Small-and-lean entity learns to deter fraud after $690,000 loss

Three medical school students founded Streets of Care to help fill critical health care needs of the homeless. Ten years later, the friends had their own thriving practices, and Streets of Care had blossomed into a successful organization with about $4 million in annual expenses. Though the founders served on the board of Streets of Care, they were no longer involved in the nonprofit's daily operations.

Cara McFarland, one of the founders, was reviewing a list of the organization's beneficiaries and found something suspicious. Streets of Care was sending funds to three organizations at the same mailing address even though their buildings were in different parts of the city. (I've changed all organization and participants' names in this column.)

McFarland was the chair of the organization's newly formed audit committee. She'd attended a seminar in which I shared the duplicate address test and other tools. So after her discovery at Streets of Care, she reached out to me to share the results of her duplicate address test and enlist my help. I explained that one exception from one test wasn't enough predication to begin a fraud examination. I advised her to test the duplicate address against all current and previous addresses that her employees used. McFarland called me back a few hours later, and the excitement in her voice was palpable. She had a match.

The queen of development

Jordana Stroud excelled at fundraising. From as early as anyone could remember she had a knack for getting people to part with their money for a good cause. She paid her way through Indiana University by fundraising on behalf of various nonprofit organizations and earned a bachelor's degree in nonprofit management. As a development professional, she led fundraising and major giving initiatives for organizations in Kansas City, Missouri; Denver, Colorado; and Newark, New Jersey.

At the age of 42, Stroud decided to take a break from her career and relocate to Los Angeles so her nine-year-old daughter could follow her dream of becoming an actress. It didn't take long for the newly minted stage mom to start looking for nonprofits she could help.

Stroud started as a volunteer for Streets of Care — mostly managing their established donor base — but she quickly demonstrated her ability to bring in much-needed cash, and within six months the organization had offered her a full-time position. Two years later, Streets of Care named her executive director after the previous ED's retirement. Stroud lived up her to reputation by bringing in close to $36 million in five years, which effectively doubled Streets of Care's program capabilities.

How Streets of Care worked

The key to Streets of Care's success had always been its relatively inexpensive overhead. In the early days, the founders did all the administrative and fundraising work without pay. As the organization grew and the founders dedicated more time to building their medical practices, they hired staff to run the daily operations but insisted that at least 93 percent of expenses were to be spent on the organization's programs. That means that only 7 cents of every dollar the organization raised could be spent on office expenses, fundraising and other administrative costs. From a business perspective, Streets of Care ran lean and kept its staff small.

Private donors primarily provided the revenue to operate the organization and its programs. This gave Streets of Care the autonomy to invest in initiatives with the best return on investment, and it also provided donors with a greater sense of ownership of the work in the community. This ideal funding model attracted some powerful entertainment executive and celebrity donors.

Streets of Care ran multiple programs focused on preventing and treating medical conditions among the area's homeless population. It also provided some of its program funds to smaller independent community nonprofit organizations that shared in Streets of Care's mission. Typically, Streets of Care's program directors identified the candidate organizations for support, and the executive director and board of directors vetted and approved them.

The schemes

McFarland and I met at the office of her private pediatrics' practice. Her clients included children of well-known movie and music stars, many of whom would become Streets of Care donors. McFarland had the files on the three affiliate organizations and Stroud's employee file. She extracted documents from each that demonstrated that the three affiliates shared a mailing address with a residential home that Stroud had previously claimed as her primary residence.

I reviewed the documents in each organization's file and noted that Stroud had vetted all of them within nine months of each other, and I didn't see indications that any program director had recommended them for funding. My interest was piqued, and I took the case.

First, I confirmed the shared address was a residential home that Stroud had previously owned, but she had sold the home to an investment company shortly after she started working for Streets of Care. Next, I checked the ownership records of the suspect organizations but found that none were registered within the state. The canceled checks made from Streets of Care to the organizations were all deposited in the same bank account and endorsed by the same company — the investment company that owned Stroud's former residence — which turned out to be a shell registered to Stroud's daughter. Over the course of three years, Streets of Care had paid $406,696 to the three supposed affiliates controlled by Stroud.

When I reviewed the timeline of the fraudulent payments to Stroud I noticed her scheme started two months into her term as executive director. Naturally, I was concerned that she might have been misappropriating funds prior to her promotion when she was in charge of development and fundraising. With McFarland's permission, I conducted a forensic audit of the books and records. Stroud had issued $282,620 in donor acknowledgements (signed by the previous executive director), which were never recognized in Streets of Care's books — bringing the total loss to $689,316.

The aftermath

On a Tuesday morning in April, Stroud floated into the Streets of Care office on a cloud. Her daughter had just landed a supporting role in an upcoming made-for-TV movie, and she couldn't wait to share the good news with everyone. Unfortunately for her, she found McFarland and me waiting.

Stroud initially was defiant, and insisted that I had made some mistake in my audit. As I presented evidence of her schemes, she became deflective and claimed that the organization's employees had made clerical errors in the records because of insufficient staffing. She blamed the board's tight control on administrative spending and insisted that if only she had had a proper staff these document errors wouldn't have occurred.

However, the evidence dismissed each of Stroud's rationalizations and explanations. She eventually admitted that she might have mismanaged some funds, but she stopped short of confessing to revenue skimming and disbursement fraud. McFarland wanted the board to press charges, but to save face the directors decided that Stroud would be allowed to resign and agree to repay the funds she "mismanaged."

Streets of Care recovered a fraction of what was lost, but Stroud went on to become the development officer of a national charity headquartered in San Diego.

Internal controls for lean organizations

The board of directors for Streets of Care learned the hard way about the perils of having poor internal controls. Yet many small and lean organizations (whether they be nonprofit or for-profit) frequently make the same mistakes. How does an entity with only a few employees institute common internal controls such as segregation of duties, tiered approval and authorization limits, mandatory vacations, job rotation and independent reconciliations?

Here are some of the controls that I helped Streets of Care institute:

• Institutional peer review: Streets of Care's administrative expenditure cap wouldn't allow it to hire enough qualified accounting and finance staff to ensure segregation of duties across the organization. So instead of separating duties, we consolidated administrative duties and instituted mandatory peer reviews. This meant that instead of giving funds directly to program directors or affiliates and letting them manage their allocated funds, the organization manages all funds from a central accounting office that two bookkeepers and a senior accountant operate. Program directors and affiliates prepare the budgets, which the board approves, and receive monthly reports from accounting. Program directors and affiliates or central accounting can raise exceptions any time the actual revenues or expenses deviate from the budget.
• Automated management: Streets of Care has invested — as much as is fiscally feasible — in automated solutions to manage revenue and expenses. This includes an online solution for donors to deposit funds directly into the organization's bank account. Similarly, an inventory control system keeps tabs on the volume and frequency of medical supplies used in the various programs and automatically orders what the organization needs when it needs it.
• Rigorous due diligence: Streets of Care now maintains a budget line item to conduct thorough due diligence and background checks on all prospective employees and partners. The organization conducted a complete background check on Stroud after it discovered her thefts and found several complaints from previous employers and an unresolved lawsuit for financial mismanagement from a New Jersey nonprofit.
• Greater board oversight: The board has dedicated resources toward internal controls for the organization, which includes the audit committee reviewing all exception reports generated and the establishment of an affiliate committee to vet new affiliate partners. The board also implemented a hotline to report fraud, waste and abuse; and engaged employees, affiliates, donors and community partners in an ongoing dialogue regarding fraud risks.
• Outsourced internal audit: The audit committee, after defining an annual internal audit plan, engages a third party to execute the plan. This strategy — plus the annual external audit — provides a more thorough examination of programs and administrative activity to detect fraud, waste and abuse.

Creatively deterring fraud

Fraud examiners who respond to suspicious activity within small organizations can typically resolve issues expeditiously by identifying the individual(s) with the greatest control over the organization's assets. On the other hand, implementing effective and efficient internal controls in small organizations requires creativity and innovation. The challenge, as Streets of Care learned, is to leverage existing resources without exhausting capacity restraints.

Robert Hogan, CFE, is a forensic accountant and fraud examiner at his firm, Hogan Consulting Group, in Atlanta, Georgia. His email address is: robert@hoganforensics.com.