Collusion in the workplace

Poor internal controls resulted in fraud in excess of $500,000 for a newly acquired division of a publicly traded Fortune 500 Company. The culprits included an hourly line clerk, human resources clerk, an administrative assistant and the human resources manager. Investigators detected the fraud while implementing the existing sound internal control system into the newly acquired division.

The authors obtained the details of this actual case of a Fortune 500 corporation from its director of internal audit. Names and details have been changed. — ed.

One of Alpha Company's goals was to grow through mergers and acquisitions, so it acquired Baker Division of Charlie Corporation, which doubled the size of operations to $5.5 billion. The initial combined numbers were staggering — predicted to be in excess of $50 million with this new relationship — Alpha and Baker.

Years earlier, Alpha Company had integrated its business processes by implementing a popular enterprise resource planning system. At the time of the Baker acquisition announcement, the company had maintained a consolidated, centralized, corporate system of internal controls for all departments. These strong controls and separation of duties ensured smooth operations and early fraud detection.

However, the situation was exactly the opposite at Charlie Corporation. Almost all its locations throughout the U.S. were individualized systems. Also, Charlie Corporation managed each location with a decentralized mentality. Baker Division had its own business processes and management information systems. Therefore, Alpha's acquisition of Baker was an accounting challenge.

Each location complex manager, including Baker, was in charge of accounting, inventory, procurement, human resources, leasing, fixed asset management, etc. As long as each location met the required budget and profit expectations, corporate office didn't interfere in its business processes. Also, Charlie Corporation had determined that Baker Division was insignificant and immaterial for its SOX 404 internal control assessment, so they excluded it from their documentation and testing scope. Moreover, the audits that the Charlie corporate audit team had performed were stale; it hadn't conducted any follow-up reports in the two years preceding the acquisition.

The work environment to assess the consolidation plan was turbulent from the beginning. Employees knew that jobs at Baker were being eliminated. Alpha needed to keep the business running through the integration plan, identify those needed in key positions and also manage employee turnover. Management held town-hall meetings to try to make sure that everyone knew upfront that Alpha was built on integrity and ethics. The management team presented a clear message that all things must be done in the proper way and that cost wasn't an issue.

Widely different tuition reimbursement program

Mergers and acquisitions drove Alpha's growth over the past decade. Policies and procedures were well-defined and clearly in place at the time of the Baker acquisition. However, the Securities and Exchange Commission took significantly longer to review the acquisition because it had to abide by the Hart-Scott-Rodino Antitrust Improvements Act, which requires pre-merger notification. (The act requires that both parties file a Notification and Report Form with the Federal Trade Commission and the assistant attorney general in charge of the Department of Justice Antitrust Division.) This delay contributed towards Baker employees' increased anxiety about their uncertain future.

Alpha was founded on a "continuous improvement operating" philosophy. This philosophy included offering a tuition reimbursement program for its employees, which its corporate continuous improvement department (CI) managed. An employee had to file an approved degree plan with the assigned CI advisor prior to the employee enrolling in the program.

Alpha's reimbursement was capped at $15,000 per employee ($3,000 payable per year over five years), based on approved documentation, which included receipts for tuition payments, campus fees, books, transcripts and grade postings. If employees didn't provide valid receipts that tied into approved degree plans, Alpha wouldn't approve the reimbursements.

Charlie Corporation's education policy was quite different than Alpha's. Each location, which managed its policy, didn't require uniform documentation and had no limits on reimbursement amounts. Charlie's corporate office didn't manage the program, except it ran tuition reimbursements through the payroll department, along with timekeeping entries.

Investigation trigger

As part of the year-end payroll reporting process, Alpha conducted an entity-level payroll control review to ensure that it correctly identified all highly compensated employees and verified proper deferred compensation amounts and documentation.

Control systems had been in place for years at Alpha to ensure consistency with benefit distribution. However, they weren't sure about the recently acquired Baker Division because it had its own legacy system, and Alpha was still integrating the two systems. Therefore, it requested that the vice president of human resources of the Baker Division have the IT team run the same queries from Baker's legacy system to conduct the review. The HR vice president told the internal audit department that several employees definitely didn't fall into the highly compensated employees' category and requested more time to review this matter. This required follow-up and triggered an internal investigation.

The corporate office of Charlie Corporation stored the detailed data files required for this review in a facility across the country. Because the acquisition had already closed, Alpha had to comply with detailed legal formalities to request the data dump files for Charlie Corporation's review.

Internal audit director gets brush-off

Alpha's internal audit department immediately began the process to request the files and also contacted a complex manager of Baker Division, Mark, to request a review of the initial information. Despite several messages, Mark didn't return internal audit's calls. Therefore, Barb, director of internal audit at Alpha, decided to visit Mark onsite to review the issues.

When she arrived, Anna, Mark's administrative assistant, told Barb that Mark wasn't available and didn't have any time to review such tedious issues. Barb persisted and soon managed to meet Mark in his office. Initially, Mark was very defensive. He said that his employees worked long hours and performed all the necessary duties. He claimed that it was his complex to manage, and he didn't need any help from the corporate office to do his job. Mark appeared to be closed-minded and wouldn't listen to any of Barb's fact-based concerns.

During this same time period, Barb received a call from Alpha's corporate office saying that one of Baker Division's facility accountants, Nicole, wanted to schedule a meeting as soon as possible to share her concerns about the timekeeping and payroll controls. Barb called Nicole. Nicole said that she had been telling the complex manager for a long time that the time reports weren't correct for the administrative office and that she needed to review the items prior to submission for payment.

Nicole said that Mark continually ignored her warnings. This conversation strengthened Barb's suspicion; she returned to Alpha headquarters to develop a plan and gather additional information. Two weeks went by and Charlie Corporation finally delivered the data files Barb had requested. Also, Barb sent an email to Mark saying that her team would be performing a limited scope review for overtime, tuition reimbursement documentation and payroll files. She also left four voice-mail messages at his office; however, she never received a response.

The audit: belligerence and death threats

Barb began to analyze the files she'd received from Charlie Corporation. She noted that six people fell into two suspect categories: overtime and tuition reimbursement. Barb pulled all tuition reimbursement coding for the location and found more inconsistencies. She added two other salaried employees to the review list, along with two additional hourly employees.

The reimbursement numbers from the data dump seemed impossible. The total reimbursement for the six full-time employees was in excess of $145,000 in three years. She contacted the Baker corporate office and requested the hard copies of payroll and tuition reimbursement files. To her surprise, she found out that Baker hadn't sent any documentation to support any payroll information. The payments simply had been made based on the amounts provided by location.

Barb called Nicole to find out where the hard copies were. However, Nicole had no clue where the administrative timecards and tuition reimbursement records were located because she was never allowed to see them. However, she confirmed that all other time records (for 1,200 hourly and salaried employees) were in her custody and that she would retrieve the information for audit to review.

Barb contacted Baker Division several times to obtain records and documentation, but all her efforts were in vain. Barb personally visited Baker Division to expedite things. When she arrived, she conducted an opening meeting with the HR director, David; the account manager, Nicole; HR manager, Emma, and the administrative assistant, Anna. The complex manager, Mark, wasn't present. Barb decided that she wouldn't leave the premises until she received the records.

Because Barb was head of the internal audit team, she was authorized to go to any location and have access to all records she needed to complete her review. She explained this to them and then demanded the records. Nicole quickly provided all the records available with her. However, Anna and Emma didn't cooperate at all.

Barb contacted David and told him about his team's lack of cooperation. David was clueless about the situation. Barb again explained that she wouldn't leave the building until she had all records in her possession. David looked puzzled and told Anna and Emma to go get the records. He explained to them that Barb had every right to review any and all records at their location and that he would explain this to Mark if necessary.

Shortly after midnight, Barb received a portion of the requested records. David promised to deliver the remaining tuition program documents early the next morning. Barb waited until everyone left and then loaded the eight boxes of records into her car. As she arrived at the hotel, a Mercedes pulled in behind her at the check-in area. Emma and Anna were inside the car. Anna shouted through the window, "Why did you take the boxes from the plant? We are calling Mark!" Barb never acknowledged them and loaded the boxes from her car to her hotel room. Barb dug through all eight boxes all night and pulled all timecards needed for the review.

The preliminary results startled Barb. Emma and Anna managed the administrative office. All the administrative employees clocked in and out from one central location in the HR area, except for the suspect group. Unlike the 1,200 hourly employees at the location who used a time clock, Anna and Dianna (an HR clerk who worked for Emma) used manual timecards created in Excel. Barb wondered why these two employees maintained separate records. Anna was the official time/payroll entry person for the administrative area. She entered and verified all items that were paid bi-weekly. This included special incentive pay, such as safety awards and attendance awards, as well as items such as tuition reimbursement. Emma was a salaried employee so there were no time-related records available to review. However, Barb wasn't interested in her payroll; she wanted to view her tuition reimbursement records.

After inspecting the timecards, Barb had many questions. She had strong suspicions that the manual timecards for Anna and Dianna were fraudulent. Dianna clearly used the same timecard every week: 7 a.m. to 7 p.m. and took a 30-minute lunch. Emma signed-off Dianna's Excel timecards each week because she was her supervisor. Anna's timecards were altered and adjusted each week often without supervisor sign-off. At one point in the year, Anna allegedly worked 240 hours overtime in a three-month time frame. This almost seemed impossible.

The next day, when Barb arrived at the facility, David was waiting for her in the conference room. Within two hours, she received the requested tuition records.

Emma and Anna delivered the box. They both said that one of the two would be present at all times during the review to ensure that Barb didn't steal more plant records. Barb informed them both that she didn't need their assistance to complete the review and asked them to leave the conference room.

Emma sent a security guard to retrieve the records from Barb, but Barb refused to surrender the records. Approximately 15 minutes later she received an anonymous threatening phone call demanding she leave the site within an hour. Shortly after that, Barb received a call from her corporate office alerting her about a death threat against her. Barb's CEO subsequently ordered her to immediately leave the facility. He sent the corporate jet to pick her up. Reluctantly, Barb packed up her computer and all the tuition records and headed to the airport without telling the employees of Baker Division.

After she arrived at the corporate office, she discussed the entire episode with her supervisors. They wanted to outsource the review to a forensic agency, but Barb insisted on completing the review herself. Finally they agreed — on the condition that she wouldn't be allowed to travel alone to Baker Division. 
Barb resumed her review of tuition reimbursement. She soon discovered that the perpetrators had fabricated invoices for multiple unaccredited or bogus schools and one well-respected university. She identified four employees of Baker Division in the tuition reimbursement fraud: Chastity (a plant supervisor), Emma, Anna and Dianna.

Barb's cross-check of schools, dates, course loads and invoices for tuition revealed many inconsistencies. Some of the invoices appeared to be fabricated, and she suspected the four employees had manipulated their grades. The university, at which these four employees had allegedly registered for the courses, later confirmed this. Barb discovered that Chastity, who attended a different university, was on full scholarship and didn't pay for tuition, fees or books. However, she billed Baker for the costs of her education.

Barb collected detailed information about the fraudulent records submitted by each of the employees. She also obtained written confirmations from the universities that the documents submitted for reimbursement were fraudulent. She prepared a solid case against each one of the employees, presented her plan of action to the corporate office and received approval from them to continue as per the plan.

Email manipulation

Barb started the process by sending Mark an email saying that she was going to visit the facility the following week to discuss the audit results. She waited a couple of hours for Mark to respond and then called him. He said that he hadn't received her email. She sent it again while they were on the phone. Again, he didn't receive the email, so she sent it a third time. While sending the emails, she was tracking them through a vaulting system. Barb discovered that Anna (Mark's administrative assistant), had directed all his emails to her inbox. She deleted the items Barb sent and allowed only the emails sent by other employees to go to his inbox.

Barb told Mark that she'd be in town the following week to cover the findings of her audit, but didn't disclose the breach of his email. She wasn't yet sure if Mark was a conspirator to the fraud, but Barb continued to track his emails and followed the trail. She observed that Anna forwarded all the emails from Mark's inbox to Emma and asked her what to do about Barb's visit to their office. Emma advised her to continue monitoring Mark's emails and delete anything that Barb sent. Clearly, Mark's email communication was compromised. It appeared that he wasn't a participant of the criminal activity. He was guilty of poor management and misguided trust but apparently not of collusion.

Company fires employees and takes criminal actions

After arriving at the Baker Division with her team, Barb met Mark and David. She explained to them the entire scheme and presented the proof and documents she'd collected. Mark and David were shocked to hear about the fraud that had been going on within their office. They both claimed they were totally unaware of it and agreed that all those found guilty should be strictly punished. After the meeting concluded, Barb and her internal audit review team called and confronted each employee who was suspected to be involved in the crime. Emma and Anna were adamant that they were innocent and still wouldn't admit the crime even after looking at the proof. The others confessed but argued that Emma and Anna pressured them.

The company terminated all the employees involved in the tuition and payroll frauds. Concurrently, Barb presented her findings to law enforcement for criminal prosecution. Law enforcement investigated and presented the information to the grand jury, which issued indictments for Chastity, Emma, Anna and Dianna. Arrest warrants were issued and the former employees were taken into custody and charged with conspiracy to defraud the company.

Chastity promptly told the authorities that she would testify against the others. She also requested to begin restitution payments so the university would know that she was trying to correct the situation because she didn't want to be expelled. The school was reluctant to consider her request but ultimately didn't expel her because she hadn't committed the fraud against them. Law enforcement told Chastity that it would charge her with a first-degree felony (theft by deception), which carried a fine and a possible jail sentence.

It took more than two years before the first case was presented to a jury. Chastity pleaded guilty for the full amount and received a first-degree felony conviction and 10 years probation. Subsequently, trial-related activities for Dianna, Anna, and Emma began.

Dianna didn't have a bank account when Emma broached the idea of the scheme with her. So, Emma helped Dianna open the account and became an authorized signatory. Emma and Anna submitted all the documentation for reimbursements and told Dianna when they would be deposited in Emma's account.

After investigators followed the money trail, examined bank records and conducted interviews, they determined that Dianna hadn't taken any classes at the school and never saw the invoices that Emma and Anna had submitted for payment. When the deposits hit Dianna's account, Emma would immediately transfer the funds into her own account. Out of the total reimbursement payments of $38,800 to Dianna, she'd actually received only $2,500. Emma had transferred the rest of the total amount to herself. Dianna pleaded guilty to first-degree felony theft that would carry a jail sentence if she were to violate the agreement. She agreed to testify against the others.

When law enforcement notified Anna that Dianna had settled and agreed to testify, she quickly wanted to plea out as well. Alpha wanted full restitution for the amounts stolen from the company, a first-degree felony charge on her record and for her to testify in court about the scheme if necessary. Anna agreed and paid Alpha $23,500.

Emma eventually agreed to plea to a first-degree felony theft, 10 years probation and full restitution — $35,300 — to Alpha. She also stole $36,300 from Dianna but got away with those funds. They were both signers on the account, and it was Emma's word against Dianna's. Dianna couldn't afford to fight the claims, so she settled.

This case included some quirky elements. Emma hired a popular and well-connected local attorney who promptly threatened legal action against Alpha for defamation of character. Fortunately, none of the ex-employees filed civil suits against Alpha. However, Alpha still would incur significant legal expenses defending itself. Also, shortly after Alpha terminated Emma, the state labor board sent Barb a fax stating that she was required to attend a labor hearing the following week to determine Emma's unemployment benefits. The administrative judge awarded a preliminary judgment to Emma, pending final review based on Alpha's appeal. However, the labor appeals court granted Alpha's petition and overturned the decision to provide unemployment benefits to Emma.

Assessing the cost of the theft

The actual tuition portion of the theft was almost $100,000. The travel, legal, external review and general fees of the investigation totaled $250,000. Additionally, the audit discovered more than $400,000 in timecard fraud that Anna, Emma and Dianna committed; however, the company wasn't allowed to prosecute for the recovery of these amounts.

Although Alpha could have proved that the timecards for a three-year period had fraudulent signatures, the judge reviewing the case said their internal controls for monitoring the expenses should have easily caught the fraud, and it was the company's fault for allowing the crimes to occur. The judge didn't allow the case to move forward against the perpetrators.

According to the judge, Mark should've been monitoring his bottom line more closely and shouldn't have blindly trusted the employees. Alpha couldn't recover a single penny from the payroll scam. Pursuing the case in civil courts was fruitless; the employees didn't appear to have available assets to satisfy civil judgments. The potential cost of civil litigation far exceeded any possible benefit.

Lessons learned

Baker Division landed in trouble because Mark, the complex manager, didn't implement proper internal controls. He blindly trusted his employees and seldom cross-checked the records. Also, he didn't analyze the situation on a macro level. Otherwise he would have immediately noticed an unusual rise in payroll and tuition costs. Also, the employees who acted under pressure should have brought this matter to top management instead of succumbing to the pressure from their colleagues. The guilty employees had been sharp-eyed enough to spot the loopholes and use them for their own benefit.

Companies that fail to adhere to strict policies and report exceptions (i.e. timecards, overtime, above-average reimbursement, etc.) are easy targets for fraud. Periodic and surprise checks may be incorporated into internal control procedures to detect unusual activities at an early stage. Moreover, an uncooperative employee is a red flag for potential fraud.

Business process owners and management:

• Must take accountability and ownership of their control systems to deter and detect fraud.
• Must define procedures for tuition reimbursement and other programs.
• Consider policies detailing acceptable or accredited schools.
• Might consider periodically directly corresponding with local participating schools to cross-check reimbursements.
• Should periodically rotate location managers and other key employees.

Management should be aware that terminated employees might bring civil litigation and also attempt to collect unemployment benefits. If this occurs, the employer's additional costs beyond stolen funds — legal fees and increased unemployment contributions — will continue to rise.

Last, and most importantly, companies must know that desperate people can do desperate things. Management must seriously take death threats, intimidation and other non-compliant actions against auditors and fraud examiners.

Let Alpha Company's mistakes be your lessons. Never let down your guard, especially when your organization acquires other entities. 

Dan Edelman, Ph.D., CFE, CPA, is the associate provost and vice president for academic affairs at Texas A&M University-Commerce and a tenured professor of accounting. Previously, he was department head of accounting at the same school.

Jana Owens, CBA, while working on this article, was a graduate student at Texas A&M University-Commerce. She now is director of shared services at a large corporation, where she focuses on compliance and controls. 

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.