Tipping the balance

The initial evidence pointed toward an open-and-shut embezzlement case. But the author describes the assumptions that almost led to an innocent employee's downfall, and he details his fraud examination that revealed the truth.

In early 2014, Paul Knowles, a criminal defense attorney, approached me seeking help with an alleged fraud. He said that his client, Samantha Thompson, a 56-year-old married woman, had until recently been employed by Service Line Inc., a New Zealand-based not-for-profit community organization that provided home-care/sheltered-living facilities and services to adults with intellectual disabilities — "supported residents."

Thompson began working at Service Line in 2005 as a social worker. Over the next nine years she rose to area supervisor — responsible for the oversight of 10 to 15 staff and 20 supported residents at five group-care residential homes — before Service Line fired her. (I've changed all names in this article.) 

She was soft-spoken with strong family values, punctual, hard-working and honest. If Thompson did something wrong, she was the first to acknowledge it, and she accepted criticism well. She was popular with her co-workers, although after the allegations were made against her, they were quick to distance themselves from her. They believed that because the police were called in, and she was charged with an offense, she must have been guilty. Management used the experience as a warning to all staff that if they breached the organization's trust then it would deal severely with them.

Part of her responsibilities was to oversee the personal trust (bank) accounts for the home residents, co-sign all checks of more than $200 with the supported resident and manage the expenditure budget for each residence.

In late 2012, a group of residents went on a trip to Spain. Thompson and three other caregivers accompanied the traveling residents, who shared the cost of the caregivers. Over several months, family members had deposited money to the traveling residents' trust accounts for their trip expenses.

A family member of a resident who didn't travel to Spain reviewed his trust account and noticed $1,600 had been disbursed from the resident's bank account with the narration in the trust cashbook entered as "travel." The family member complained to the head office of Service Line, which initiated an internal investigation. An in-house accountant based in another center carried out the investigation and reported to management that Thompson initiated the transaction.

Service Line extended the internal investigation back another two years after Thompson's supervisor reviewed Thompson's employment file and noted that management had disciplined her about 18 months earlier for not keeping accounting records up to date in one of the homes that was randomly audited. Many discrepancies began to surface, including inadequate receipt evidence of what residents' funds had been spent on, alleged purchases from favored suppliers and failures to comply with internal procedures surrounding the handling of residents' funds.

Thompson's manager interviewed her for an explanation without fully disclosing each allegation. The manager didn't indicate to Thompson before the meeting the extent of the issues. (Under New Zealand employment law, when a meeting has been called with potential disciplinary outcomes, employees are entitled to know the general subject of the meeting, the purpose of the meeting and to have explained to them the potential outcomes. Also, they're entitled to have a support person or union representative present.)

Further, the manager structured the meeting to discipline Thompson but not allege that she might have misappropriated supported residents' trust funds. The manager alleged that client trust funds were missing or unaccounted for. However, the stated purpose of the meeting was that the record keeping for the home was in question, rather than the real purpose, which was to discuss the record keeping in regard to client trust funds. The manager didn't mention at the meeting anything about the audit findings or the narrow focus of the investigation. Thompson didn't know until the last meeting that management was considering only her as a possible thief — if that's actually what had happened.

The manager held a second meeting with Thompson a few days later, at which she fired her. Service Line reported the matter to the police the next day.

The complaint to police contained the in-house accountant's report, notes from the meetings with Thompson and an assessment of the issues (from Service Line's perspective), including copies of the in-house manuals and procedures surrounding cash-handling arrangements for supported residents.

Six months passed before police contacted Thompson to arrange an interview. In the meantime, the company instructed its in-house accountant to extend her investigations. The accountant found more record-keeping discrepancies.

A detective from the Police Criminal Investigation Branch interviewed Thompson on video for a little more than an hour. She repeatedly denied misappropriating any of the supported residents' funds. Thompson said she wasn't a good record keeper and had difficulty with collating receipts for all purchases. She said she often put them in a drawer in the administration office and intended to match them to the trust cashbook later but then was too busy to complete the job.

Thompson told the detective that she'd admitted on several occasions to her manager her weak performance in this area and also had talked about it in multi-manager meetings. Regardless, management hadn't taken any steps to assist her with additional training or support. Just before the end of the interview, the detective discussed the issue of the $1,600 travel payment.

Thompson protested that the detective must have been mistaken because the resident that the detective referred to never traveled. The detective told her he wasn't mistaken. Thompson suggested that the funds might have been taken out of the complaining resident's account in error, and if he checked the trust accounts of the residents who traveled it would be clear which resident paid $1,600 less for his share of the travel than the others. The detective said he would examine the trust accounts.

At the conclusion of the interview, the detective formally arrested Thompson, processed her through booking and then released her on bail pending formalization of charges and a trial date.

New Zealand police prepare "caption summaries" to inform the court about: the nature of an alleged offending, the sections of the Crimes Act 1961 (most crimes in New Zealand are created by this act) that the offending breaches, the dollar value of the offending and the proscribed penalties for each offense. In essence, the summaries set the scene for the evidence police would produce in support of its case.

Following were the allegations in Thompson's case:

• No receipts or other evidence existed to support a total of $15,000 of residents' trust account expenditures.
• She had authorized all transactions and had cashed or co-signed all checks.
• She hadn't complied with Service Line's cash-handling policies.
• Thompson offered no reasonable explanation to satisfactorily explain either the amount or the number of transactions of reasonably small and otherwise undetectable amounts in a five-year period.

Though the sums were small and the alleged offenses occurred over a long period, the victims were some of society's most-vulnerable members. Service Line and the police believed the alleged offenses warranted a criminal prosecution and public denunciation of the alleged offender. Meanwhile, Service Line reimbursed the amount of the alleged discrepancies back to the trust accounts.

Thompson told Knowles, her attorney, that she was innocent and that she hadn't misappropriated any supported residents' trust funds or any of the general funds from the residences.

Knowles explained to Thompson that — from a practical perspective — if she chose to reimburse Service Line for the alleged loss, any prosecution might result in a fine or at worst a short period of community service. He said the cost of defending her position through to the end of trial would substantially exceed the cost of any reimbursement. Thompson declined the opportunity to make restitution and again proclaimed her innocence. However, the allegations and evidence, including sworn statements from Service Line staff and internal investigators, strongly supported the broad nature of the allegations.

After I familiarized myself with the allegations and Thompson's explanations (as she provided to her attorney) I mapped out an action plan:

• Establish a factual matrix — a flexible investigation and reporting structure from which the fraud examiner derives the final reporting of observations, conclusions and recommendations. It begins as the examiner's theorem or hypothesis of the event under investigation, and then determines an initial investigation strategy in which he or she identifies critical people, places, events and timelines. The fraud examiner uses it to identify possible outcomes from the fraud examination, measure collected evidence, and then analyze and report that evidence against both the theorem and the outcome possibilities.
• Determine the police's and Service Line's assumptions that they'd relied on in reaching their conclusions about Thompson's alleged misconduct.
• Determine if all of the evidence that supposedly supported the allegations existed, and if not, why not.
• Identify what wasn't in the information provided by the police and Service Line that might have assisted Thompson's position had they disclosed it.
• Review the police's and Service Line's overall investigation approaches so I could assess their fairness, independence, objectivity and bias factors.
• Investigate Thompson's personal and family financial background, including her spending patterns and habits, personal and family debt, credit card patterns of expenditure, loyalty card transaction histories and store credit/charge account history.
• Find and interview third parties who knew Thompson when she worked for Service Line and locate any others who might be able to provide perspective of her lifestyle.

Facts just didn't add up

From the factual matrix, I identified persons who might have had critical information for the investigation. I started with material the police provided through its disclosure process and then determined other information I might require.

I posed a series of questions to myself to address the theory of the case and then sought out parties who could answer those questions. I never interviewed Thompson in person, only through written correspondence and through her lawyer. This preserved legal privilege in her answers and allowed me to be very direct with both my questions and in seeking information.

The strength of her financial background came out of questions about her assets, income, family circumstances and spending patterns. Much of my analysis was via my reading through material provided through enquiries and by inputting comparative data into spreadsheets. I electronically scanned all data and then searched for keyword identification. Essential to the analysis phase (so that we didn't get buried in meaningless piles of paper) was referencing our recovered material for analysis back to the initial matrix. That one document was our overall plan, route map and investigation guide. If we hadn't revisited the matrix regularly then it would have been easy to get sidetracked and lose our way in a maze of paper, numbers and irrelevancies.

After I collected and analyzed the information, I ascertained:

• Service Line didn't disclose to police that Thompson had previously complained that she was behind in her record keeping.
• Non-compliance with cash handling and receipting procedures at several group Service Line residences was a common problem and not just confined to those Thompson administered.
• Thompson's supervisor didn't conduct monthly mandatory reviews (in effect, mini-internal audits) of cash handling and recording processes in accordance with the cash handling manual. (If she had, she would have detected Thompson's poor record keeping.)
• Service Line's internal audit staff membership failed to keep any records that would have shown monthly internal checks on supported residents' trust accounts.
• Personnel record keeping failed to identify and follow up on staff training requests and concerns.
• Despite their assurances, the police didn't investigate the $1,600 payment or follow up with Service Line after its interview with Thompson.
• The police also didn't investigate Thompson's or her family's financial backgrounds. My investigation disclosed that two years prior to her termination Thompson received an inheritance of close to $2 million — half in cash and half in property. As a testament to her strong family values, when offered her part of the inheritance earlier than the other beneficiaries, she requested the lawyers make trust advances to another, less-fortunate family member first and leave her share of the estate to be sorted out later.

My 41-page final report to defense counsel included 100 indexed and cross-referenced documents. I concluded that Service Line's and the police's investigations were poorly planned, demonstrated bias, reached unsupported conclusions and failed to reach the necessary standard of proof to assure Thompson's conviction.

Defense counsel disclosed my full report to the police prosecutor. By agreement, the matter was called in district court 10 days later. After the charges were read, police offered up no evidence to support the allegations. Accordingly, the court dismissed the charges. 

First impressions and facts

The essence of a fraud examination is objective, unbiased investigation and reporting. Fraud examiners aren't judge and jury. We do, however, feed the process with our reports, often pivotally tipping the balance of doubt in favor of a decision one way or another.

As CFEs, we need to be alert as to what isn't always obvious. In my 20-plus years as a CFE, I have provided professional services to law enforcement, lawyers, the corporate sector and not-for-profits. Most of that work arose from a known fraud, quantification of the loss, identification of the alleged offender(s) and the presentation of evidence in prosecution.

When I accepted Thompson's defense attorney's case, I didn't have a view about Thompson's innocence or guilt, although I recall thinking on the first reading of the allegations and supporting material that the police argument was rather compelling. But as independent fraud examiners we have to get over any initial impressions and move on with our job. Investigate, review, report. Regardless of the outcome, we're charged with ensuring that what we do is fair, unbiased and factual so that when we arrive at an outcome, we're able to fully support it. Someone's reputation or freedom might rely on it.

David Petterson, CFE, is a Regent Emeritus and the managing director of Forensic Accounting Services Ltd, a New Zealand-based financial investigation and litigation support practice.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.