The Role of Forensic Accountants in Measuring and Detecting Fraud in Employee Loss Claims

Insurance claims for employee losses are generally examined by an insurance carrier, which will often retain a forensic accountant who has the ability to measure employee losses. Employee losses are typically categorized as either asset misappropriation, bribery and corruption, or financial statement fraud. Insurance carriers often seek the assistance of forensic accountants to quantify such claims. Initially, the forensic accountant will be retained to calculate the employee loss. During the analysis, should a forensic accountant detect the possibility of fraud in a claim, it may prompt further investigation by the carrier.

A recent example of both asset misappropriation and bribery/corruption occurred at Apple, Inc. A former Apple employee was indicted on federal charges for allegedly defrauding the tech company out of more than $10 million spanning several years. According to prosecutors, the defendant engaged in a multitude of schemes to defraud Apple, including taking kickbacks, stealing parts, and causing Apple to pay for inventory and services it never received.

Another recent example of financial statement fraud occurred at the Kraft Heinz Company. The Securities and Exchange Commission (SEC) charged the company along with the chief operating and procurement officers with engaging in a long-running expense management scheme that resulted in the restatement of several years of financial reporting. According to the SEC, from 2015 through 2018, the multinational food giant engaged in various types of financial misconduct, including recognizing unearned discounts from suppliers, and maintaining false and misleading contracts, which improperly reduced the company’s cost of goods sold and allegedly received “cost savings.” The accounting improprieties resulted in Kraft reporting inflated EBITDA (earnings before interest, taxes, depreciation, and amortization). In June 2019, after the SEC investigation commenced, Kraft restated its financials by correcting more than $200 million of improperly recognized cost savings.

This paper focuses on the two significant, but different, roles forensic accountants play in quantifying employee losses and how — in the normal course of the analysis –— they may find instances of fraud that require further investigation. The authors first provide detailed guidance for forensic accountants in how to quantify employee losses and later offer insights into behavior that may indicate fraud stemming from such claims. They also explain the factors considered by carriers when hiring external accountants.

This discussion begins by defining some of the terms and potential players in employee loss claims that are examined for possible fraud. First, what is an employee loss? Generally, an employee loss is the loss of money, securities or other property caused by employee dishonesty.

Second, what does a forensic accountant do? The AICPA (the governing body of professional accountancy in the United States) defines forensic accounting as “…the application of specialized knowledge and investigative skills possessed by CPAs to collect, analyze, and evaluate evidential matter, and to interpret and communicate findings in the courtroom, boardroom or other legal or administrative venue.” Therefore, professional accountants, mostly CPAs, conduct forensic accounting engagements. A subcategory of forensic accounting is fraud examination, which may be conducted by either accountants or nonaccountants.

Third, according to Black’s Law Dictionary, fraud is “a knowing misrepresentation of the truth or concealment of a material fact to induce another to act to his or her detriment.” The four major elements of fraud are: (1) false statement of a (2) material fact which is (3) willfully made with an (4) intent to deceive.

Fraud is a global problem affecting all organizations worldwide. The Association of Certified Fraud Examiners (ACFE) stated in Occupational Fraud 2022: A Report to the Nations,its 2022 global study on occupational fraud and abuse, that fraud caused total losses exceeding $3.6 billion USD. The same study estimated that organizations lose five percent of their revenue each year to fraud.

Overview of Employee Loss Claims

An employee loss may trigger coverage through various policies with the business entity’s insurance carrier. The complexities for employee loss claims arise when attempting to measure the potential loss, and whether the loss is related to either asset misappropriation, bribery and corruption, or financial statement fraud. This paper addresses each of these employee loss types.

Asset Misappropriation

Asset misappropriations are most often thefts of cash, but they may also include theft of a company’s securities, inventory, time or intellectual property. Common examples of asset misappropriations include the following:

• Employee removes cash from the register in a retail business.
• Employee forges company checks to themselves or to entities they control.
• Employee deliberately overstates amounts for reimbursement from the company.
• Employee creates fictitious expense reports.
• Employee diverts corporate receipts to themselves or entities they control.
• Employee removes or diverts inventory from the business.
• Employee utilized business time or resources for personal gain.
• Employee sells proprietary computer code to competitors.
• Employee utilizes customer lists or other trade secrets for personal gain.

The first step in measuring an asset misappropriation employee loss event is the determination of what calculations must be done. Generally, the potential loss is assessed through analysis of the amounts withdrawn and returned to the company as follows:

The documents required to complete this analysis will vary based on the type of business and complexity of the asset misappropriations. The following documents are typically requested in order to analyze asset misappropriation claims:

• Bank statements/bank reconciliations
• Copies of cancelled checks (original documents are preferable)
• Details of deposits and wire/ACH transfers
• General ledger (for relevant periods)
• Income/profit and loss statements
• Insured’s claim
• Police report (if applicable)

It also may be suitable to conduct interviews of relevant company personnel to gain additional information about the claim or the alleged losses.

The second step in measuring the employee loss is performing the correct analysis. This process may be as simple as looking at a bank account for a forged check or, in more complicated situations, utilizing formulas to determine the amount of money that should have been deposited and comparing those amounts to actual deposits.

The forensic accountant will also analyze which transactions are potentially legitimate versus personal in nature by examining bank statements for transactions that relate to relevant business activities. It is important that the forensic accountant have a thorough understanding of the company’s business so that they will better be able to determine questionable transactions. As an example, for a manufacturing concern, payments to a boutique clothing store or adult content websites would certainly rise to the level of questionable transactions. Payments to fast food restaurants and office supply companies are more difficult to ascertain.

Asset Misappropriation Case Examples

Case Study 1

QBurgers, Inc., a business that specialized in gourmet burgers and French fries, submitted an employee loss claim to XYZ Insurance Company alleging that, during the past five days, one of the shift managers was stealing cash from the nightly deposits.

Upon receipt of the assignment, the forensic accountant will generally research the business, market environment, competitors, trends and the general economy of the region where the business is located. Below are examples of the documentation and information from the carrier and business that the forensic accountant may request:

• Cash register reports
• Bank statements/bank reconciliations
• Deposit slips
• Police report (if applicable)
• Accounting deposit and payment ledgers

The next steps are to evaluate and analyze the documentation and related claims. The forensic accountant may perform such analyses as follows:

• First, an analysis of QBurger’s cash register reports, for the relevant period, shows an average of $10,000 per day in cash sales. Company policy is that all cash sales are deposited each night.
• Second, an analysis of QBurger’s bank statement, for the relevant period, shows an average of $9,000 per day in deposits.
• What is the amount of potential loss?

Therefore, the employee loss (i.e., value of the potential claim) may be calculated as follows:

As a final check, the forensic accountant should ascertain whether either cash remained at the facility (in a vault or other location), or deposits were delayed in posting or misapplied by the bank.

Case Study 2

KBeauty, Inc., a high-end nail salon, submitted an employee loss claim to XYZ Insurance Company alleging that $10,000 was taken from the business on or about December 10, 2021. The insured claims the source of cash was accumulated sales from the previous months.

Upon receipt of the assignment, the forensic accountant analyzed the cash, check and credit card sales for the months of February through December 2021 as depicted in the following chart:

The following charts depict KBeauty’s total and cash sales.

 

The immediate red flags in the charts above are the significant increases in cash and total sales beginning in October 2021. Such increases may be caused by the seasonal nature of the business, but they might also be caused by fraudulent manipulation of the company’s accounting records. The forensic accountant should further analyze KBeauty’s records to determine whether the increase in cash sales is valid by examining the cash logs and bank deposits.

Bribery and Corruption

Bribery occurs when a person offers something of value to another person in order to receive something in exchange. Corruption may be defined as dishonest or fraudulent conduct by those in power, typically involving bribery. Therefore, bribery is a subset of corruption. Bribery and corruption are common to both business and governmental concerns. Examples include:

• Employee accepting money or favors for free or reduced cost services.
• Business bribing government or private officials to receive contracts.
• Bid rigging — an illegal practice that involves competing parties colluding to choose a winner in an open bidding process.
• Kickbacks — payments made to someone to facilitate a transaction or event.
• Bribing management for a compensation or bonus increase.
• Bribing public officials for changes to laws or regulations.

The first step in measuring a bribery and corruption employee loss event is the determination of what calculations must be done. Generally, the potential loss is assessed through analysis on the financial impact to the business. For example, if a bribe was paid by an employee, how was the bribe paid? Was it paid in cash, services or through the transfer of inventory? The determination of the payment method will determine much of the needed analysis.

The documents required to complete this analysis will vary based on the type of business and complexity of the bribery or corruption. The following documents are typically requested in order to analyze such claims:

• Bank statements/bank reconciliations
• Copies of cancelled checks (original documents are preferable)
• Relevant contracts
• Inventory records and inventory write-off documentation
• Details of deposits and wire/ACH transfers
• General ledger (for relevant periods)
• Income/profit and loss statements
• Insured’s claim
• Police report (if applicable)
  • Again, it may also be appropriate to conduct interviews of relevant company personnel to gain additional information about the claim or the alleged losses.

The second step in measuring the employee loss is performing the appropriate analysis. The analysis may be as simple as looking at a bank account for a payment to an individual or a large cash withdrawal, or in more complicated situations, utilizing analyses to determine overcharges to cost centers or missing inventory.

Bribery Case Example

Case Study

MManufacturing, Inc., a business that produces microchips utilized in cellular phone applications, submitted an employee loss claim to XYZ Insurance Company. In its claim, the business alleged that a current employee paid bribes to a leading cellular phone manufacturer, Orange Cellular, in order to obtain a lucrative contract for microchips during 2021. In addition to the bribes, there were also allegations that the employee billed the client less than contractual amounts as inducement to obtain the contract. The estimated loss amount is unknown.

Below are examples of the documentation and information from the carrier and business that the forensic accountant may request in relation to a bribery loss:

• Cash and checks registers/logs
• ACH/Wire transfer registers
• Bank statements/bank reconciliations
• Relevant contracts
• Accounts payable and payment ledgers
• Financial statements, including income, balance sheets and cash flow statements
• Police report (if applicable)

The next steps are to evaluate and analyze the documentation and related claims. The forensic accountant may perform such analyses as follows:

• First, an analysis of MManufacturing’s books and records indicate it entered a contract on January 1, 2021, to supply 2,000,000 microchips per month to Orange Cellular during 2021 at a total price (including freight) of $1.65 per chip. According to management, all chips were shipped, and all invoices were paid by Orange Cellular. Based on the review of the contract, the contract was signed on behalf of MManufacturing by Thomas Jome, Vice President of Sales and on behalf of Orange Cellular by Melissa Rose, Senior Vice President of Procurement.
• Second, an analysis of MManufacturing’s check registers and ACH/wire transfers indicate multiple payments to Melissa Rose. Such payments should be evaluated for appropriate business purposes versus potential fraud.
• Third, an analysis of the invoices submitted by MManufacturing to Orange Cellular reveal multiple invoices with prices less than the contractual rate of $1.65 per chip.
• What is the amount of the potential loss?

Therefore, the employee loss (i.e., value of the potential claim) may be calculated as follows:

The forensic accountant analyzed all payments to Melissa Rose as follows:

Based on the available data, 11 payments were made to Melissa Rose in 2020 and 2021 — via both check and wire transfer. Two payments were made for the reimbursement of air travel, hotel and dinner expenses for a site visit to MManufacturing’s corporate headquarters. Receipts and documentation were obtained from the files supporting these reimbursements. Nine wire transfers were made to Melissa Rose, totaling $100,000. There was no supporting evidence for these payments.

According to the accounts payable manager, these payments were made based on verbal authorization from Thomas Jome. Each of these expenditures should be considered suspect and potentially fraudulent.

The forensic accountant then analyzed the relevant contract specifications along with the invoices and payments made to Orange Cellular. The following chart shows the total units sold per month (two million per month and 24 million in total), total invoices, and the average price per unit sold. The chart also clearly depicts that in certain months the average per unit charge is less than the contractual rate of $1.65 per unit.

The forensic accountant learned through interviews with the company’s invoicing and accounts receivable personnel that Thomas Jome authorized the deviations from the contractual rates.

The forensic accountant confirmed that Orange Cellular paid the $37.2 million in invoices. Therefore, the total loss may be calculated as follows:

The carrier and the terms of the insurance policy would determine whether the $2.4 million withheld from the contracts is payable under the policy. MManufacturing’s legal and (forensic) accounting fees may also be covered under the policy.

Financial Statement Fraud

In the simplest terms, financial statement fraud is the intentional misstatement of financial statements in order to deceive financial statement users. Such frauds may cause negative impacts to shareholder value through reductions in share price for publicly traded companies or through fines and penalties by regulators and governmental agencies like the SEC or the Department of Justice (DOJ). Examples include the following intentional acts:

• Overstating (or understating) revenues or expenses on the company’s income statements
• Inflating (or deflating) asset values on the company balance sheet
• Hiding obligations or other liabilities
• Disguising related party transactions or financing relationships

The first step in measuring a financial statement fraud loss event is the determination of what analysis must be done. Generally, the potential loss is assessed by analyzing the financial impact on the business. For example, if the chief financial officer intentionally overstated company revenues in an attempt to increase the size of the executive bonus pool, the loss analysis may include the corrected revenues and the calculations of the corrected bonus pool. In a separate example, the intentional misstatement of financial statements may not be a specific loss event, but there may be costs associated with restating the financial statement by outside forensic accountants and law firms (which may or may not be covered under the insurance policy).

The documents required to complete this analysis will vary based on the complexity of the financial statement fraud. The following documents are typically requested in order to analyze such claims:

• Historical financial statements
• General ledgers
• Payroll and bonus documentation
• Bank statements and reconciliations
• Insured’s claim
• Police report (if applicable)

It also may be appropriate to conduct interviews of relevant company personnel to gain additional information about the claim or the alleged losses. Interviews are generally conducted in the following order:

1. Friendly witnesses (whistleblowers/attorneys) — The first phase of interviews serves to establish facts and allegations. The attorneys may assist you with intelligence gathered to date. The whistleblower (if available) may provide greater details, facts and circumstances related to the initial allegations.
2. Neutral witnesses (supervisors/direct reports/tangential) — The second phase of interviews serves to confirm the facts obtained from the friendly witnesses and provide additional details. Such interviews are important to determine the reliability of the initial allegations.
3. Adverse witnesses (potential accomplices) — The third phase of interviews focuses on other potential bad actors. Often, when confronted with accusations and supporting facts, adverse witnesses will confirm bad acts and provide details of the target’s involvement.
4. Target witnesses — The final interview (if possible) is with the target(s) of the investigation. The interview is most efficient when performed last so that you can have all available information at your disposal to confront the target and rebut any false statements.

The second step is performing the appropriate financial statement fraud analysis, which is rarely simple and may become extraordinarily complicated. We examine a reasonably simple fraud in the section below.

Financial Statement Fraud Example

Case Study

Dee Homes, Inc., a business that develops residential subdivisions and builds single-family homes, submitted a claim to XYZ Insurance Company. In its claim, Dee Homes alleged that a group of three employees colluded to overstate 2020 and 2021 revenues to increase bonus payments for the executive team. The estimated loss amount is unknown.

Below are examples of the documentation and information from the carrier and business that the forensic accountant may request in relation to the financial statement fraud:

• Cash and checks registers/logs
• ACH/wire transfer registers
• Bank statements/bank reconciliations
• Relevant bonus agreements
• Accounts payable and payment ledgers
• Financial statements, including income, balance sheets and cash flow statements
• Insured’s claim and policy
• Police report (if applicable)

The next steps are to evaluate and analyze the documentation and related claims. The forensic accountant may perform such analysis as follows:

• First, an initial interview with Dee Homes CEO, Jennifer Baez, revealed that an internal whistleblower reported through the company’s intranet site that one or more executives intentionally overstated company revenues in 2020 and 2021. The whistleblower further revealed that the fraud was accomplished through manual journal entries posted on the last day of each year and that the results of these entries significantly increased incentive bonus payments to a group of executives.
• Second, Baez reported that the company did have a special incentive bonus pool targeted to three corporate executives — the chief financial, operating and procurement officers. Based on an analysis of the relevant bonus plans, the incentive bonus pool was calculated as 25% of EBITDA for each calendar year. Such bonuses were to be paid equally to the three executives on February 1 of the following calendar year.
• Third, an analysis of the income statements and general ledgers over the past five years for Dee Homes revealed the following unsupported journal entries:

  

• Fourth, further analysis and interviews with accounting personnel revealed that the above entries were made at the request of the chief financial officer. The company’s books and records contain no support for these entries and no amounts have been collected on the accounts receivable balances to date. The forensic accountant determined these entries were unsupportable and overstated both net income and EBITDA.
• What is the amount of the potential loss?

Therefore, to find the employee loss (i.e., value of the potential claim), the forensic accountant should first calculate the executive bonus pool before adjustment for the above entries as follows:

In the next step, the forensic accountant adjusted EBITDA for the unsupported journal entries in 2020 and 2021 and recalculated the executive bonus pool. The following chart shows a potential overpayment and potential claim of $875,000.

Conclusion

Employee loss claims can be both complex to measure and have areas in which fraud exists. Insurance companies often bring in forensic accountants to quantify the employee loss. Those who have significant experience recognizing fraudulent schemes may also detect activity that merit further analysis and investigation. When hired to investigate these matters, forensic accountants must know how to identify the various signs and patterns that indicate that a fraud has occurred or is ongoing. In these cases, forensic accountants are called on to gain a unique understanding of how the claimant’s business operates — specifically how income, expenses, profit and loss on a historical basis is realized. With this information and insight into the circumstances of the insured’s financial situation, a forensic accountant can identify instances of fraud within an employee loss claim.