reduce the gross profit margin.

From a first glimpse of the financial information, SGA were reasonably consistent. So, I needed to focus on other areas.

One of the more overlooked analytical tests relates to cash flow and operating performance. Cash flow statements are very useful in analyzing data, and when they're missing in the financial statements, you need to create a simple dual axis graph (See Figure 3.) for reviewing net income, using this formula: current year (CY) cash flow from operations/CY net income. 

[Figure 3 is no longer available. — Ed.]

The most notable item in the graph is that net income and cash realized from operations (CRO) aren't following the same pattern.¹ As net income increases steadily from YR 1 through YR 4, cash flows from operating decreases from YR 1 to YR 2 and again from YR 3 to YR 4. The only items subtracted from net income that aren't subtracted from operating cash flows are depreciation and amortization. Therefore, net income and cash realized from operations should follow similar patterns, not opposite patterns, as shown in Figure 3.

Because the initial analytic (Figures 1 and 2) showed that SGA expenses were reasonably consistent, and the test indicated possible issues with the financial statements, we needed to analyze other components of net income. The Beneish M-Score Model and its components were the perfect tools.

BENEISH M-SCORE MODEL

The Beneish M-Score Model, developed in 1999 by Messod D. Beneish, Ph.D., professor of accounting in the Kelley School of Business at Indiana University – Bloomington, consists of eight indices capturing financial statement anomalies that can result from earnings manipulation. The indices are constructed from data in a company's financial statements; when calculated, they create an M-Score to describe the degree to which the earnings have been manipulated.

In his research, Beneish found that the companies he studied correctly identified 76 percent of the earnings manipulators and incorrectly identified 17.5 percent as non-manipulators.²

The formula for the model is:
M = –4.84 + 0.92*DSRI + 0.528*GMI + 0.404*AQI + 0.892*SGI + 0.115*DEPI – 0.172*SGAI + 4.679*TATA – .327*LGVI.³

Beneish based the formula on a weighted average of these components:

• DSRI: days sales in receivable index (CY AR/sales)/(PY AR/sales).
• GMI: gross margin index ((PY sales – PY cost of sales) / PY sales) / ((CY sales – CY cost of sales) / CY sales).
• AQI: asset quality index (1 – (CY CA + CY Net FA)/CY TA)) / (1 – (PY CA + PY Net FA) / PY TA)). 
• SGI: sales growth index (CY Sales/PY Sales).
• DEPI: depreciation index (PY DE / (PY DE + PY Net PPE)) / (CY DE/(CY DE + CY Net PPE)). 
• SGAI: selling, general and admin expenses index (CY SG&A/CY Sales) / (PY SG&A/PY Sales) 
• LI: leverage index ((CY LTD + CY CL) / CY TA)) / ((PY LTD + PY CL)/PY TA)).
• TATA: total accruals to total assets index ((CY WC – PY WC) - (CY Cash – PY Cash) + (CY Income Tax payable – PY Income Tax payable) + (CY Current LTD – PY Current LTD) – CY DE)) / CY TA. 

Here's the explanation of the component abbreviations:

• CA = current assets.
• CY = current year or current period.
• DE = depreciation expense.
• FA = fixed assets.
• GM = gross margin.
• LTD = long-term debt.
• PPE = property, plant and equipment.
• PY = prior year or prior period.
• SG&A = selling, general and administrative.
• TA = total assets.
• WC = working capital.

In his research, Beneish determined that a score greater than –2.22 (or less negative than this number, eg., –2.21 would be greater) indicated a strong likelihood of a company manipulating its financial statements.

It's possible to use the various component calculations to find unusual anomalies in receivables, unusual expense capitalization, declines in depreciation and changes in gross profits. The model also provides a general benchmark to use when comparing various indices within the formula. For all components, with the exception of TATA (total accruals to total assets index), the general benchmark is one, while the benchmark for TATA is zero.

However, most of these indices will have slight variations within each company, except for TATA, which tends to be stable. So when you use these benchmarks, look for the variances that aren't within the normal ranges for the company; fictitious entries covering up embezzlement will have a direct affect on these variances over a period of time.

If you've already determined from the comparison of net income to cash realized from operations that there's at least one, if not more, anomalies in the financial statements, the next step is to use the Beneish M-Score model to quickly find specific areas that need further investigation.

Some of the more meaningful predictive indices for this case study include the days sales in receivable, sales growth index (SGI) and the gross margin index. Beginning with sales, use the SGI to see what that reveals. See the calculations for the SGI in Figure 4.

By using one as the general benchmark, as Beneish suggests, YR 2 appears unusually high in comparison to the other years. From our earlier analytics of the financial information, we knew that sales also increased in YR 3 but our sales growth index decreased in YR 3. The decrease in the sales growth index for YR 4 and YR 5 is consistent with the general financial information. However, before drawing any conclusions about further investigation of sales, it's necessary to perform one more component of the Beneish M-Score model: days sales in receivables (DSRI). Compare the DSRI in each year and then compare that to the SGI. See Figure 5 for the DSRI calculations.

All these calculations are less than one, except for YR 5. From discussions with management, they said that many of Xyz's customers are billed C.O.D. and collections are collected up front, so we should have expected to see these calculations to be slightly lower but still similar to the Beneish benchmark of one.

Because YR 5 had been adjusted for the fraudulent activity, we could expect YR 4 to be a reasonable comparison. However, YR 3 was unusually low, even for company standards. It's important to realize how these two analytics work together. Using YR 5 as the example: as the SGI decreased, the DSRI increased. YR 4 also followed the same pattern but the pattern reversed for YR 3. Both the SGI and the DSRI decreased in YR 3.

Based on the analytic testing of the SGI and the DSRI, the anomalies identified in both YR 2 and YR 3 in two separate tests showed the need to perform further investigations on sales and receivables.

Based on our preliminary assessments, another analytic from the Beneish M-Score model is required: the growth margin index (GMI). When using this index, you're able to further test sales and the COS area of the financial information.

The GMI also has a general benchmark of one and includes slight variations in the calculations from year to year. However, the changes should be relatively minor when the company is managed well and management reviews and updates profit margins for the various product mixes when cost increases incur. Xyz's gross margin index calculations are varied as noted in Figure 6. Note that the calculations vary as much as 90 basis points.

Because of the variation between the actual calculations and the benchmark, we created a graph of these numbers to easily see the changes. (See Figure 7.)

The Figure 7 graph makes it quite clear the variations were more widespread compared to our discussions with management. We now needed to look at the COS based upon the GMI calculations.

Because the GMI indicated potential anomalies in COS, and the graphical representation didn't exactly give that "warm, fuzzy feeling," it was time to pull another analytic from the bag of tricks and take a deeper look at COS.

Sometimes scatter plots can pinpoint parallel relationships. If these relationships exist, then the next step is to perform a regression analysis of COS. A scatter plot also easily accomplishes this task and provides a quick, efficient method for determining such a relationship (see Figure 8), which in the Xyz case was between sales and COS. Based upon the plot, we determined that the relationships changed proportionately so regression analysis was an appropriate analytic for COS. 

[Figure 8 is no longer available. — Ed.]

REGRESSION ANALYSIS

The goal in using regression analysis is to determine what the predicted COS would be compared to the actual COS recorded in the financial information.

See the descriptive analytics on the recorded costs and the comparative mean (or median) in Figure 9. Notice the predicted COS and the actual COS is consistent in YR 1 but is lower than the actual COS recorded in the financial information in both YR 2 and YR 3, which indicated the need for further investigations to drill down to the details of the transactions within this financial information group. Again, the anomalies noted in this analytic relates to both YR 2 and YR 3, along with the SGI and DSRI.

[Figure 9 is no longer available. — Ed.]

ANALYTICS LEAD TO A FULL FRAUD EXAMINATION AND A CONVICTION

In recapping the results of the analytical tests of Xyz Inc., I used the analytics to construct a road map that I could use to pinpoint further areas I needed to investigate: sales, receivables and COS for YR 2 and YR 3. I could now drill down to the detailed transaction levels — instead of "hunting and pecking" — to find the fraudulent transactions. My fraud examination would now be more efficient and effective.

I discovered that the office manager had embezzled funds by recording fictitious invoices in the COS categories — primarily raw materials and shipping. She also manipulated sales and receivables to a lesser degree than COS — just enough to prevent a drastic change in net income so that management wouldn't detect significant changes in the financial information.

The bulk of the embezzlement was "hidden" in the COS accounts. The analysis of the road-map analytical tests helped us to quickly concentrate on suspect areas and provide quality evidence that allowed Xyz Inc. to not only prosecute the office manager but also get a conviction for embezzlement. The courts gave her a 10-year prison sentence but allowed her probation.

Sidebar:  

Ratio analysis can detect red flags

Ratio analysis is a means of measuring the relationship between two different financial statement amounts. The relationship and comparison are the keys to the analysis. Ratio analysis allows for internal evaluations using financial statement data. Traditionally, financial statement ratios are compared to an entity's industry averages. The ratios and comparisons can be very useful in detecting red flags for a fraud examination.

Following are three of many financial ratio comparisons:

Current ratio
CURRENT ASSETS/CURRENT LIABILITIES
The current ratio — current assets to current liabilities — is probably the most commonly used ratio in financial statement analysis. This comparison measures a company's ability to meet present obligations from its liquid assets. The number of times that current assets exceed current liabilities has long been a quick measure of financial strength.

When detecting fraud, this ratio can be a prime indicator of manipulation of the accounts involved. Embezzlement will cause the ratio to decrease. Liability concealment will cause a more favorable ratio.

Quick ratio
(CASH + SECURITIES + RECEIVABLES)/CURRENT LIABILITIES
The quick ratio, often referred to as the acid test ratio, compares the most liquid assets to current liabilities. This calculation divides the total of cash, securities and receivables by current liabilities to yield a measure of a company's ability to meet sudden cash requirements.

The quick ratio is a conservative measure of liquidity that is often used in turbulent economic times to provide an analyst with a worst-case scenario of a company's working capital situation.

Receivable turnover
NET SALES ON ACCOUNT/AVERAGE NET RECEIVABLES
Receivable turnover is defined as net sales on account divided by average net receivables. It measure the number of times accounts receivable is turned over during the account period. In other words, it measures the time between on-account sales and collection of funds.

This ratio uses both income statement and balance sheet accounts in its analysis. If the fraud includes fictitious sales, this bogus income will never be collected. As a result the turnover of receivables will decrease.

Excepted and adapted from the ACFE's 2013 Fraud Examiners Manual.

Pam Mantone, CFE, CPA, is the senior assurance manager with Decosimo Certified Public Accountants in Chattanooga, Tenn. 

¹ "Financial Intelligence: People and Money Techniques to Prosecute Fraud, Corruption, and Earnings Manipulation," The United States Attorney Bulletin, March 2012, Volume 60, No. 2, pages 36-37. 
² "The Detection of Earnings Manipulation," Messod D. Beneish, Ph.D., June 1999 and Financial Analysts Journal, Sept./Oct. 1999. 
³ Ibid.

Read more insight and discuss this article in the ACFE's LinkedIn group.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.