Missing items

I have been away on vacation and now I have exams to mark and Christmas preparations to finish.  So, I must confess that these examples are fillers as I have been too busy to write much else these days.  However, I do still feel that they have value.

Sometimes fraud is detected through the identification of missing items or transactions; in other cases unexpected transaction are found, highlighting the fraud.  However, in some fraud investigations identifying what is not there can be as important as finding out what is there.  Missing accounts receivable payments, branch offices not reporting revenue or unrecorded receipts of goods are just a few of the many symptoms of fraud.  In a similar fashion, duplicate invoice payments or payroll check numbers may be a result of fraudulent activity.  The following two examples illustrate the utility of identifying missing items in a sequence or unexpected consecutive items.

Case Study: Free Calls

Employees were permitted to use their office phone to make long distance calls as long as they paid for the charges.  From the employees’ perspective, it was a good deal since the company had a special discounted rate with the telephone carrier.  From the company perspective, it was a good deal too.  Employees liked the arrangement and it increased the number of calls that allowed the company to negotiate a better long distance discount rate.  Every week Caroline in accounts payable reviewed the long distance bill and identified non-company numbers called.  The person, from whose phone the call was made, was asked to complete a ‘long distance call’ slip detailing the date and cost of the call.  Each quarter, the employees were required to submit the long distance call slips and reimburse the company for the ‘personal calls’ portion.

One month, William accidentally lost a long distance call slip and, as a result, only reimbursed the company for the slips submitted.  Latter, he found the missing slip, but did not disclose the error.  When nothing happened, he deliberately failed to include several long distance call slips from time to time.

At the end of the year, the auditors tested the controls over the reimbursement of long distance charges and noted that there was no control to ensure that the employees were paying for all the personal calls they actually made.

The auditors reviewed the reimbursement records using the Gaps command.  Since the long distance call slips were pre-numbered, the test easily identified 26 missing slips.  The results were presented to Caroline who matched the numbers from the missing slips to the carbon copies of the slips.  William was identified as the culprit for 25 of the missing slips.  When approached by the auditors, he admitted to neglecting to include all of the weekly slips, and was ordered to reimburse the company.  In accordance with the strict policy on fraud, he was fired.

Cash Study: Frequent Traveler

The assistant to the President was required to accompany the President on many of her frequent business trips across the country.  As a result, the auditors did not normally question the high travel expenditures of the President, or of her assistant.  However, they had received an anonymous tip that the assistant was committing fraud.

During the initial fraud investigation of the assistant’s hotel bills, they calculated her total travel costs by type, and noticed that she had significantly higher accommodation expenditures than the President.  The team leader was curious as to why this was the case, and instructed his team to review all transactions related to her hotel expenditures.  In particular, they sorted them by invoice number and used the Duplicates command to look for duplicate invoices.  They also used the Gaps command to examine the sequence of these expenses.  As expected, there were no duplicates and the Gaps command run on the invoice number revealed many gaps in the sequence of the hotel invoice numbers. This was not surprising since each hotel used its own invoice numbering system and had many clients, each with their own invoice.  What surprised the auditors was that the analysis showed 10 bills from one hotel that had no gaps between – they were in sequence 20311 to 20320.  This was the case even though the dates of the invoice spanned several months.

The auditors checked with the hotel and discovered that the assistant had stayed at the hotel on the dates in question.  However, the billing manager told them that the invoice numbers were not part of their invoice sequence and had not been issued by the hotel.  The auditors brought the results of their analysis to the attention of the President and received permission to question the assistant.  The assistant admitted to using her computer to scan in a real invoice from the hotel.  She then used this scanned invoice to make copies – thereby falsifying her travel claims.  She would inflate her hotel bill every time they stayed at that hotel, which was often since the President had a lot of business in that city and always stayed at that hotel.  She unwittingly had simply incremented the invoice number each time she generated a new invoice.  The Gaps command allowed the auditors to find the altered invoices and discover her scheme.

Lessons-learned: The ability to see indicators of fraud in the data includes not only seeing what is there (and is not expected) but also what is not there (and is expected to be).  Missing items can range from inventory tags, purchase orders, health claim forms and even transaction ids in ERP system (why are we missing 6 transactions?).  In other cases, you should have gaps – in fact you shouldn’t have consecutive items (e.g. invoice numbers, credit card numbers (anything with a check digit), and various types of receipts.

The ability of auditors and investigators to analyze data is enhanced when they can manipulate and work with the data.  Sometimes it is necessary to create new fields, not existing in the original file – such as Total value of inventory (quantity on hand * unit price).  ACL is ideal for this type of analysis – allowing new field to be created and then compared with existing fields or data in other files.  It can perform simple calculations (quantity * unit price) or conditional calculations (markup is 57% if product code is ‘01’; 68% if product code is ‘02’ and so on.).  Whether there are millions of records or only thousands – the analysis is fast and easy; and the results are often revealing.

New System – control weaknesses

It is always important to test controls when systems and/or processes change.  Sometimes a current process may have adequate controls, but the new process may not be as secure.

Equipment Serial Numbers

A large company with several plants purchased expensive, highly specialized, equipment for use in its manufacturing plants.  A central purchasing organization made all the purchases and the inventory held until required by a plant.  The inventory manager was understandable proud of the inventory system; having recently implemented just-in-time inventory practices while maintaining a quick response time to orders from plant managers. This meant that expensive equipment was only purchased if, and when, required.  The new inventory practices were saving the company millions of dollars every year.  However, he had heard a few rumblings about inventory theft, and although he was not personally aware of any problems, he asked audit to take at look at the issue.

The audit teams conducted a thorough review of the controls and only found one area of concern – when items were shipped to the plants, they were automatically removed from the electronic inventory system.  The receiving plant manager did not have to send any proof of receipt, so there was no sure way of knowing if the item had reached its proper destination.  The inventory manager countered that if someone had ordered an item and did not receive it, he would certainly hear about it.  He even produced a few emails where the recipient had questioned the status of deliveries that were only a day late.  The audit team leader smiled as said, ‘what if they were not expecting a delivery?’.

The audit team requested a copy of all high dollar equipment that had been purchased in the last year; this included all equipment that had been shipped to the plants.  The data was sorted and a check for duplicate serial numbers performed.  The results revealed that 53 expensive items, used in the manufacturing process, had duplicate serial numbers.  The company had purchased hundreds of thousands of dollars worth of equipment – twice; and in each case, the shipping agent was the same person.

The auditors, with the help of the inventory manager, set out to catch the thief.  They noted that while all equipment had been shipped to various manufacturing plants, none of the managers at the plants had placed an order for, or received the equipment.  The next time the clerk in question prepared a shipment for delivery for which the receiving plant manager had not placed an order, audit arranged for a private security company to follow the truck.  Instead of delivering the equipment to the plant specified on the shipping receipt, the equipment was delivered to a warehouse in the city.  Two days later, the inventory manager asked the clerk to place an order for the same model equipment. The security personnel followed the truck as it delivered the same equipment back to the company warehouse.

In the weeks that followed, audit was able to prove that the clerk was placing false orders for equipment, charging the inventory to phony projects.  The equipment was delivered to a warehouse and held until a purchase order was placed for the same item.  The clerk would then arrange for the equipment to be shipped to the company – selling the company back its own inventory.  The serial number had not been changed, so it would have been identified as a duplicate if the equipment had not been removed from the inventory system when it was shipped the first time.

As a result of the investigation, the clerk was fired and the serial numbers of all new equipment were compared to those of equipment that had previously been in the inventory system.  Controls were put into effect to ensure that equipment was shipped to, and received by, project managers.

ACL Commands: FILTER, SORT, RELATE