Tag Archives: segregation of duties

Oh Yes, She Did!


In previous posts, when talking about the importance of controls in a system to help prevent fraud, I discussed the case of Amy Wilson. These posts were specifically about how trust is not a control. Regardless of how nice a person seems to be (or is) or how long someone has worked for you, you should never decide that you can trust them enough to forgo system controls. It really cannot be said enough, trust is not a control. It does not matter how good a person is or how long they have worked without ever considering defrauding their employer, there may come a time when they face great pressure to commit fraud. It is important that, should this time arise, there are controls that deter them from giving in to temptation.

In my first post about Amy Wilson, I discussed how many controls I come across when I run a race compared to how few controls I have seen in many businesses. I continue to be amazed by this; people will put so much into making sure folk aren’t fabricating their running times, yet they are willing to trust those very same folk with their money and assets. The second time I wrote about Amy Wilson, I had watched her enlightening interview on the Attestation Update website. Here and in the articles she has authored, Amy Wilson speaks very clearly about what she did and how she could either have been caught or have never had the opportunity to perpetrate the fraud.

Well, fast forward to today. I received notification, this morning, that Amy Wilson had visited my website and left me a comment. She was very complimentary (whew!). I am glad because Ms. Wilson does have great lessons to impart and I appreciate that she does not take issue with how I have shared her story and lessons. To have real life examples of where the weaknesses in a system were, how they were exploited and the ultimate consequences of all of this is absolutely priceless. When it comes to designing and instituting controls in a financial system, it is imperative that this is performed effectively and consistently. In order to make sure that this process is correctly implemented, the stories must be told clearly, correctly and honestly. It is fantastic that Ms. Wilson is unflinching when she talks about what she did; that kind of thing does not happen often. This kind of honesty helps forensic accountants get better at what they do and, hopefully, businesses get better at deterring, preventing and detecting fraud. Finally, feedback like Amy Wilson’s helps me feel happier about what I do.

Tagged , , , , , , , , ,

Stuff It

Back in the early days of my time as an auditor, I went on many inventory counts. Because companies would have to close their businesses while the inventory count was going on, they tended to happen over the weekend. I am yet to meet anyone who likes to spend their weekends at work and it is even worse when all of your friends are going to be sleeping in or doing something fun while you are at work. I could complain (and I am sure I did) but it was a necessary part of the work that I did and so I spent several weekends at a client, observing their inventory counts and carrying out audit tests. One particular assignment sticks in my head. I went to a company that had a very large inventory of bags of cement. I cannot, for the life of me, remember what the company did – whether it was construction or the manufacture and sale of cement. Either way, there was a huge warehouse, filled with stacks of these bags. I don’t know how much you know about cement but, what I found out that day is that cement is very powdery and the small particles are very good at escaping the bags that they are put into. You could see the air in the warehouse; it looked a little like the inside of a snow globe, except for the fact that no one would ever make a snow globe of mountains of brown bags. One of my tests involved test counting areas of inventory to see if my numbers tied up with the numbers counted by the client. I walked around sections of the warehouse and counted stacks of bags – the length, breadth and height – and multiplied numbers to come up with totals. I was not done though. I had to make sure that the mountains were made up of cement bags all the way through and not, say, hollow in the middle. So, I climbed up the dusty stacks of bags, fighting my fear of heights in the name of my mission, and checked to make sure that the stacks were not hollow. I then also had some of the staff at the company move some bags around to make sure that the stacks were made up of only cement bags and not bags of some other filler. I went home that day coated in a film of cement dust. I know my neighbors were wondering how an auditor could get so dirty at work – didn’t I just work with a calculator and pen? Ink stains were expected, but not cement. For all the complaining that I did about spending my Saturdays on inventory counts, I found a lot of the assignments, like this one, to be a lot of fun and rather exciting. I got to be queen of the cement mountains and bound about, on high, in the name of thoroughness.

If you have a company that sells or makes any kind of stuff, you will have inventory, which is also called stock. In accounting lingo, inventory is considered to be an asset because it is something that is expected to make you money in the future. For the very reason that inventory is expected to make you money in the future, it is important, for the health of your company, to safeguard your inventory, so that someone else doesn’t make off with it and, thus, your future money. I have spoken many times about many ways to prevent fraud and error with financial statements, but a lot of these steps can be translated into making sure that you hold on to your stuff.

In the world of inventory, your stuff disappearing is referred to as shrinkage. It makes it sound like you didn’t follow the instructions for laundering clothing, but it basically means that someone is stealing from you and, I don’t know about you, but I don’t like it when people steal my stuff. Any advice I can take to keep that from happening is good advice to me. The first step, in order to protect your inventory, is to keep it locked up. I have told you before about the steps my husband took to install physical barriers to access to his belongings in his studio. These are the types of steps that you should take in physically safeguarding your inventory, your stuff. Depending on what you have and what your needs are, the physical safeguarding may be locks, cameras, doors with security codes or even those fancy retina scanners that we see on crime shows. You should not only keep your inventory under lock and key but also limit access to the inventory to a few authorized parties. Only people with a reason to get to the inventory should have access. This makes it easier to trace the movements of inventory and it also serves as a deterrent to those who might think about pilfering inventory. If the list of suspects is a short one, those people might think twice about stealing.

The segregation of duties is also vital with inventory. The cycle of inventory begins with its purchase. Inventory is then stored until it is needed for manufacture or sale. Sometimes inventory is damaged, expires or is otherwise no longer of value to you and your company. When this happens, the inventory is either destroyed or sold, at a loss, to someone else who still finds it useful. Now, if one person has control over this process, from purchase to sale or destruction, there are many opportunities for fraud. For example, a person may take inventory, sell it for a profit and then write off that inventory as obsolete, pocketing the money made from the sale. Another example of fraud is ordering and receiving, say, ten items, but claiming that only nine were received. This person can then take the tenth item for personal use or profit.

Another very useful and important control is the use of preprinted, prenumbered documentation. These documents range from order forms, to receiving reports and shipping reports. All movement of inventory coming in and going out must be documented and those documents must be prenumbered. Gaps in the document numbering, or repeated numbers, will raise red flags that should be investigated. Missing documents should also raise red flags that should be investigated.

Inventory is your company’s stuff and it is important to seek out the advice and guidance of qualified CPAs to best protect it. Doing so dissuades potential criminals from trying to take it and also will make it easier to track it down, should someone take it. Taking the time to adequately plan and incorporate these controls into your inventory system can protect you from loss. I know I get worked up about people messing with my stuff and I am pretty sure you feel the same about the stuff that helps your business run.

Tagged , , , , ,

From The Horse’s Mouth

Mister-Ed-Talking-HorseEarly last year, I wrote about Amy Wilson and the lack of controls that existed in the company that she stole from. The complete lack of controls and reliance on trust gave her the opportunity to steal from the company, which she did… for four years. She was actually caught by the fraud department at the credit card company, not by her employers. Anyway, I am talking about her because Jim Ulvog has an excellent post on his website, Attestation Update. Here, Amy Wilson tells us about her fraud, how she was caught and how she got away with things for as long as she did. It is an excellent watch and a great reminder of the very wise words – “trust, but verify.”

Tagged , , , , , , , , , ,

It’s A Good Hurt

This morning, after my run, I pulled out my yoga mat and foam roller and embarked on my post-run stretches. I am yet to come across a runner who looks forward to the stretching – most of us confess to not stretching enough. And as much as we deplore the stretching we tend to do that more often than the foam rolling. This is because, despite the benign name, the foam roller is an instrument of torture. When I have taken yoga classes, teachers have asked me if I am a runner. They ask this, not because my yoga skills are impressive, but because my leg muscles are so tight that touching my toes is a feat; it’s not a good look. These tight leg muscles are what I target with the foam roller. I am terrible at stretching because stretching after a run is mind-numbing tedium. I am atrocious at using my foam roller after a run because trying to loosen up my tight muscles after a run hurts like hell. However, if I don’t loosen up these muscles, I am setting myself up for injuries and pain that will keep me from running for a lot longer than it takes to suffer through the rolling.

The same is true of many aspects of an entity’s financial system. There are many controls that are recommended by accountants and auditors that may seem like overkill or painfully tedious. However, as I have explained in some of my posts regarding aspects of control systems, such as segregation of duties and double entry accounting, being proactive about creating and maintaining a robust financial control system goes a long way to keeping things from going horribly wrong in the future. I will be the first person to tell you that there are many parts of an accounting system that are not fun. For example, it would be so much easier to have checks come into a company and be dumped on an accountant’s desk and have that one accountant deal with recording the check in the books, depositing the check in the bank and then reconciling the bank statement at the end of the month. Way too many companies opt for the easier path and find many ways to justify their decisions – the accountant has been with them for years, the accountant is such a nice person and totally trustworthy and wouldn’t act in an unethical manner. It’s an easy path until the money is stolen and, more often than not, not recovered. Too many stories of beloved staff members who have turned out to be fraudsters and thieves should show people that a great personality is not an acceptable control measure. Way too many times, we discover that the friendly coworkers are able to perpetuate their crime for a long time because they just seem too good to be crooks.

Record-keeping can seem like such a drag. I mean, what fun is there is debits and credits and keep track of income statements and balance sheets. Oh, and don’t get me started on the headaches that a balance sheet that doesn’t balance can bring. Why would anyone want to keep track of order forms, receipts and other elements of an audit trail? When making an adjustment to the ledger, you know that you will totally remember why you processed the change, even ten years from now. You don’t need to provide backup or keep a record of why you made the change. You wouldn’t believe how often I hear this kind of talk from accountants. Six months later, practically none of them can explain a journal entry that doesn’t have backup and this is for the accountants that have not decided to move on to another company, leaving the person who has taken over their position completely in the dark. Especially since we live in an age when people are not married to one job for life, it is essential that anyone looking at a transaction can find out just about everything there is to know about the transaction without having to employ the services of a forensic accountant.

There are times when I start nodding off just at the thought of the some of the processes I need to go through. Sometimes I think – I don’t really need to check this; the accountant has done this a hundred times, so it is probably okay. But then I think about what might happen if I am incorrect. The thought of how much more I will have to do if I don’t perform the check and then have to clean up the mess afterward pushes me to suck it up and do things correctly the first time. When, on occasion, I find an error, I know that it’s good that I decided to do the right thing. Also, the fact that those in the finance department know that work is being reviewed and being given a look-over by others is a great deterrent to those tempted to engage in nefarious behavior. I also remind myself of this when my own work is being reviewed and my ego has to be reminded that even I can make mistakes and that, in the name of outputting a superior product, the checks on work are not only good but necessary.

Running a business is not all fun, games and glamour. There are times when the physically and mentally painful work must be done in order for the business to succeed and minimize errors and fraud. I groan in pain and have to will myself to remain diligent and not cheat on the foam rolling. The neighbors may wonder what is going on but I know that this is how I can minimize injuries and keep on running happy and healthy. Likewise, though I make less noise (at least, I think I make less noise) about some of the work that I have to do, I know that this is what must be done to keep the company happy and healthy. So, do what hurts – it’s good for you.

Tagged , , , , , , , , ,

Here’s My Number And A Dime…



“If you see something, say something”. Living in New York City, this is a message I come across often. I see it advertised all over the subway, I see it on buses and I have even seen it on television. Although the messages tell us to inform a police officer, MTA employee or call a toll-free number in the cases that we do see something and want to say something, I have often thought about the logistics of this. On my way home from work, I tend to end up in the last subway car. Now, say I get onto the train and I see something and I want to say something. I am in the last car and can barely see the subway conductor who is in the middle of the train. Do I try to run up the platform to get to the MTA employee before the train doors close and the train sets off? Do I perhaps hope that there is a police officer that I can alert, hanging out on the subway platform? My subway station is one of the few that now has cellphone reception, so I could call the toll-free number. However, I have never taken the time to actually take the number down so I have no idea what it is. All this said, I like to think that, on the day that I do see something and need to say something; it will be like the movies and things will fall in place and work out.

Previously, when talking about controls, I have discussed the importance of the segregation of duties and how having several people involved in a process means that there are other people who are watching what is going on and who, therefore, can report any untoward activities that they see. Annually, the Association of Certified Fraud Examiners (ACFE) publishes a Report to the Nations on Occupational Fraud and Abuse. The 2014 report stated, “Over 40% of all cases were detected by a tip – more than twice the rate of any other detection method.” That is a staggering statistic and emphasizes just how important people who see and say something are when it comes to fraud detection. The knowledge that there is an easy way for fraud to be reported may also serve as a deterrent to those contemplating committing fraud. In response to a series of huge financial scandals that led to losses in the billions of dollars and the end of companies such as Enron and WorldCom, the Sarbanes- Oxley Act was passed in 2002. Among its various provisions, it required that publicly traded companies establish a whistleblower system that makes it easy for employees and third parties to anonymously report financial misdeeds.

There is a television show called “The First 48”. The premise of the show is that the chances of solving a murder are cut in half, if investigators do not get a lead within the first 48 hours. On a few occasions, I have watched as detectives go from door to door in a neighborhood, asking people if they know anything about the homicide that occurred. Generally, the police are met with silence, shaking heads and closing doors. However once they get back to the police station, their phones start ringing and people leave anonymous tips that often lead to an arrest. Anonymity is a very important aspect of creating a whistleblower system. The fear of punishment for reporting fraud, such as being fired, demoted or even physically attacked, can keep a witness silent. It is vital that a person knows that they can safely make a report and remain unidentified, should they wish to do so.

There should be several reporting options available to the whistleblower, such as the telephone, an electronic system and U.S. mail, giving the whistleblower the opportunity to use the method that they are most comfortable with. Also, the system should be available 24 hours a day, 365 days a year. With the whistleblower hotline, a trained interviewer, who knows how and what to ask the caller should answer the phones. The last thing a nervous caller wants to deal with is voicemail.

In order to make the whistleblower system most effective, a corporate entity’s staff, vendors and other third parties need to know that there is a way that they can report wrongdoing and that action will be taken. This means that a company with a whistleblower system should distribute literature and hold training sessions on ethics, processes and how to report any financial wrongdoing. Several years ago, I caught a cab from Manhattan to Brooklyn. During my ride, the cab driver complained about having to drive to Brooklyn and tried, several times, to drop me off at a subway station. I insisted that he take me to Brooklyn, as I had requested. He then spent the rest of the ride swearing and protesting. Once we reached my destination and I stepped out of the taxi, he yelled out the window, “Bitch”, and drove off. Suffice to say, I was upset by this experience. Shaking, I walked into the building and called 311, New York City’s non-emergency information and complaint service. I told the operator about my experience and gave her the taxi driver’s medallion number. She took my report and asked whether or not I wished to remain anonymous. I chose not to, wound up facing the driver in a hearing, and winning my case. I did all this because I did not appreciate how the taxi driver had treated me and felt that I should not let him think that it was okay for him to behave in that manner. More importantly, I did this because I knew about and had access to an easy, and well-publicized service where I could lodge my complaint and have my issue investigated and resolved.

I have mentioned that publicly traded companies in the United States are mandated to set up a whistleblower system. It is in the interest of other entities to consider a system by which anyone who comes across financial crime can report the crime, knowing that something will be done about it and that no one will come after them for making the report. Sometimes something as simple as an anonymous mailbox can make a big difference – just knowing that there is a way to report crime gets people reporting crime. Then again, as an employee or a third-party, such as a vendor or a customer, there may be times when you feel as though the corporate culture is so corrupt that no one within the company will respond to your complaint. At times like this, you should look to the law for assistance. In New York City, you can call 311 for guidance and assistance. You can also visit the District Attorney’s website for information on how to report a financial crime. The power of people speaking up when they see something amiss cannot be underestimated and voicing your concerns is easier than you imagine; remember whistleblowers are the number one (by far) way in which fraud is discovered. So, really, if you see something, say something. You don’t even have to worry about the train leaving you behind.

Tagged , , , , , , , , , , , , , , , , , ,