Free Essay

Accounting Forensic Wells

In: Business and Management

Submitted By Economicso
Words 290722
Pages 1163
Wells4689_FM_1

05/31/2007

1

Fraud
Casebook

Wells4689_FM_1

05/31/2007

2

Wells4689_FM_1

05/31/2007

3

Fraud
Casebook
Lessons from the Bad Side of Business

Edited by Joseph T. Wells

John Wiley & Sons, Inc.

Wells4689_FM_1

05/31/2007

4

1
This book is printed on acid-free paper. 
Copyright # 2007 by Association of Certified Fraud Examiners, Inc. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Wiley Bicentennial Logo: Richard J. Pacifico.
Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923,
978-750-8400, fax 978-646-8600, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-6011, fax 201-748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.
For general information on our other products and services, or technical support, please contact our Customer
Care Department within the United States at 800-762-2974, outside the United States at 317-572-3993 or fax 317-572-4002.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.
For more information about Wiley products, visit our Web site at http://www.wiley.com.
The case studies presented in this book are based on actual cases. Names, dates, locations, and some facts have been changed to protect the privacy of the organizations and individuals involved.
All amounts are in U.S. dollars unless otherwise specified.
Library of Congress Cataloging-in-Publication Data:
Fraud casebook : lessons from the bad side of business / Joseph T. Wells.
p. cm.
Includes index.
ISBN 978-0-470-13468-9 (pbk.)
1. Fraud–Case studies. I. Wells, Joseph T.
HV6691.F737 2007
363.250 963–dc22
2007009247
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1

Wells4689_FM_1

05/31/2007

5

For Barry C. Melancon:
A true giant in the accounting profession

Wells4689_FM_1

05/31/2007

6

Wells4689_FM_1

05/31/2007

7

&
Contents
Preface
PART

xiii

1

CHAPTER

Asset Misappropriation

1

1

High Art, Low Value: How a Connoisseur Became a Convict

3

by Ellen A. Fischer
CHAPTER

2

The Ambitious Payroll Manager

16

by John Tonsick
CHAPTER

3

The Insider

25

by Craig R. Sinnamon
CHAPTER

4

Aloha, Hawaii!

36

by Dominic A. D’Orazio
CHAPTER

5

What About Pete?

44

by Michael Goldman
CHAPTER

6

Check, Please

54

by Peter Parillo
CHAPTER

7

The MoJo Skim Twins

61

by John F. Kronick
CHAPTER

8

The Mole

71

by Manuel Pereira
CHAPTER

9

Her Passion for Fashion

79

by Bethmara Kessler
CHAPTER

10 An Unaffordable Complex

91

by Jeffrey D. Barsky
CHAPTER

11 A Taxing Problem

100

by Andrew H. Kautz

vii

Wells4689_FM_1

viii

05/31/2007

8

contents

CHAPTER

12 PHANTOM LINKS IN THE SUPPLY CHAIN

108

by Christopher J. Kelly
CHAPTER

13 The Trusting Business Owner

117

by David H. Glusman
CHAPTER

14 The $13 Million Man

126

by John Francolla
CHAPTER

15 They Didn’t Know Jack

137

by Janet M. McHard
CHAPTER

16 The Skim Sisters

145

by Adam K. Bowen
CHAPTER

17 No Such Thing as a Free Lunch

156

by Suzanne Coggins
CHAPTER

18 The Dirty Custodian

164

by Paul J. Harvey
CHAPTER

19 The Video Game

172

by Carlos L. Holt
CHAPTER

20 Bet Your Life on It

183

by Howard B. Grobstein and Joshua R. Teeple
CHAPTER

21 When Petty Cash Isn’t Petty

195

by Karen Frey
CHAPTER

22 Where Did My Money Go?

203

by Robert Barr
CHAPTER

23 Three Strikes and You’re Out!

212

by Mary Best
CHAPTER

24 Country Club Fraud—What a Steal!

222

by John Boekweg
CHAPTER

25 Where in the World Is Dina Sanchez?

233

by Briana J. Paciorek
CHAPTER

26 School of Fraud

242

by Nessan Ronan
CHAPTER

27 Price Check on Register One

251

by Dwight Taylor
CHAPTER

28 The Sky Is the Limit by Brian E. Browning

260

Wells4689_FM_1

05/31/2007

9

contents
CHAPTER

29 SUPPLEMENTAL INCOME

ix

268

by James E. Whitaker
CHAPTER

30 An Innocent Perpetrator

276

by Howard C. Sparks
CHAPTER

31 Dr. Amy

285

by Stephen A. Pedneault
CHAPTER

32 Patriotic Game

295

by James Lee
CHAPTER

33 Would You Like the Special Poutine, If You Know
What I Mean?

305

by Richard Elliott
CHAPTER

´
34 Three-Ring Circus: An Expose of a Corporate
Commission Embezzlement

316

by David A. Schneider
CHAPTER

35 One Bad Turn Deserves Another

327

by Forrest Bowman Jr. and Charles F. G. Kuyk III
CHAPTER

36 Dialing for Dollars

337

by Ian Henderson
CHAPTER

37 Wake-Up Call

343

by Michael Speight
CHAPTER

38 The Dental Queen

351

by Kenneth J. Wilson
CHAPTER

39 Shirley A. Little Wouldn’t Hurt!

358

by A. T. ‘‘Chief ’’ Schwyzer
CHAPTER

40 Just When You Thought It Was Safe

368

by Frank D. Moran Jr.
CHAPTER

41 How Many Ways Can I Defraud You?

378

by David Clements
PART

2

CHAPTER

Corruption Schemes

389

42 A Contract of Convenience

391

by Robert B. Walsh Jr.
CHAPTER

43 Corruption by Seduction by Douglas M. Watson

404

Wells4689_FM_1

x

05/31/2007

10

contents

CHAPTER

44 ‘‘BIG EASY’’ BUSINESS

418

by Patrick W. Malik and Jeffrey R. Sebree
CHAPTER

45 Unlucky 13

425

by Graham J. Thomson
CHAPTER

46 It’s 11 p.m. Do You Know What Your IT Director Is Up To?

434

by John Kula
CHAPTER

47 These Weights Didn’t Measure Up!

444

by Joseph R. Dervaes
CHAPTER

48 Swimming with the Sharks

455

by Pedro Fabiano
CHAPTER

49 A New York State of Fraud

466

by Martin T. Biegelman
CHAPTER

50 Information Superhighway

477

by Barry Davidow
PART

3

CHAPTER

Financial Statement Fraud Schemes

51 Banking on Fraud

491
493

by Jason Lee
CHAPTER

52 Just a Matter of Time

502

by Margaret Smith
CHAPTER

53 Bury Me Not in Guyandotte

510

by John W. Burdiss
CHAPTER

54 The Woolly Mammoth Eats Its Prey

519

by Paul Pocalyko and Charles N. Persing
CHAPTER

55 Double Damage

527

by Matthias K. Kopetzky
CHAPTER

56 How to Steal a Million Dollars Without Taking the Cash

536

by Richard A. Riley
PART

4

CHAPTER

Other Fraud Schemes

57 This Land Is Your Land, This Land Is My Land

547
549

by Andrew Pappas
CHAPTER

58 Paradise Lost by Pierre E. Lautischer

560

Wells4689_FM_1

05/31/2007

11

contents
CHAPTER

59 BODIES FOR RENT

xi

568

by Rebecca S. Busch
CHAPTER

60 The Million-Dollar Breach of Trust

577

by Holly Frook Graham
CHAPTER

61 Troubled Water

587

by Dimiter Petrov Dinev
CHAPTER

62 Con Artists Gone Wild

596

by Heinz Ickert
Index

607

Wells4689_FM_1

05/31/2007

12

Wells4689_FM_1

05/31/2007

13

&
Preface

F

raud, as you will read in the following pages, is not committed by accounting systems or computers. It is carried out by living, breathing human beings who outwardly seem no different from you and me. Occupational frauds—those offenses that occur in the workplace—are all too common; nearly every company has been a victim or will be in the future. It would be easy to say that this phenomenon happens because of greedy, dishonest people. But greed is a natural human trait. And all of us lie. So that explanation falls short of predicting who will turn to occupational fraud. More often, as you will see, fraudsters appear to be ordinary individuals who believe that they are caught in extraordinary circumstances. They are frequently upstanding, God-fearing, patriotic citizens who despise crime as much as the rest of us. Moreover, they don’t really look at themselves as criminals. But they certainly are.
I have been fascinated with the motives and morals of white-collar criminals for close to
40 years. Preventing, detecting, and investigating fraud has become my life’s work. It didn’t start out that way, though; I graduated with an accounting degree and became an auditor before being accepted as a special agent of the Federal Bureau of Investigation. Fraud cases, large and small, were my bread and butter. After nearly 10 years, I left to start my own consulting firm specializing in white-collar crime issues. And in the late 1980s, I helped form the Association of Certified Fraud Examiners (ACFE), the world’s largest antifraud organization, where I still serve as chairman.
Along the way, I’ve lectured to thousands of antifraud professionals, traveled to nearly every corner of Earth, taught in the graduate school at the University of Texas at Austin, conducted independent research on the causal factors of fraud, and written extensively on the topic.
This book, my thirteenth, pulls together the experiences of fraud examiners from across the globe, each of whom has provided details about a case he or she has investigated.
Although the literary styles are as unique as the people who wrote them, all the chapters drive home a number of universal themes. First, those who commit fraud usually do so without a grand plan; instead, they made bad decisions, one after the other. Second, like water, fraud follows the path of least resistance. That is, these offenses are never more complicated than they need to be in order to accomplish the perpetrator’s illicit goals. So you will notice that many of these schemes are the essence of simplicity. xiii Wells4689_FM_1

xiv

05/31/2007

14

preface

Third, occupational fraud follows definite patterns. We first determined that fact in
1996 with the release of the ACFE’s first Report to the Nation on Occupational Fraud and
Abuse, which consisted of an in-depth study of over 2,000 actual cases furnished to us by certified fraud examiners. The Report has been replicated three times since then. We’ve been able to classify frauds by the methods used to commit them. There are three broad categories—asset misappropriations, corruption, and fraudulent financial statements— and there are numerous subschemes.
Fraud Casebook: Lessons from the Bad Side of Business is organized around these schemes, which has subsequently been dubbed the ‘‘Fraud Tree.’’ Part I is devoted to the most common offenses, asset misappropriations. Part II covers corruption; Part III details fraudulent financial statements, the least common but by far the most expensive occupational frauds; and Part IV focuses on a variety of other fraud schemes.
Each case involves four areas. Why the fraud was committed is an important human interest story. How the fraud was committed gives the accounting and other technical details. Lessons learned offers sound advice on what went wrong. And preventing future occurrences shows what must be done to keep the same kind of schemes from happening again. You will notice that many of these stories don’t have pleasant outcomes; justice was not served and lives were changed forever. My experience in this field has taught me that when fraud occurs, there are no winners. That makes prevention the ultimate goal. And that process begins with educating ourselves.
Lessons from the Bad Side of Business can be utilized by academics wishing to expose their students to the realities of fraud. It can easily be an accompaniment to one of several fraud texts, including my own, Principles of Fraud Examination. But practitioners, managers, and business owners will also learn a great deal in these pages. Finally, those with a general interest in occupational fraud will discover that this book is simply a fascinating read.
Thanks go first to the ACFE members who wrote the case studies. They didn’t do it for money; the profits are earmarked for the ACFE General Scholarship Fund, which provides grants to deserving college students. Good writers know that there is nothing easy about this craft, and they are therefore commended for their efforts. Authors also are aware of the critical symbiotic relationship that exists with their editing team. John Gill, Kassi
Underwood, and Andi McNeal of the ACFE Research Department did an outstanding job in that regard. Finally, I appreciate the assistance of Tim Burgard of John Wiley & Sons,
Inc., who wouldn’t give up until I agreed to take on this project.
Fraud is a serious problem that goes much beyond monetary losses. It costs jobs, raises, corporate reputations, and individual dignity. Fraud Casebook: Lessons from the Bad Side of
Business will shed light into the dark corners of government and commerce so that we can hopefully avert, in the future, some of the same mistakes we have made in the past.
Joseph T. Wells, CFE, CPA
Austin, Texas
June 2007

Wells4689_c01_1

05/31/2007

1

part one

Asset Misappropriation

Wells4689_c01_1

05/31/2007

2

Wells4689_c01_1

05/31/2007

3

chapter

1

&
High Art, Low Value: How A
Connoisseur Became A Convict
ELLEN A. FISCHER

f there were a law that required people to trade their names for a single adjective,
Lawrence Fairbanks would be Cosmopolitan. A tallish, gaunt man of 45, Lawrence held the position of Assistant Vice Chancellor of Communications—the glitziest job in the glitziest department of Aesop University. In the vast sea of academe, Lawrence’s ship steered clear of the lecture halls, laboratories, and weekly beer orgies on Fraternity Row. I doubt that
Lawrence ever met a professor, much less a student. Instead, he sailed the waters of media and public relations. Lawrence was in charge of making sure that the university’s good side was featured in every last magazine, newspaper, and brochure that dropped off the printer.
The position of AVC-Communications fit Lawrence like a second skin. He had been recruited by Aesop from a renowned magazine empire, and it showed. Two decades in the publishing world had secured him the professional trust and personal admiration of the writers, editors, photographers, and graphic artists who produced award-winning publications on behalf of the university.
Moreover, Lawrence wore the cultured charisma of a man well studied in the arts. His knowledge and taste far surpassed the better-known works you might guess on Jeopardy! or in a game of Trivial Pursuit. Lawrence was captivated by the black-and-white photography of the early twentieth century. He was versed in original oil paintings and ceramic pieces by important—though not mainstream—artisans in New York, San
Francisco, and London. The breadth of Lawrence’s interests included antiques—all kinds of antiques, ranging from old books to the earliest cameras, apothecary items, steam trunk luggage, and toys. Lawrence also had a fondness for period furniture of the sort you might find in a museum. Art was Lawrence’s life.
Lawrence’s high regard among the university communications creative staff was shared by the administrative employees who reported to him. Though fluent in the language of the elite, Lawrence Fairbanks was no snob. He always greeted the accounting clerks, the administrative assistant, and the receptionist by name. At Christmas, he arranged a destination luncheon and tour of the newly opened museum—the one that had a yearlong waiting list. Every employee in the department was invited.

I

3

Wells4689_c01_1

4

05/31/2007

chapter 1

4

high art, low value: how a connoisseur became a convict

Lawrence’s glad-handing social ease endeared his university colleagues and impressed the literati and glitterati of the media and art worlds. It also won him a lovely, intelligent wife. Having waited until his late 30s to marry, Lawrence was now the father of six-yearold Ruthie and three-year-old Bobby. It was touching to see how a keen art connoisseur had reserved the outer surface of his office desk as a minigallery for the framed works of his two little crayon masters.
Lawrence’s wife, Allison, worked as a midlevel corporate attorney; despite their dual income, which exceeded $250,000 a year, the family home was unpretentious. In a city that sweats opulence, the Fairbanks’ home stood unremarkably among other homes of its style in a neighborhood better known for its nearness to prominent cultural venues than its prominent residents. The cozy, single-story clapboard house of pre–World War II construction had three bedrooms and a single bathroom. It was just big enough for four people who, by all appearances, followed the script of the American Dream.
But there was more to Lawrence’s life than his wife, his children, and his job—and there was certainly more than met the eye to the way he approached his love of art. Normally, when one speaks of a love of art, one refers to a hobby that provides enjoyment and enrichment. Normally, one’s most cherished pieces are shared with family.
Normally.
We often hear that the most public personalities can mask the most private souls. And, while the inner reflections of a private soul are normal, the secret, shame-driven need for certain objects is called ‘‘obsession.’’ No one—not even Allison Fairbanks—knew the extent of Lawrence’s love for art, nor the lengths to which he would go to acquire it, hide it, and ultimately dupe employer and supplier alike into feeding his passion.
Art nourished Lawrence’s troubled heart even as it starved his soul to death.
Art was Lawrence’s life.

The Face of Many
Aesop University, the largest campus in a state university system, enjoys an eminence that rivals the Ivy League. Founded in 1871, Aesop grew from a state teacher’s college to an institution with a world reputation for scholarship, research, and community service.
Modestly put, the university produces and attracts the ‘‘Who’s Who’’ of every imaginable field. Every orange and burgundy sweatshirt in the student bookstore proclaims its logo, Omnibus Punim, which is translated to mean ‘‘The Face of Many.’’
Aesop’s family portrait includes famous actors, Olympic athletes, a Supreme Court Justice, and several Nobel laureates. The Aesop Medical School successfully pioneers new treatments for the most hopeless conditions. Its doctors have ministered to the destitute and distinguished alike.
On any give day, Aesop’s total student enrollment reaches 35,000 among its undergraduate, graduate, and professional schools. To keep this educational behemoth running, Aesop employs upwards of 25,000 staff and faculty. And though situated in the highest-rent district of one of the three largest cities in the United States, Aesop’s 500-acre

Wells4689_c01_1

05/31/2007

5

the face of many

5

¨ber-school its very own zip code. Aesop’s football team, the campus has earned the u
Thundering Bison, has secured the celebrity campus a regular spot on the 11 o’clock news.
More important, its $3-billion budget has won it a set of permanent box seats in the crosshairs of the state legislature.
The university’s in-house business and technology experts have patiently guided this tradition-steeped grandfather of higher education toward the Information Age. With the steady, gentle prodding that got Daddy to trade his turntable for a CD player, Aesop eventually migrated from its old record-keeping system of manila folders and microfilm to the ‘‘Give-it-to-me-now!’’ world of computers.
By the mid-1990s, Aesop’s entire purchasing and accounts payable system was computerized. Just enter a log-on ID and password, and an authorized employee is soon staring at any financial transaction processed in any of the university’s departments. Push another few buttons, and you’ll know which employee entered a purchase request before he or she fired it off to the campus’s central Accounts Payable Department. You’ll see the serial number of the university check and the day it was cut. You’ll even know whether that check was sent out to the vendor through the U.S. mail or whether it was first sent back to the department that requested the payment.
Any business with as many moving parts as Aesop University must make sure that its bills are paid efficiently, but not recklessly. So along with the streamlining of the accounts payable process comes a few built-in security measures. One big safeguard is the university’s purchasing policies—in particular, the policy that dictates spending limits.
Aesop’s ‘‘Low-Value’’ Purchase Delegation Policy places a ceiling on how much any one campus department can spend with a single vendor on a given day without obtaining formal approval from the Central Purchasing department. Exceeding that limit causes the
Materiel Acquisition and Disbursement (MAD) automated system to halt a department’s purchase request and reroute it to campus’s Central Purchasing unit.
That is, if more than $2,500 worth of business per day—plus a small additional margin for tax and delivery—is going to any one supplier, Central Purchasing will automatically gain control of the purchase. There are all kinds of good reasons, too—for example, making sure that old Aesop, a public university, is given the best deal in the marketplace and that it obeys a long list of state and federal laws.
You can almost see the buyers in Central Purchasing standing there, sneering, arms folded, tapping their feet and wondering what the accounting assistant in the Norwegian
Poetry department was thinking when he ordered $2,984.32 worth of Viking translation guides from the Oslo Down company. That type of order immediately results in an e-mail from one of those sneering foot-tappers to the immediate supervisor of the accounting assistant in the Department of Norwegian Poetry.
You might question how a fiscally responsible outfit could extend so much green rope, every day, to a few hundred campus departments. Yet that is exactly the rationale behind the Low Value Purchase Authority—a mouthful of a term that simply means that a
$3 billion university is placing up to $2,500-and-change worth of trust in any one department to buy whatever it needs from a single vendor on a given day.

Wells4689_c01_1

6

05/31/2007

chapter 1

6

high art, low value: how a connoisseur became a convict

The Low Value Order (LVO) policy allows an organizational giant like Aesop
University to function more efficiently by not paralyzing Central Purchasing with routine, nonrecurring purchases. Sure, it involves a measure of risk, but the alternative is a mountain of overdue payments and a premier university with some really bad credit.
Aesop University’s purchasing policies and automated safeguards served the institution well. But not for long.

Designing a Fraud
It began with a midmorning phone call from a hoity-toity furniture store—the kind that omits the word ‘‘furniture’’ from its name. A man identifying himself as ‘‘Squire’s chief financial officer’’ called the Aesop University Internal Audit department and told our receptionist that he needed to speak to an auditor. He had to report a fraud.
Our receptionist directed the call, just as she did every other one that struck her as odd, to me. I am one of 25 audit professionals in the Aesop Audit department. Since Aesop is the largest of the 12 campuses in our state university system, there is more than enough work to occupy an audit staff of our size.
Ours is a department of specialty units dedicated to particular areas of the campus such as health care or, in my case, a specific discipline like forensics. Although six of us are
Certified Fraud Examiners, I am the audit manager of investigations. That is, I am responsible for looking into matters of alleged financial misconduct. Or to be less euphemistic, alleged stealing.
I answered my ringing extension as I always do, with my first and last name. Satisfied that he had an auditor on the line, Mr. CFO repeated his announcement—he was calling to report a fraud. He knew it was fraud because Mr. CFO had previously been an auditor for a
‘‘Big 8’’ accounting firm.
Mr. CFO then informed me that he was holding a photocopy of Invoice Number 5432, bearing Squire’s logo. The invoice, in the amount of $2,664, requested payment for
‘‘design and illustration services.’’ It also made reference to one of Aesop University’s fancy publications, Bison Quarterly, a glossy magazine with feature articles on our institution.
Mr. CFO continued. Invoice No. 5432, he said, was accompanied by a recently cut university check in the same amount, payable to Squire. Lawrence Fairbanks, the Assistant
Vice Chancellor who oversaw our university’s publications unit, had authorized the payment. Fairbanks’s signature was more than legible—it was artistic. Moreover, the billing and shipping addresses were in care of his university office.
‘‘Just a minute,’’ I said to Mr. CFO. ‘‘I can look up the invoice on our system.’’ Using our
MAD system, it took all of 90 seconds to get the electronic version of Invoice 5432 on my computer screen.
‘‘Okay,’’ I said. ‘‘Invoice 5432 certainly looks like a normal type of expense for the
Communications Department.’’ But, I wondered aloud to Mr. CFO, why was a furniture store calling me to discuss it?

Wells4689_c01_1

05/31/2007

7

just the fax

7

Then the explosion:
Mr. CFO explained that the hoity-toity store personnel immediately recognized
Lawrence Fairbanks as a regular customer, but they didn’t know—or care—about his fancy university title.
And, while the invoice copy that accompanied the university check described ‘‘design and illustration services’’ for Bison Quarterly, Squire’s own copy of that same invoice instead authorized the fabrication of a one-of-a-kind chaise lounge. Prophetically, this chair—or rather, this chaise—was named ‘‘Ophelia,’’ the psychologically and physically doomed heroine in the Shakespearian tragedy Hamlet.
As I silently recalled a verse from our high school production, the Bard was trumped by this chilling quote from Mr. CFO:
‘‘Lady, I don’t know squat about magazines. Should I make the chair or not?’’

Just the Fax
If there’s one thing I know, it’s that big guns make big holes, and I sensed that Mr. Lawrence
Fairbanks had fired a cannon. I asked Mr. CFO to fax me everything he had that pertained to Invoice 5432. Within moments, I heard the tinkling of the fax phone in our copy room a few yards away from my office.
As I lifted the warm pages from the fax tray, I first inspected Invoice 5432, for $2,664, the version that Lawrence Fairbanks had enclosed with the university’s check. It read
‘‘design and illustration services for Bison Quarterly.’’ Along came a copy of a low-value purchase order (LVO, for short) in the amount of $2,400. The $264 difference was for sales tax and delivery.
Finally, the fax printed out Squire’s version of Invoice 5432. It looked similar to Aesop’s copy. The layouts of the invoices were identical. The billing address, ‘‘Mr. Lawrence
Fairbanks, c/o Aesop University Communications,’’ was the same. Even the boxy, 3-D logos at the top center of the invoices matched.
But the descriptions of the purchases did not.
In the body of the Squire invoice, in place of ‘‘design and illustration services,’’ were details for the fabrication of a one-of-a-kind ‘‘Ophelia Chaise.’’ It gave precise instructions for the fabric and color—mauve damask, to be exact. It also contained a note that Squire was to contact Lawrence Fairbanks when the chair was ready.
While my first impulse was to carry my handful of trouble straight into the office of the audit director, Frank Adams, I slowly walked back to my own office to eat a banana and contemplate. Was this a one-time indiscretion on the part of a respected university official, or was this a slip-up in an ongoing scheme?
I clicked my mouse on the icon that led me back to MAD, and I input the department code for University Communications. The department had a $4 million annual budget. If
I was going to find more examples of the ‘‘Squire type,’’ I knew that I would have to drill carefully. I started by typing the four-digit code that the University Communications department used to identify publications expenses on the ledger.

Wells4689_c01_1

8

05/31/2007

chapter 1

8

high art, low value: how a connoisseur became a convict

A list of transactions cascaded down my computer screen. As I scrolled through them, I noticed that many of the amounts over the past year or two were under $2,500— many by only a dollar or two. I also noticed a number of ‘‘regular’’ payments in identical amounts, paid to the same vendors over the course of two to six months. The amounts were rarely under $1,000 and never more than $2,499.
I clicked open 20 payments. The online LVO and invoice details were similarly worded:
‘‘design and illustration,’’ ‘‘stock photos,’’ ‘‘reprints of original artwork,’’ or ‘‘printing and layout.’’ All made reference to an Aesop magazine, newsletter, or brochure.
Next, I examined the vendors’ addresses. One was in San Francisco, another in New
York, and still another in Chicago. Publishing ignoramus that I am, it made no sense that so much of the design and illustration work was done out of town. I chose one vendor named Lincoln Photography, partly because it had a San Francisco address and partly because MAD displayed six consecutively numbered invoices under the lowvalue threshold.
I Googled the address. Not surprisingly, what I got back was not Lincoln Photography, purveyors of stock shots, but Lincoln Galleries, exclusive dealers specializing in early twentieth-century black-and-white photographs snapped by artists who probably tortured themselves to death.
Finally, I broke the news to Frank, the audit director. He listened to my account of the phone conversation with Mr. CFO, the faxed Ophelia Chaise invoice, and the lowvalue payments to out-of-town art galleries. Frank uttered a one-syllable expletive, and, with that colorful pronouncement, he authorized me to proceed with a full investigation. The central purpose was clear: to identify the bogus invoices, to quantify the total loss to
Aesop, and to collect the evidence to prove it to the university police and the district attorney. I started by isolating payments that fit a handful of criteria:


One or more payments to a single vendor



Under $2,500



Consecutive or closely numbered invoices



One-word vendor names



Vendor address out of town, or out of the United States, or in a major city



Vendor address in the ‘‘artisan’’ sections of our city

Given that University Communications was an artsy kind of business to begin with, I expected that my initial search for phony transactions would include some that were really
A-OK. Yet I wanted to make certain that I wasn’t dancing over any rocks that were covering up snakes.
Eventually, I identified 52 vendors and 200 LVO purchases that spanned a threeyear period, and I obtained copies of the front and back of each cancelled university check. Wells4689_c01_1

05/31/2007

9

you can take it to the bank

9

You Can Take It to the Bank
As the paper drifted in, I started matching up the endorsements on the backs of the checks with the vendor names on the in-house versions of the invoices. Some of the mismatches were so obvious, it hurt. For example, the check that Aesop issued to ‘‘Redhill Publishing’’ in New York City was endorsed and deposited by ‘‘Redhill Antiquarian Books.’’ The payee names on the checks were always close enough to the vendors’ true names that they were less likely to notice the ‘‘slight’’ inaccuracy. In the end, vendors are far more concerned that the checks they deposit stay deposited—and you can take an Aesop
University check to the bank.
Discretion was not only the better part of valor; it was the only way to keep an investigation of a high-profile character from a famous institution from being publicized prematurely. During these early stages, when we only had one invoice for a fussy purple chair, Frank decided to inform only his boss and campus in-house attorney.
My challenge was to have the vendors respond to my requests to mail and/or fax me copies of the authentic invoices without tipping our hand. Anyone who calls our main office number reaches a recording that announces, ‘‘You have reached the Aesop
University Audit Department.’’ I came up with a way to minimize the perceived stature of the department by transforming my name from Ellen the Audit Manager into Poor Ellie the Temporary Bookkeeper. Sure, Mata Hari is a more exotic nom de guerre, but Ellie was easy to remember.
I timed each call toward the end of the business day, adjusting for different time zones.
That way, whoever answered the vendor’s phone would know that Poor Ellie was stuck working late. I began each call by raising my speaking voice half an octave and beginning with the words ‘‘Um, hi.’’
The story was pretty much the same: Poor Ellie was slogging her way through thousands of university payment records. She had to make sure that Aesop’s main
Accounts Payable department had a copy of each and every invoice that it paid over the past three years. For some reason, the university lost a slew of invoices during that time, and Poor Ellie had to ask the vendors for copies. Poor Ellie had to get the job done— or else.
Pathetic? Sure, but it worked. In came the proof.
Fairbanks’s methodology was obvious. He not only had doctored the description of the purchases, but he applied his own artistic flair—and some common desktop publishing tools—to redo the vendors’ logos. In some cases, Fairbanks created a new letterhead for the vendor, eliminating telltale verbiage like ‘‘dealers in antiques since 1947’’ that might have alerted the support staff in University Communications and campus Accounts Payable.
Over three years running, Lawrence Fairbanks spent $475,000 of Aesop’s money on lithographs, serigraphs, original oils, photographs, antique luggage, books, and cameras.
Cartoons, sculptures, and ceramic pots. Strange space-age looking lamps with Swedish names. More fussy chairs. A phrenology head and three taxidermy specimens—all encased in glass; all incredibly dead.

Wells4689_c01_1

10

05/31/2007

chapter 1

10

high art, low value: how a connoisseur became a convict

It was time for me to interview Assistant Vice Chancellor Lawrence Fairbanks. Frank and I first met with Fairbanks’s boss, Lennie Scott, to give him the background of the case and to solicit his assistance in getting Fairbanks to submit to an interview. Scott was surprised and outraged. Within 30 minutes of our meeting, he sent us a copy of the e-mail in which he instructed Lawrence Fairbanks to come to the Aesop Audit Department at
10 a.m. the following day to discuss some questionable transactions.

Decorating the Trap
Before Fairbanks arrived, I did some interior decorating in our conference room. On our massive, bleached oak conference table, I arranged the files for the 52 vendors in five open cartons, so that the folder tabs with their names were visible. Along the way, we also had gotten a private investigator to take snapshots of the buildings of the 30 or so local galleries and furniture stores that Fairbanks patronized. I opened the photo album to the picture of the Squire storefront and set it at the edge of the conference table, nearest the door.
Fairbanks couldn’t miss it.
Lawrence Fairbanks arrived at the Aesop Audit Department reception area at 10 a.m. sharp. Frank and I each shook Fairbanks’s hand outside the closed door of the windowless conference room where I had set up shop.
Frank led the way in and sat in one of the chairs across the table from where Fairbanks and I would sit next to each other. As I had learned in several Certified Fraud Examiner training seminars, my sitting beside Fairbanks would allow me develop the rapport that would, with a measure of luck, lead to his unburdening.
Neither Frank nor I expected what Lawrence Fairbanks did next. Upon eyeing the opened photo album and the cartons arranged on the conference table, Fairbanks pivoted on his heels, marched straight out of the room, and, with increasing velocity, through the reception area and out of the suite. I heard no ding from the elevator—he had taken the stairs. Early that afternoon, Frank received a call from the campus attorney whom he had notified earlier about our investigation and our pending interview of Lawrence Fairbanks.
Upon leaving the Aesop Audit suite, Fairbanks did not stop until he reached the office of his attorney, Arnold Kruger.
Kruger assured the campus attorney that Lawrence Fairbanks would return to Aesop
Audit the very next morning and that he would cooperate fully in an interview. But there was a catch. Apparently, the connoisseur had kept nearly everything that he had purchased and was offering to assist the university in recouping the ill-spent funds by selling off the goods. Kruger was trying to dissuade Aesop’s officials from prosecuting Fairbanks in the criminal arena by allowing him to make the university ‘‘whole’’ again.
Then there was the sympathy factor: Kruger explained that Lawrence Fairbanks was a very troubled soul who had been under psychiatric care. He was not a thief; he was sick, and he was prepared to make it all up to the university. The campus attorney told us that he would not recommend that criminal prosecution be avoided. However, he did make an

Wells4689_c01_1

05/31/2007

11

a thieving pack rat

11

agreement with Kruger that the university would support his client’s efforts to mitigate the loss.
The next morning, Lawrence Fairbanks returned to the Aesop Audit conference room. Slouching in a maroon V-neck sweater, a 1960s rock band haircut overshadowing his ashen face, the connoisseur confessed. In carefully measured sentences, Fairbanks recounted how he got away with his first purchase—a $10,000 oil painting that he split into four ‘‘low-value’’ orders for ‘‘design and layout’’services. In the earlier days, he would take an actual invoice, cut and paste the logo into a less telltale version of the vendor’s name onto another sheet of paper, and photocopy the whole thing. Then he discovered it was easier to fabricate the entire invoice using simple word processing graphics. He began to crack a faintly proud smile.
‘‘How did the vendors react to getting checks drawn on Aesop University’s bank account and not yours?’’ I asked.
As I had guessed, the vendors really didn’t care, and Fairbanks knew they wouldn’t.
Aesop is a player in the art world, and Fairbanks’s position in the university was prestigious.
No one questioned the fact that the checks were coming from Aesop. A few must have assumed that Fairbanks was purchasing art and fancy furniture on the university’s behalf.
‘‘Who else in University Communications knew what you were doing?’’ I asked.
Eyes intense, Fairbanks adamantly replied, ‘‘No one!’’
Fairbanks explained that, as with most top-level officials, he did not do windows. That is, he had administrative employees processing the invoices—the sanitized versions. He even knew how to skirt the ‘‘checks and balances’’ in his department that provided for a secondary review of each transaction by an accounting supervisor. So long as there was a budget for the ‘‘publications’’ purchases, the busy accounting supervisor, always immersed in details, was not going question him.
And what of Fairbanks’s wife?
With downcast eyes, Fairbanks began to sob as he proclaimed how much he loved
Allison and dreaded how this was going to shatter her life. She knew nothing of his purchases. A Thieving Pack Rat
But, how did Fairbanks keep Allison from knowing? Did he bring the merchandise home?
‘‘No.’’ He sighed. ‘‘That is my sickness.’’
Fairbanks unfolded the story of a poor child peering through store windows in a depressed downtown area. It had been his goal to gain the education and social standing that would gain him the finest things that money could buy. Along the way, Fairbanks branched out from the banality of department store goods and into the esoterica of fine art and antiques.
Even more than the acceptance he enjoyed from the art world, Fairbanks was following a noble calling. He was saving old, dark photographs of people who didn’t matter anymore, even though their images had become collectors’ items. He was preventing old books,

Wells4689_c01_1

12

05/31/2007

chapter 1

12

high art, low value: how a connoisseur became a convict

antiques, and the strangest objets d’art from being erased from their place of honor in the world. And he was creating new pieces—like the Ophelia Chaise—that would be the antiques of tomorrow.
They mattered; he mattered. And he kept them from harm’s way in a public storage facility. Over the past three years, Fairbanks had rented three contiguous storage rooms in one of those ‘‘You-Haul-It, You-Store-It’’ places. Many items, he assured me, were still in their original packing.
Aesop University was not paying for the storage. I checked.
Before our interview concluded, Fairbanks had a question for me. I thought he was going to raise the usual concerns about what would happen next, whether he would go to jail, and so on.
Instead, he startled me by asking, ‘‘Tell me—is this the most sophisticated scheme you’ve ever seen?’’
Not vindictively, but honestly, I replied, ‘‘No, Lawrence, it isn’t.’’
As Fairbanks ambled out of the Aesop Audit suite, he looked more insulted than contrite. The police and the district attorney pronounced the case a ‘‘slam dunk,’’ and Fairbanks was sentenced to full restitution and a one-year house arrest.
In a sweet, three-bedroom home of prewar construction, Allison, Bobby, and Ruthie
Fairbanks were awakened from the American Dream. Allison divorced Lawrence and moved out of state. At the conclusion of his house arrest, Fairbanks moved to the same city, to be near the kids. He now supports himself as a freelance magazine writer on the subject of arts and culture.

Lessons Learned
Our investigation provided incontrovertible proof of Aesop’s monetary loss of $475,000, not to mention a detailed confession. However, we all agreed that the process would have been a lot easier had Lawrence Fairbanks set fire to his acquisitions or dumped them in the river. The investigation in the Audit Department was within our control, but the agreement between Arnold Kruger and the campus attorney was not. We all intuited that the sale of the Fairbanks collection would not abolish the loss or, as Fairbanks optimistically asserted, net Aesop a profit. However, the university now was obliged to take custody of, and account for, all of the merchandise that awaited us in the three storage lockers.
As auditors, Frank and I knew better than to handle it ourselves. We called in experts.
On a wet, dreary November morning, clad in blue jeans and old sneakers, I joined two similarly attired curators from the Aesop University art museum. Lawrence Fairbanks met us, keys in hand.
I had come to the storage facility equipped with an Excel spreadsheet that served as an inventory of all of the items from the vendors’ actual invoices, including a title, physical description, and, where applicable, the artist’s or gallery’s serial number.

Wells4689_c01_1

05/31/2007

13

lessons learned

13

The curators brought two cameras, kid gloves, bubble wrap, and a university truck to transport the collection to a secure room that had been reserved in the Aesop administration building. The door to the secure room had been outfitted with an emergency installation of a dual-custody lock. One curator had a key; and the offset key was given to the receptionist of the area outside of the secure room. We planned it so that both ‘‘unrelated’’ employees had to be present in order to admit the appraisers and, eventually, the buyers.
Again, as auditors, Frank and I would not take custody of these unwanted assets. Still, we knew that we had to play a major role in protecting Aesop from being accused of breaching the attorneys’ agreement—or even compromising the criminal case—if one of the purchased items had been ‘‘lost’’ or damaged.
Lawrence Fairbanks raised the first of the three corrugated metal doors to reveal a fully packed locker. It looked just as he described it—most of the items were still in their original cartons, unopened.
All day long, the curators methodically opened each carton and removed the pieces. We jointly identified the pieces, and as I checked off each item, both of the curators, Lawrence
Fairbanks, and I each initialed the line item on the Excel spreadsheet.
The curators placed index cards bearing the inventory number that I had assigned in front of each piece, and they simultaneously photographed the items. We wanted to make certain that, if one camera failed, there would be a second photograph.
The curators then encased each item in bubble wrap, affixed a sticker bearing the same inventory number, and loaded the pieces onto a dolly. When the dolly was full, Lawrence
Fairbanks would close down and lock the metal door, and he and one of us would ‘‘escort’’ the dolly to the truck. The driver, an experienced employee of the Aesop Museum, would carefully load the objects into the back, as Fairbanks watched.
We would not allow Fairbanks to leave our presence while either the storage lockers or the truck were unlocked. Finally, when the process was complete, everyone, including the truck driver, signed the inventory listing, which I took back to the Aesop Audit
Department. I immediately faxed the listing to all who were present at the storage facility and to Arnold Kruger and the campus attorney.
For several months beyond Lawrence Fairbanks’s house arrest, University Communications served its own time with some heavy-duty bookkeeping that resulted from the attorneys’ agreement. It was quite a burden as the auction houses dribbled $100,000 worth of sales proceeds, in piecemeal fashion, back to Aesop.
I didn’t ask what became of one of the more curious items, ‘‘squirrels under glass,’’ after one of the curators mentioned that it is illegal to sell taxidermy specimens in this state.
The biggest lesson in all of this—and one that served us well—was that an investigator will, at some point, lose complete ownership of the case. As auditors, we were not in the position to tell the campus attorney to back off from an agreement with the subject’s lawyer—one that almost created more work than the investigation itself.
However, by adopting a flexible posture and applying our expertise in the areas of record keeping, safeguarding, and accountability, we were able to exert our own special brand of control over an unexpected complication.

Wells4689_c01_1

14

05/31/2007

chapter 1

14

high art, low value: how a connoisseur became a convict

Recommendations to Prevent
Future Occurrences
Separate Accounting Duties and Implement Secondary Purchase
Approvals at All Employee Levels
Assistant Vice Chancellor Fairbanks was uniquely positioned to commit major fraud through his position of authority and trust in the Aesop Communications Department.
Traditional business controls, such as separation of accounting duties and secondary approvals of purchases, were limited to subordinate staff in the past. High-level officials were practically immune to scrutiny, which enabled Fairbanks to rack up an astronomical bill in fraudulent activity. It is important to separate accounting duties and have secondary approvals of purchases, regardless of an employee’s rank.
Monitor for Suspicious Activity
A member of senior finance staff—not a department-level accountant or any of the subordinate departments—should be hired as an independent monitor for the entire organization. The monitor should look for signs of trouble: repeat payments to the same vendor, payments just under the low-value threshold, vendor names and addresses that seem incongruous with the online descriptions of the expenses. The monitor should report anything that appears strange or suspicious.
Redefine Job Descriptions to Maintain Integrity
Human resource experts should review and update the accounting supervisor’s written job description. The supervisor should understand that she is as responsible for the integrity of the expenses she approves as she is for the bookkeeping detail. When the accounting supervisor in Aesop University Communications accidentally took delivery of a large package from the San Francisco–based Lincoln Galleries, she immediately recognized the address from the many invoices she had approved for
Lincoln Photography. The supervisor said that she had a ‘‘funny feeling’’ about the package. She was not afraid of angering Lawrence Fairbanks by questioning him about the delivery. To the contrary, the supervisor was more fearful that a serious inquiry might cause unnecessary harm to her boss’s reputation.
The accounting supervisor lacked the healthy perspective of an overseer. She was entirely focused on making sure that the individual ‘‘publications expenses’’ were charged to the correct ledger codes and that they fit safely over the bottom line. A specific job description that clearly stated her duties may have prompted the accounting supervisor to inspect the package more closely and put a stop the fraud in a timely manner. Wells4689_c01_1

05/31/2007

15

recommendations to prevent future occurrences

15

Implement Tip Line
Finally, though not the direct result of this particular case, Aesop University implemented a
24-hour whistleblower hotline that supports anonymous complaints. Had the hotline existed during his acquisition of the Fairbanks collection, Lawrence might only have squirreled away one locker’s worth of stuff.

Ellen A. Fischer, CFE, CIA, is the audit manager responsible for all investigations in a large research university. During the past 20 years, she has conducted investigations of complex and high-profile fraud cases toward their successful prosecution. Ms. Fischer enjoys writing about her cases almost as much as she does investigating them.

Wells4689_c02_1

05/31/2007

16

chapter

2

&
The Ambitious Payroll Manager
JOHN TONSICK

hen Dena Brenner entered a room, people noticed. Her bright blue eyes were framed with blonde, shoulder-length tresses. She wore stylish, expensive clothes that flattered her slender figure. Never too much makeup and just the right amount of jewelry, Dena looked much younger than the 37-year-old mother of three that she was.
Only six years earlier, after finishing her associates degree, Dena went to work in the payroll department of Sure Growth Seed Company, a family-owned business based in
Ohio. Three years later, Sure Growth was acquired by a much larger establishment,
International Agricultural Seed, commonly known as IAS. Dena quickly attracted the attention of the new owners and was offered a position as corporate payroll manager, requiring her to relocate to the West Coast. She worked at the company’s corporate headquarters, the same building occupied by top management. It didn’t take long for her to become a favorite of those in the executive suite. Thoughtful, cheery, and flirtatious,
Dena was responsive to every administrative whim. The company’s CEO held Dena in particularly high regard. He took an active role in protecting her interests and advancing her career. If you were to ask anyone at IAS, they would tell you with certainty that she was on her way to bigger and better things.
Dena’s husband, Ron, stood in contrast to his polished and professional wife. Tall and stocky, he was a quiet, plain-spoken man. He’d spent most of his adult life working lowlevel jobs in the dairy industry. Married for 15 years, Ron and Dena had three beautiful daughters. As is usually the case with fraud, things aren’t always what they seem. As much as
Dena was loved by her superiors, she was viewed with mistrust by many of her peers and subordinates. Instead of a charming problem-solver, they saw her as arrogant, cold, and condescending. Even worse, they thought, was the way she treated her husband. Unable to find work in the family’s new hometown, Ron enrolled in college and became a full-time student. When he wasn’t in class, he took care of the girls. He was the family cook, chauffeur, housekeeper, and, most important, errand boy. He meekly complied with
Dena’s every demand.
By most accounts, Dena was a taskmaster when it came to dealing with Ron. Even the slightest transgression would send her into a withering tirade. Though kinder to her

W

16

Wells4689_c02_1

05/31/2007

17

a suspicious transfer

17

daughters, she treated them the same way as her other possessions. They were cared for, but were viewed more like accessories.
There was one more thing that bothered Dena’s coworkers: her lifestyle. Sure, she made a decent salary, but no one could understand how she was able to live so extravagantly. She wore beautiful clothing and jewelry. Dena and her family lived in a spacious five-bedroom house in one of the area’s nicest neighborhoods. The Brenner home was richly appointed with tasteful furnishings and artwork. Dena and Ron both drove new cars, and all three girls attended private school. Even more curious were her two horses, to which she seemed more attached than to her own daughters. When anyone dared to ask how she could afford these things, Dena responded quickly with a story of inherited wealth and wise investments.
Sure Growth Seed Company began in 1865. The American Civil War had just ended, and a reunited America was headed back to work. At that time, more than half of all the country’s citizens earned their living as farmers, and the company found the perfect moment to begin selling agricultural seed. As America grew and prospered, so did the new business. Becoming an industry innovator, Sure Growth provided high-quality, high-yield seeds that were resistant to drought and pests.
At the dawn of the new millennium, the U.S. agricultural business was bigger than ever; it had also changed dramatically. Family farms played a much smaller role in an industry that was now dominated by large corporations. One was International Agricultural Seed, a global company that had grown through a series of mergers. As IAS followed its plan to become a market leader, Sure Growth was added to its list of acquisitions. With thousands of employees and facilities around the world, IAS was sophisticated. It was an environment conducive to the ambitions of Dena Brenner.

A Suspicious Transfer
Klaus Dieter had been with IAS in Europe for more than a dozen years. A handsome, blond, athletic man in his mid-30s, he acted as if he were born in the executive suite. His
English was nearly perfect, with only his name and the slight hint of a German accent divulging his roots. Klaus made it a point of pride to know every aspect of IAS’s business, a trait that allowed him to move up the corporate ladder quickly. To most, it was a foregone conclusion that he would head the company someday.
When Klaus arrived at headquarters, Dena had been the payroll manager for nearly three years, and the IAS executive team seemed more enamored with her than ever. By this time she had placed her mark on the department’s operations. With support from the CEO and other executives, she moved payroll to the director of human resources. ‘‘That’s where it belongs,’’ she said confidently. Besides, like the CEO, the human resource director was
Dena’s good friend and supporter. In addition to changing the reporting relationship, she had a new payroll system installed. Using the complexities of the new system as justification, she replaced all of the department’s long-term employees with her own handpicked staff.

Wells4689_c02_1

18

05/31/2007

chapter 2

18

the ambitious payroll manager

Just as Klaus made it a point to know every aspect of IAS’s business, Dena made it a point to endear herself to every executive at the company. Klaus seemed to be the lone holdout.
For reasons unknown, and in spite of Dena’s best efforts, she just couldn’t seem to bring him under her spell. Klaus assumed his new role as treasurer with his usual enthusiasm and love for details. It was his job to make sure that IAS had sufficient financial resources to operate the business and to continue the company’s growth; that meant keeping a close eye on cash flow. In only his second month as treasurer, Klaus noted something odd in the numbers. The company payroll was processed every two weeks and, with only minor fluctuations, came in at roughly $4 million. During the last payroll cycle, the number was
$4.7 million. Surprised at the large increase, Klaus phoned Dena, who was away on business in Chicago.
‘‘What happened?’’ he asked.
‘‘I’m not sure,’’replied Dena, ‘‘but I’ll find out right away.’’ The next day, she was back in the office and $700,000 had been wired into the company’s bank account. ‘‘Problem solved,’’ explained Dena. ‘‘Just a bank error.’’
With a plausible explanation and the money’s quick and safe return to the company account, most of Klaus’s peers would have dismissed the issue and moved on to something else. No doubt Dena’s quick resolution would have earned their praise. But that wasn’t
Klaus’s style. Besides, $700,000 was a lot of money. If it was a bank error, shouldn’t someone explain how it happened? Something else was bothering Klaus. Dena was always responsive to executive requests, but her abrupt return from Chicago seemed a bit over the top, even for her. Couldn’t she have just made some phone calls?
Acting on his suspicion, Klaus phoned my colleague. He explained the situation and asked if it made sense.
‘‘Where did the money come from?’’ we asked.
‘‘I don’t know,’’ replied Klaus.
‘‘Why don’t you call the bank to see if you can find out?’’ we suggested. Within a short time, he got an answer that infuriated him: The money had been wire transferred from
Dena Brenner’s personal bank account.

Memory Loss
Distressed and angry, Klaus did a little digging on his own. He learned that the $700,000 in question related to three payroll transfers. All three were made to Dena’s bank account number but used the name of Yuet Chi, a former IAS employee who’d left the company more than two years ago. Klaus asked our firm to launch an investigation.
The next morning my colleague, Carrie Lane, was shown to the board room at IAS’s corporate headquarters. At the center of the room was a massive black marble conference table surrounded by high-backed black leather chairs. The pale gray walls, expensive artwork, and thick gray carpeting seemed to soften the bright sunshine that was streaming through the windows. It was in stark contrast to the moods of those who would soon occupy it.

Wells4689_c02_1

05/31/2007

19

memory loss

19

Dena Brenner walked nervously into the conference room—impeccably dressed, but distraught. She was followed by her boss, Dan Redfern, the Vice President of Human
Resources. Carrie made some brief introductions and told Dena that she was trying to sort out what happened with regard to the bank error.
‘‘I’m never doing anything again without getting someone’s name in blood,’’said Dena.
The simple bank error she described just the day before sounded a bit more complicated now. ‘‘From time to time, Amanda Salazar sends me e-mails requesting special payments for employees,’’ Dena explained. Amanda was an HR manager who, like Dena, worked for
Dan. ‘‘Since the e-mails came from Amanda, I never questioned them. I’ve processed lots of them over the years,’’ she said.
‘‘These payments are nearly a month old,’’ replied Carrie. ‘‘How were you able to get the bank to reverse them?’’
‘‘It was just a matter of finding the right person,’’ explained Dena. When Carrie asked her the name of her contact at the bank, Dena refused to provide it. ‘‘I don’t think she was supposed to do what she did,’’ she said. ‘‘I don’t want to get her in trouble.’’
‘‘Do you recognize the name Yuet Chi?’’ asked Carrie.
‘‘No,’’ replied Dena.
‘‘These transfers are very large. Aren’t they unusual?’’
‘‘Not really,’’ Dena said unconvincingly. When shown the bank account number to which the transfers had been made, she claimed she didn’t recognize it. Finally, Carrie showed Dena a fax from the bank indicating that the account belonged to Dena and her husband, Ron.
Dena’s face turned ashen. After several minutes, she said, ‘‘I’ve returned. . . .’’ Then her voice trailed off.
‘‘You’ve returned the money?’’ asked Carrie.
‘‘No,’’ said Dena. ‘‘I didn’t take it.’’ After a long pause she said, ‘‘I’m feeling uncomfortable. I don’t know what will happen to me.’’ Crying now, she asked, ‘‘Will I be prosecuted? I would talk if I had a guarantee of no prosecution.’’
Carrie could make no promises but encouraged her to start from the beginning. ‘‘Did you know Yuet Chi?’’ she asked.
‘‘I just picked him,’’ Dena said solemnly. ‘‘I don’t remember why, maybe because he was terminated.’’ The first theft had taken place a year earlier. She reactivated Chi’s account in the payroll master, changed his bank account number to hers, and transferred $40,000.
After the transfer, she changed the account number back to Chi’s and deactivated his file. As
Dena recounted her thefts, Carrie began to add up the numbers; they totaled $1.2 million.
‘‘I still have it,’’ Dena said softly. ‘‘I have all the money. Between my checking and savings accounts, a money market fund, and my children’s bank accounts, I have all of the money. I can get it for you today.’’
‘‘Did you take anything else?’’ asked Carrie.
‘‘No,’’ said Dena, ‘‘I swear on a stack of bibles.’’ She then prepared and signed a written statement admitting to the thefts, agreeing to return the stolen money and to help the company document the transactions.

Wells4689_c02_1

20

05/31/2007

chapter 2

20

the ambitious payroll manager

Dena was escorted to the door by security. A short time later, she returned to the office with a cashier’s check payable to the company for $500,000. She agreed to meet with
Carrie and me the next day at a fast food restaurant near the office. We both watched intently out the window, awaiting Dena’s arrival. Right on time, a shiny new black SUV pulled into the lot. She stepped out of the car dressed in faded blue jeans and a sweat shirt.
With no makeup and dark circles under her eyes, she looked as if she’d had a long night.
Carrie introduced us.
‘‘I know you’ve been through a lot in the last 24 hours,’’ I said, ‘‘but I have to ask you some more questions. Did you take anything more than you’ve already told us about?’’ I asked. ‘‘Absolutely not.’’ she said.
‘‘Now would be a good time to tell us,’’ I said, ‘‘because we’re going to keep looking.’’
With a quizzical look, Dena asked, ‘‘How long do you think it’s going to take?’’ Fighting the urge to smile, I said, ‘‘Probably a couple of weeks.’’
Dena and I met once more at the fast food restaurant. She assured me that I was wasting my time in looking further. She told me that all of the money had been taken in the same way: using the payroll system and the name of Yuet Chi. She told me that no one else at IAS was involved. ‘‘Even my husband didn’t know until the day I was sent home,’’ she said.
We made a copy of Dena’s hard drive and began downloading electronic copies of IAS’s payroll registers. Carrie and I interviewed Dena’s coworkers and reviewed paper files. The interviews seemed to confirm Dena’s assertion that she had worked alone. Our examination of documents did reveal a clue: Each payroll register was missing one page.
We later learned that these showed the transfers to Dena’s bank account. A search of Dena’s hard drive revealed no hints, but we hit the jackpot with the electronic payroll registers.
Sorting disbursements by bank account number, we uncovered more than a dozen new transfers to Dena’s bank account using the names of three additional terminated employees, totaling $700,000. The next day Carrie and I sat in a quiet corner booth at a coffee shop. Across from us sat Dena and her husband, Ron, whom Carrie and I were meeting for the very first time.
‘‘Dena, we found another $700,000,’’ I said. A distressed Dena looked at me and said,
‘‘No. I didn’t do it.’’ She then dropped her head and stared silently into her lap.
‘‘I knew you guys were gonna do this!’’ Ron shouted angrily. ‘‘You’re going to blame her for stuff she didn’t even do!’’
I assured Ron that we had no reason to do that. For the next half hour, I repeated my allegations several times, but Dena continued to adamantly deny it. Except for these brief exchanges, there was silence between us. Finally, Ron couldn’t stand it any more. ‘‘Did you take the money?’’ he asked his wife.
‘‘Yeah, I took it.’’ Dena said.
‘‘Why didn’t you say that half an hour ago?’’ he shot back angrily.
‘‘I forgot,’’ Dena whispered.
After years of passively doing Dena’s bidding, Ron seemed empowered by the situation.
‘‘Could you excuse us for a moment?’’ he asked. ‘‘Of course,’’ I said. Ron grabbed Dena by

Wells4689_c02_1

05/31/2007

21

the law wins

21

the arm and took her outside. Through the coffee shop window, Carrie and I could see the two of them engaged in a heated conversation. A few minutes later, Ron walked briskly back to the booth with his wife in tow.
‘‘You know about the property in Michigan,’’ he said. We had done a search for assets but had no reason to check in Michigan. ‘‘Of course we know about that,’’ I said.
Well, we did now.
‘‘It’s worth about $400,000,’’ Ron said. ‘‘We paid cash for it. You can have that, too.’’

The Law Wins
Now that the investigation was complete, IAS turned its attention to recovering its losses.
Dena had already returned $1.2 million. Our discovery of the additional thefts meant that she needed to come up with another $700,000. Out of ready cash, she was no longer in the mood to cooperate. IAS filed a civil suit against her seeking recovery of the stolen funds, plus the cost of the investigation. Faced with the expense of litigation and the overwhelming evidence of her guilt, Dena settled the civil suit.
She agreed to repay her remaining debt to IAS by surrendering the property in
Michigan, her home, cars, jewelry, furniture, and artwork. As she dispassionately described the assets that she would surrender, tears welled up in her eyes when she got to the horses. ‘‘Please make sure they find a good home. They’re my pets,’’ she said, sobbing.
Dena showed no such emotion when offering up her children’s personal belongings.
It wasn’t over yet. IAS wanted more than restitution; it wanted Dena to be punished.
With pressure from Klaus, the company filed criminal charges and asked me to assist. I prepared several binders of evidence gathered during the investigation and took them to
Derek Thompson, head of the district attorney’s White Collar Crime Unit. We spent several hours reviewing it. The binders included Dena’s signed confession and a detailed description of what she had done and how she had done it. They also included original documents and computer files to support each illicit transfer to her account. ‘‘We don’t usually get cases that are this well prepared,’’ Derek said. ‘‘It could take some time, but I’m ready to get started.’’ Paul Kole, a D.A. investigator, was assigned to work on the case.
Several months passed after our meeting. There had been no arrest and, except for a few inquiries from Paul, not much seemed to be happening. At one point, on a hot summer day with temperatures well over 100 degrees, Dena’s neighbors noticed smoke coming from her chimney. Unable to imagine why anyone would light a fire on such a hot day, they summoned the fire department. They arrived to find Dena burning documents in her fireplace. After that, IAS grew increasingly concerned that Dena would escape prosecution. Those fears were soon laid to rest.
Dena and Ron were moving out of the beautiful home that was no longer theirs. Along with the house, most of their possessions had been sold, and they were returning to Ohio with the children. As they placed the last of their meager belongings in a rented trailer, Paul walked up the driveway with a warrant for Dena’s arrest. ‘‘I won’t put the cuffs on you in front of the children,’’ he said, ‘‘but you’ll have to come with me.’’ Out in the street, Dena

Wells4689_c02_1

22

05/31/2007

chapter 2

22

the ambitious payroll manager

was handcuffed and placed into the back of the squad car. Leaving the children behind,
Ron walked out and spoke to his wife through the open window. ‘‘I’m still going to Ohio with the kids,’’ he said flatly. ‘‘I’m also filing for a divorce.’’ Ron turned and walked to the driveway without looking back. Paul drove away with Dena, who was about to spend her first night in jail.
Dena was charged with multiple counts of theft, money laundering, and tax evasion. A conviction on all counts could put her in prison for decades. Derek offered her a deal. In exchange for a guilty plea, he would recommend a sentence of nine years. Dena was stunned. In nine years, her children would be grown. She never expected to see prison, much less a sentence of this length. She declined the deal and asked for a jury trial.
Derek subpoenaed Dena’s bank statements and gave them to Paul, who immediately came to me. ‘‘John, I wouldn’t know where to start with these things. Can you help?’’ I agreed. Dena had given me photocopies of some of her bank statements, but I had never seen most of them. I noticed numerous large deposits ranging from $4,000 to $50,000. I asked Paul to subpoena the supporting details from the bank. The information provided only deepened Dena’s problems.
Part of her job as payroll manager was to prepare and file the company’s tax returns.
Over the years, she made large overpayments to various state and federal tax authorities.
Once the returns were filed and paid, she applied for refunds. Those checks, made payable to IAS, came directly to Dena. She simply endorsed them ‘‘Pay to the order of Dena
Brenner’’ and deposited them to her checking account. The misappropriated refunds totaled $350,000.
Derek added the additional thefts to Dena’s previous charges, along with multiple counts of forgery and computer fraud. If convicted on all counts and given the maximum sentence for each charge, Dena could spend the rest of her life in prison.
Derek asked me to appear as a witness for the prosecution at Dena’s criminal trial. By the time I testified, she had been incarcerated for nearly a year. When she entered the courtroom, I was shocked by her appearance. Dena was wearing a prison-issue navy blue jumpsuit and white tennis shoes. She was shackled at the waist and ankles, causing her to shuffle when she walked. With no makeup and long gray roots in her washed-out blond hair, there was almost no trace of the stylish young woman I first met. After hearing my testimony and reviewing the evidence gathered during our investigation, the jury found
Dena guilty of all charges. She was sentenced to 15 years in state prison.

Lessons Learned
The Dena Brenner investigation was successful on many levels, but two aspects stood out.
First, IAS realized immediately that it needed help. The company called an outside expert as soon as it suspected a problem and listened to our advice. Internal investigations are often undertaken by individuals who lack the necessary tools, training, and experience.
Frequently they do more harm than good. Many times suspects are confronted prematurely, without adequate proof, which allows them to conceal or destroy evidence

Wells4689_c02_1

05/31/2007

23

recommendations to prevent future occurrences

23

and alert co-conspirators. Critical evidence is often ignored or handled improperly, rendering it useless in a judicial setting. Because IAS called experienced investigators first, we were able to put together a clear, convincing case of what Dena did and how she did it.
This was a critical factor in winning the civil action and the criminal conviction.
Second, the sequence of the investigation provided maximum benefit to the organization. By conducting a thorough inquiry, the company compiled all of the evidence and information necessary to proceed with the civil suit. This helped keep the time and expense to a minimum. Similarly, when filing criminal charges, most of the work was already done for the D.A. It wasn’t necessary for the government to tie up scarce resources investigating a complex crime. This brought the case to trial more quickly. It also provided the prosecutors with a road map for presenting the criminal case in a way that easily won a conviction.

Recommendations to Prevent
Future Occurrences
The circumstances that allowed Dena Brenner to commit fraud against her employer are all too common. We recommended a number of changes.
Supervisory Review
The payroll master file includes the employee’s name, address, Social Security number, rate of pay, and bank account number—the kind of information that changes infrequently or not all. Dena was the only IAS employee with access to this file. She was authorized to make changes without anyone’s approval. Not only could she alter data in existing records, she was also free to add or delete employee names. We advised management to review and approve all payroll master file changes. We recommended that changes be reviewed and approved by a supervisor to ensure that all changes have been properly authorized and are made correctly.
The payroll register shows the details for each disbursement to each employee. In an attempt to conceal her thefts, Dena removed the page showing her fraudulent disbursements immediately after the payroll was processed. It didn’t matter much anyway, because no one at IAS ever saw it but Dena.
Post Payroll to General Ledger
Another control weakness that helped Dena conceal her fraud involved the payroll system itself, which had the capacity to post transactions to the general ledger electronically after each pay period. Dena feared that this might inadvertently disclose her theft, so she refused to let the posting occur automatically. ‘‘There’s a bug in the system and I just don’t trust it,’’ she told management. Each pay period, Dena would prepare a ‘‘manual journal entry,’’ allocating her fraudulent transfers to a huge number of expense accounts in various

Wells4689_c02_1

24

05/31/2007

chapter 2

24

the ambitious payroll manager

departments. By splitting them up and spreading them around, Dena made her transactions more difficult to spot by anyone who might be looking.
Frequent Reconciliation of Payroll Account
Before she began making fraudulent transfers, Dena tested the system to see if she would be caught. Rather than use the wire transfers, Dena authorized two fraudulent payroll checks that were never cashed. If someone noticed them, she could simply say that they were errors. But they weren’t discovered because the payroll bank account hadn’t been properly reconciled for more than two years. At the time Dena’s fraud was uncovered, the payroll bank account had more than 500 outstanding checks totaling $700,000, including the two checks used by Dena to test the system. We recommended that the controller’s office reconcile the account each month and that it be reviewed and approved by a supervisor.
Segregation of Duties IAS did not have an internal audit department. However, we recommended that someone not involved in processing payroll observe the distribution of paychecks and earnings statements. This recommendation was to help ensure that no more
‘‘Yuet Chis’’ would show up on the list.
Long before she began using the payroll system, Dena stole from her employer by overpaying the taxes and then applying for refunds, which she kept. This was possible because Dena prepared the returns and no one checked them for accuracy. Additionally, tax refund checks were mailed directly to her. So we recommended that payroll be reviewed, approved, and mailed by someone other than the preparer. We also suggested that refund checks be sent directly to a ‘‘lockbox’’ at the bank.

John Tonsick, CFE, CPA, is a forensic accountant and keynote speaker. He provides consulting services in the areas of fraud, internal controls, and expert witnessing. Mr.
Tonsick is a graduate of Robert Morris University and has nearly 30 years of experience in preventing, detecting, and investigating white-collar crime.

Wells4689_c03_1

05/31/2007

25

chapter

3

&
The Insider
CRAIG R. SINNAMON

ot long after 20-year-old Stefanne Rider was hired at Majestic Bank, she became the most popular teller in the office. Tall and slender with strawberry blond hair and hazel eyes, she had a smile that could light a small town. Stefanne was one of four children raised in blue-collar, rural Morgantown, Pennsylvania, by her mother, Cindy.
Her father, Sam, owned and operated a local furniture store—his pride and joy. When large chain stores moved into the area, his business experienced lean years, but he and
Cindy always managed to make ends meet.
After Stefanne graduated from high school at age 18, she was accepted to attend Saint
Joseph’s University in Philadelphia. She immediately fell in love with the campus and begged her father to let her go. But how would Sam afford to send his daughter to the college of her dreams? The family qualified for some financial assistance, but not nearly enough to afford tuition, room and board, a meal plan, and books. Sam and Cindy mortgaged their modest home of 27 years, and Stefanne took out student loans to cover the remaining costs.
Stefanne reveled in college life. She studied Communications and received full honors her first two years. In September, at the start of her junior year, life was perfect. Then the unthinkable happened.
The remnants of Hurricane Ivan barreled through Morgantown and pummeled the area, dumping more than eight inches of rain in two days. A creek near Sam’s store flooded.
He fought tooth and nail to combat the rising water, but his efforts were futile. Within a few hours, the storm wiped out the building and all of the furniture inside. Most of all, it devastated Sam. One cost-cutting measure he had employed in order to send Stefanne to college was dropping his expensive flood insurance coverage. Now his business was destroyed, and he had to start over from scratch.
Stefanne returned home from college, placing her dreams on hold so she could contribute to the family. She took a job as a teller at Majestic Bank. The branch manager,
Lena Santana, knew Stefanne well. Lena remembered giving her lollipops years ago through the drive-up window when Stefanne accompanied Sam to the bank to make the daily deposit. Stefanne already knew many of the customers in town and possessed the attributes necessary to be successful in her new position.

N

25

Wells4689_c03_1

26

05/31/2007

chapter 3

26

the insider

Majestic Bank is a large, regional bank based in Pittsburgh with approximately $110 billion in assets, over 9,500 employees, and a network of 850 community banking offices spanning from Maine to southern Virginia. It was founded over 17 years ago, starting with four branches in a small western Pennsylvania town. There exists a corporate culture of camaraderie and an entrepreneurial spirit. Employees are referred to as team members.
Majestic invests significant resources into the Loss Prevention and Security (LP&S) function. LP&S is segregated into two primary areas, Loss Prevention and Mitigation, and
Fraud Investigations. Loss Prevention/Mitigation employs a large team of highly trained analysts at a central site. Their function is to maintain and review various software applications designed to detect and reduce losses associated with fraud. The Fraud
Investigations team consists of a smaller group of professionals, each strategically located throughout the bank’s footprint. Many are retired law enforcement detectives. Others, like me, are career bankers. I joined the team after two years in retail banking and seven years as a corporate auditor.

What Did You Do with My Money?
Carolyn Sasser, a career banker and a member of my team, was one of a couple of investigators responsible for investigating all forms of bank fraud cases originating in the greater Philadelphia area. She was in the process of reviewing what appeared to be a routine counterfeit check case on a humid summer afternoon in her tiny office in
Rosemont, Pennsylvania. The victim in this case was a customer named Thomas White.
He opened an account more than 10 years ago. Thomas, a retired World War II Air Force pilot, stopped by the local Majestic branch in the Chestnut Hill section of Philadelphia to withdraw $100 cash before going to the grocery store. Soon after handing his withdrawal slip to the teller, he was stunned to learn his account was overdrawn.
‘‘How could that be?’’ he asked. ‘‘Didn’t my Social Security deposit post to my account last Friday?’’
‘‘Yes,’’ the teller replied politely. ‘‘But you also wrote three checks to your account last night,’’ she continued.
‘‘That’s impossible! I need to speak to Gina immediately,’’ he demanded.
Gina Stevens, the branch manager, had opened his account at the Chestnut Hill branch.
She and Mr. White got along famously. But now he was fuming. ‘‘What is going on with this bank?’’ he asked Gina curtly before she could even say hello.
Gina listened intently to Mr. White’s problem. To her, it sounded like a case of counterfeit checks. ‘‘We will take care of you, Mr. White,’’ she reassured him. Gina completed the necessary paperwork and opened a new account for him. Majestic reimbursed Mr. White in full but he terminated his relationship with the bank a few days later, sighting concerns over security.
Carolyn reviewed the checks contained in his file. The check stock used by the counterfeiters really resonated with Carolyn. ‘‘Didn’t I recently work on a case with similar-looking fakes?’’ she asked herself aloud. She then looked at the back of the check

Wells4689_c03_1

05/31/2007

27

following the footprints

27

and observed a stamp from Kingdom Bank based in New Jersey. ‘‘Kingdom Bank?’’ she wondered. ‘‘I’ve been speaking with their Security Department a lot lately.’’
After a few minutes of reviewing Mr. White’s file, Carolyn realized that this was no ordinary counterfeit check situation. Luckily, she was fanatical about organizing her files.
She quickly was able to pull a few cases, and compared them to Mr. White’s. All of them were relatively small (under $4,500 loss), so Carolyn had placed them on the back burner while she tended to larger issues. Each victim customer noticed the activity soon after it began. She found three other counterfeit cases with similar attributes—individual checks less than $1,500, same check stock, similar handwriting, all negotiated through Kingdom
Bank in New Jersey. Carolyn called Tim Carter, the security officer at Kingdom. ‘‘Not only were all of them deposited at our bank,’’ he informed Carolyn, ‘‘but they all went through the same ATM machine at one of our branches in Trenton! All four of our customers immediately withdrew all of the money from their accounts using the same
ATM.’’
It was obvious that these seemingly small cases were associated with the same check fraud ring. Carolyn knew that LP&S likely had more problems. She immediately called
Mary McFadden, another Majestic Bank fraud investigator in Freehold, New Jersey, to see if she had any similar issues.
Mary took copious notes as Carolyn provided details of her cases.
‘‘Wait a second,’’ Mary said, ‘‘What was that last account number?’’
It was Mr. White’s. ‘‘Carolyn,’’she continued, ‘‘that is a passbook savings account. I just received a small counterfeit check case involving checks that posted to a statement savings account. How is it possible that checks can post to savings accounts?’’ she asked. Mary pulled the case file.
‘‘You know what? My victim customer’s name is James White. Let me look at the back of the checks . . . yep, Kingdom Bank. You know what else, Carolyn?’’ Mary continued. ‘‘All the victim customers’ names are common: Tom White, James White,
Mark Williams, Tom Jones, Michael Smith. This doesn’t appear to be a dumpster-diving operation. These victims were targeted systematically.’’
Carolyn agreed, ‘‘You’re right. I smell an internal fraud. Let’s get Kathy and Craig on the line.’’

Following the Footprints
I had just returned to my office after lunch and was sifting through the mountain of paperwork on my desk when the phone rang. It was my manager, Kathy Backman, the corporate internal fraud manager at Majestic Bank. She manages a team of five analysts and three investigators trained to proactively identify and investigate various types of internal fraud, such as branch cash embezzlements, payroll fraud, and general ledger frauds. I am one of the three internal investigators reporting to Kathy.
‘‘Craig, I need you right away,’’ she said, on a mission.
‘‘What’s up?’’ I asked.

Wells4689_c03_1

28

05/31/2007

chapter 3

28

the insider

‘‘I’ll explain when you get here,’’ she replied.
I scurried to Kathy’s office, four doors down from mine. ‘‘What’s going on?’’
‘‘Carolyn and Mary are on the phone with me now,’’she said. The women explained to me the circumstances that preceded their call.
‘‘Well, it appears a bank employee has compromised your victims’ accounts,’’ I stated.
‘‘Craig, research the ‘Footprint Report’ to determine if the same employee queried the victims’ accounts before the counterfeit checks were negotiated,’’ Kathy instructed.
The ‘‘Footprint Report’’ was created by Majestic’s IT Department at Kathy’s behest a couple of years ago after she suspected an insider was stealing customer account information. She could not prove her theory due to the bank’s inability to monitor employee inquiry activity. The ‘‘Footprint Report’’ captures all customer profile/account queries performed by staff directly on the bank’s mainframe system. A team member must use his or her unique user ID and password to directly access it. If someone queries a customer profile/account directly on the mainframe system, the ‘‘Footprint Report’’ will capture the activity and the associated user ID.
I reviewed the bank statements associated with the five customer accounts and started my research with two of them that contained minimal account activity. ‘‘It should be easy to isolate a common user ID with these two accounts. The customer’s infrequent activity should result in fewer account queries,’’ I concluded. I first searched ‘‘Footprint Report’’ for victim Tom White’s account. Mr. White’s deposit activity consisted only of a monthly direct deposit of his Social Security. He writes some checks to pay his monthly bills and only on occasion withdraws cash over the counter at his local branch. I noticed the first counterfeit check posted to his account on July 9, so I started with a date range search beginning June 1 to July 8. There were a couple of inquiries performed by team members.
I cataloged the user IDs and query dates/times on a spreadsheet. I searched the ‘‘Footprint
Report’’ for the next victim customer, Mark Williams, and cataloged the queries as I did with Mr. White account. ‘‘Bingo!’’ I said. ‘‘We have a hit!’’ I noticed that the same user ID performed queries on the accounts owned by White and Williams less than two weeks before the counterfeit checks posted.
I searched the system for the owner of this user ID. It was Stefanne Rider at the
Morgantown branch. Why would a teller in rural Pennsylvania want details for a customer residing an hour and a half away in Philadelphia? I then reviewed Mr. White’s account and noticed that Stefanne asked for his name and account number on June 30 at 12:05 p.m. on the mainframe system. I further observed that Stefanne queried Mr. White’s profile and account number on the mainframe system at this time, and also several other rather common names within just a few minutes, some only seconds apart. She appeared to be haphazardly searching for customers.
In no time I was able to trace the three remaining profiles to Stefanne’s user ID.
Counterfeit checks began to post to each account within two weeks of her inquiries.
Coincidentally, all five victims resided and performed their banking in the greater
Philadelphia area or New Jersey, hours away from Stefanne’s Morgantown branch. It was obvious that she was the point of compromise. I phoned Kathy right away. ‘‘I think

Wells4689_c03_1

05/31/2007

29

following the footprints

29

we have our suspect,’’ I said. We discovered that Stefanne was on vacation visiting family in Ohio for the remainder of the week and was scheduled to return the following
Monday.
‘‘Great,’’said Kathy, ‘‘This gives us the opportunity to investigate further and determine the scope of this case. There are probably more victims out there. We can interview
Stefanne the day she returns from vacation and maintain the element of surprise so she doesn’t have the opportunity to concoct a story behind her activity. However, let’s disable her system access immediately, just in case. Solicit the help of the analysts to conduct comprehensive research. We need to identify as many actual and potential victims as soon as possible, so you’ll need their help. Report your findings to me by the end of the week,’’ she stated.
‘‘So much for catching up on my paperwork,’’ I said aloud as I journeyed to my office to set up a conference call with the analysts.
Kathy’s team and I worked long hours to link Stefanne’s inquiries to customer accounts victimized by counterfeit check activity. By the end of the week, we linked her to 18 victims of counterfeit check activity, with total bank losses exceeding $54,000. The fraud had begun only a couple of months before. Victims spanned from Maine to Virginia, and all had common names. Every counterfeit was negotiated at Kingdom Bank and clearly originated from the same check stock. Each one contained very similar handwriting. It was also evident that the ‘‘ring’’ had an insider working at Kingdom, as the identities of many confirmed
Majestic victims were used to open accounts at Kingdom. Finally, we knew that many more of our customers had been compromised by Stefanne, as she performed inquiries on countless others. The analysts closely monitored these accounts while regional management and Kathy painstakingly devised the appropriate action plan, including contacting the customers, freezing their accounts, and offering free identity theft protection.
During the investigation, we determined that Stefanne maintained an employee checking account at Majestic. I reviewed her account and identified several nonpayroll cash deposits in amounts ranging from $400 to $1,000. She had deposited over $10,000 just over the past few months. I explained our findings to Kathy, who then reported the results to regional management. Next, we contacted Lena, Stefanne’s manager, but did not disclose the nature of our investigation. We needed to obtain some background information prior to the interview. Lena advised us of the unfortunate circumstances that recently befell Stefanne and her family, insisting that she was a top performer, loved by her team and the Morgantown customers.
‘‘If she did anything wrong, I’m sure she’ll have a legitimate explanation,’’ Lena insisted.
‘‘She’s a sweet girl and I would stake my reputation on her.’’
‘‘What makes you think she did anything wrong?’’ Kathy asked.
‘‘Well, any time loss prevention calls, it usually means someone is in trouble,’’ Lena replied. ‘‘That’s not true,’’ Kathy said. ‘‘We simply think Stefanne may have some information to help us with a current investigation. Please ask her to report to the Administration
Building first thing Monday morning to meet with Craig.’’

Wells4689_c03_1

30

05/31/2007

chapter 3

30

the insider

It was 9:30 a.m. and the start of what would be a productive work week. A trembling
Stefanne Rider arrived at our office. When I went to introduce myself, I was startled to see that an older gentleman who identified himself as Sam Rider, her father, accompanied her.
He wanted to participate in the interview with his daughter. I told him that the meeting pertained to a private bank matter, and I could not allow him to be present. Sam was clearly agitated, but he acquiesced and waited in the lobby.
As we entered our conference room, I introduced Stefanne to Tracy Blattner, an employee relations representative from Majestic, and directed her to a chair in the middle of the room. The table was previously moved to the side so there would be no obstruction between us. Tracy sat in a chair several feet behind to witness the interview.
Stefanne remained visibly nervous, clutching her purse in her lap with her arms crossed, head down, and eyes tentatively peeking at me from under her strawberry blond bangs. She rocked slightly back and forth in her chair as I began asking her some basic background questions about her education, job responsibilities, and family life in an effort to develop a rapport with her. As I learned more about Stefanne, I began to sense the anxiety building in her. She appeared sheepish and spoke almost with a whisper. Before I was able to begin asking Stefanne questions pertaining to the case, she began to sob. I placed my memo pad to the side, pulled my chair closer to her, and asked, ‘‘Is there something you want to talk about? You seem to have the weight of the world on your shoulders, and I’d like to help you in any way I can.’’
‘‘I don’t think there is anything you can do to help me,’’ she responded, tears streaming down her face.

Running on Empty
It took the better part of an hour to settle Stefanne down so that she could speak to me coherently. She eventually confessed to selling customer identities and account numbers to a ring operating out of Philadelphia.
Stefanne had met a young man named Buck while employed as a barmaid at a pub near campus. A regular patron, he had befriended her not long after she began working there.
Buck was brash and flirtatious with slicked-back dark hair and a rail-thin build. Although nobody actually knew how he made a living, he appeared to have a lot of money. He drove brand-new import cars, dressed to the nines, and tipped better than any other patron. One night he approached Stefanne after hearing from the bar owner that she was leaving school to tend to a family crisis. He also had learned she accepted a job with Majestic Bank as a full-time teller.
He approached Stefanne. ‘‘I’m sorry to hear about your family situation. It sounds pretty bad. I hear you took a job at a bank, huh?’’ Buck asked.
‘‘I need to help pay the family bills, my own credit card bills, and put food on the table— at least until things get better. I’m devastated that I have to leave school, but I have no choice,’’ Stefanne said.

Wells4689_c03_1

05/31/2007

31

running on empty

31

Buck then made his pitch. ‘‘Listen, I think I can help your family and get you back to school in no time, but you need to do something for me,’’ he said. ‘‘You take that job with the bank, and I’ll give you $200 for every customer account you give me, along with each of their Social Security numbers, addresses, birth dates, phone numbers—any information you can access.’’
‘‘But isn’t that against the law? What in the world are you going to do with it?’’she asked.
Buck explained that his friends needed the information to make and cash counterfeit checks, and customer identities to open bank accounts and establish credit lines.
‘‘I don’t know,’’ Stefanne said.
Buck interrupted, ‘‘You want to help your family, right? You want to return to school, right? If you turn me down, you’ll probably never come back to college. Anyway, nobody gets hurt in the end. The bank has millions of dollars and will reimburse the customers.’’
‘‘But what if we get caught?’’ Stefanne asked.
‘‘I’ll tell you what,’’ Buck said. ‘‘After your shift I’ll take you to my friend’s house and show you how it works. Deal?’’ he asked persuasively. Stefanne reluctantly agreed.
Her shift ended at 2:30 a.m., and she met Buck outside of her dorm. He drove her to an old, rundown row home somewhere in North Philadelphia. Buck navigated through a complex network of small side streets and dark alleys so Stefanne would not be able to determine the exact location of the property. They entered from behind the row home and proceeded down a dark stairway to the basement. There, they met a man who called himself ‘‘Taz.’’ Taz was an older, heavyset African American man who wore a prosthetic leg. ‘‘This is the girl who is going to join our team,’’ Buck said, as he rushed to the basement.
Frightened, Stefanne stood at the base of the stairway. Taz grinned and motioned her into the basement. As she made her way toward the men, Stefanne’s eyes were drawn to what appeared to be a modern studio equipped with laptop computers, digital cameras, stacks of blank checks and credit cards, and laminating equipment. ‘‘This is where it all happens,’’
Taz explained proudly.
The men explained that the information she agreed to provide would be used to create counterfeit checks and fake IDs. Taz provided the fakes to a group of ‘‘runners’’ who would open bank accounts and negotiate the counterfeit checks.
‘‘We’ll also tell the runners to apply for loans using the identities you give us,’’ Taz continued. He had a partner who recruited homeless people. ‘‘They’ll do anything to make a few bucks,’’ he explained. ‘‘Stefanne, we’ll make more money than you can imagine,’’ Taz promised. ‘‘And your job is the easy part. It’s the runners who risk getting caught.’’ It didn’t take them long to convince Stefanne to agree to the scheme. She would have done almost anything just to get out of that row house!
Buck returned Stefanne to her dormitory. ‘‘I’ll call you on your cell in a few weeks and let you know how we’re going to do this,’’ he told her.
Two months later, Stefanne was already a favorite teller at the Morgantown branch.
One day during her lunch break, her cell phone rang. It was Buck.

Wells4689_c03_1

32

05/31/2007

chapter 3

32

the insider

‘‘I got $600 and need some customers, Stefanne,’’ he said without even introducing himself. She knew exactly what he meant. ‘‘Meet me at Burger King after the bank closes tomorrow and don’t target customers that go to your branch. That would be too obvious.’’
Stefanne returned to her station and quickly decided it would be easiest to query common names on the bank’s mainframe system.
Ultimately, Stefanne confessed to stealing the identities of over 55 Majestic depositors.
She explained that she would meet Buck once per week and exchange customer screen prints for cash.
‘‘I still can’t believe I did this,’’ she whispered to herself as she completed a written statement. ‘‘Did you tell your dad?’’ I asked.
‘‘I told him this morning after I was asked to come here,’’ she responded. ‘‘I wouldn’t have involved my dad if Buck didn’t call me on my way here. He made it clear that I was not to cooperate with you. I immediately called my dad and told him everything.
That’s why he came with me this morning. He had no idea what I was doing. He just thought I was making extra commissions by cross-selling bank products. He pleaded with me to cooperate with you. I wasn’t sure I would until you started asking me questions.’’ When the interview was complete and her written statement was secured, Tracy informed Stefanne that her employment with Majestic Bank was terminated. After handing me the keys to her teller cash drawer, I escorted an emotionally drained young woman from the conference room. I watched her approach her father and collapse into his arms. Stefanne later offered a treasure trove of information to law enforcement. The intelligence she provided resulted in the arrest of several criminals and the breakup of an organized crime ring operating out of Philadelphia. She avoided jail time by cooperating with the prosecution of these criminals, but received five years probation and was ordered to pay $66,000 of restitution to Majestic Bank.
The promising future of this once-exuberant, intelligent young woman changed forever the day she decided to enter into the criminal underground world of identity theft and check fraud—a fact she will be reminded of each and every time she completes a job application. Lessons Learned
I learned a great deal as a result of this and other identity theft cases involving Majestic Bank customers. Information Security—Restrict and Monitor
In today’s environment, it is critical for every organization to develop and implement enterprise-wide countermeasures to external and insider attacks against their information

Wells4689_c03_1

05/31/2007

33

lessons learned

33

technology environment. Majestic Bank recognized the risks associated with insider attacks and the need to restrict employee access to sensitive information to only those who require it to perform their job. One countermeasure currently under management consideration is biometric technology. Rather than requiring a customer to provide an easily counterfeited driver’s license and secondary form of identification, a customer can authenticate his or her identity with a mere scan of a fingertip.
It is no less critical for organizations to monitor employee access to sensitive company data. For example, Majestic Bank’s ‘‘Footprint Report’’ was a relatively new tool that enabled us to identify the single point of compromise. Although it was instrumental in identifying the suspect after the fraud was well under way, we have further enhanced the surveillance of employee system activity. As such, Majestic Bank implemented new business intelligence software to proactively monitor employee access to sensitive company data by capturing anomalous teller inquiry activity, such as:


Inquiries to the bank’s teller processing system with no corresponding customer transactions 

Inquiries on customers residing outside of the teller’s predetermined geographic region 

An unusually high volume of inquiries in comparison to historical volumes associated with a given teller



An unusually high volume of inquiries performed by a teller on a predetermined list of common names, such as ‘‘Smith,’’ ‘‘Jones,’’ and so on

Employee Assistance Programs
Majestic Bank partners with an organization that offers a wide variety of programs designed to support Majestic team members with just about any life issue, such as financial crises, child care issues, and elder care. Lena Santana failed to recognize the extent of Stefanne’s dire situation and direct her to the employee assistance program (EAP).
Perhaps Stefanne could have received the help she needed before resorting to nefarious activity. Customer Retention—Identity Theft Assistance Unit
LP&S and Retail Management had difficulty coordinating proper notification to the identity theft victims. The bank did not have standardized procedures, which created an atmosphere of confusion with respect to roles and responsibilities and did not allow the bank to adequately leverage its resources to respond to customer needs in a timely, organized fashion. LP&S quickly recognized the need to provide victims a single point of contact to facilitate customer retention. As such, LP&S established an Identity Theft
Assistance Unit consisting of five highly trained team members charged with the responsibility to respond to the needs of identity theft victims.

Wells4689_c03_1

34

05/31/2007

chapter 3

34

the insider

LP&S Case Management
Carolyn and Mary utilized years of investigative experience and open dialogue to link multiple fraudulent events (i.e., counterfeit checks) to a single point of compromise. The importance of open communication and dialogue within an organization cannot be overstated. Oftentimes, entities unknowingly maintain a ‘‘silo’’ approach in their day-today operations. Majestic Bank’s LP&S Department now nurtures a culture of open, honest dialogue among its team members.
Tip Line
Although Stefanne pilfered customer identities stealthily, many insiders fail to exercise such discretion. Majestic Bank provides all team members with an anonymous internal hotline to report unusual or suspicious activity to LP&S. However, only one LP&S team member is currently assigned the responsibility to man the hotline between 8 a.m. and 5 p.m.
Because callers often are forced to leave information on a recorded message, many fail to provide sufficient, actionable information. Messages are also sometimes inaudible due to a poor phone line connection. LP&S recommended management consider outsourcing this function to a company that can deliver live, 24/7 coverage by personnel trained to extract detailed information from each caller, while ensuring 100% confidentiality.

Recommendations to Prevent
Future Occurrences
Information Security
All companies, including financial institutions, should make it a priority to understand the current threats to their IT infrastructure and consider leveraging technology to defend against attacks from external and internal sources.
Background Checks
Organizations should utilize a comprehensive applicant screening process inclusive of criminal background and credit checks, especially for those positions requiring extensive cash handling and access to sensitive company information, such as customer profiles.
Zero Tolerance Policy
Executive management at Majestic Bank has taken a stance against fraud committed by its team members. They maintain a ‘‘Code of Conduct and Ethics’’ that must be signed by every newly hired team member. In addition, all team members must review the code during each annual performance review and sign a document acknowledging it, which states in plain language the fiduciary duty of everyone to refrain from transactions or

Wells4689_c03_1

05/31/2007

35

recommendations to prevent future occurrences

35

behavior that seems even slightly impropriate and report suspected fraud to appropriate personnel. The code also specifically addresses the bank’s position regarding fraud, namely
‘‘zero tolerance and prosecution of the offenders.’’ This document can serve as a deterrent and sets the appropriate tone from the top.
Customer Education
Majestic Bank uses every communication avenue at its disposal to educate customers on how to protect themselves from identity theft. The bank’s Web site contains a prominently displayed section dedicated to these issues. Each branch displays signage warning customers of the threats associated with identity theft. Brochures are also on display in branches and are periodically enclosed with customer statement mailings to educate people about the risks. The call center often plays an audio message alerting customers waiting on hold to the danger and warning signs of identity theft.
The bank advertises and offers a software product that is linked to the three major credit bureaus. This provides customers with instant access to their credit files, automatically monitors changes or inquiries to credit files, and alerts customers to any unauthorized accounts opened in their name.
Employee Training
Financial institutions should conduct ongoing employee training about identity theft. At a minimum, they should develop written policies and procedures governing disclosure of customer information, and use them as a basis to train employees. Employees should be trained to recognize fraudulent attempts to obtain customer information and execute the necessary prevention techniques to protect customer information from internal and external threats, such as shredding documents containing sensitive company or customer information, avoiding unauthorized access to computers, and limiting the amount of information provided over certain communication channels like e-mail and telephone.
Majestic Bank’s LP&S and Legal departments provide on-site and web-based employee training covering these and many other issues associated with the security of customer information and related privacy regulations.

Craig Sinnamon, CFE, is a regional fraud investigations manager with a large financial institution. He is a graduate of Beaver College (now known as Arcadia University) and has 11 years of auditing and fraud investigations experience in the financial services industry. Wells4689_c04_1

05/30/2007

36

chapter

4

&
Aloha, Hawaii!
DOMINIC A. D’ORAZIO

arin Jensen seemed to have it all. A self-proclaimed family man, he married a lovely gal named Julia and had two young children. His wife stayed home to manage the active lives of their kids, while Marin appeared to be a model employee at the
American Logistics Agency. From the exterior, their lives were picture perfect.
The Jensens’ home was nestled away on a quiet tree-lined cul-de-sac in one of the
Northeast’s more affluent communities. The two-story colonial sits on two acres of beautifully landscaped property that was purchased by the Jensens for almost $400,000.
The dead-end street was ideal for the kids, since it does not have a heavy flow of traffic. A state park is located near the neighborhood, which is used for various athletic competitions and has an adjoining farm that resembles what daily lives were like before the advent of the industrial age. Because of the proximity to the state park, one can bike around the neighborhood in the late afternoon and spot deer meandering through the residents’ yards. At first glance, one might surmise that the area consists of the type of folks who spend a great portion of their professional lives climbing the corporate ladder. Indeed, this is not the type of neighborhood one would associate with a middle-management government worker. Of course, it is no crime for a middle-management employee to live in such a neighborhood. Certainly there are other ways to accumulate the type of wealth one would need to afford the property, but if the lifestyle one is living cannot be explained by the income one is earning, questions arise.
Marin’s home, though modest compared to some of the more elegant houses that dot this high-income town, contained features common among families who prefer to have amenities close to them. For example, the backyard contained a playground area and an inground swimming pool, surrounded by flowers and bushes. These quiet and serene conditions could persuade one to meditate. Like many of their neighbors, the Jensens employed landscapers who mow and edge the lawn, trim the bushes, and maintain the yard.
Marin took pride in coaching his children’s sports teams and running the usual family taxi service, transporting his kids to their respective sports and extracurricular activities.
While most of today’s families own minivans, the Jensens had the original family conveyance: a station wagon.

M

36

Wells4689_c04_1

05/30/2007

37

the copycat

37

After working for American Logistics for several years, Marin rose to the position of senior logistics management specialist. He was considered likable, and several program directors wanted to use his services. During one particular year, he split his work time between his main office and two other customers. When a third customer inquired about his services, Marin’s supervisor stated he had already used up his available work time for the year. The prospective third customer suggested that if Marin would agree to work for him, he would be willing to pay for the overtime. Marin agreed to put in the time, over and above his normal workweek. Once his work for the third customer was finished, Marin began to struggle financially. He had become accustomed to the extra cash. With his real estate taxes climbing, he had to come up with another way to supplement his salary.
The American Logistics Agency is a part of the federal government, located in the northeast region of the United States. As an integrated entity, it develops, fields, and sustains base command and control, intelligence, surveillance, and reconnaissance systems.
American Logistics deals with research and development, management, and distribution of equipment to support soldiers who are fighting overseas. The company employs about
10,000 people worldwide and is also supported by thousands of contractors.
Although American Logistics is located on a site with other federal government entities that covers over 1,000 acres of prime real estate, it is self-sustained, complete with its own fire and police departments, post office, supermarket, gas station, church, child care center, liquor store, thrift shop, credit union, and motor pool. It also contains a range of outdoor amenities: three swimming pools, a physical fitness center, tennis courts, softball fields, a bowling center, a golf course, an athletic complex, and a picnic area.
As typical of any federal government entity, and in addition to its list of researchers, procurement officials, and logistics specialists, American Logistics also employs lawyers, internal auditors, and criminal investigators, along with a resource management office and a personnel office that ensures the agency is properly financed and staffed.
American Logistics is one of the state’s largest employers and produces $3.4 billion for the state’s economy.

The Copycat
As supervisor to Marin, Arthur Kiley never had any complaints. But one Monday, that changed. After Marin made photocopies of his new travel order, he mistakenly left the document in the machine. Mr. Kiley was the first to notice, and when he looked at the travel order, he observed that the signature block had been cut out of a previously signed order and taped to the new one.
‘‘Marin, may I ask what you’re doing with this signature taped to your travel order?’’ asked Mr. Kiley.
Marin replied that he was simply trying to make the signatures darker because when he faxed them to the ticketing office, the color was muted.
Later that day, Mr. Kiley approached Marin again to inquire about the taped travel order. Still, Marin assured him that he was ‘‘just making sure the signature was dark enough

Wells4689_c04_1

38

05/30/2007

chapter 4

38

aloha, hawaii!

to be legible for the ticketing office.’’ Mr. Kiley pressed on, threatening him with an audit of his past reimbursements of travel claims if he didn’t come clean.
At the end of the day, Marin had not ’fessed up to any wrongdoing, so Mr. Kiley decided to do a little detective work. It didn’t take long for evidence to surface. When he looked inside Marin’s trashcan, he found a travel order with the signature cut out of it, copies of pay stubs, and copies of other travel orders where the initial ‘‘J’’ was handwritten by Marin.
The ‘‘J’’ pertained to the first name of Mr. Kiley’s boss, Mr. James Heyward, who was the authorizing official for Marin’s travel orders and subsequent travel voucher claims.
Mr. Kiley contacted Samuel Mezzacante at American Logistics’ legal office for guidance.
Upon being informed of the possible fraud, Mr. Mezzacante first contacted the criminal investigators. Next, he called my department, the internal review evaluators, and set up a meeting to examine the evidence. Mr. Mezzacante requested our services to review Marin’s travel vouchers and to determine how many vouchers were fraudulently filed.
In the meantime, Mr. Kiley had obtained several of Marin’s settlement vouchers and tried to compare the dates of supposed travel to what Marin was actually doing on those dates. The settlement vouchers were subsequently turned over to us in the Internal
Review Evaluator Department.
We notified the Defense Finance and Accounting Service and requested copies of all vouchers that were paid to Marin. It took several weeks to receive all of the copies. We had asked for vouchers going back five years, which meant the Finance Service had to research within their archives to find them, make copies of the documents, and mail them to us.
The next step was to contact the Bank of Commons, the contractor that managed the
Government Travel Card program. All government travelers are required to use the
Government Travel Card for all official travel-related expenses such as hotels, car rentals, limousines, airlines, or trains.
Since I had three staff members working on this review, I decided to divide the scope of the project into three timeframes. Each member worked on a one-and-a-half-year timeframe. Have Committed Fraud, Will Travel
While reviewing Marin’s travel vouchers and receipts, we noticed that on trips down to
Springfield, Virginia, he stayed at a hotel chain that was not familiar to us. We searched the
Internet to find the phone number of the hotel’s corporate office. When we contacted them, they confirmed that the hotel was located in four cities in Virginia—but none in
Springfield.
In an attempt to give Marin the benefit of the doubt, we contacted Joseph Somers, an evaluator from our corporate office in Virginia, and asked him to go to Springfield to the address listed on the hotel receipt and verify whether any hotel existed at that location.
Perhaps Marin had accidentally listed the wrong hotel name. When Joseph tried to go to the address, he could not find it. None of the locals were aware of a hotel with a similar address either. The hotel simply did not exist.

Wells4689_c04_1

05/30/2007

39

have committed fraud, will travel

39

The next day, Joseph called our office and reported his findings. Afterward, we drafted a letter and sent it certified mail to see if there was any chance that Joseph was mistaken. The letter was returned a few weeks later, stamped NSA—No Such Address. Our fears began to take shape. This scheme would require us to research the records and ‘‘leave no stone unturned,’’ as our director, Martin Dais, instructed us. In other words, Mr. Dais told us to check every receipt and contact every vendor and to ask for legitimate receipts from the companies involved. We were also to ask the vendors if Marin had stayed in their establishments or used their car rental services as he claimed on his travel vouchers.
On some claims, Marin would use his Government Travel Card to charge for car rentals with one company, while his travel vouchers would show that he used a different one:
Alamo Rent-A-Car. In all of those cases, Marin’s claim for River Run Rent-A-Car was higher than his actual charge on his Government Travel Card. Also, when we looked at the
River Run receipts that were attached to his vouchers, we noticed that the receipts were always in the same position on the letter-size paper, which indicated that Marin had a template in his computer’s hard drive and was printing out his receipts as he needed them for ‘‘proof ’’ of his various trips. We contacted the corporate headquarters for River Run and asked if Marin had used the agency to rent cars for his business trips. The River Run official told us that Marin was not showing up in their database as ever having rented a car.
The official also faxed us an example of a valid receipt. When we compared that receipt to the ones that Marin had printed, we realized that the only difference was a five-digit code that appeared at the bottom of the valid receipt. This code identified either the person handling the transaction or a specific River Run agency office.
When we compared Marin’s travel claims to his Government Travel Card charges, we noticed that he had used his Government Travel Card to charge train tickets at the station nearest to the airport. However, on Marin’s travel vouchers, he would claim that he took a limousine from his residence to the airport and back. The cost was always under $75, which would have required him to submit a receipt to our finance office. So an $11 charge
(cost of train ticket) became a claim for $74 (cost of limousine), a net profit of $63 for each direction for each trip that Marin claimed.
Another travel voucher showed that he had gone to a location in northeast
Pennsylvania. However, his Government Travel Card transactions showed that he was gambling in an Atlantic City, casino located in southeastern New Jersey. We thought it unlikely that Marin was capable of being in two places at the same time.
As we scrutinized the travel vouchers, we realized that each year Marin’s claims would grow to a larger amount. Also, when we conducted a review of Government Travel Card transactions, Marin’s name came up because he was using the Government Travel Card in restaurants close to his residence. These types of transactions are classified as a misuse of the
Travel Card since there was no official purpose for him to eat at the local restaurants. At the end of that particular review, the names of the misusers were turned over to their respective directors who coordinated discipline with the personnel office. When Marin was notified that he was found to have misused the Travel Card, he probably thought he got away with submitting all of the fraudulent vouchers. After receiving administrative disciplinary

Wells4689_c04_1

40

05/30/2007

chapter 4

40

aloha, hawaii!

action, he began upping the ante by claiming parking costs of $18 per night at the hotel that did not exist in Springfield, Virginia.
We noticed a pattern developing while reviewing the travel vouchers. Marin would always leave a few days before his scheduled date of departure or would always stay a few days after his travel had ended. After piecing his travel vouchers together, we noticed that over a three-month stretch, Marin was basically on the road 100 percent of his time. For example, his travel vouchers showed him leaving on a Monday and returning on a
Thursday. Then he would leave the next day (Friday) and return Tuesday. Again, he would leave the next day (Wednesday) and return Monday, and so on. I joked to my staff that he might as well not even unpack. Obviously, we questioned whether he was actually on travel status the whole time.
Another claim showed that Marin had traveled to Virginia for a meeting. We contacted the host for that meeting and were told that Marin had called ahead to say that his car broke down. The host had cancelled the meeting and scheduled it for another day. While Marin did not stay in Virginia for his entire travel time, the documentation on his voucher claimed that he stayed there for three days.
In one part of the review, we noticed Marin had scheduled a trip in February—just a few months back. He made reservations through the government ticketing office for a plane ticket that took him to Savannah, Georgia. On the day that he departed for Savannah, he went to the Delta Airlines counter and charged a round-trip flight to Savannah through his
Government Travel Card. Then he went to the Continental Airlines counter and had the counter person exchange his government-issued round-trip ticket to Savannah for a oneway personal ticket returning from Los Angeles. A few weeks after returning from
Savannah, he called Continental and had the company exchange the one-way trip from
Los Angeles to a round-trip ticket to Hawaii for July 15. Since that date had not yet come, we knew that Marin was planning a vacation. We had to work fast.

Permanent Vacation
During the course of our investigation, Marin had his security clearance taken away from him, which meant that he could not work on any classified or secret work. In essence, he was relegated to administrative duties that were very minor and that did not require any type of security clearance. Soon after, Marin’s computer was taken way from him so that the forensic investigators could retrieve all of his electronic mail, along with any files he may have stored in his hard drive.
Having no security clearance or a computer to do even minor tasks, Marin wrote an e-mail during the week of April 11 to Mr. Kiley, claiming that since he no longer had a way to complete his work, he felt that there was nothing to do but resign from American
Logistics. His last day was April 15. We had to get all of our paperwork to the prosecuting attorney before Marin could go to Hawaii.
While checking his computer files, the forensic investigator retrieved electronic files for his fabricated hotel claims and for his car rental claims, which is what the internal

Wells4689_c04_1

05/30/2007

41

lessons learned

41

evaluators had suspected all along. In addition to the files, there was e-mail correspondence between Marin and his wife, who asked him point blank when the next travel check was coming in. They needed the proceeds to pay for the current month’s mortgage. The
Jensens were desperate to make this scheme work.
In the early stages of our investigation and while working with the criminal investigators, Agent Stone Huntington and Agent Thomas Harter, we learned that the office of the U.S. Attorney only took cases that exceeded a certain dollar amount. Once we calculated that the scheme exceeded $100,000, Agents Huntington and Harter brought it to the attention of the U.S. Attorney’s Office. After showing Giovanni Falcone, the
Assistant U.S. Attorney, what we had pieced together, he had us go back to all of the voucher claims and reconstruct them to allow for valid claims to which Marin may have been entitled. It was this reconstruction that forced us to compare the travel voucher claims against his Government Travel Card charges. Unfortunately for Marin, he didn’t realize that he was leaving a trail whenever he used his Government Travel Card.
Falcone told the investigation team that he needed the field work done at least 30 days before July 15 so that he could have the warrant signed and issued to Marin before he left for Hawaii.
Agents Huntington and Harter, along with a couple of local police officers, went to
Marin’s house around 5:00 p.m. on July 14 with a warrant for his arrest. As he was handcuffed and led out of his house, his wife came running down the stairs to ask ‘‘Marin, what about our trip to Hawaii?’’
Huntington and Harter advised Marin of his Miranda rights. The two agents drove him to the county jail where he would spend the night. Along the way, the two agents asked
Marin why he carried out this scheme to defraud the federal government. He replied that he worked harder than most people in the federal government but was not justly compensated for his work.
The next day Huntington and Harter escorted Marin to the federal courthouse at the state capital. At Marin’s arraignment before the federal judge, his attorney asked if Marin could go to Hawaii with his family since they were scheduled to depart that day. But the judge confined Marin to the state of his residence. Meanwhile, his wife took the children and spent a week in Hawaii without him.
Marin was charged with one count of wire fraud covering over 150 fraudulent vouchers and totaling over $150,000. He was found guilty and was ordered to pay $151,460 to the federal government for fabricating expense vouchers. He was also sentenced to 20 months in federal prison and ordered to serve three years of supervised release upon the completion of the prison term. According to the transcript filed in the federal court, Marin took the money over a five-year period to pay off mounting credit card debt.

Lessons Learned
After talking to various parties who were involved in ensuring that Marin traveled and performed his duties in conjunction with his travel orders, no one could unequivocally

Wells4689_c04_1

42

05/30/2007

chapter 4

42

aloha, hawaii!

state that he or she knew exactly whether Marin had properly performed his duties. He fell through the cracks. He had everyone fooled. If he worked for Mr. Kiley, he would tell customers A and B that he was working for his immediate supervisor. Other times he would tell Mr. Kiley that he was working for customer A or B, regardless of where he was.
Mr. Kiley had no control of Mr. Jensen, nor did he corroborate with customer A or B to attest that Mr. Jensen was indeed traveling for them. It was sheer luck that Mr. Kiley found the taped travel order in the copier—and sheer stupidity for Marin.
Although many ‘‘red flags’’ appeared during the perpetuation of this fraudulent scheme, nobody investigated them. For example, when the travel account for one customer had totally been expended, the budget analyst did not ask why all of the funds were spent.
Individuals who are responsible to review and authorize the travel claims need to ensure that they review them for accuracy and legitimacy.

Recommendations to Prevent
Future Occurrences
Implement Electronic Travel Order and Travel Voucher Claim System
Since the scheme unfolded, American Logistics has started using a new electronic travel order and travel voucher claim processing system. Controls are set to prevent the oversight of individuals who might manipulate the system, like Marin. Still, the individuals who are responsible for authorizing travel claims should review them for accuracy and legitimacy.
Require and Check for Appropriate Documentation
Travelers should submit appropriate documentation (i.e., receipts for any costs at $75 or higher) when filing their travel voucher claims. Otherwise, the voucher should be returned to the traveler until he or she can support the claim.
Use Common Sense
Ensure that the travel voucher claims, especially where the traveler has to list them, pass the commonsense test. For example, parking costs to stay at a particular hotel are usually charged to the room and appear on the final hotel bill. If the traveler claims parking fees, but they do not appear on the hotel bill, the authorizing official should investigate the claim. Establish and/or Utilize a Cross-Communication System within the Organization
All authorizing officials should take the time to review vouchers for padded or incorrect claims. Establish a system that ensures that all departments are notified and capable of

Wells4689_c04_1

05/30/2007

43

recommendations to prevent future occurrences

43

reacting when a false claim is uncovered so that proper actions can be taken to minimize damage and weed out those individuals responsible for the fraud. Directors who have oversight of employees should be included in the voucher-reviewing process, so that they can cumulatively corroborate the travel status of the employee.
Inform the Travelers of Consequences and Maintain a Watchful Presence
Travelers should be aware of the consequences of filing false claims. Communicate the penalties that can be imposed. Also, periodically conduct independent reviews so that selected travelers can be contacted directly and questioned about individual charges.

Dominic A. D’Orazio, CGFM, is a senior evaluator for a U.S. Army Internal Review Office in the northeastern United States. He has assisted the criminal investigators on numerous cases involving white-collar crime. Mr. D’Orazio is a graduate of Philadelphia
University and has over 28 years of experience in auditing.

Wells4689_c05_1

05/31/2007

44

chapter

5

&
What About Pete?
MICHAEL GOLDMAN

his is a story about failed partnerships, failed marriages, and rampant bankruptcy fraud. What once appeared to be a successful company progressed through a legitimate bankruptcy filing, followed by a postpetition looting of funds. There are related-party transactions, ghost payroll checks, benefit withholdings, quadruple-entry accounting, mortgage application fraud, wire and mail fraud, money laundering, and fraudulently filed bankruptcy operating reports. The story isn’t over yet, but so far there have been more than $5 million in civil judgments issued and settlement payments made by five banks that were unwitting participants in these various schemes.
It began with Fred Morgan, the owner of Gopher Design. Fred was in his mid-40s, smooth and charismatic, and always well dressed. He was slender and a little frail looking, a bona fide lady’s man, but definitely not the type who would do well in prison. People have one of two reactions after meeting Fred. The majority liked and trusted him instantly. But a small minority of us felt the urgent need to check our pockets and take a quick shower after shaking his hand.
Mrs. Morgan was not as physically attractive as her husband, but had been a winner of the gene-pool lottery in other ways. Her father had built a hugely successful business empire that created enough wealth to keep his offspring very comfortable for multiple generations. Her parents didn’t seem to like her husband particularly, but they were there with open arms and an open checkbook whenever anyone in the family needed money.
There was no apparent reason why Fred would ever resort to theft when he was married to such a huge source of wealth.
Fred’s number-two guy, Pete Slowinski, was almost the exact opposite of Fred. While
Fred could sell ice to an Eskimo, Pete seemed to rub everyone the wrong way. He was rough, tough, and gruff. Physically, he was short, squat, and very muscular. And his face was very flat, as if he had been hit with a shovel in his formative years. His blank stare of ignorance was a stark contrast to Fred’s apparent total knowledge about almost anything you could think to talk about.
When anyone who knew him was asked if Fred was capable of committing fraud, they answered that he was smart enough and gutsy enough, but there was no reason for it; his wife’s family was wealthy beyond belief, and Fred could dip into that trough whenever he

T

44

Wells4689_c05_1

05/31/2007

45

call to duty

45

wished. The same question about Pete elicited a unanimous answer: He didn’t have the brains to defraud anybody; he just did what he was told.
The differences between the two men even extended to their choices in women. Mrs.
Morgan was the definition of ‘‘shrew.’’ Employees literally quaked in fear when she walked through the office. She was loud, obnoxious, and totally abrasive. Fred was rumored to have an Italian girlfriend in Italy, whom he visited often. Mrs. Slowinski, Pete’s wife, was a quiet woman well liked by everyone in the company. Employees generally felt bad for her because Pete had a public affair with the company’s shipping clerk, a very plain and quiet young woman.
Gopher Design had been a successful graphic arts company for more than a decade. Its client list included many large advertising agencies, Fortune 500 companies, local restaurants, and nonprofit agencies. Gopher’s customers had a tough time in the years when businesses were hit by the dearth of advertising that followed the 9/11 attacks, weakness in the hospitality industry, and massive changes in charitable donation patterns resulting from changes in tax laws, and disasters—some natural, some not. Technology changes that impacted both the way that design work is done and the way that Gopher’s customers disseminate their information created a great need for large capital spending. Despite this,
Gopher had not suffered the economic hardships that many of its competitors experienced.
Fred and a partner had run Gopher together since its inception, but eventually had a falling out. The partner left the business, sued Fred in state court, and won his case. Fred continued to operate the business, but had been ordered by the court to buy out his former partner for an amount in excess of $1 million. Rather than make this payment, he placed the company into voluntary Chapter 11 bankruptcy.
Gopher’s bankruptcy case appeared to progress normally, but slowly. The debtor’s bank suspected check kiting at various times but was never able to prove anything more than careless cash management. Personal lawsuits against the bank president filed by Fred and by other companies that his family owned kept anyone from investigating him too thoroughly. The bankruptcy court finally confirmed a plan where Gopher would pay its secured debt in full and about 33 cents on the dollar of all its other prepetition debts.
Everybody was looking forward to Gopher emerging from the bankruptcy process as a healthy, rehabilitated company.
Rather than serve as the poster child for bankruptcy success, Gopher crashed and burned immediately upon its release from court supervision. It emerged from bankruptcy with no cash and hopelessly insolvent. The U.S. Trustee immediately stepped in, put Gopher back into bankruptcy, and appointed a Chapter 7 trustee to investigate what had happened.

Call to Duty
I was at the base of a mountain in central Quebec when the Chapter 7 trustee called my cell phone, introduced himself, and told me that the U.S. Trustee had recommended that he call me to help investigate Gopher. I had served as examiner in a bankruptcy case involving allegations of fraud both prior to and after the bankruptcy filing, so the U.S. Trustee was

Wells4689_c05_1

46

05/31/2007

chapter 5

46

what about pete?

familiar with my work. He went on to explain that because there was no money at all in the bankruptcy estate, there was a good chance that I may never get paid for taking the case. I must have been drunk on the fresh mountain air, the overwhelming beauty all around me, and the joy of being with my family—I said I’d do it.
My first day back from vacation, I met Fred and an attorney from the trustee’s firm outside Gopher’s offices. Fred was pacing back and forth, totally distraught when we arrived—the alarm company had discontinued service, the building had been broken into, and most of the sophisticated computer equipment was missing. Fred took us inside and showed us the point of the break-in. Interestingly, the splinters still on the door all pointed to the door being kicked out from the inside. Some of the ‘‘stolen’’ computers were subsequently found, much later, to have been given to employees in lieu of amounts that
Fred owed to them.
I asked Fred to give us a tour of the facility. We started with his office, which was totally empty except for a box of monthly operating reports that he had filed with the bankruptcy court. He explained that he was only a figurehead in the company and that Pete Slowinski ran absolutely everything. When I asked about the operating reports, he answered that he didn’t understand a single thing on them, he was totally baffled by numbers and accounting, and that all he did was sign what his accountants prepared for him.
As we walked through the various cubicles, Fred became more and more distraught at each set of dangling wires where computer equipment used to be. He didn’t know where any of the company’s business records were or how we could get in contact with the former accounting staff, or how anything could possibly be figured out. If only he had stayed more involved, things may have worked out so much better, he whined. After all, he lost more than any creditor—his livelihood, his reputation, and all his personal net worth were gone with Gopher.
Fred’s only contribution to the investigation was the ability to tell us who sat in each of the cubicles. He claimed not to know anything else about the business. File cabinets were all locked, and Fred had no idea where the keys were. Pete’s office was jammed full of clutter—files and paper were everywhere. Despite the office being an incredible firetrap full of stuff, the only usable documents were a very impressive collection of carry-out menus from practically every restaurant within a five-mile radius. It was clear from the food stains on them that the menus were not there to sample different design styles.
The cubicle next to the accountant’s had been vacant. There were dirty, dusty boxes jammed under the work surfaces. When I opened them, I found binders of batch reports showing inputs (billings to customers, invoices from vendors, commissions due) into the accounting system and some of the outputs (accounts payable checks paid) from the system.
I was thrilled as I carried boxes out to my vehicle. This was a very messy and overwhelming way to start an investigation, but at least all those boxes gave me justification as to why an accountant might need a business truck if the IRS ever questioned my tax deductions.
A few days later, Fred attended a meeting at the U.S. Trustee’s office. This was a chance for the Chapter 7 trustee to ask him questions about anything related to the case, under oath. Unfortunately, we still didn’t have enough information to know what to ask. All we

Wells4689_c05_1

05/31/2007

47

it’s all in the details

47

had to go on at this point were copies of cancelled checks provided by the bank and the monthly operating reports submitted by Fred. He wanted so very badly to help us, he said, but he just didn’t know anything.
It turned out that Fred was familiar enough with the operating reports to be able to boastfully point out that he had stopped drawing a salary after the first few months of the case. He did this, he said, because the company couldn’t afford him and he wanted it to succeed. Later in the questioning he admitted that the company had been paying large bills for credit cards in his name, but that was only because the company had no credit and
Fred was personally paying for expenditures the company needed. Later still, he admitted that the company had made payments for personal loans taken out by him, but that was only fair since he was not otherwise being compensated for all his efforts on the company’s behalf. There was already enough inconsistency here for the case to get interesting. It’s All in the Details
Back in my office, I had to figure out what to do with three truckloads worth of boxes of batch reports. My initial hunch was that since the salesmen spoke highly of Fred, he probably hadn’t cheated his salespeople out of their commissions. If I compared the sales used to calculate commissions to the sales recorded in the general ledger and in the receivables system, I was bound to find discrepancies that would prove that sales were being diverted. I gave up on this after two weeks; every single item I looked at traced through all the documents just as it should have.
I visited with the bank president who had been unlucky enough to be Gopher’s lender.
He was convinced that Fred had been kiting checks, and gave me more boxes containing
28 months’ worth of bank statements and cancelled checks. Another week of charting and diagramming the ins and outs of the bank account showed that looking for kited checks was also was a dead-end endeavor.
One curious element did pop up from the bank account work, but I didn’t know what it meant or what to do with it: Fred used many different banks for his personal accounts and for the other companies that he controlled. I noticed this when I reviewed deposits into
Gopher’s accounts and from the endorsements on the backs of some of the checks that
Gopher had written to Fred.
Stymied, I turned to the monthly operating reports. All of the activity reported through
Gopher’s main bank tied out to the bank statements. All of the activity reported through
Gopher’s secondary bank also tied out the bank statements. But if everything was tying out, there should have been more cash. It didn’t make sense. I needed to look at the detail behind the reports and accounting batches.
Crawling around under the desks at Gopher’s offices again, I found more boxes of documents in the area where human resources used to work. This was the good stuff: original deposit slips, copies of the checks that customers had remitted, and original remittance advices showing what the customers had paid for.

Wells4689_c05_1

48

05/31/2007

chapter 5

48

what about pete?

What a difference original source documents make. I noticed that in some months, the batch reports that had original source documents attached to them did not trace through to the monthly operating reports. ‘‘How could this be?’’ I wondered, since I had already tied out most of the batch reports. Retracing some of my prior steps made the answer obvious:
There were often two different sets of batch reports for the same transaction.
What happened was that a customer would remit payment to Gopher, the payment would be recorded in the accounting system, and the appropriate batch report would be generated. At a later time, someone would go into the system and change the batch report to be a different date, a different amount, and sometimes even a different customer. But why? Again, the answers were in the details. Actual deposit slips found with the original batch reports showed the existence of eight additional bank accounts in four different names.
None of these was authorized by the bankruptcy court and none was property of Gopher, but all had Gopher’s customer’s checks being deposited in them.
With documentation of Gopher’s money being deposited into non-Gopher accounts, the trustee was now able to subpoena bank records for all of the accounts I had identified and for any other accounts that we knew of that were held by Fred, his wife, his children, or his companies. We now had most of the pieces of the puzzle.
Fred had been diverting customer payments to his own bank accounts and to the bank accounts of companies controlled by him. He even diverted money to a company owned by Fred’s adolescent son. When Gopher needed money, Fred would return some (but not all) of what had been diverted.
For example, when BL Publications, a customer, made a $150,000 payment to Gopher,
Fred had it deposited into one of his unauthorized bank accounts. He might then transfer
$130,000 of this back into Gopher’s bank account. A batch sheet may be prepared showing this deposit as consisting of $115,000 from BL Publications and the remaining $15,000 as having come from three other customers in payment of their invoices.
Later Fred might transfer $20,000 from one of Gopher’s official bank accounts to the other. The transfer going out of one bank account would be correctly accounted for as an intercompany transfer. The deposit into the second account, however, would be accounted for as having been received from BL Publications, thereby clearing more of the amount still showing as open on their account from the original diversion of funds. The result of all this was that Gopher received $130,000 in cash, Fred received $20,000 in cash, and $150,000 of the bankruptcy estate’s accounts receivable were marked as ‘‘paid.’’
These discoveries explained why there was money missing. They also explained why the bank president had suspected kiting: Every time a Gopher check bounced, it had been covered by a deposit from another account. Fred was covering the cash shortages he had created with some of the money he had diverted. It looked like kiting but was entirely different. It was significant that all of the cash diversions went into accounts that only Fred had access to, because this made it clear who was committing the fraud. Many of the batch details attached to original deposits had notes on them from the accounting staff indicating

Wells4689_c05_1

05/31/2007

49

direct deposit

49

where to deposit the money ‘‘per Fred’’ or ‘‘per FM,’’ further sealing the case against him.
Most of these were initialed by Fred himself. He could no longer claim ignorance and noninvolvement with the accounting process, as his initials were on source documents on almost a daily basis.

Direct Deposit
Where was Pete during these daily diversions? His absence was both curious and troubling.
In all the boxes and boxes of documents I reviewed, I never found a diversion of customer money to Pete. I never even found evidence that he had been there. While reviewing
Fred’s personal bank accounts, I found one instance where Pete wrote a personal check to
Fred for $50,000. That check bounced and was never replaced. Why did Pete pay Fred
$50,000? If the money really was owed, why was it never repaid after the check bounced?
These questions gnawed at me.
I interviewed some of Gopher’s vendors, all of whom were furious at being cheated by
Fred. Some of them tipped me off about having some of their bills paid from a bank account in a state 1,600 miles away, which would have been an invaluable clue if I had not already found that that bank was being used. None of them mentioned Pete in any role other than Fred’s stooge.
I also interviewed some of Gopher’s former employees, all of whom were also furious at being cheated by Fred. Some provided sworn affidavits about being directed by Fred to divert Gopher’s receipts to bank accounts that did not belong to the company. They provided more information on the use of the out-of-state bank account. They related rumors of Fred’s exotic European girlfriend, whom I never found any actual evidence of.
But again, nothing about Pete.
I had reviewed the backs of all the cancelled checks written during the bankruptcy process, and had noticed that one of the employees seemed to sign his paychecks with a number of different signatures and used six different banks. He also had twice as many paychecks as he should have had based on the company’s pay cycle. My hypothesis was that
Pete printed up a fake ID and cashed these extra checks, but nothing could be proven.
Even so, it would be a very small fraud compared to how much money was missing, overall.
The dimwitted, clueless Pete Slowinski had managed to slide through this entire train wreck without ruffling anyone’s feathers and without leaving any kind of paper trail.
Almost. He didn’t get away without ruffling his wife.
During an interview with the recently divorced ex-Mrs. Slowinski, she mentioned that her former husband had moved into a very expensive house with his new girlfriend. Oh yes, there was also once a strange call from a bank rejecting one of Gopher’s deposits that had not been properly endorsed. That call from the bank never made sense to her, because
Pete was never involved with Gopher’s finances and she didn’t know anyone who used that bank. Our investigation had not turned up the existence of the new house or of that strange bank account, because they were both in Pete’s girlfriend’s name. When an FBI agent

Wells4689_c05_1

50

05/31/2007

chapter 5

50

what about pete?

assigned to further the investigation reviewed the mortgage application for the house, she found the applicant’s income grossly overstated compared to her payroll records at the debtor. This finding of mortgage fraud was good enough for a subpoena of the girlfriend’s bank records, and that is where we found the money that Pete had diverted.
Fred’s scheme had been to convert money received by the debtor into his own. But Pete was more clever. Rather than invoicing customers for work done by Gopher on the company’s accounting system, Pete had just typed up invoices instructing the customers to pay directly to his own post office box. The sale never appeared in Gopher’s records, and no one ever knew to look for the money.

The Outcome of the Investigation
Two three-inch binders of evidence against Fred were presented to the judge in bankruptcy court. Fred, who began the case professing to know nothing of finance and accounting, convinced the judge that he was able to represent himself due to his background in finance and investments and his daily involvement in the debtor’s affairs. He did a stellar job; by the time he was done, the judge had assessed him with over $5 million of judgments and penalties. The judge also instructed the trustee to have Fred referred back to the justice department for criminal prosecution.
The money Fred took has not all been found. Hundreds of thousands of dollars were traced to family members, and hundreds of thousands more were paid to lawyers as either fees or retainers. I am not aware of any record of large matters that these lawyers handled for
Fred. Client confidentiality rules can make lawyers a good place to park money that needs to be hidden for a while.
The Morgans received an uncontested divorce and agreed to a huge child support settlement so that Fred’s family would have first dibs on whatever money does turn up.
However, since Fred was still living with his wife and family six months after the divorce decree, the divorce is being challenged as a sham. Our theory is that his Italian girlfriend never existed, but was instead a setup if a justification for a quick divorce was needed. Fred filed for personal bankruptcy, but because the judgments against him are fraudrelated, they are not dischargeable. The criminal case is proceeding.
Pete, however, had all his stolen money nicely tied up in one piece of real estate. In addition to the theft from the bankruptcy estate, charges are being prepared against him and his girlfriend for mortgage fraud, money laundering, mail fraud, and wire fraud.
Six different banks had accepted checks made payable to Gopher and allowed them to be deposited into accounts that did not belong to the company. None was properly endorsed. Two banks made the argument that as an officer of the company, Fred had authority to endorse Gopher’s checks, but under bankruptcy procedures, he never had the authority to open undisclosed additional bank accounts. Five of these six banks have made restitution to the bankruptcy estate, and the sixth appears to be headed to litigation with the trustee.

Wells4689_c05_1

05/31/2007

51

lessons learned

51

Lessons Learned
As bad guys, both Fred and Pete had their strong points and their weaknesses. Their strengths were almost enough to get them through their frauds scot-free. Ultimately, though, it was their individual weaknesses that gave them away.
Fred was an arrogant showoff who thought he was smarter than everyone else. Every alter-ego company that he made up had some permutation of his initials as its name. He concocted what he must have considered such a grand scheme that he didn’t feel that he needed to destroy the evidence totally. He smoothly and continuously changed his story as more and more evidence was unpeeled. His final, passionate speech to the bankruptcy judge was that he was so smart that if he had done anything wrong, he would not have left that much evidence lying around. Nobody bought his professions of total ignorance at the beginning of the case, nor did anyone buy his pretense of being too smart to have done what he was accused of at the end of the case.
Pete was the real sleeper. Except for that one $50,000 check that raised my suspicion, he went through this case like a ghost. He didn’t leave a trace. Unlike Fred, he had no need to keep trophies or score cards, so no evidence was left behind. Through most of the case I thought that $50,000 check amounted to Pete giving Fred a percentage of what Fred was allowing him to steal.
In hindsight, my guess is that Pete was trying to hide money from his wife, in anticipation of divorce. If he had just left the money as marital property and allowed his wife to keep half, I never would have thought to interview his wife, there would never have been a chance for her to mention that returned deposit from the bank and the big new house her husband was living in, and the reason to investigate Pete never would have been turned over to the FBI.
In a fraud investigation, you have to follow your hunches. If something feels wrong, it usually is—even if you can’t explain why. A fraud investigator needs to be tenacious in pulling on all those little strings that seem out of place.
Fraud shows up in the flow of details. In this case the summary reports and the accounting entries supporting them were all faked. I would never have found this if I hadn’t taken the investigation all the way back to source documents. If I had started with source documents and merely traced them into the accounting records, I wouldn’t have found the fraud, either, as there were two sets of records: those that were entered from the source documents and those that were made up to support what Fred wanted to show on the operating report. The only way to have found this fraud was to start at one end of the reporting flow and trace all the way through to the other—in this case, from the bankruptcy operating reports all the way back to source documents.
By the time I identified and documented all of Fred’s fraud, I had used up the time allotted for the investigation. Pete almost escaped. I like to think that if there had been more time, I could have started with the original source shipping documents from Federal
Express and traced them through the accounting system to the bankruptcy operating reports, and that would have uncovered Pete’s fraud.

Wells4689_c05_1

52

05/31/2007

chapter 5

52

what about pete?

Looking back at Fred and Pete, at the impressions they created and at the assumptions everybody made about them, I can’t help but be reminded that fraud is deception. When fraud is suspected, nothing can be assumed or taken at face value, because the better the fraud, the easier it is to be deceived. Both people and computer-generated printouts can be very different from what they pretend to be.

Recommendations to Prevent
Future Occurrences
The Problem of Owner-Committed Fraud
At this point in the story, I should be prescribing how to prevent this type of fraud from happening again. Unfortunately, I can’t. Collusion in a company can defeat almost every control, especially when the collusion is among the most senior people.
It is likely that the type of activity described here occurred at Gopher for years. I have seen owners stealing from their own companies time and time again; it is called tax fraud, and unless a taxing authority catches on, there are usually no other victims to complain.
Typically, somebody’s greed is what undoes them. Fraudsters become addicted to the free and easy money, and they take more and more until it becomes a noticeable problem. I have worked on cases of brother against brother, husband against wife, and partner against partner, and in almost every case, both sides were initially in on the fraud. The fraud becomes a problem when one partner takes more than the other partner, and the less egregious party starts a fight for his or her ‘‘fair share’’ of the spoils. The lawsuit that led to
Gopher’s bankruptcy may have been triggered because Fred was taking out more cash than his partner.
Detection
Owner-committed fraud may not be preventable, but it is detectable. This is usually done by conducting either a lifestyle audit or a detailed comparison of the business’s inputs to the reported outputs. The devil is in the details—for example, a laundromat that uses too much water and electricity for the amount of quarters it says it received either has very inefficient machines or an owner walking out with very heavy pockets each night.
Study Bankruptcy Operating Reports Thoroughly
In this case, the fraud could have been detected earlier if the bankruptcy operating reports had been studied more thoroughly. There were printouts from the accounting system to back up every schedule and make them appear accurate, but the reports were not consistent from one schedule to the next. For example, the cash disbursements listed in the disbursement schedule did not equal the total disbursements shown in the bank account summary schedule. Many of the schedules were internally consistent each month but did

Wells4689_c05_1

05/31/2007

53

recommendations to prevent future occurrences

53

not roll forward from month to month. These reports had a wide distribution, but it doesn’t appear that they were adequately focused on by any of the parties who received them until all the money was gone.
The evidence indicates that Fred was a diligent debtor-in-possession during the initial months of Gopher’s bankruptcy. Most likely Fred was establishing credibility with the various parties overseeing the case while he earned a good understanding of how the system worked. These well-behaved months were followed by what looks like two months of experimenting—minor inconsistencies and inconsequential fabrications in the accounting data were submitted with the operating reports, and nobody noticed them.
This probing was followed by a couple more months of low-level cash diversions, always small enough that they could be excused away and returned if detected. They weren’t.
Pay Attention to the Details
In today’s environment of automation, budget cuts, not enough time, and information overload, it is more important than ever to stay focused on the details and always to tug on those little strings of inconsistency that occasionally stick out. One of the best ways to prevent large frauds is to detect them when they are still small frauds.

Michael Goldman, CFE, MBA, CPA, CVA, is principal of Michael Goldman and Associates,
LLC, in Deerfield, Illinois, a practice focusing on fraud, valuation, and insolvency. He is an expert witness and has experience in cases involving fraud, solvency, fairness, commercial damages, marital dissolutions, valuation issues, professional malpractice, and bankruptcy issues.

Wells4689_c06_1

05/31/2007

54

chapter

6

&
Check, Please
PETER PARILLO

very weekday, millions of people wake up at the break of dawn, take a shower, get dressed, and hit the road to the office. Julie Rizzo was no different. She left her apartment at 6:15 every morning to catch the 6:20 express bus from Brooklyn to
Manhattan. Upon arrival to her stop, she walked to the same coffee stand on the corner of
Fifth Avenue and East 45th and ordered her usual breakfast: a large cup of coffee, light and sweet, and a plain bagel with a thin layer of cream cheese. Clutching her breakfast in a brown paper bag, she continued down the street, entered her building, and rode the elevator to the fifth floor. Like clockwork, Julie arrived at the office at 7:00 a.m. sharp.
Sitting at her desk, sipping her coffee and enjoying the bagel, she began her day. She reconciled bank statements, reviewed invoices, checked inventory levels, placed orders, answered the telephone, and wrote checks—the usual.
Julie was gifted in bookkeeping and excelled in the subject in high school. In her senior year, she decided college was not for her, opting instead to work immediately after graduation. Since she lacked any real experience, Julie knew that it would be difficult to find a job, so she decided to ask her uncle Dominick if he needed any assistance with the bookkeeping for his wholesale jewelry business. Because accounting was not his area of expertise, Dominick needed an employee he could trust. The timing was perfect. Both agreed to terms, and soon after Julie graduated, she began working for her uncle as his bookkeeper, a position she held for over a decade.
If you were to meet Julie, you would not see a criminal but rather a normal everyday woman who worked hard to make ends meet. Happily married to her husband for over 15 years and with two children, she had the perfect life—or so it seemed.
Good Gold Wholesale was a small but successful wholesale jewelry business in the heart of Manhattan. Dominick imported the finest gold possible and was a supplier to some well-known retailers. The business grossed approximately $10 million a year and employed eight people full time, ten during the holidays to help with the increased volume of shipments. Of the eight full-time employees, six were family members, including Julie.
The business was very well respected. It had been around for a long time and was considered to be one of the most reliable wholesalers in the jewelry district. Started in the
1960s by Dominick’s father and built on the premise of honest business, it was established back when a handshake was as good as a written contract and profit, though important, was

E

54

Wells4689_c06_1

05/31/2007

55

one mess leads to another

55

second to reputation. Dominick believed in his employees and trusted that they would perform to the best of their ability with honesty and integrity.

One Mess Leads to Another
After graduating from college, I joined a small accounting firm in Manhattan that specialized in write-up work, which offered me diversified business experience. The office was located in Midtown; the view from the twenty-second floor was breathtaking.
Though small, the firm had fairly prestigious clients who enjoyed the personal attention and immediate turnaround that we provided. There were also many smaller clients, including several jewelry wholesalers.
One of my first assignments was Good Gold Wholesale. When I met Dominick for the first time, I noticed that his handshake was firm and solid. He seemed to be an honest businessman. Julie was quiet and hardly spoke unless I asked her a question. It was as if she were analyzing me and the level of skill I possessed. I could tell that she was very smart.
When I performed my duties, Julie was always there to assist me. One particular month, a conflictinmyscheduleoccurredandI wouldhave todomy workforGoodGoldaweekearly.
Julie was on top of things; I felt confident that the information I needed would be available. I called her office and was quickly transferred tovoice mail. Her message stated that she would be out for two weeks and, if the call was urgent, to contact Dominick. When I informed my manager, he remarked that it was strange; she never took more than a dayor two off at a time. I called Dominick to ask if I could come into the office and gather the information I needed.
‘‘Her desk is a mess, but come on in,’’ he replied.
At Good Gold, I was buzzed in through the security door, which slammed shut behind me. Dominick was waiting on the other side. When we reached Julie’s desk, he turned to me and said with a smirk, ‘‘Good luck.’’
Dominick was right. It was a mess. Files and papers were strewn about with several halfempty coffee cups. One of Julie’s cousins was getting married overseas, so Dominick surprised her with tickets to attend the wedding and to stay a few extra days.
Luckily, I knew exactly what information I needed and where to locate it. But as I began my search, I realized it was going to be harder than expected. I decided to organize her desk into files, which I thought Julie would appreciate. As I sifted through the information and labeled the various items using Julie’s pen, I sometimes wrote names incorrectly and would use the eraser on her pen to correct my mistakes. Not thinking much of this, I completed organizing the invoices and began working on the bank statements. I opened an envelope addressed from a bank and several dozen checks fell out. Again I didn’t give it a second thought. As I reviewed the cancelled checks, I noticed two payments to American Express and several other vendors that I did not recognize. As I looked more closely, I noticed in the memo section different credit card numbers, which I presumed meant that Dominick had two accounts. But when I asked him, he responded, ‘‘No, why would I want to do that?
Keeping track of one card is hard enough.’’ At that point I did not tell him what I had found, deciding it would be better to conduct more research first.

Wells4689_c06_1

56

05/31/2007

chapter 6

56

check, please

Some Slight Alterations
As I gathered information from Julie’s desk and loaded my briefcase with folders, I tried to convince myself that there was a logical explanation. I was just overreacting. Julie was a wife and a mother of two children. Why would she steal from her own uncle? I glanced at the calendar. I had four days to figure it out.
When I returned to my office, I went directly to the copy room. After making copies of all of the documents I’d obtained from Julie’s desk, I began analyzing the information, starting with the invoices. There were the obvious payments for gas, electric, insurance, shipping, and professional fees. In addition, there were a few miscellaneous items, such as plastic bags used for shipping and inventory. Everything appeared to be in order.
I then turned my attention to the bank statements and the cancelled checks. Over 30 had been written. There was something strange about the American Express checks, so I put them aside to analyze the remaining ones. Some of the vendors I immediately recognized—they were catalog companies that sold home accessories. I thought that perhaps Dominick ordered something. Just in case, I added this to my list of questions for him. I continued reviewing the remaining checks and noticed there were two payments each for telephone and electric expenses. Additionally, there were two different account numbers written in the memo section of the checks to the telephone company.
I put together the invoices paid for the month and pulled out the telephone records.
The account matched one of the checks, and it had been paid in full. I called the customer service number and waited patiently as music played.
‘‘Hello, my name is Tracy. May I please have your account number?’’
I began to stutter and fumble for the check as she repeated, ‘‘Account number please.’’ I read the numbers off the bottom of the check.
‘‘Hello, Mr. Miller, how can I assist with your account today?’’ she asked.
I replied, ‘‘I wanted to see what address you have on file. For some reason the invoices seem to be arriving later and later every month.’’
‘‘I’m looking at your account and don’t see that you ever paid late,’’ the representative said, ‘‘Could it be that you have a new mail carrier?’’
‘‘Maybe,’’ I replied, ‘‘but I don’t see the mail carrier, so I am not certain.’’
I began thinking of past conversations I had with Julie when we talked about us both growing up in Brooklyn. I recalled her mentioning that she lived on Benson Avenue.
I asked the representative, ‘‘You do have the correct address? Benson Avenue, right?’’
The representative tapped on her keyboard before she said, ‘‘That is right, 2551 Benson
Avenue.’’ After I hung up, I knew that this was going to be a sensitive issue, and if I was to prove what Julie was doing, I had to gather as much evidence as possible.
I began listing all of the checks in Excel and documenting the check numbers, payees, amounts, information in the memo sections, and corresponding invoice numbers. I highlighted checks in question and made copies of all the checks and invoices, which I saved to my hard drive. With only four days to build my case, I had to go back to Good
Gold. Placing the original documentation and the copies in my briefcase, I headed out the

Wells4689_c06_1

05/31/2007

57

some slight alterations

57

door. As I walked into the store, I began to think about what I was going to tell Dominick. I knew that I couldn’t reveal too much before I had a strong case. Again the door slammed behind me. I knew that if I continued down this path and was wrong, there was a good chance I would be fired. When Dominick walked by, I told him I had missed some of the documents I needed when I was there earlier and asked him if he knew where Julie kept them. He replied, ‘‘You can check her desk drawers. I don’t bother looking for anything there anymore. I needed a pen one time and used one of hers, but she insists on using those damn erasable ones and they always smudge. Feel free to go through her desk. If you clean it up, you will be doing her a favor.’’
I sat down at Julie’s desk and started opening up the drawers. In the first one, I found personal items: a pair of dress shoes, hair products, and various magazines. As I took them out, I noticed that some of the names of the magazines matched the names on the checks.
After I emptied the majority of the drawers, I saw several folders in the back and discovered one of the most important pieces of the puzzle: blank invoices. They represented various vendors: office supplies, repairs, cleaning, messenger services, and pest control. For the first time, the evidence started to take shape.
Unfortunately, there was only seven months of activity available. Dominick kept documentation in the office and placed all prior years in storage. I listed the vendors by group and noted the amounts paid for each. I was surprised to find that over the past seven months, Julie may have stolen $32,000. I wondered how long this had been going on. As I placed the information in my briefcase, I knew I would have to inform my manager. I told
Dominick that I was heading home and asked if he would be available the next day for a meeting.
‘‘Sure, I guess. What’s up?’’ he inquired. I told him that I might have some questions about some transactions, but I needed to do some more research first. The next morning I caught the early train into Manhattan. The office was still empty when I arrived at six o’clock. After flipping the lights on and making a fresh pot of coffee, I printed multiple copies of the information and waited for my manager, Rob. When he arrived, I told him that we had an issue with Good Gold. He called Lori, a senior partner with experience in fraud investigations, to review the information I put together. I explained to her that after receiving the cancelled checks from the bank, Julie would erase the names and replace them with fictitious vendors. Lori recommended that the next step was to formulate a plan to interview Julie. I then suggested to Lori that since we had copies of the checks before
Julie altered them, all we had to do was to allow her to make the changes and obtain the altered checks afterward. Then we would have all the necessary evidence.
‘‘That’s a great idea. We just have to make certain that Dominick is on board with it.’’
Lori said. I called Dominick and asked him to come to our office. When he arrived, I escorted him to the conference room. After taking our seats, Lori began, ‘‘Dominick, we have discovered some suspicious activity that you should be aware of. Peter will explain to you what he has found, and if you have any questions, we will do our best to answer them.’’
I began explaining what I had discovered and supported my findings with copies of the documents. Dominick, shocked, asked, ‘‘What do I do now? Do I fire her?’’
‘‘No,’’ Lori stated. ‘‘We want you to do nothing right now.’’

Wells4689_c06_1

58

05/31/2007

chapter 6

58

check, please

‘‘Nothing?!’’ he screamed. ‘‘How do you expect me to do nothing?’’
I then told Dominick we expected that when Julie returned to work on Monday, she would alter the checks and we would be able to confront her. Though reluctant, he finally agreed. The next step was for me to go back to Good Gold and put all of the information back in its original place. That was going to be easy; Julie’s desk was a mess. Then we only had to wait for her return.

The Truth Comes Out
I woke up Monday morning later than I wanted to. It took a few seconds for my eyes to focus on the time. Then it hit me: 7:30! I jumped out of bed and quickly put on my suit. I was able to catch the next train for the city and make it into the office shortly before 9:00.
After I grabbed a cup of coffee and settled in, I called Julie.
As the phone rang, I heard, ‘‘Good Gold, can I help you?’’ It was Julie. I asked her about her vacation, and we chatted a bit before I proposed coming in on Thursday and Friday.
Julie hesitated but said, ‘‘Sure, that will be fine. I may have to work a little late, but I should be done by Thursday.’’ I told her I’d see her then and felt relieved as I hung up the phone.
The plan was in motion.
On Wednesday, I met with Lori and Rob. Lori was direct with her instructions. ‘‘All you have to do is go in as planned and obtain the checks and invoices. After you confirm that the checks were altered, call me and I will come to Good Gold with Rob to ask Julie some questions.’’ That night, as I made my way home, I was thinking of what would happen to Julie. Her uncle had every right to press charges. But would he have the courage to have his niece arrested and possibly cause major turmoil in the family? It was late and
I had to get some sleep. In a few hours all of my questions would be answered.
The next morning I woke up greeted by a gust of cold air. Finally I reached the building where Good Gold was located. As I rang the bell, Julie quickly let me in. ‘‘Here you go— all the information you need.’’ She pointed to a desk that was approximately 10 feet from hers. Perfect, I thought. But how was I going to look through the information and call the office without her overhearing me? This was going to be a challenge. As I sifted through the documents, I noticed the invoices Julie created. I then looked through the cancelled checks. As expected, they were altered. I needed to call Lori, but how? A few minutes later,
Julie went to the restroom. I seized the opportunity to phone Lori, but was transferred into voice mail. I left her a message. After an hour or so, I finally heard the doorbell. It was Lori and Rob. Julie, surprised to see them, asked, ‘‘How are you two doing? I guess they’re bringing out the big guns for us.’’
Lori responded, ‘‘Hi, Julie, we’re here to see Dominick to discuss tax options. He’s expecting us. We know where he is, so we’ll just go back there and see if he is ready.’’
In a few moments I heard Dominick’s voice: ‘‘Julie and Peter, can you both come in here? You two should be part of this meeting.’’ I looked at Julie and shrugged my shoulders, playing it off as if I did not know what was going on. Julie walked ahead of me as I gathered the necessary information: the original checks, altered checks, blank invoices, and false invoices she had created.

Wells4689_c06_1

05/31/2007

59

lessons learned

59

After we entered Dominick’s office, I shut the door behind us and took a seat at the conference table across from Julie. Lori looked at her and said, ‘‘Julie, Peter was here last week and discovered that you have been altering checks and creating false vendors for your personal benefit.’’
Julie interrupted: ‘‘But I didn’t do anything.’’
Lori cut her off. ‘‘Before you say anything that will harm you further, I suggest that you listen to Peter.’’ I explained to Julie what I had found. I informed her that I knew about the fake vendors, the blank invoices and multiple payments. Julie glanced at the information.
Then she looked around the room, as if trying to think of an explanation. Realizing that she was trying to conjure up a story that would somehow make sense, I told her, ‘‘Julie, I have copies of the checks.’’
She looked at me briefly and then averted her eyes. This time I was more precise. ‘‘Julie,
I have copies of the checks. I know you altered them.’’ Julie’s facial expression changed. Her eyes swelled up and she began to cry, knowing that that she was caught. Then Dominick started crying. I guess it was difficult for him to accept that his own niece would steal from him. He turned to Julie and said, ‘‘I want you to tell us everything: when you first started and how you did this. Then we need to see how we will fix this mess.’’
Over the next few hours, Julie said that she first started stealing a few years back by paying for a personal magazine subscription. She explained, ‘‘As long as the lights were kept on and no one called for payment, Dominick assumed that all was well. I realized that it was easy to buy things for myself.’’
Julie created over 50 different fake vendors, ordering the forms from the printer. Since the invoices were blank, she would type them up using the typewriter by her desk. To avoid being noticed, Julie would come in early or work quickly when Dominick left the office. After she finished explaining all of the details, Dominick asked the last question, ‘‘How much did you take from me?’’ Julie looked down at her lap and said, ‘‘I’m not sure; about $300,000.’’
Over the past 10-plus years Julie was able to steal hundreds of thousand of dollars. Dominick then turned to Lori and asked what he should do. Lori discussed all of the options, one of which was to press charges. Dominick shook his head no and then said, ‘‘I have a better idea. Julie will continue to work here at half of her salary until the debt is paid off. Since you know what to look for, I would hope Julie would not go back to her bad ways. If you find that she does, I will have no choice but to have her arrested.’’ Everyone was surprised, especially Julie. She began to cry again and hugged her uncle. As I packed up, Dominick pulled Lori and me aside and said,
‘‘You did well. From now on I want Peter to do the work, nobody else.’’ Lori smiled and replied, ‘‘Dominick, I’ll call you in the morning. We have a lot to talk about. We need to discuss computer-based general ledger programs.’’ He rolled his eyes. ‘‘Great, more money to spend.’’
Lori and I looked at him. Dominick said, ‘‘I know, I know, this is for the best.’’

Lessons Learned
After this investigation, I realized that being a family member does not eliminate the temptation to steal. It does, however, provide a false sense of security to business owners who wrongfully assume that their relatives are always honest and trustworthy.

Wells4689_c06_1

60

05/31/2007

chapter 6

60

check, please

Dominick learned the hard way that he must be actively involved in all aspects of his business. Soon after the meeting with Julie, he installed a computer system and a tailored general ledger program. In addition, he revoked his niece’s check-signing rights and submitted a new signature card to the bank.

Recommendations to Prevent
Future Occurrences
Computer-Based Ledger System
Utilizing a computer-based general ledger system allows multiple preventive actions to be implemented. There are many inexpensive prepackaged general ledger programs out there for small businesses. Dominick decided to go with a tailored system, and we were able to implement these systems:
 Access controls to prevent the addition of new vendors (to deter fictitious expenses) and customers (to deter fictitious refunds). Only Dominick had the ability to add new vendors and customers.
 Edit reports to highlight any changes to vendor or customer information.
 Monthly sign-off of journal entries and check runs. Dominick became very involved with the financial side of his business, reviewing information thoroughly.
 Implementation of purchase orders and establishment of limits so excess merchandise was not purchased.
 Ratio analysis. This is an easy and cost-effective way to allow tracking trends to isolate peaks and valleys and inquire to why they occurred.
 Monthly inventory counts. Dominick insisted that a live inventory count be performed at the end of every month. In addition, on several occasions, a ‘‘surprise’’ inventory count was conducted.
 Computer-generated checks. After implementation of the computer system,
Dominick threw out the typewriter and copier and invested in an all-in-one unit that had the ability to print checks. This allowed for additional control when using prenumbered check stock that Dominick kept locked away in his office.
 Check-signing authority. Dominick removed Julie from the signature card and is now the only person authorized to sign checks.

Peter Parillo, CFE, CPA, CBM, is an internal audit director for Vonage Holdings Corp., in
Holmdel, New Jersey. Mr. Parillo graduated from the College of Staten Island and has over 10 years of experience in conducting fraud investigations. He resides in Freehold,
New Jersey, with his wife, Lori, and his two children, Victoria and Peter.

Wells4689_c07_1

05/31/2007

61

chapter

7

&
The MoJo Skim Twins
JOHN F. KRONICK

o look at them, you’d swear Maureen ‘‘Mo’’ Frugali and Joann ‘‘Jo’’ Brennan were sisters, maybe even twins. Both were in their early 50s. Each had the same flat, unkempt hairdo. They were short and pudgy, making them waddle when they walked.
Their frumpy, wrinkled clothes looked more like nightgowns than dresses.
Mo and Jo were peas from the same pod. The two were raised a few miles apart in a bluecollar area of New Jersey. Their stories were remarkably similar. Life was not easy for their families, struggling to make ends meet in a rapidly expanding economy with high inflation. They pinched every penny to make sure there was enough money for rent, food, and utilities. Mo’s father was a metalworker, her mother, a homemaker trying to raise four children. Jo’s parents divorced when she was 14, and she lived mostly with her two sisters and her mother, a part-time middle school teacher. Her father worked as an electrician in
New York City and was always away, even before the divorce. Through their teen years,
Mo and Jo took on many babysitting jobs to help their parents pay bills and have a little spending money.
Neither girl enjoyed studying. In fact, both barely graduated from high school. Their people skills eventually landed them jobs at doctors’ offices as receptionists and ultimately bookkeeper and administrative assistant positions, handling claim submissions. It was through their jobs that they met. Jo called Mo to request a patient’s records and they struck up a conversation. One thing led to another, and the two decided to meet for lunch. They had so much in common; they wanted to trade childhood stories. Mo asked
Jo over for a visit, and from that time forward, the two women were nearly inseparable.
Over the next two years, Mo and Jo did just about everything together. Soon Mo married
Bob, and Jo married Marvin; unfortunately neither marriage was very fulfilling.
After three years in the same position with no advancement or significant pay increases,
Mo realized that work in the doctor’s office was going nowhere. She dreamed of earning more money and moving up. One day she noticed a help-wanted ad for Colossal
Healthcare, the biggest in the state. The company was looking for claims payment clerks, which was right up Mo’s alley. She had spent the last three years coding payment forms and submitting them to Colossal for the doctor’s office. She was excited to have a skill that could command a high hourly pay rate. She applied, interviewed, and was hired.

T

61

Wells4689_c07_1

62

05/31/2007

chapter 7

62

the mojo skim twins

Mo got into the rhythm of the claim processing routine, learned the business cycle, and soon realized that the volume was rapidly increasing. Management promoted Mo to claims supervisor and promised her more help. No sooner had Mo settled into her new position than she asked Jo to join her at Colossal. Jo didn’t have to think twice. She applied and was hired within a few days. The MoJo twins were on their way.
Mo and Jo slowly climbed the Colossal corporate ladder, occasionally taking a leave of absence to have a baby. With work and child rearing, there was little time to enjoy life.
Neither woman liked parenting, as they were preoccupied with having enough money to pay their family bills. Neither husband brought home much money, and living in the New
York City area was expensive. Between child care and commuting expenses, there was barely enough for a night out on the town.
Meanwhile, Mo and Jo became masters in the art of claim processing. The work continued to pile up, and additional help was always scarce. Colossal management decided it was time to rethink the staffing issue and sought to create a training group that could produce an efficient, effective claims processing team in a fraction of the time that it normally took. Their choice to head up such a training group was obvious—Mo and Jo. So began the MoJo training force.
As Mo and Jo worked with the company’s real-time claims processing systems, they became experts in identifying shortcuts. They learned how to manipulate the system to eliminate bottlenecks and speed up claim payments. While in a training session one day,
Mo remarked to Jo that they could probably create and pay claims without the company ever knowing about it. She explained that training claims were processed along with real ones. The checks on training claims were reversed out of the production systems to arrive at actual claim processing totals for the day.
‘‘Whoa,’’ Mo exclaimed. ‘‘The company wouldn’t even know what the real payment amounts were, since no one ever reconciled the totals.’’
In her 15 years with Colossal, Mo said she’d never seen the company auditors review the claim processing details; rather, they derived the real claims totals by subtracting the training totals she provided. It sure would be nice to take home some of that money. Jo imagined what she would do with hundreds, if not thousands, of training claims dollars. ‘‘It might be fun to test the auditors to see if they can catch a bogus claim and check,’’ Jo speculated. ‘‘It would make us look good if we could show that we know the systems so well that we can identify weaknesses,’’ Mo added. ‘‘Maybe they’d even give us a raise if we were successful.’’
‘‘Okay, let’s try,’’ Jo agreed, and at it they went.

The Bigger They Are . . .
Colossal Healthcare, headquartered in New York City, was one of the nation’s largest nonprofit health claims processor. In business for nearly 50 years, with offices in several other cities in the Empire State, Colossal prided itself on its size and stature in the health care industry. With its impressive, large computerized claims processing operations and

Wells4689_c07_1

05/31/2007

63

fake ids

63

state-of-the-art systems, the 1970s were good years for Colossal. The company attracted the best and brightest systems developers, accountants, auditors, and claims processors, as well as the most stalwart of customer companies, including many from the Fortune 1000.
Over several decades, health care rates had increased somewhere in the range of 800% from the 1960s. State legislators were unwilling to approve further rate hikes for Colossal until its management could prove that it was successful in scaling back its bloated costs.
Colossal was ordered to change its external audit firm and institute self-review and operational practices that would identify and eliminate fraud, waste, and inefficiencies in the company. The new auditing firm produced a management report disclosing many operational deficiencies and management lapses. As a result, a major reorganization was mandated, a new chief executive and board were established, and new processes were instituted. One of those included development of auditing practices using the existing information technology audit (IT audit) group to assist the regulatory internal auditors to detect fraud. The legislature determined that Colossal should be able to uncover fraudulent claims to the tune of at least 1% or 2% of total payments, which would be within the industry levels. With claims exceeding $7 billion per year, the legislature expected that at least $70 million in fraud should be detected and recovered. As the acting director of IT audit, I knew this was going to challenge my skills to develop innovative fraud detection techniques. The staff consisted of only seven auditors; we were already stretched to the limit, and now there was the added burden of aiding the regulatory auditors in fraud detection duties.

Fake IDs
No sooner had the fraud investigation mandate come down than I was called into a meeting with the other audit directors to discuss the extent of our involvement. Colossal’s senior management was taking a radical approach by turning everything upside down to determine whether there was any underlying fraud. Such measures included group credentialing, physician certification and validation, contract review, and ultimately claim examination. This was no small effort, as there were well over 15,000 groups, 5,000 physicians, 10,000 contracts, and 14 million claims.
A special group of regulatory auditors began the process when my team was called to assist in validating physician names in the database. In addition, we were asked to initiate an automated process to uncover claims fraud. With two of my staff, I constructed a highlevel plan and timeline for claim fraud discovery.
‘‘Where do we begin?’’ I asked. ‘‘What would be the most obvious type of claim fraud?’’
We could, I surmised, divide up claims by groups, physicians, hospitals, types of claims, and the like. We decided to start simple. ‘‘Let’s write a program to identify a very basic fraud search,’’ I said. ‘‘We’ll check medical claims for the masculine sex to see if any male has received a hysterectomy procedure. That would clearly be a fraud.’’ We wrote a routine to cover all hysterectomy claims for a six-month period, sorting by sex and extracting any male claims results. BINGO! A total of five claims printed out, and one of the patients was a

Wells4689_c07_1

64

05/31/2007

chapter 7

64

the mojo skim twins

five-year-old boy. We had our very first potential fraud audit result. I instructed my team to research the five claims to verify that the sex was not a coding mistake. Within 30 minutes, my staff came back, laughing about what we had found. It seems payments had been issued on that young boy who had received, over the past two years, not one but two hysterectomies. Additionally, two of the claims were processed using deceased physicians to authorize them, and one was paid to a post office (PO) box address, even though
Colossal’s system did not allow that. This last payment stood out. How did that claim slip by and get paid? We needed to solve the mystery.
After a weeklong investigation, a top technical staff member, Jack Greer, came to discuss the PO box payment with me. He had traced the check from payout back through the origination process and had run into a problem. The claim had been authorized by a supervisor whose identification (ID) was temporary on our mainframe customer information control system (CICS). In other words, someone had set up the impermanent
ID (Claire37) to authorize and pay this claim. Since the CICS was a ‘‘real-time’’ system with no existing audit logs, it was virtually impossible to determine exactly who had initiated it. However, one thing was clear: The ID belonged to someone in Colossal who had supervisory capabilities and privileged access to our systems. Our investigation identified several other fraudulent claims that Claire37 had authorized, and showed that they had indeed been paid. We also discovered that someone had first created a temporary
ID in order to then create the Claire37 ID, both of whom were still unknown.

Mum’s the Word
I could see from our initial work that we would probably uncover much more fraud than we had anticipated. I instructed my staff to keep the current investigation under wraps and disclose no details to anyone without my permission. I also met with the director of regulatory audit to discuss our findings. If my initial suppositions were correct, we might have a major internal fraud ring on our hands, and I wanted everyone working together to resolve this case and preserve evidence in the event we needed to prosecute. We did not know whether the perpetrators were internal or external, hackers, or disgruntled employees. Working round the clock, the IT audit staff gathered all CICS temporary IDs and records of claims processed by them over the past six months. We sorted by agent and further organized them by those that had authorized claims payments to PO boxes. It would take an intentional act by an employee in a supervisory capacity to manipulate the system to pay a claim to a PO box address. What we hadn’t yet figured out was where the manipulation had occurred and why these claims weren’t flagged for review. We narrowed the search to an inside job; we knew we had to find someone who had access to the systems, could initiate claim agent IDs, and could change authorized payment addresses.
To understand how the CICS system worked and how claims were paid, Jack, Bill
Taylor, the manager of regulatory audit, and I called for a meeting with the head of the training section, Mo Frugali, who had also invited her right-hand staff person, Jo Brennan.

Wells4689_c07_1

05/31/2007

65

mum’s the word

65

Mo immediately asked why we were digging into the matter. To protect our real goals, I told them that we were reviewing changes in systems as part of an audit, and we needed their help to understand the online claims processing system. My explanation didn’t put either of the women at ease. The atmosphere was tense, and we noted the women provided almost monosyllabic answers.
‘‘Can a claims agent change claims IDs?’’ I asked.
‘‘No,’’ said Mo.
‘‘Can a claims agent change payment addresses on a claim once it is ready for payment?’’
I asked more forcefully.
‘‘No,’’ chimed Mo and Jo, almost in unison.
‘‘Who can create processing IDs?’’ I asked.
‘‘Only authorized claims agents and supervisors can access accounts in the CICS production regions, and they are set up by the security administration group in the CICS operations center,’’ Mo informed us.
At a loss as to how we could acquire more information from them, I looked directly at
Mo and then Jo, and asked, ‘‘You both have claims agent supervisor authority in the CICS training region, right?’’ Both of the women were startled by and unprepared for this question. ‘‘Yes,’’ Mo said hesitantly. Jo looked at her. ‘‘But that’s the CICS test region, not the production region.’’
‘‘How many trainers have CICS IDs?’’ I asked.
‘‘Ten, maybe twelve,’’ Jo replied.
‘‘And can a trainer create temporary IDs? Or create another to process test claims?’’ Jack asked, following my lead.
‘‘In the CICS test environment, yes,’’ Mo stated.
‘‘What about in the production region?’’ I inquired.
‘‘Huh? No,’’ Mo sheepishly responded.
‘‘Are you called upon to resolve processing problems in the course of the day? You know, when the normal processors can’t solve a problem? Don’t you provide that type of production assistance?’’ I asked.
‘‘Umm, well, yes,’’ Mo replied. It was both frustrating and exciting to know that we were on the trail of uncovering this mystery, and it seemed that Mo and Jo were dragging down the investigation.
‘‘Well,’’ Jack began, ‘‘don’t you log onto the systems with production IDs and try to fix claims that are stuck in the processing stream? Isn’t that what people call you for during the day, aside from training?’’
‘‘We try to help process problem claims,’’ Jo replied, without providing details.
‘‘And what IDs do you use when you do that?’’ I asked.
‘‘Well,’’ Mo replied, ‘‘there are around twelve people that get called for these issues. We use our initial log-on IDs, and then CICS prompts us for our agent
IDs. Then the claim is fixed and forwarded real-time for final disposition and/or payment.’’ Wells4689_c07_1

66

05/31/2007

chapter 7

66

the mojo skim twins

We were still clueless. We were looking for a smoking gun, but so far, we hadn’t even figured out how claims IDs could be created and deleted without a trace. I was sure that Mo and Jo could provide insight into that matter. I was frustrated by the fact that they were far from helpful—and even a bit of a stumbling block. Bill approached me after the meeting and asked to speak to me privately.
‘‘Did you see the way Mo and Jo acted in the interview? Did you watch their facial expressions and eye contact during the questioning?’’ he asked.
‘‘Not really. I was more interested in following the trail of the questions, and trying to figure out the logic,’’ I replied.
‘‘Well, I study people as part of my job, and I would stake my reputation on the fact that those two were hiding something. Their answers were not straightforward or forthcoming. They were nervous and avoided eye contact. That’s a dead giveaway,’’ Bill insisted.
‘‘I guarantee this: If they are in cahoots, they will get caught because of their greed. It’s human nature to keep doing what you’ve been doing as long as you’re not caught.’’ The more you get away with something, the more you think you’re invincible. The fact that you weren’t able to catch Mo or Jo in anything just serves to embolden them to continue.
Mark my words.’’
‘‘Let’s start with their processing IDs and check to see what claims they processed over the last six months,’’ I said.
‘‘I’m going to do a background check on those two. See where they live, and how they live,’’ Bill concluded.
When Bill left, Jack was waiting to see me. I could tell he was excited—and on to something good. ‘‘I think I figured out how those claims IDs are being created and deleted without a trace. I had systems administration turn on CICS logging over the past week, and we watched claims IDs and followed any that were created in that time. We particularly focused on claims touched by the training supervisors,’’ Jack said, almost unable to contain himself. ‘‘Well, don’t leave me hanging. What did you find out?’’ I asked, almost ready to choke him for the information.
‘‘Apparently we have a number of matches on claims IDs that were created to process bogus claims and then deleted. And those were created by Mo and deleted by Jo.’’ Jack beamed. I could hardly believe it. Mo had been with the company for some 20 years, and
Jo for just a little less. They were Colossal’s star trainers. How could this be happening?
‘‘Show me what you’ve got,’’ I told Jack, hoping that he could positively identify how these fraudulent claims were being processed.
‘‘It gets interesting,’’ said Jack. ‘‘Remember, Mo and Jo know our systems inside and out. They can do virtually anything on them. Management has trusted them to self-police their activities. So they used their imagination to play the system. Apparently, a claim agent training supervisor creates a training ID, which is modified to allow it to process CICS production transactions. Only a claims supervisor has the capability to override the training nature of those IDs, which are used to create a claim that is either a training account or a real subscriber that is pending closure for nonpayment of premium, is inactive

Wells4689_c07_1

05/31/2007

67

mum’s the word

67

or the subscriber status is deceased, but the account has not yet been coded. Now, it gets better.’’ Jack chuckled.
‘‘I worked with Bill to set up a sting operation,’’ he continued. ‘‘We noticed that some of the payments to PO boxes were cashed by the same person even though the box numbers were different. But Bill was one step ahead of them. He put people on surveillance at the post offices with the help of the U.S. Postal Inspection Service. Sure enough, one of the perpetrators came by and picked up one of the payments and was followed to the bank. As soon as that person cashed the check, he was apprehended, with the help of the local police department. Fearing the worst, he began to spill his guts, incriminating our two star trainers.’’ ‘‘Now that we know how they are executing some of the fraud, can we prove it? And is the dollar amount high enough to get the local district attorney to prosecute?’’ I asked.
‘‘No problem,’’ Jack replied. ‘‘We have traced this back for the last ten years, and by our calculations, these two have stolen over $11 million.’’
‘‘Yikes!’’ I replied, startled that it had been going on for so long. ‘‘What can we prove?’’
‘‘Well, that’s the bad part. We can only prove about $285,000 in fraudulent claims over the last six months,’’ Jack said. I told him to round up the records, put them in chronological order, and start re-creating the scenario for law enforcement. In the meantime, I called Bill, and we arranged to meet first with Mo and then with Jo. I called
Mo and told her that we needed a few minutes of her time to check a claim ID, and she hesitantly agreed.
Mo maintained a poker face throughout the questioning. She offered no confession and no corroboration. Mo, Bill, and I listened to Jack recite the scheme. Bill informed Mo that her fellow cohort who had cashed the checks had been arrested earlier that day. Mo showed little emotion. ‘‘You can’t prove anything,’’ she replied.
We began to disclose the real evidence, linking her ID to several of the bogus claims, and proving by both log-in and building access records that she was indeed the real culprit. I could see the panic in her eyes, but she offered no details. Then Bill presented some more information. Apparently, Mo was living high on the hog, having just bought a new home in a wealthy suburb of New Jersey, and was putting in a $50,000 in-ground pool, all on a modest salary. New cars, extravagant vacations, and other trappings of wealth were all disclosed in the meeting; Bill had been thorough. Mo was shocked at how much information we had gathered, but still she would not confess. Finally, we told her the jig was up; unless she agreed to play ball with us, she was going to be arrested and taken to jail.
Bill even reminded her that she would lose her retirement benefits if she was terminated for cause and prosecuted. Mo was unmoved. True to our word, we had already contacted the police and filed the necessary charges beforehand, and a policeman was standing outside.
Since Mo would not cooperate, we brought in the officer, and she was led off the premises in handcuffs and taken to jail.
Jo was another story. Having kept the pair isolated, we brought Jo into another room where other regulatory auditors and human resource personnel interviewed her, disclosing the volumes of data documenting the fraud scheme. Jo panicked. Like Mo,

Wells4689_c07_1

68

05/31/2007

chapter 7

68

the mojo skim twins

she too was in danger of losing her retirement benefits and receiving a jail term if convicted. Bill came into the room and tried to coax her to reveal her fraud activities. She admitted that she had done some wrong deeds, but she would not confess to specific fraudulent transactions. Perhaps she and Mo had previously discussed the issue. Maybe they believed that even if they were caught, the sophistication of their crime would be over the heads of any jury members and they would not be convicted. In any event, Jo was arrested on site and led from the premises in handcuffs.

Colossal Fraud Deserves a Like Punishment
Mo and Jo were able to post bail the very next day and were out on the street looking for their next job. Mo, pending her trial, landed work at a competitor’s health care claims processing company. We could not do a thing about it since privacy and hiring laws prohibited us from giving a bad reference or disclosing pending litigation. In the end, though, prosecution was successful, and both women were convicted of the fraud, spent some time in prison, and paid restitution. While it was not the full $11 million we believe they stole, at least they were branded as felons and probably will not have the opportunity to commit this kind of scheme again. But I remind myself what Bill told me: People will keep committing crimes until they get caught. And history tells us that people repeat their past, mistakes and all. Unless companies wise up, these kinds of frauds will continue to occur, costing all of us in the end.

Lessons Learned
While implementing the fraud detection program, I learned that no one was above reproach. We found that employees, doctors, hospitals, customers, subscribers, groups, and companies had all been involved in fraudulent claim activities. It’s enough to make your head swim. It did, however, help us to convince management to implement sweeping changes in claims processing, monitoring, and auditing. The before-and-after picture of
Colossal’s stance on data integrity and security was astounding.
The MoJo scheme reminded me there can always be a bad apple in the barrel, but it’s not always possible to pick it out before it affects everyone. Colossal needed more audits, controls, and other fraud countermeasures. There were no system checks to make up for the shortfall, and systems, being neutral, were at the mercy of corrupt individuals.
Was Colossal any different from other health care claims companies? No, it was just bigger. Unfortunately for management, it was a game of catch-up to try to stop the hemorrhaging of claim fraud dollars with an already overworked audit and control staff— one that was not up to the challenge technically.
As Lord Acton first uttered, ‘‘Power corrupts, and absolute power corrupts absolutely.’’
So, too, absolute power that has no checks and balances, no controls or accountability, is certain to run amuck. Mo and Jo, as the star trainers, should not have been able to move

Wells4689_c07_1

05/31/2007

69

recommendations to prevent future occurrences

69

from the training environment into production without strong audit controls and supervisory review. Colossal learned the hard way, but many other companies may still be relying on a key set of employees who have inappropriate authority and unbridled power to execute transactions. Such authority, it is assumed, is provided with complete trust that employees will do the right thing all the time. We all know that is a foolish notion. Colossal proved this point.
It took multimillion-dollar fraud schemes and state legislature mandates to force
Colossal to rethink its strategy regarding audits and proactive controls. Based on our early efforts at automated fraud detection, a new breed of software was developed in the health care industry to assist companies.
Colossal hired fresh management and members of the board of directors to revamp its systems, replaced its external auditing firm, and also brought in specialized consultants to help management implement a state-of-the-art fraud management and reporting system.
Significant resources were added to the audit and control functions. Colossal was forever changed. Recommendations to Prevent
Future Occurrences
This fraud was a wake-up call for Colossal management. What they learned and what they chose to do about it were impressive. Here are some of the ways that the company chose to remediate the fraud problem.
Fraud Awareness
Colossal changed its posture about fraud. Instead of denying it exists, management decided to identify it as an ever-present danger and implemented employee awareness and training programs to identify and report fraud.
Fraud Prevention Hotline
Colossal instituted a toll-free number to encourage customers, employees, subscribers, and anyone else who is aware of a health care fraud to call and report it. Colossal provides identity concealment to those who request it.
Audit and Control
The company updated its audit routines to include annual fraud audit detection programs from certified bodies, and requires all current and future audit personnel to complete training and execute fraud examinations. Colossal requires claim agent ID quarterly audits based on sample selection. Real-time claim agent ID creation is prohibited, and independent oversight of them is instituted.

Wells4689_c07_1

70

05/31/2007

chapter 7

70

the mojo skim twins

Background Checks
Colossal requires background screenings prior to hiring employees in sensitive areas.
Segregation of Duties: Production versus Training and Development
Colossal was a textbook case where monitoring for effective segregation of duties was defective or nonexistent. Colossal implemented tough new measures to prevent training and development personnel from performing production functions. Audit routines were added to ensure compliance.
Quarterly Recertification of Key or Privileged Systems Users
Colossal also implemented quarterly reviews of key systems and requires management recertification of all system user functions and entitlements.

John F. Kronick, CPA, CISA, CISSP-ISSAP, ISSMP, CISM, CITP, PMP, is director,
Information Security, at Citigroup, N.A. in New York. He has over 25 years of professional experience, 14 of which have been in information security, fraud audit and risk assurance services, health care, and consumer services sectors. He holds an MBA from the University of South Dakota and a BSBA in Accounting/Finance from Phillips
University.

Wells4689_c08_1

05/31/2007

71

chapter

8

&
The Mole
MANUEL PEREIRA

om Grey had four years of banking experience when he joined our financial institution. He worked closely with our customers, handling their most confidential information. Some described him as a loner who was constantly trying to figure out a way to make big money. Others knew him as a playboy who repeatedly ended romantic relationships with coworkers in favor of newer employees.
I am no stranger to moles, those insipid insiders who have plagued the counterespionage services of every intelligence agency known. It was a life I thought I had left behind when I turned in my FBI credentials, top secret clearance, and governmentissued firearm for a more peaceful life with predictable hours at a financial institution.
During my tenure with ‘‘the Bureau,’’ I spent five years on the Foreign Counter
Intelligence (FCI) squad chasing spy types from East Germany, the Soviet Union, and
Czechoslovakia. But with the fall of the Berlin Wall, I, like many of the Bureau’s FCI resources, was reassigned to the White Collar Crime unit, which is where I spent the final years of my career.
I manage a group of 14 fraud investigators for a midsize bank that operates solely in
California. About a third of us were ex-cops. The rest of our department included a few with criminal justice degrees and others with retail loss prevention and claims processing experience. Our work was routine for the most part; the fraud we mitigated daily was usually as obvious as the proverbial nose on one’s face. Besides the ever-present counterfeiters and check washers, we chased after credit card thieves, angry ex-boyfriends with an
ATM card and PIN trustingly provided in happier days, wayward children whose
‘‘spitting image of their father’’ included a remarkable talent for replicating dad’s signature, and the occasional wallet-grabbing hooker. Together, those made up an interesting yet predictable array of cases. Losses had been quite substantial before I accepted the position, growing at a rate of about 10% annually, a trend management wanted to stop. Employing a more cohesive investigative approach, we began to earn a reputation as a financial institution that had you arrested the moment you pulled that flimsy fake ID out of your pocket. We started making house calls, which was one thing back in my federal days

T

71

Wells4689_c08_1

72

05/31/2007

chapter 8

72

the mole

but quite another with neither gun nor badge. Our persistence and in-your-face investigative styles, while perhaps unorthodox for a financial institution, rewarded us with the desired results. Life was good in the world of bank fraud and forgery—or so we thought. But on one particularly cold day in January, some events unfolded that threatened to ruin what had been a downward trend in losses.

The Dog Has Its Day
Investigators love to talk about their cases, whether boasting or complaining. It was one of the few benefits of being confined to tightly cramped spaces. While it may seem less than conducive as a productive work environment, the truth is that if investigators had their own offices, they would likely never share what was going on in their worlds.
Thus, bits and pieces of information that often are linked to make investigations successful would never happen. It was one such morning that the investigators for the check and credit card fraud areas entered my office to discuss some disturbing parallels in their newest cases.
I listened to similar stories about sharp increases in fraud activity and large dollar losses committed by criminals who are ‘‘just too good.’’ But bank fraudsters aren’t the most erudite criminals in comparison to the large and complex Wall Street types we often read about over coffee. Branch personnel often called with questions about the ‘‘Capival Bank’’ or ‘‘Bank of Stattes’’ cashier’s checks that were being presented for payment. The average white-collar street thug, at least in California, was a horrible speller with a less-thanadmirable command of proper grammar. Oftentimes they are in such a hurry to negotiate a counterfeit check that they forget to sign the item or are oblivious that the MICR line is crooked, double printed, or misaligned.
As we discussed the team’s worrisome trends and anomalies, I became particularly concerned when I learned that in three instances, imposters had visited branches posing as legitimate customers and had successfully negotiated large withdrawals of cash. The fraudsters had everything they needed to make the visit a successful one, including a driver’s license and, most disturbing of all, the secret pass code we use for many of our customers to protect them from this very thing. Silly words, like the name of their dog or their favorite flower, which in my opinion is so much more effective than a mother’s maiden name or a date of birth, can both be easily discovered. The odds of a fraudster pulling out a fake or stolen ID and correctly providing our teller with the name of our customer’s Shar-pei, ‘‘Mr. Toodles,’’ would be extremely slim, if not impossible. Yet here we were with thousands of dollars in losses and mysterious impersonators who knew not only the name of Mr. Toodles on the Jones account, but
Rosebud, Snookie Bear, and Chrysanthemum on the Smith, Gomez, and Hawks accounts, respectively. It had been more than a few years since I had left my cold war escapades, but one thing was certain: These fraudsters weren’t guessing their way to success. They had help that only an insider could offer. We had a mole, and he wasn’t showing any signs of stopping.

Wells4689_c08_1

05/31/2007

73

information highway

73

Information Highway
In a typical month, we received four or five telephone calls from various law enforcement agencies that had discovered during a traffic stop that the speeder or expired tag holder was not only concealing the usual stolen weapon and a few grams of crack, but was also in possession of stolen financial information. People were often found to be harboring copious amounts of stolen credit reports, credit cards in various names, ATM cards with
PIN numbers, and stolen checkbooks.
One such call came just days after we began suspecting that an insider was stealing information. The arresting officer in a town 100 miles away advised that he had discovered documents that we would be interested in. When I pressed him for more details, he explained that he had been searching a suspect’s car and in the process had discovered what appeared to be ‘‘customer information.’’
‘‘I can see your customer’s name, address, account number, mother’s maiden name, date of birth, license number, password, and account balances,’’ he advised.
I was a bit stumped for a moment, naively assuming that a customer had carelessly thrown away his bank statements with pass codes written on them, so I asked him to fax the seized documents to me. As our team anxiously gathered around the machine, listening to the steady clicking of the agonizingly slow printer, our eyes grew wide. Customer account profiles printed from terminals within our company headquarters appeared: the worst possible scenario and the final confirmation of the existence of our mole.
The walls of my office began to look like a war zone as we tacked up large pieces of poster board in columns around the room. Our lists of check cashing suspects, photos of account imposters, and employee suspects were voluminous. As we proceeded, the case grew. We found numerous similarities that linked recent frauds with the existence of a mole. We listed victims under their respective fraudster and wrote loss totals beside their names. To an outsider, it probably looked like a serial killer investigation on NYPD Blue, but for us, it was an attempt to grasp the scope of what we were facing. We were racing against the clock and we knew from experience that it was much better to face the press with the employee fraudster in jail than empty-handed.
After the case was laid out, we began analyzing our losses using a relatively new tool that tracked teller access through computer surveillance. A few long days passed until we were able to link most of the damage to one employee who was hired the prior year. We had almost 40 victim accounts. Nearly 30 of them had been accessed by a staff member who worked in the Telephone Operations Center, answering customer inquires. While he was clearly our best target, approximately 10 of these accounts were seemingly untouched by him, leaving us with some doubt about whether we had identified the only perpetrator or if others were involved.
Before we could accuse anyone, we would need more proof. We began studying the account profiles seized in the traffic stop. The more we looked at these documents, the more confused we became. None was accessed by the primary suspect, yet all of the accounts had been victims of fraudulent activities. Most of the information contained in

Wells4689_c08_1

74

05/31/2007

chapter 8

74

the mole

these seized documents was accurate when compared to the current customer database, but some of the data was pure nonsense. Customers holding an average amount of $1,200 were showing balances of $1,000,000. Some of our customers were at the right street address but in the wrong city, or their account numbers were correct while their Social
Security numbers were not.
We continued to review and theorize, searching for links to our mole, until one of our team, a criminal justice graduate, asked what seemed like a meaningless question: ‘‘When can an employee manipulate an account without any repercussion?’’ He stood next to the war desk staring at the information with a quizzical expression on his face.
The ex-cops looked at him impatiently. ‘‘When we spend our time asking stupid questions we don’t catch the bad guys,’’ one said, turning back to the growing labyrinth on the wall.
The criminal justice graduate seemed a bit dejected so I decided to take him seriously and at least pretend to consider the question. I thought for a moment, and my mind drifted back to a very long week when I first started with the bank. I looked at him; he shook his head slowly with a devious smile that told me he too had been thinking. ‘‘Actually, it’s not a stupid question.’’ I put my arm around the ex-copper and continued.
‘‘In teller training class you can add a million dollars to an account, change the addresses all you want, and do whatever else. In those classes, they work with real accounts. These documents, my friends, were taken from that class during somebody’s first days on the job.
When we see who on our list was in teller training class during the week these were printed, we have our mole.’’
The following morning we called Tom in for an interview. He was in the teller class from which the seized profiles were stolen and was also the employee who had accessed 30 of the 40 compromised accounts. We made our suspicions known to the feds and the U.S.
Attorney’s Office. None of these agencies objected to us conducting the initial interview, partly because they had nothing to lose, and they know that employees are often more likely to confess to a company investigator who can only take away their job, as compared to a federal agent who can take away their freedom.
Tom was nervous from the start. His answers were indicative of deception, and when confronted with our suspicions, his rebuttals were weak and lacking conviction. He was street savvy, though: not afraid to look me in the eyes while attempting to remain cool and unaffected. I offered him what I considered to be the best motivator for those who are wise to the game: the chance to tell authorities his story first and be the one who fingers everyone else rather than the one who ends up getting the finger. I told him that everyone knew what he did. The rest was up to him. After two hours of who, why, what, where, and when, he became agitated.
‘‘So what do you want me to do, lie about myself? You want me to tell a lie? Fine. What do you want me to confess?’’
So you did do it, I thought to myself, leaning over so that our knees were just inches apart, attempting to invade his personal space without being too obvious. ‘‘You

Wells4689_c08_1

05/31/2007

75

information highway

75

would do that for me? You would lie about a crime you didn’t commit just because I asked you to?’’
He looked away for a moment before announcing, ‘‘Well, you don’t believe what I have been telling you—that I didn’t do it—so I may as well just confess. You ain’t interested in the truth, that’s for damn sure.’’
He looked away again and was sliding up into his chair to move farther away from my knee. I could see that he was losing his aggression and determination. It was a good time to downplay his involvement in the entire caper in an effort to make confession palatable to him. ‘‘You know, Tom, if you were the ringleader in all of this, then I am wasting my time, but
I don’t think you are. I think somebody asked you to do this. You want to know why?
Because the losses in this investigation have gotten pretty high—and I don’t see a Lexus outside in your parking spot.’’
‘‘That’s for damn sure,’’ Tom replied.
‘‘So what I need to know is this: Did you provide account information to just one person, or were you selling this information all over town?’’
There is a moment in a successful interview when the weight of the world becomes heavy and the lies have stretched to capacity. It is then that the suspect’s body confesses before his mouth catches up with it. The breath he has been holding finally escapes.
Tom’s shoulders dropped and he sighed. ‘‘I don’t want to go to jail.’’
An experienced interviewer knows that the suspect has just confessed. For the most part, the fight was over. This is a time to say nothing, to allow the tears to well up.
‘‘I don’t want to go to jail,’’ he whispered again, shaking his head. The room grew quiet and I leaned closer. I wasn’t going to speak; it was his show now. I mirrored his posture and bent forward in sympathy and understanding to encourage his continued cooperation. I nodded my head compassionately.
Then someone spoke, but it wasn’t Tom. Management had requested an observer in the room, and unfortunately, he didn’t have the experience to know when to be quiet.
He couldn’t handle the uncomfortable silence and gave in to his need to say something— anything. He asked about a totally unrelated element of the crime, jerking Tom away from thoughts of jail, his child, and losing his job and reputation. Tom answered the question calmly, but when he finished, he stood up and announced, ‘‘I’m done,’’ and walked out.
I went home disappointed and troubled, a feeling that occasionally follows an extensive interview—especially when I know the suspect’s life will be forever altered. I knew that although he didn’t confess, we had him, and that he was probably pacing the floor of his home at that very moment. I thought about his son. I was a single parent. It was hard at times, and I wondered if he, too, had a mountain of bills and if fraud was supposed to be his way out. From what we had learned from other staff members and his file, he wasn’t a drug abuser, had never been arrested or chronically unemployed, and wasn’t mad at our company and seeking revenge. We did our job well and stopped him early. We had discovered our mole, and that didn’t happen often.

Wells4689_c08_1

76

05/31/2007

chapter 8

76

the mole

The King Falls
The FBI agent told me that when they arrived at Tom’s home a few days later, he took only a few minutes to confess. He immediately turned over the name of Raphael Kingston, a local criminal whom they believed to be the ringleader of an organization that included counterfeiters, bank employees, check cashers, imposters, and manufacturers of fraudulent documents. He had recruited Tom to get a job at the bank for the primary purpose of removing confidential information. When the police raided Kingston’s home, they encountered his roommate, an enormous naked man running through the kitchen nearly scared out of his mind. He later became a key witness against Kingston, admitting that he had made all of the fake driver’s licenses and counterfeit checks used in the scheme.
Together they had used a network of prostitutes, welfare moms, and low-level gang members to impersonate bank customers and to cash checks from their accounts, affecting our bank and several others.
I was eventually called to testify and told my story. I explained what had happened to arouse our suspicions and how we had narrowed our search down to Tom.
On cross examination, Kingston’s defense attorney asked the anticipated questions:
‘‘Do you possess any information which proves that your employee provided this information directly to my client?’’
‘‘No, I don’t.’’
‘‘Did you see your employee provide any stolen records to my client?’’
‘‘No, I did not.’’
‘‘Have you seen my client’s name on anything associated with this case that even suggests he had anything to do with this investigation?’’
It’s always a smart move for a defense attorney to read through the documents he receives during discovery. It is also important not to ask any questions for which you are not relatively certain of the answer. If Kingston’s attorney had practiced this advice, he would not have asked that particular question.
‘‘Yes, one of the counterfeit checks was made out to your client and he negotiated it at one of our branches.’’
Fraudsters can be bad spellers and sloppy printers. They are also impatient and greedy much of the time. Cashing that check wasn’t a great idea, especially for someone denying participation in a bank fraud scheme.
The first trial of Kingston ended in a mistrial. As it turns out, I wasn’t the only one tired and exhausted, because the judge learned that one of the jurors had fallen asleep during testimony late in the afternoon as the trial was about to end. As was his duty, the judge called in all of the jurors in and asked how many of them had nodded off at any time during the prior weeks. Three sheepishly raised their hands.
A new trial was ordered. I wasn’t called to testify.
I never found out much about Kingston other than what I learned while watching him in the courtroom during my testimony. He appeared disinterested in the proceedings, dressed in his designer jeans covered with patches from various NBA teams. I learned that

Wells4689_c08_1

05/31/2007

77

lessons learned

77

he had been on probation for robbery with a firearm at the time he initiated his scheme against area banks. After his second trial, he was found guilty and was sentenced to 51 months in prison. According to the sentencing report, there were over 60 victims in the case. Kingston was ordered to pay restitution of nearly $100,000. He received 29 felony convictions. Five other participants entered into plea agreements for their parts in the scheme. Tom was sentenced to six months in jail.

Lessons Learned
One of my mentors was fond of saying ‘‘Confess early and often.’’ I think in these days of identity theft, and now with the never-ending stream of compromises, there is certainly some value in adopting this creed if and when your information is compromised.
Informing your customers that you have taken every imaginable step to prevent data leaks but were a victim of someone you trusted is something most people can relate to.
There are numerous stories about the Social Security Administration, tax preparers, credit agencies, banks, and even hospitals dealing with employees who have stolen confidential information and have used that information for profit.
Our initial contact with account holders to inform them of the compromise was handled without excuses or any shadowing of the truth. A letter sent to them stated: I am sorry to inform you that your information has been compromised. We are saddened and surprised that someone we trusted has let us all down this way. What I can tell you is that this person was identified quickly and has been indicted and will be prosecuted. I am calling to apologize and to reimburse you for the funds that were removed from your account. Most of the responses we received, even from the most initially indignant of our customers, were understanding. It wasn’t that we forgot to lock the door to a branch or had been careless with a laptop. We simply had a bad apple in the bin. Some were less conciliatory and asked, ‘‘Don’t you do background checks?’’ We explained that we do, but that this employee had no criminal record. Many people assume that employees who commit occupational fraud have long and lengthy rap sheets: perhaps petty theft, possession of a controlled substance, and a few embezzlement indictments under their belt.
This is, of course, far from the truth. In reality, only 7% of bank employees who steal from their employer are ever charged with a crime. They are free to move from bank to bank, and many do just that. And while the discovery of the stolen training class documents proved that Tom had taken the job with one purpose in mind, I can’t think of anything human resources, his department managers, or anyone else could have done to isolate him as a potential criminal during the hiring process. He was just another guy who walked, talked, and looked like everyone else. But then again, he was a mole, and that’s what they do.

Wells4689_c08_1

78

05/31/2007

78

chapter 8

the mole

Recommendations to Prevent
Future Occurrences
Fraud Policies Introduced to Employees: The Perception of Detection
Creating the perception of detection is an integral part of preventing occupational fraud in today’s workplace. While handing out our fraud policy, which outlines specific nontolerable acts, I inform employees that everything they do via e-mail, on any terminal, or on the telephone is subject to corporate surveillance and recording. I tell the stories of those who have gone before, their aspirations and their untimely demise. After this, we review the federal statutes for bank fraud and computer secrecy. I let them know that there are cameras that look like cameras and cameras that look like clocks and smoke detectors. More Surveillance
One technique we use is to create a report that lists how many times each teller looks at an account without performing a transaction. We created a position for one investigator to review this report and to initiate an investigation against all of the high scorers. Curiosity that leads to violating a consumer’s privacy may start with one innocent peek to see how much your boss makes, how much your next-door neighbor deposits on a monthly basis, or to check up on an old flame. Inquisitiveness is great when it comes to scientific pursuits and space exploration, but bad when it comes to banking and customer privacy.

Manuel Pereira is a former Special Agent with the Federal Bureau of Investigation, previously assigned to the White Collar Crime and Foreign Counter Intelligence squads.
He has eight years experience directing the security and loss prevention efforts for a
West Coast financial institution.

Wells4689_c09_1

05/31/2007

79

chapter

9

&
Her Passion for Fashion
BETHMARA KESSLER

obbi Jean Donnelly was hardened by her humble beginnings in rural Mississippi.
The fourth of six children in a blue-collar working-class family, she spent the early years of her life in hand-me-down clothes, living in the shadow of the siblings that came before her.
As the result of public school zoning policies, Bobbi Jean attended class with some of
Mississippi’s most prominent families. At a young age her self-image plummeted as she endured the ridicule and torment inflicted upon her by the girls in designer clothes who would chant, ‘‘Poor, poor Bobbi Jean, she can’t get her clothing clean!’’ Instead of submitting to her plight, the scrappy schoolgirl confronted her oppressors, frequently landing in the midst of large playground brawls. Eventually she learned to use her charm and wit instead of her fists—she won over the critical in-crowd and gained some popularity in middle school and high school.
Determined to rise above her roots, Bobbi Jean left Mississippi after high school to chase after her dream of becoming ‘‘somebody.’’ Not sure what she would do for living, she headed to New York City and landed a job with a temp agency. Luck was on her side;
Bobbi Jean’s first assignment was temping for the design house of a major fashion retailer.
This eventually led to a full-time job that lasted three years. Over the next eight years she continued to hold high-profile administrative support roles for fashion executives until finally landing her most lucrative position at Mod Fashions, Inc.
When she joined Mod Fashions, Bobbi Jean was newly married and had recently moved with her husband into a very attractive home in a New Jersey suburb. The house was beautifully appointed with fine upscale furnishings. The property was sprawling, complete with a swimming pool.
For Bobbi Jean, image was everything. She worked hard to project a family portrait of affluence, lying to coworkers about her ‘‘privileged’’ upbringing in Mississippi. Bobbi
Jean’s stories were so convincing that no one questioned the extent of her designer wardrobe. She was always decked out in the latest high-end clothes and accessories from
`
head to toe. Hermes, Prada, Gucci, Chanel, and Louis Vuitton were some of her favorite designers. Bobbi Jean sported a brand-new outfit every day and was the envy of all of her coworkers. Her shoe collection could rival anyone’s, containing hundreds of pairs from

B

79

Wells4689_c09_1

80

05/31/2007

chapter 9

80

her passion for fashion

designers like Jimmy Choo and Manolo Blahnik. In the end, her passion for fashion would be her downfall.
Mod Fashions, Inc. was a hip multibillion-dollar retailer based in Kansas City, Missouri.
Launched in 1970 by a brother and sister team, Steven and Debra Cammamod, it rose from its humble beginnings—a small mom-and-pop store on the outskirts of a big city—to a chain of over 2,000 stores across the country that carries every trendy must-have of the season. When Steven and Debra started the business, they surrounded themselves with a handful of trusted friends and advisors. For the first five years, Mod Fashions was run solely by the small posse they had assembled.
As the business grew, so did the need to expand the team to help manage the day-to-day requirements of the company. After eight highly profitable years, the Cammamods built a crackerjack team from the retail industry’s who’s who in fashion. Two years later the company went public. Over the years the business became a multidivisional giant boasting over 75,000 employees worldwide.
Ron Dawson joined the company to run its design division, the incredibly fast-paced place where fashion is created. He had a cadre of 40 designers and design contractors, supported by a team of 20 individuals with various back-office support expertise. The team was based out of New York, over 1,000 miles away from Mod Fashion’s home office in Kansas City.
When Ron joined the Mod team, he quickly began the search for an administrative assistant. He knew the importance of having a great assistant—one he could trust. Ron placed an advertisement in the New York Times classified section and was inundated with
´
´ resumes from people clamoring to join the world of fashion. As he reviewed the applicants, one stood out from the crowd. Bobbi Jean Donnelly was a seasoned professional with several years of experience supporting senior executives in the industry. Ron was so impressed by her captivating personality during the interview that he immediately extended an offer, which she quickly accepted.
The chemistry was there; Ron and Bobbi Jean hit it off right away. After working together for only a short while, their connection grew strong. Ron’s trust in his new assistant was solidified. People throughout the company could not stop talking about her.
‘‘Bobbi Jean is amazing,’’they said. Ron didn’t hesitate to take her with him to Kansas City, where she would interact with all of the senior executives’ assistants and home office support personnel. From the Accounts Payable Department to the executive suite, she charmed them all.
With the accolades pouring in, Ron quickly propelled Bobbi Jean from her position as his administrative assistant to office manager. That promotion entailed a significant increase in responsibility and authority. In addition to managing Ron’s needs, Bobbi Jean also supervised the remaining support personnel and prepared and oversaw the Design
Department’s budget, a task that Ron despised. She was more than willing to shield him from mundane financial tasks. His least favorite was the review of expense reports submitted by his staff. Ron gave Bobbi Jean the responsibility of providing the first level of

Wells4689_c09_1

05/31/2007

81

design on more than a dime

81

review; he relied on her to make sure that the expenses were valid before he signed them.
On a few occasions, when Ron was traveling out of town or swamped with work, he asked
Bobbi Jean to sign the expense reports on his behalf.

Design on More than a Dime
I joined the Mod team three and a half years after Bobbi Jean was hired. As the business grew, management decided it was time to build a robust Internal Audit Department. That’s where I came in. My internal audit team was conducting a routine and relatively straightforward travel and expense audit, which was not expected to reveal any major surprises. We developed a program designed to ensure that the corporate travel and expense policy was followed by employees and to confirm that adequate internal controls in the processing and payment of expense reports were operating effectively. The team scoped a sample of individuals and transactions to test. The people selected were from those employees who submitted the highest dollar amounts over the course of the year for reimbursement. Moreover, transactions were randomly selected across the total population of expenses submitted.
The approach and criteria used to audit the transactions differed significantly from the approach used to audit the individuals. The transactions were reviewed for compliance with the policy, proper authorization and approval, and the legitimacy of the expense.
That work yielded no major surprises. The more interesting results of the work were in the review of individuals. My team looked at all expense reports submitted by the selected employees over a one-year period. We were looking at the expenses based on the employee’s role in the company and for any patterns of activity that seemed unusual. It didn’t take long for us to identify a pattern from one area of the business—the Design
Department. There were several individuals who devised very inventive ways of submitting expenses on more than one occasion for reimbursement, demonstrating that their creativity was not limited to fashion.
My lead auditor, Mike Stuart, entered my office with piles of paper spilling over his arms. He was animated as he shared the details of the expense reports he reviewed.
‘‘You have to see this,’’ he said. ‘‘There are at least six people that are submitting their
American Express bills for reimbursement instead of the detailed receipts for individual expenses. On most of them, I can’t tell if the charges are even for a legitimate business purpose; some of them definitely look odd.’’
As Mike took me through the documents, the bills began to show a pattern: one month of charges, plus the next month a late fee with the old and new charges combined. In essence, at least three employees were submitting the same charges twice, one of which included a seemingly fake late fee.
Mike indicated that the three people were part of the design team in New York. So I asked him to bring in all of the expense reports for the employees in that department. As
Mike and I flipped through those documents, we began to uncover more red flags.

Wells4689_c09_1

82

05/31/2007

chapter 9

82

her passion for fashion

Several of the employees submitted New York City taxi receipts for reimbursement, a legitimate business expense when conducting business in different locations in Manhattan.
Upon examination of the actual taxi receipts, Mike and I noticed multiple receipts that appeared to come from the same taxi on the same day.
I am a born and raised New Yorker. Hailing a taxi in New York City is quite a feat— getting the same taxi twice, let alone several times in one day, is virtually impossible. New
York City taxis are regulated, and all have electronic meters that print receipts. The receipts all show the taxi medallion number, which is how we were able to identify that they came from the same taxi. Below the medallion number is the trip number.
I became very suspicious when the multiple receipts had sequential trip numbers on the same day. The time stamps on the receipts had small gaps between the end time of the receipt first in sequence and the begin time of the next one. In some cases there were five or six sequential taxi receipts. Upon further inspection, the tear pattern of the bottom of the earlier receipt in the sequence was an exact match for the tear pattern at the top of the one following it.
Mike and I also found several cases of meal receipts being submitted twice. The detailed bill usually presented at the end of the meal was separated from the credit card receipt for the same meal, and each was submitted separately for reimbursement. On a few occasions the person submitting the receipt would put different tip amounts and totals on each of the documents to make the duplication less obvious.
‘‘Who had the most expenses this year on the design team?’’ I asked Mike, after a quick scan of the reports.
‘‘The office manager, Bobbi Jean Donnelly; she charged about $115,000 worth of expenses this past year,’’ he responded.
I asked Mike how much her boss, Ron Dawson, submitted.
‘‘About $40,000,’’ he replied.
It seemed strange that Bobbi Jean’s expenses would be so much higher than Ron’s. It also disturbed me that her name came up in all of the schemes we had identified at this point. I went to meet with our general counsel, Fred Jackson, and informed him of what we had identified in the audit. He agreed that we needed to conduct a thorough investigation of the design team’s expenses. As we’d begin the broader investigation, I would make sure that we thoroughly reviewed the activities of Bobbi Jean.

The Fraudulent Five
Mike and I sat down to develop an investigation strategy. The volume of expense reports submitted by the design team was daunting. It would be impossible to effectively review every one of them in detail. We decided first to acquire a solid understanding of the organizational structure and normal business activities of the design team. Then we would do a high-level review of the expense reports submitted by each individual. Based on that review, we would be able to identify any individuals who had expenses or patterns of

Wells4689_c09_1

05/31/2007

83

the fraudulent five

83

activity that were inconsistent with normal business expenses. We would put those aside to conduct a deeper analysis.
Mike and I went to meet with the director who was responsible for communicating with the design team on their budget, Jack Stevens. Jack had spent quite a bit of time in
New York with Ron, Bobbi Jean, and the team to learn about their functions in the business and understand in depth how they operated.
‘‘You have to understand that what the design team does is art, not science. A lot of the expenses that you will see in their budget will look unusual.’’ This is the first thing that Jack said to us. Formally trained as an accountant and finance person, he admitted to having a hard time wrapping his mind around the types of expenses that came through the department. As Jack took us through the organizational structure and budget of the design team, he explained that the group’s role was to create new products for the company. The team traveled extensively around the world to be influenced and inspired by fashions and lifestyle trends. On those trips, team members would immerse themselves in local culture, entertainment, and shopping experiences. People would frequently buy things on the trips to serve as reminders of inspiration when they returned to the office. They call those purchases ‘‘samples.’’ In New York, the team would create presentation projects, often incorporating their samples, to present to various merchants around the company.
Jack showed us books of photographs that captured some of the presentations—they were awe-inspiring. Out of these, new ideas would be born and new products created.
The meeting with Jack provided just the right amount of context for our investigation.
Mike and I sifted through the piles of expense reports and set aside approximately six individuals whom we would review in detail, in addition to the three we were already planning to look at.
We decided that the best approach would be to use our audit software, Interactive Data
Extraction & Analysis (IDEATM). The expense reports were manual, which would make that difficult. In fact, submissions from these individuals were recorded in such a sloppy fashion that it was hard to truly analyze the patterns of data effectively. In all nine cases the expenses were submitted over many months, making it difficult to piece together all of the elements of the alleged business activities. Mike and I agreed that it would be worthwhile to invest the time of some members of our team to help build a database of the expense detail to facilitate the review. That investment paid off. The data read like tea leaves, giving us insight into the potential fates of each of the individuals. In four cases, expenses appeared reasonable and appropriate. For the five remaining people, it was clear that there were some problems that would need to be rectified.
Seth Warren, George Miller, Robin Simmons, Rose Waller, and Bobbi Jean Donnelly were systematically and routinely submitting expenses multiple times for reimbursement.
Mike and I nicknamed them the ‘‘Fraudulent Five.’’ By using IDEA to identify duplicate amounts quickly, we were able to isolate the expense reports that we needed to review in tandem. For example, the data would show us the exact amount, say $123.42, processed twice, and we would look at the different expense reports that corresponded with those

Wells4689_c09_1

84

05/31/2007

chapter 9

84

her passion for fashion

charges. Mike and I looked at the receipts that were submitted as support. It became easy to separate the duplicates, and in some cases, those that were submitted multiple times. Seth appeared to be quite gutsy; he actually submitted a $132.86 charge for a car service five times over the course of seven months.
Mike and I also used IDEA to analyze expenses submitted from the same vendor for similar amounts, expenses incurred in the same week based on the detailed receipt information, and multiple submissions of the same expense category for the same day.
Once we identified the Fraudulent Five as individuals involved in similar schemes, we analyzed the patterns of data across them as a group and found a few instances where Seth and Robin submitted the identical expenses. When they traveled together and had a meal, one would pay with their credit card and the other would get the detailed receipt and submit it as if they paid cash for the meal. Through various schemes, the Fraudulent Five submitted approximately $75,000 in false expenses.
About $12,000 was attributable to Bobbi Jean. I still had a nagging feeling about the sheer amount of expenses she was submitting. Using IDEA, I ran further analyses on her expenses to roll them up by category. I was very surprised to see that the majority of her purchases were samples. It particularly struck me as odd because that would mean that in her capacity as office manager, Bobbi Jean also had the luxury of traveling around the world with the design team to make decisions about fashion trends. I looked at her sample purchases and was overwhelmed. At times I can be considered a ‘‘fashion emergency,’’ so the names of some of the designer clothes, shoes, and accessories that Bobbi Jean purchased didn’t register with me, but the prices did. Seven-hundred and fifty dollars for a pair of
`
Jimmy Choo shoes, $875 for a Hermes scarf, $1,250 for a Prada wallet: all samples and all coded to various projects that the design team appeared to have done for Mod Fashions.
Using IDEA, I extracted all travel-related expenses submitted by Bobbi Jean to see if the sample purchases correlated to trips that other design team members took. I thought that this would at least validate that her role could be broader than it appeared and that I was worrying about all of these charges for no reason. I was very surprised to see that she did go on several trips with the team. Upon further review, I found a trip to London that seemed to further validate Bobbi Jean’s importance on the design team. It appeared that Ron had sent her to London to meet with 12 students to recruit interns for Mod Fashions. Bobbi
Jean had submitted over $6,000 for a one-week trip to do the recruiting; she had wined and dined the interns at the finest restaurants in London, including one outing that cost $1,386.
Surely if all of these charges were fraudulent, Ron would have picked it up in his own budget review.
I went back to the general counsel and took him through the circumstances of each individual. We decided that it was time to sit down with Ron to share the details of the investigation when he came to Kansas City. I had never met this design prodigy, but he was definitely a legendary figure at Mod Fashions. Fred warned me about the need to be delicate: ‘‘He is creative and might be a bit sensitive.’’
Ron was wildly charismatic, bursting through the door of our conference room like a gust of wind. Fred introduced us, and Ron made it clear that he did not like auditors. He

Wells4689_c09_1

05/31/2007

85

a (corrupt) design for living

85

was very kind in ensuring that I didn’t take his comment personally, but it was clear that he was not interested in becoming friends. As Fred and I took him through the schemes of the
Fraudulent Five and the $75,000, it was apparent that he was disappointed and disgusted by his staff ’s conduct. He shared that Seth was a wheeler-dealer type so he wasn’t surprised, but the rest really caught him off guard. The person that disappointed Ron the most was his trusted manager, Bobbi Jean.
‘‘I pay her so well. Why would she steal $12,000?’’ he asked. ‘‘Her family is so wealthy; I can’t understand why she would need the money!’’
Ron was really distressed. Deep down, he knew that Steven and Debra would be displeased with him for harboring a collection of untrustworthy employees.
Next, Fred discussed a game plan. We collectively agreed that Fred and I would fly to New York to meet with each person and give them a chance to explain themselves.
Bobbi Jean would be a problem, though; she was out on maternity leave, at home in the suburbs of New Jersey. Fred and I would have to organize a way to connect with her while we were there on our trip.

A (Corrupt) Design for Living
Fred and I arrived at the design office in New York bright and early on a Wednesday morning. We were clearly out of place in our corporate suits. The environment was casual, trendy, and very hip; we were not. Ron greeted us and quickly shepherded us into a small but exquisite conference room with floor-to-ceiling windows, a phenomenal view, and some of the most incredible objects d’art that I have ever seen. Ron introduced us to the human resources director, Anne Skully. We discussed our plan for interviewing Seth, George,
Robin, and Rose. Anne would be present during the interviews along with Fred and me.
George and Rose were quick interviews. They both readily admitted to the complete extent of their actions, taking full accountability for what they had done. Robin was a bit ornery. She put up a strong wall of resistance, denying any impropriety until directly confronted with each and every expense report. Ultimately, she bowed her head and accepted defeat.
Seth was a completely different story. He was slick, as Ron had warned us. As we presented him with the evidence of each of his fraudulent acts, he responded with indignant outrage at ‘‘the incompetence’’ of his assistant. Seth poured on the charm as he explained that he was incredibly disorganized and incapable of even dreaming up the type of schemes we were accusing him of committing. He claimed that he gave his assistant wads of crumbled receipts to sort through and process.
‘‘She is not very intelligent,’’ he asserted. ‘‘This is all a mistake and it’s her fault.’’
Despite Seth’s best efforts to deflect responsibility, his explanations did not make sense.
Fred and I questioned him in excruciating detail about his process for giving his receipts to his assistant. He could not explain how she would have duplicate receipts to process for him over the course of many months unless he repeatedly gave them to her in a piecemeal fashion. Seth, George, Robin, and Rose were terminated that day.

Wells4689_c09_1

86

05/31/2007

chapter 9

86

her passion for fashion

It was 2:30 p.m. when Ron, Anne, Fred, and I reconnected in the conference room to discuss how we were going to handle Bobbi Jean. Despite feeling betrayed, Ron insisted that we allow her to exit Mod Fashions gracefully. We decided that Fred and I would call her at home, explain what we found, and tell her that we would allow her to finish out her maternity leave and resign without returning to the office. Ron and Anne left the conference room so Fred and I could get down to business.
As we were getting ready to make the phone call, I decided to ask Ron one more question. I walked to his office where he and Anne were meeting, and interrupted the two of them.
‘‘I hate to bother you, Ron, but I just need to ask you one thing before we call Bobbi
Jean. How much do you think she submits per year in expenses through her travel and expense reports?’’
‘‘Probably about $10,000 to $12,000 per year,’’ he answered.
My stomach sank as I continued, ‘‘So if I told you the amount was more than $100,000 a year, it would surprise you?’’
It looked like someone had knocked the wind out of Ron. ‘‘That can’t be! What are you talking about!?’’
I explained that the biggest category of expenses was samples, and went on to enumerate the types of purchases I saw. Ron calmly looked me straight in the eye as he attempted to hide his rage and whispered, ‘‘She was not authorized to purchase samples.’’
Fred and I agreed that we needed to terminate Bobbi Jean immediately and then figure out the extent of her fraudulent activities and what actions to pursue. We called her and explained that we had found approximately $12,000 of expenses that she had fraudulently submitted for reimbursement. Bobbi Jean was confident yet guarded as she insisted that there must be a mistake. She went on to explain that her workload was so great that it was possible that she had accidentally submitted things for reimbursement on more than one occasion, and if so, it was in error. Fred then went on to tell her that we also believed that a large number of expenses that she submitted were not valid; they were possibly personal in nature. Bobbi Jean was cautiously dismissive as she said, ‘‘You just have no idea what I really do for the design team.’’
Fred explained the conditions of her termination and indicated that we would do some additional work to determine if we would take any further action. As parting words, he suggested that she seek the assistance of a lawyer regarding this situation. Fred and I flew back to Kansas City that Wednesday evening. I spent Thursday and
Friday working with my team to pull together all of Bobbi Jean’s expense reports and receipts and catalog them for a detailed review with Ron that I scheduled for the following week. On Monday morning I flew to New York with two suitcases in tow, which contained meticulously prepared binders of the reports and supporting receipts that my team had pieced together. Ron and I agreed to meet at an office that he was able to borrow, a considerable distance from the design office. He was hesitant as he eyed the suitcases, but

Wells4689_c09_1

05/31/2007

87

a (corrupt) design for living

87

cordially invited me into the beautiful office overlooking Central Park. He offered me a cup of coffee and we got down to business.
I pulled all of the binders out of the suitcases, organized them chronologically, and began reviewing them with Ron. For the next two days I received an accelerated education in fashion and began to bond with Ron in a way that neither of us expected. We were both infuriated by the audacity of Bobbi Jean as we separated the expenses into piles of those that appeared to be legitimate, those that were clearly fraudulent, and those that were questionable. Ron easily recognized a lot of Bobbi Jean’s clothing, shoes, and accessory purchases as things that she wore to work on a regular basis.
Mod Fashion’s expense reporting process requires individuals to give descriptions for the business purpose of an expense and have their boss sign off on the actual expense report. Ron was amazed by the accuracy with which his signature was replicated. Every expense report had a signature that reasonably appeared to be his own. However, we compared documents that he actually did sign with those he did not, and viewing the documents side by side clearly showed the anomalies in the forged signature. With
Ron’s tutelage into the world of fashion, I was able to clearly see that in many cases
Bobbi Jean’s receipts did not match up to her explanations. Before meeting Ron, I did not know that Jimmy Choo exclusively sold shoes, handbags, and small accessories.
On several occasions Bobbi Jean submitted Jimmy Choo receipts but claimed that they were blouses and pants. Ron showed me that a close look at the receipt clearly indicated a size of 7.5, which is not a clothing size but a shoe size. A savvy fashion buff would have easily seen the pattern of deception.
Ron lost it when we came across the expenses for Bobbi Jean’s trip to London to interview the design interns. He quickly pulled out his calendar and confirmed that the dates of that trip coincided with a vacation that she and her husband took to London.
A final tally of her fraud was approximately $275,000 over two and a half years. Almost
95% of the expenses that she submitted to Mod Fashions for reimbursement were false.
I called Fred to discuss our findings. We agreed that the right thing to do was to talk to the district attorney in New York and see if they would prosecute Bobbi Jean criminally for her actions. Our case was assigned to Assistant District Attorney Wendy Simmons. I met with Wendy at her office in downtown Manhattan. She was impressed with the organization and detail of the documentation that we provided for the case, and she readily agreed to prosecute Bobbi Jean.
Several weeks after meeting with Wendy, she called to tell me that she met with Bobbi
Jean and her lawyer. Wendy shared that Bobbi Jean was very impressive and confident during their interview, denying all of the allegations and offering to provide witnesses who would substantiate her position of innocence. She claimed that all of her purchases were legitimate, authorized, and part of normal business practices of the design team. Wendy said that she would need to meet with these witnesses and Ron to decide if there really was a case to pursue.
Wendy met with Ron and the three witnesses Bobbi Jean produced, all ex-employees of
Mod Fashions: Jackie Adams and John Bresnin, who were terminated for poor

Wells4689_c09_1

88

05/31/2007

chapter 9

88

her passion for fashion

performance and had a clear ax to grind with Ron; and Holly Wilson, who left the business to start her own company. Jackie and John were cool yet adamant about the authenticity of
Bobbi Jean’s purchases and legitimacy of her actions. But Wendy quickly sized them up and concluded that they were disgruntled ex-employees who would not be credible witnesses for the defense.
Wendy called me to confirm that she was now confident in the case against Bobbi Jean, and would sit down with her and her lawyer to discuss the possibility of a plea agreement.
At first, Bobbi Jean was adamant about her innocence and refused to consider any plea agreement. Ron and I testified before a grand jury that subsequently handed down an indictment against Bobbi Jean. Eventually she decided to avoid a messy court battle and accepted a plea that came with a jail sentence of 6 to 12 months.
Several months later I testified in unemployment court to justify our termination of
Seth Warren for cause. The judge was very patient with Seth, allowing him to explain the
‘‘mistake.’’ Before he denied Seth any unemployment benefits, the judge said, ‘‘Sir, you must expect that the whole lot of us are ‘not very intelligent,’ as you claim your ‘poor hardworking assistant’ to be, if you expect us to believe that you did not intentionally and systematically time the submission of your expense receipts with the explicit purpose of defrauding the company for your personal benefit.’’ Visibly deflated, Seth did not seem to be so slick after all.
I went to Bobbi Jean’s sentencing hearing and watched as she stood apprehensively; her body language did not exude her usual confidence. The understated and unfashionable outfit she wore was ironic considering that her passion for fashion was the cause of her downfall. Bobbi Jean was ushered away in handcuffs with her head down, never turning back even to say good-bye to her husband. As she left the room, I thought about the baby she left at home. I wondered if she regretted her actions—or just getting caught.

Lessons Learned
When this was all over, I worked with the management team to recap the breakdowns and lessons learned that enabled Bobbi Jean and the rest of the Fraudulent Five to commit their acts. We all agreed that there were many important lessons to take away from this.
Ron placed too much trust in Bobbi Jean, giving her authority that went virtually unchecked. Checks and balances must be in place and operating effectively. Leaders should not delegate their fiduciary responsibilities. Once Ron allowed Bobbi Jean to sign expense reports and manage the design department’s budget, he did not engage in the level of review that would have alerted him to the fraudulent activities.
By signing the expense reports for the design team on Ron’s behalf and managing the budget, Bobbi Jean could pad certain budget categories in the planning process by submitting details described only as ‘‘other’’ or ‘‘miscellaneous.’’ She could also monitor and control the budget lines that everyone’s expenses hit to prevent variances that Ron might want to review in more detail. Therefore, when she would submit her fraudulent

Wells4689_c09_1

05/31/2007

89

recommendations to prevent future occurrences

89

expenses, she would code them to budget line items that were running under budget. Ron didn’t suspect a thing.
There also needs to be a clear definition of roles and responsibilities between the staff who sign expense reports and those who process them. At Mod Fashions there was confusion as to what exactly the manager’s signature on an expense report meant. For us, it was not clear whether it indicated that the manager was authorizing the expenses as reasonable or that the manager reviewed the report and supporting detail and was attesting to the validity of the expense. Management thought it was the former, and the travel and expense processors thought it was the latter. The result was that neither could thoroughly monitor expenses that employees were submitting across the company.
On a personal note, Ron and I became good friends and colleagues. Despite his early resistance, the journey we took together through this set of unfortunate circumstances bonded us. As an added benefit, my taste in fashion has definitely improved as a result of our friendship.

Recommendations to Prevent
Future Occurrences
Use Clear Supporting Documentation for Travel and Expense Reports
We modified our travel and expense policy to be black and white in respect to appropriate supporting documentation for expenses. We now require original documentation and prohibit things like credit card statements and photocopies. This prevents employees from submitting duplicate expenses for reimbursement.
Use Corporate Credit Cards for Business Expenses
We now require all employees to use their corporate credit card for business expenses. This has significantly reduced the amount of expenses for which people claim to have paid cash and reduces the ability to split the credit card receipt from the detailed receipt and submit both for reimbursement.
Train Travel and Expense Processors
We have trained our travel and expense (T&E) processors in the basics of identifying the red flags of fraud. Using the actual receipts submitted by the Fraudulent Five with some additional educational materials, I put together a training class for the processors to demonstrate what fraud looks like and to increase their awareness of various schemes.
Update Technology
Both the internal audit team and the T&E team have considerably expanded use of the audit software, IDEA, to proactively look for warning patterns of fraud in the T&E data.

Wells4689_c09_1

90

05/31/2007

chapter 9

90

her passion for fashion

The T&E has also developed auditing protocols that allow it to be most efficient in auditing T&E data. Team members separate big spenders from the rest of the population.
Much as Mike and I did during our initial internal audit, they look at those big spenders in detail for patterns that appear odd on a quarterly basis. In addition, they randomly select expense reports to review against a set of audit criteria on a weekly basis.

Bethmara Kessler, CFE, CISA, leads enterprise business risk management for a Fortune
500 company. Her 25-career has spanned various audit and risk management roles involving fraud investigation and ethics compliance in the retail, entertainment, consumer products, and public accounting industries. Ms. Kessler received her BBA in
Accounting from Baruch College.

Wells4689_c10_1

05/31/2007

91

chapter

10

&
An Unaffordable Complex
JEFFREY D. BARSKY

t an early age, Christine Cross immigrated to America with her parents. The first in her family to go to college, she worked hard to achieve a degree in accounting and was proud of her accomplishment when she became a CPA.
After graduating, Christine married and she and her husband, Jimmy, found jobs with
Affordable Housing, Inc. (AHI), a charity that developed, owned, and managed a large number of housing projects for low-income families and the elderly. After several years of working together, Jimmy developed some health issues and resigned.
Christine was originally hired as an internal auditor and, within two years of employment, she was promoted to the director of fiscal services. She possessed a dominant personality and demanded respect from everyone. AHI employees who reported to
Christine knew not to question her authority. She had terminated more than one person for disagreeing with her.
Yet despite her quick rise, she would complain of feeling underappreciated. She did not think that management recognized her professionalism—according to her, they didn’t acknowledge or even realize how hard she worked for the company. She claimed to have back problems due to her stressful job. Because of this, she needed to take work home. This conveniently also explained why she was absent from the office on many occasions.
Although Christine was the predominant breadwinner, the family lived an extravagant lifestyle. It included, among other things, expensive cars, pricy real estate investments, and exotic travel. Christine’s Harley-Davidson motorcycle was modified at a custom shop, costing tens of thousands of dollars. Jimmy owned two motorcycles that were worth a combined $30,000. They shared four relatively new vehicles and a custom-built trailer used to transport their motorcycles long distances.
The couple traveled to warm locations to escape the winters in Cold Creek, North
Dakota, and often discussed their luxurious foreign travels with AHI employees. Christine and Jimmy publicly reminisced about traveling to Florida, where they stayed at a pricy condominium. The couple also was proud of the fact that they sent their children to the best private schools and expensive colleges. It was well known by AHI employees that Christine and
Jimmy spared no expense for the education of their kids.

A

91

Wells4689_c10_1

92

05/31/2007

92

chapter 10

an unaffordable complex

Everyone wondered how the Cross family could afford this lavish lifestyle on one salary.
However, no one wanted to risk his or her job by confronting Christine.

Not So Affordable, After All
Affordable Housing, Inc., was a large not-for-profit charity located in Cold Creek,
North Dakota, that provided services to economically disadvantaged residents of the community. One of their divisions developed, owned, and managed approximately 20 affordable housing apartment projects that provided low-cost housing to qualified lowincome families and elderly tenants. Tenants’ total household income levels may not exceed certain amounts to be eligible to live in the apartments. The projects charged tenants a rent equal to a certain percentage of their income. The balance of the rent was paid by the Cold Creek Housing Authority, which received some of its funds from the federal government. The subsidies received from the Cold Creek Housing Authority allowed the apartment projects to meet their operating needs without charging tenants a higher rent.
The record keeping for subsidized housing was complicated. An owner was required to maintain more records for this type of housing than in a typical apartment complex.
Evidence of tenants’ income levels had to be proved on a regular basis. This step, which is required by the regulatory agreement with the housing authority, was to ensure that the tenants are qualified based on their total household income. The owner needed to also prepare monthly reports, which provided the housing authority with support for the rent charged to each tenant so that the housing authority knew how much to pay the owner. Christine hired people with limited accounting experience, and, as a result, the accounting staff was far from effective. Furthermore, AHI management focused on its goals of providing services to the citizens of the community, not the strength of the accounting department and its related internal controls. An inexperienced accounting staff and complex reporting requirements resulted in records that were behind and often insufficient.
For example, bank reconciliations often were not completed on a monthly basis.
While AHI had reasonable polices and procedures, they were not always followed and therefore were not effective. The combination of Christine’s forceful personality and the lack of experience in the accounting department made it possible for Christine to get away with breaking the rules. In violation of company policy, Christine instructed the employee who received the mail to give the unopened bank statements directly to her.
This allowed her to destroy or alter checks before other individuals ever saw them.
According to company policy, disbursements required approval by someone other than the person who requested the payment. In many cases, Christine made the check request and then approved the invoice for payment anyway. She was then able to obtain payments for companies that were controlled by her or her husband. But as it turned out, these
‘‘companies’’ were nothing more than bank accounts that were controlled by them and used to deposit AHI checks.

Wells4689_c10_1

05/31/2007

93

rain(tree) check

93

When It Rains, It Pours
Most of AHI’s apartment projects operated at a small cash surplus. However, one project,
Raintree Apartments, was an exception. Raintree had received favorable rent increases from the housing authority over the years, generating a cash surplus of approximately
$4 million. Raintree also had nagging water penetration problems, so management decided to commence a renovation project to correct them. This included replacement of windows and casements and a redesign of the roof line to eliminate the leaks. Alison Kramer, the
AHI internal architect, along with outside consultants, prepared a construction budget of
$2 million, well within the project’s cash surplus. As required by the housing authority, management sought and received approval to commence the renovation project.
One fall day, Alison received two calls—one from the general contractor and another from the inspecting architect—both of whom complained about not having their draw request paid. When Alison contacted Christine about the situation, she was told that
Raintree Apartment’s funds were invested in the stock market, and they had suffered a significant decline. Christine asked Alison to slow down the renovation project so that the funds would have ample time to recover in value before they were needed to pay bills. She also demanded that Alison obtain her approval before committing to any additional work in excess of $100,000. Unbeknownst to Alison at the time, the statement regarding the decline in value of the stock market made no sense because an investment of surplus funds in this manner was in violation of the regulatory agreement between the housing authority and AHI. It turned out that the funds were not invested in the market, anyway.
Alison requested and received copies of the paid bill file on the renovation project from another AHI employee. Upon reviewing the paid bills and draw requests, she noticed certain payments totaling over $700,000 that she had not approved. This aroused her suspicions. One of the bills she had not approved was listed as being paid to the architect.
Mysteriously, it contained two different type fonts. Once Alison called the architect’s office, she determined that this payment had not been received. She also contacted the general contractor and located certain bills listed to him that he had not received.
Bothered by her discovery, Alison disclosed the findings to her supervisor. Management was concerned, among other things, with two issues: Since government funds appeared to be involved, there could be legal consequences to the organization. Also, if the public became aware of the fact that AHI had been defrauded by an employee, there could be a negative impact on AHI’s ability to raise contributions.
Management contacted their law firm for advice, which suggested that a complete investigation be conducted and appropriate steps taken to resolve the matter. The law firm recommended me to AHI, and after an initial meeting, I was engaged to conduct an investigation. Rain(tree) Check
I began the investigation by conducting an interview with Alison Kramer and obtaining several important documents: a copy of the list she prepared of questionable checks written

Wells4689_c10_1

94

05/31/2007

94

chapter 10

an unaffordable complex

from a checking account of Raintree Apartments; copies of the approved construction contract, along with the typical documents evidencing payment to the contractor such as draw requests and change orders; and a copy of the approved architect agreement. Alison also provided me with a copy of a fax from Christine’s home, which was a Housing
Authority ‘‘approved’’ construction contract in the amount of $2.1million. This approval was $200,000 higher than the actual construction contract with the general contractor,
Williams Construction Company, Inc. I then obtained copies of invoices and draw requests in support of actual payments to Williams and the architect, Martin Stewart, from the Accounting Department. I reviewed all of these documents with Alison for unusual items. One significant example of an unusual item was an invoice in support of a payment to J&C Design in the amount of $275,000. This invoice was a draw request allegedly for the general contractor, Williams, which indicated payments should be made to the
‘‘architect,’’ J&C Design, for payment to Williams. Over the years, I have reviewed a substantial number of invoices and documents related to construction and never saw an example where the architect receives payment and then pays the general contractor for the construction work.
There were several other unusual things about this draw request. First, it stated that the contract amount was $2.35 million, or $450,000 higher than the actual contract amount of
$1.9 million. Interestingly, the contract amount listed did not even agree with the approved Housing Authority contract amount of $2.1million. Second, the draw requested indicated that the contract price was increased by ‘‘approved’’ change orders in the amount of $250,000. It is very unusual for approved change orders to be in round numbers.
According to the actual change orders on file, the contract amount was actually decreased by approximately $82,000. Therefore, the change orders were overstated by $332,000, and the adjusted contract price (original contract price plus change orders) was overstated by
$782,000.
To continue the investigation, I obtained copies of the bank statements for the Raintree
Apartments checking account from which the renovation project were paid. I quickly determined that the account had been opened for a period of three years. I also deduced that, on average, only two to three checks were written per month. Accordingly, I decided to review all checks written on the account.
During my review, I noticed that many of the checks appeared altered or were missing altogether. I requested and obtained an authorization letter from the client, giving the bank permission to provide me with copies of all cancelled checks.
Also, consistent with my usual practice, I asked Alison for additional names of AHI employees whom she thought would be helpful to interview. She suggested Bill Miller in accounting. Christine had hired Bill 10 years earlier on a part-time basis while he attended a local university. Upon graduation, he began working for AHI full time, where he progressed from an assistant bookkeeper to senior accounting supervisor. In recent years,
Bill was responsible for preparing accounting analyses and schedules that were provided to the outside auditors of the various AHI entities. While preparing these schedules and

Wells4689_c10_1

05/31/2007

95

rain(tree) check

95

analyses, Bill noticed certain checks payable to vendors that he did not recognize—namely,
Jimmy’s Metal Works and J&C Design. He provided me with a list of seven payments made to these vendors in the approximate amount of $62,000. He had been afraid to bring these items to AHI Management or to the outside auditors for fear that he would be fired if management ignored the issue or if he was wrong.
Bill also told me that he noticed that one of the outside auditors, Michael Woods, appeared nervous when dealing with transactions involving Raintree Apartments. This only occurred on the Raintree audit. Bill was not the only one to notice the odd behavior.
During some water cooler conversations, employees learned that Michael was having an affair with an AHI employee, which Christine also knew about. The employees surmised that Christine used this as leverage to force Michael to ignore suspicious items. It is possible that he knew something was not right, but failed to look into it for fear of having his affair exposed. At this point, I received the requested checks from the bank and decided to review them as the next step in the investigation. I compared them to the ones in AHI’s files. I also now had an original check as it had cleared the bank from the batch of checks that had been missing. My review revealed that many of the checks had been altered. For example, one supplied by the bank was written to Jimmy’s Metal Works in the amount of $195,000. The payee was altered to ‘‘Williams Construction Company, Inc.’’ on the copy of the check in
AHI’s files. Inspection of the back of this check as it originally cleared the bank revealed that it was endorsed ‘‘For deposit only, Jimmy’s Metal Works’’ with a bank account number. On the back of this check in AHI’s files, the endorsement was altered to read ‘‘For deposit only, Williams Construction Company, Inc.’’ with a bank account number. From this I surmised that the check was written to Jimmy’s Metal Works and deposited into a bank account in its name. Later the check was altered to read ‘‘payable to Williams
Construction Company, Inc.,’’ an approved AHI vendor.
In addition, I noticed that all but two of the checks missing from AHI records were written to Jimmy’s Metal Works, J&C Design, Jimmy Cross, or Christine Cross. Most— but not all—of the checks found in the AHI files that were written to the Crosses or to one of their controlled entities were altered in a similar manner to the check in the amount of
$195,000 to Williams. A review of public records revealed that Jimmy’s Metal Works and
J&C Design were not registered or licensed companies. It was not difficult to surmise that
J&C stood for Jimmy and Christine.
The invoices supporting these payments were generally draw requests to Williams
Construction Company, Inc. or invoices to Jimmy’s Metal Works and J&C Design. As mentioned, the draw requests had inflated amounts well in excess of the actual contract amount. The invoices to Jimmy’s Metal Works and J&C Design were without any address or phone number and were described as ‘‘services rendered.’’ Many of the invoices and check requests were not in the file.
Later in the investigation, I was able to subpoena the checking account statements for
Jimmy’s Metal Works, J&C Design, and Jimmy and Christine Cross. In summary, I determined that of the total of $2.6 million disbursed from this account from its inception,

Wells4689_c10_1

96

05/31/2007

96

chapter 10

an unaffordable complex

$1.55 million was disbursed to Jimmy and Christine Cross or companies under their control. Bill suggested I interview Carl Perry in accounting, another AHI employee. Carl described certain aspects of the accounting system and how bills were approved and paid.
Carl told me that Christine had a ‘‘system’’ requiring that if the bank questioned any
Raintree checks made payable to Jimmy’s Metal Works or J&C Design, he was to confirm that they should be honored. In addition to providing me with notes he had maintained,
Carl told me about conversations that occurred with four other AHI employees about suspicious vendors being paid that seemed to be linked to Christine and Jimmy. According to Carl, several employees were aware of something but afraid to come forward.
Next, he described some of the Crosses’ purchases. According to Carl, the couple would show him pictures of some of their prized possessions, including the cars, the motorcycles, their expensive condo in Florida, and furnishings for their new house.
Based on the interviews conducted and documents examined, I became aware of some payments from other AHI checking accounts to one of the entities in the Cross empire. As a result, I obtained bank statements, cancelled checks, and cash disbursement journals for as many years back as possible for review. I then noted any check made payable to Jimmy
Cross, Christine Cross, J&C Design, and Jimmy’s Metal Works. Also, I took a sample of checks payable to other vendors and reviewed the supporting documents to determine if any of these checks appeared linked to the Crosses. In summary, I located $2.48 million in checks payable to the Crosses or one of their controlled entities.

A Place for Everyone and Everything in Its Place
Upon completing an initial review of documents and conducting several interviews, I met with outside legal counsel to consider the appropriate steps to recover funds from the
Crosses. Counsel decided that sufficient information existed to file a civil lawsuit. Once the suit was filed, I requested that outside legal counsel subpoena the bank records of
Jimmy’s Metal Works, J&C Design, and the Crosses. Access to these bank records provided me with a history of deposits into their bank accounts. I was able to determine the source of most of these deposits. The sources included transfers from other Crosscontrolled accounts, payroll from AHI, and deposits of fraudulent checks from AHI. This helped minimize the risk that I had missed major defalcations during my review of AHI records. Near the conclusion of my engagement, I prepared a written report that was forwarded to AHI’s insurance company. I cooperated with their investigator by responding to questions and providing him with documents as requested. The insurance company made a payment up to the limits of the policy, but it was less than the amount of the total loss suffered by AHI.
During the investigation, I was consulted by AHI management and outside legal counsel about potential negligence by the outside audit firm. Instead of filing a lawsuit

Wells4689_c10_1

05/31/2007

97

lessons learned

97

against the auditors, I suggested that AHI have a meeting with the audit firm and discuss a potential settlement. Ultimately, a settlement was reached between them, which provided a payment to AHI without the need to file and litigate a lawsuit, saving professional fees.
I also cooperated with local authorities who had commenced a criminal investigation, which resulted in indictments of both Jimmy and Christine Cross. The authorities were very helpful to AHI. They gave the Crosses a large incentive—a plea bargain carrying a modest sentence—for turning over the majority of the assets purchased with AHI funds.
In the end, Jimmy and Christine agreed, which minimized legal and other professional fees, while still allowing recovery. Christine received a sentence of 1 to 3 months and
Jimmy was sentenced to 6 to 12 months.
AHI sold the real estate and other assets it received from the Crosses. From these sales, insurance proceeds, and the proceeds from the settlement with the auditors, AHI collected almost all of its loss of $2.48 million. Because AHI was able to satisfy the housing authority that all funds were returned, no action was taken against it. Fortunately, the case did not appear to have any negative impact on the organization’s ability to raise contributions from the public.

Lessons Learned
In concept, the fraud uncovered was quite simple. Phony invoices and other supporting documents were created to support fraudulent payments to nonexistent vendors. As a result, the investigation was simple, as well. All that was required was for me to follow certain basic fraud investigation techniques, such as interviewing witnesses and examining and maintaining the chain of custody of documents. However, certain aspects of the investigation were difficult and time consuming. It took a long time to retrieve copies of checks from the bank. Also, because AHI wrote so many checks, reviewing even a sample of disbursements from the other AHI accounts was time consuming.
From the beginning, there were many signs of potential fraud occurring. Christine and
Jimmy’s extravagant lifestyle was a clue. How could a family afford this lifestyle on one salary? Also, Christine chose inexperienced employees to work in the Accounting
Department because they were less likely to discover the fraud. Due to her controlling nature, they would be also less likely to expose the scheme if they became aware of it.
Allowing Christine so much control over a poorly functioning Accounting Department should have been avoided.
Another red flag was poor record keeping. The records were constantly behind. One way to cover up a fraud is to create phony documents while altering other documents. It takes a lot of time to create phony invoices and draw requests. When an employee uses his or her time in this manner, the result is that other duties are not performed, and the books and records are delinquent and often incomplete. It is harder to spot fraudulent transactions in incomplete records. In addition, Christine took documents out of the

Wells4689_c10_1

98

05/31/2007

98

chapter 10

an unaffordable complex

office to her home. Perhaps this was because the task of creating phony documents and altering others was a risky endeavor at the office.

Recommendations to Prevent
Future Occurrences
Segregation of Duties
AHI should have enforced its policy of having someone other than the employee who wrote checks reconcile the bank statements. The individual who prepared the bank reconciliation should receive the bank statements unopened from the mail clerk. One classic internal control policy is segregation of duties. There are several examples where this control could have prevented the losses incurred by AHI. The bank statements should not have been transmitted from the mail clerk to Christine. She should not have been allowed to reconcile the Raintree bank account used to pay for the major renovation project because she was also the person writing checks from this account.
This reconciliation should have been performed by another AHI employee who received the bank statements directly from the mail clerk. In addition, Christine should not have been able to approve invoices when she wrote the checks and check requests.
Having so much control over these transactions permitted her to create and approve phony invoices, cut the checks to pay them, and destroy or alter documents to cover up the fraud.
Monitor Budgets
It is important to develop a system to monitor the cost of major renovation or construction projects. This system should include an approved renovation or construction budget with monthly comparisons of budget to cost incurred and estimated costs to complete. The system should also consider written confirmation of contract terms with major contractors hired by AHI.
Implement Fraud Hotline
AHI should encourage employees to come forward if they suspect fraud. A good way to promote this is to implement a fraud hotline. Employees and customers are more likely to report occurrences of fraud if the tip line is anonymous.
Hire Experienced Accountants
It would be beneficial for AHI to hire individuals with sufficient experience in accounting and internal controls. The company should also hire an internal auditor who can monitor the progress of AHI’s changes to and compliance with internal controls.

Wells4689_c10_1

05/31/2007

99

recommendations to prevent future occurrences

99

Confine Records to Office
A policy should be established and enforced that prohibits employees from removing records from the office. Taking important records home allows employees the opportunity to alter or embellish documents, resulting in fraud.

Jeffrey D. Barsky, CPA, has a forensic accounting practice in the Washington, D.C., area.
He provides fraud examinations, performs tracing of funds, prepares and rebuts damage analysis, and consults with attorneys in civil and criminal litigation. Mr. Barsky is a graduate of the American University and has more than 20 years of experience in forensic accounting services.

Wells4689_c11_1

05/31/2007

100

chapter

11

&
A Taxing Problem
ANDREW H. KAUTZ

ngela Bauer was the youngest of six children and the only girl. She wasn’t particularly attractive, but she made up for that with a pleasant nature, and people warmed to her quickly. She was also a social person, quick to join others for coffee or a drink after work, and was well liked by her coworkers. Unfortunately, her social skills did not carry over into her academic life. She didn’t graduate from high school, but she eventually obtained a GED. In later years, she managed to finish a few bookkeeping and business courses at a local community college, but she never completed the degree requirements.
Despite her limited education, Angela managed to gain an understanding of how businesses operate, and she built a career working for small construction companies. She was known as someone who was always willing to help, charming enough to convince most people that she was a capable and loyal employee.
Angela met her husband, Don, when they were both would-be students at the community college. Don may not have known it at the time, but he was a perfect match for
Angela. His easygoing, almost naive, approach to life fit well with her take-charge nature.
As Don would later remark, ‘‘Angela would give me my allowance, and that’s what I could spend myself. She handled everything else.’’ Don worked as a telephone adjuster for a small insurance company. It was not a glamorous job, nor very challenging, but it suited him. By the time they were in their early 40s, Angela and Don had two children and had settled into a comfortable existence. Like most middle-class parents, they were determined to give their children a better life. The drive to provide for her children was very strong in Angela, and anyone that knew her could see that her kids truly were the center of her world.
Angela worked for Agassiz, a midsize construction company, for over 10 years, starting as a clerk and working her way up to the accounts payable area. Her duties included issuing checks to vendors, but she had no check signing authority. She later left Agassiz to take a better-paying job a year before the fraud was discovered.
Agassiz is a closely held collection of companies involved in road and commercial building construction. It is highly respected in the industry and known for its quality work.
The owners have always believed that their success is directly attributable to the hard work and dedication of their more than 200 employees. The family-owned nature of the business permeates the work environment and has created a high degree of trust and

A

100

Wells4689_c11_1

05/31/2007

101

off the record

101

reliance on individuals. While employees are expected to give 100% to the company, they are rewarded when those efforts succeed.
Agassiz’s operations had expanded over the years, but its internal controls had not grown with the organization. This was especially true in the accounting area, where employees had sole control over many functions, often with little oversight and a great deal of responsibility.

Off the Record
My first contact at Agassiz was with the senior administrator, Diane Stapleton. She had been with the company for over 20 years. My call to Agassiz was prompted by a notice I had received regarding a potential employee dishonesty claim. Diane was upset by the fact that someone may have stolen from the company, while, at the same time, she had trouble believing it was true. As in many cases of employee fraud, the scheme was discovered completely by accident. A government auditor had been winding up a review of Agassiz’s books when she questioned an amount recorded as a sales tax payment. The government had no record of having received the amount, yet the company’s books showed that it had been paid. Diane’s first inkling of a problem came when she couldn’t find the check or any documentation to support the payment. She knew that the records were up to date, and since the missing check had been issued over a year earlier, there was no reason for it not to be on file. Diane told the auditor she would do some more digging and get back to her with more information. What Diane didn’t know was that she was on the brink of uncovering a fraud that would occupy her time for the next several months and shake her trust in coworkers for many more.
When she could not find the check, Diane telephoned Angela at her new job. Even though Angela had left Agassiz almost a year earlier, Diane often called her with questions because it saved her some time—and she welcomed the opportunity to talk with her old friend. They had worked together for 10 years and she had relied heavily on Angela, especially in regard to accounts payable. After a few minutes of catching up, Diane asked about the payment the auditor was questioning. Not surprisingly, Angela wasn’t much help, and she told Diane that she couldn’t recall anything about it. What was surprising was the fact that Angela abruptly cut off the conversation, saying that she was very busy.
Diane was frustrated. Not only had she spent most of the day with the government auditor, she now had to spend more time tracking down a missing check. Then it hit her: She could call the bank and have it send over a copy. It would be faster than trying to locate it by herself.
When she picked up the fax from the bank the next day, any frustration she still felt was quickly replaced by confusion. There on the payee line, where she expected to see
‘‘Ministry of Finance,’’ was the name ‘‘HWC Bank.’’ There was a credit card number written on the memo line, but she knew the company’s credit card number by heart, and this was not it. The writing was clearly Angela’s, but whom did the credit card belong to?
Diane had a thought. She pulled one of Angela’s old expense claims and checked the number of the credit card that Angela had used to pay for a course she had attended. It was

Wells4689_c11_1

102

05/31/2007

102

chapter 11

a taxing problem

the same as the one on the check she was holding. Why would the numbers be the same?
What was going on?
Then it finally sank in. The missing check, the lack of backup documentation, the incorrect payee, Angela’s abrupt manner: Angela had stolen the money. That appeared to be the only explanation. But it wasn’t an explanation at all. They had worked together for years; Angela wouldn’t have done that. Diane needed to talk to someone about this, so she headed straight to Bill’s office.
Bill Morgan was one of the two owners of Agassiz. When Bill heard Diane’s story, he didn’t know what to say. He treated his employees like family, and he couldn’t even fathom that one would steal from him. He took another look at the check and compared it to the credit card number on the expense report; there was no mistaking what he was seeing. He looked up from his desk and said to Diane, ‘‘See what you can find out without raising any flags.’’

Digging Up the Dirt
Diane was not quite sure what to do next. She reasoned that since the check had been disguised as a tax payment, she would check the records for other similar items. While she had hoped that she wouldn’t find anything else, Diane had a sick feeling that there would be more. It didn’t take long for her fears to be realized, as she quickly determined that another ‘‘tax payment’’ was missing from the files. When she reported this to Bill, they both knew what had to come next. Bill looked at her and said, ‘‘Let’s go back as far as we can and look at all the companies Angela was involved with.’’
Diane rolled up her sleeves and got to work. She pulled all the bank statements for the three companies for which Angela had been responsible and reviewed them for missing checks. This was no minor feat as many of the records were in a large trailer that was used for storing old files. Investigating a former coworker—a friend—was unpleasant enough, and the visits to the trailer just made it worse. As Diane worked her way through the pile of statements, she discovered several checks with white-out in the payee area. The payee name written on top matched what the records showed, but there was obviously something else underneath.
Each time Diane determined that a check was missing or found one with White-Out, she made a copy of the bank statement and requested the check from the bank. It wasn’t long before one of the checks that the bank faxed back showed ‘‘Angela Bauer’’ as the payee.
Any lingering doubts that Diane had were completely wiped out when she saw that name. After looking through several boxes of bank statements, cleared checks, and accounting records, Diane noticed that in one month there were two disbursements payable to the
HWC Bank for Bill’s company credit card. When she turned the checks over and examined the reverse side, she noticed that one had a teller stamp while the other did not. She knew that the credit card payment was always made in person by Angela or someone else from the office, so there should be a manual teller stamp on any legitimate payment.
Determined to get to the bottom of this, Diane pulled out the credit card statements and found the one for the corresponding month. She examined it several times, to be sure, but

Wells4689_c11_1

05/31/2007

103

digging up the dirt

103

there was only one payment credited. Now she had more to look for. She went back to the beginning of the pile of bank statements and looked for double payments to the HWC
Bank credit card. Each time she found a double payment, and there were several, she checked the HWC Bank credit card statement to verify that the check without a manual teller stamp did not appear as a credit to the account. The bank would not, or could not, give her any information on the accounts.
After 18 days of paper cuts and dusty file boxes, Diane had reached the end of her investigation and her rope. She had determined that Angela’s scheme spanned almost six years. It involved 54 checks ranging in amount from $1,181.54 to $25,080.00 for a total of nearly $462,000. Of those 54 checks, 34 had altered payees and 20 were payable to the HWC Bank, which had not been credited to any Agassiz bank account or credit card.
As she looked at the white-out on the checks, Diane realized how obvious it looked after the fact. The correction fluid left noticeable evidence of an alteration but it had never been questioned by the bank. Then again, since Angela had been responsible for reconciling the bank statements, no one at Agassiz had questioned it, either. All in all, it was a devastating revelation for Diane. At the end of her story, she told me, ‘‘Each time I found a missing or altered check or duplicate credit card payment, I just couldn’t believe it! I kept asking myself, Why? I was angry and felt totally betrayed. This was one coworker that I considered a friend.’’
The next day, I sat down to my first meeting with Agassiz at their main office. The grim faces around the boardroom table belonged to Diane, Bill, and their in-house legal counsel, Norman Mayer. None of them had been in this type of a situation before, including Norman, who had experience in the criminal justice system. I explained the process for making a claim under their fidelity bond. When broken down into the various parts, bond claims are not overly complicated, but to someone unfamiliar with the process, it can seem like an endless paper chase.
After I finished my presentation, Diane summarized her findings. I was quite impressed.
For someone with no investigative experience, she had done an excellent job at ‘‘digging up the dirt.’’ She had copies of all the checks that were found in the files and that had cleared the bank. The only thing that was missing was the other side of the equation.
Where had the money gone? That was going to be my job. In any employee theft claim, I try early to determine where the money went and whether I can recover any of it. In this case I was optimistic, yet still skeptical, when Diane told me that Angela was living in a very large house on the outskirts of the city. I had been down this road before only to find that the large house had an equally large first, and in some cases second, mortgage. By the time most employee frauds are discovered, the money is usually long gone—frittered away on a gambling or drug addiction or spent on extravagances that have little resale value.
Later that evening I took a drive past the Bauer home. I was stunned to see where they were living. The house itself was not that large, only 2,400 square feet, but the four-car garage, curved driveway, and two-acre lot made it look like a small country mansion. Even with the partially finished landscaping, the property had to be worth at least $300,000. A passerby would certainly think that the Bauers were quite a successful family. With a

Wells4689_c11_1

104

05/31/2007

104

chapter 11

a taxing problem

combined take home income of about $4,000 a month, the only way they could afford to live in that house while raising two kids and driving expensive vehicles was through
Angela’s ‘‘extra income.’’
From the information Diane had given me, I knew that the late-model Oldsmobile parked in the driveway was Angela’s. I wondered whether she was enjoying the early summer evening, oblivious to the investigation that was headed her way, or whether she was sitting in her house fretting over the call she had from Diane about ‘‘that check.’’
Diane sent me the information she had compiled, which clearly showed that the funds had been misappropriated. Angela was the payee on many of the checks, but I still didn’t know where the money had gone. To get this information, I retained legal counsel to obtain an order requiring HWC Bank to disclose the details of the accounts into which the checks had been deposited. The court granted the order, which required HWC to identify the account holders and produce statements and related information.
The initial package of documents from the bank provided me with just the information
I needed. While I had assumed that Angela was an account holder, it turned out that there was another, her husband, Don Bauer. He was named along with Angela on two bank accounts and was the sole signer on a credit card that had been credited with the proceeds of several of the checks. This immediately made me wonder whether Don was involved in the scheme, either actively or passively, or if there was some other explanation. Either way it raised the possibility of recovering from Don, given that he had apparently benefited from Angela’s fraud. This would become very important as it would mean that I would be able to recover assets owned either solely or jointly by Don, including his vehicle and his share of the family home.
Over the next couple of months, information from the HWC Bank slowly trickled in.
As each package of statements arrived, I entered all the transactions from the bank and credit card accounts into a spreadsheet that allowed me to look at their financial activity over a six-year period. My primary goal was to confirm that each check was credited to an account held by Don and/or Angela. Secondary goals were to determine how the funds were used, locate any assets that may have been purchased, and determine whether there were accounts at other financial institutions. An unexpected result of my analysis was the discovery of two large deposits to one of the Bauer accounts. When Diane checked
Agassiz files, she confirmed that these funds were also misappropriated, bringing the number of disbursements to 56 and totaling more than $485,000.
It was now 80 days since Diane had discovered the first check, and it was time to bring things out in the open. Legal counsel was putting the final touches on a statement of claim against Don and Angela, along with applications for orders to seize Don’s truck, garnish bank accounts in their names, and place a notice of pending litigation on their house.
As support for what I was alleging against the Bauers, I had prepared a spreadsheet that showed $485,952 had been misappropriated from three of the Agassiz companies over a period of six years. My analysis showed that $118,822 of this amount had been credited to Don’s HWC Bank credit card and $268,685 had been deposited into accounts held jointly by Angela and Don. Based on the limited financial information I had, I was

Wells4689_c11_1

05/31/2007

105

between a rock and a hard place

105

also able to show that on an average monthly basis, the Bauers were spending almost twice their estimated $4,000 monthly take-home pay. Over six years, the couple had spent between $200,000 and $400,000 more than they had earned. The variance was due to the fact that I still did not have all the credit card and statements that the Bauers held, including the bank account where Don’s paychecks were deposited. However, I did have evidence that Don’s truck payments and the house mortgage payment came out of HWC
Bank where some of the checks had been deposited. This was important information, as it would provide support for our applications to seize or tie up the Bauers’ assets. The information was obviously compelling, as the court granted the orders. While this was a victory, it was far from the end of the road.
One hundred four days after discovery of the scheme, Don and Angela were served with our statement of claim and the related orders. Don was served at work, which had to be embarrassing, but the seizure of his luxury pickup truck must have been like a kick in the stomach. The next day I received a call from the Bauers’ legal counsel who wanted to talk settlement. Don claimed that he knew nothing about Angela’s actions, but he was prepared to turn over his share of the joint assets in exchange for the return of his truck. Angela was claiming that the bulk of the money was spent on gambling. She was also prepared to forfeit their assets. In exchange, they both wanted a complete release. It was difficult to determine whether this was a good deal because I did not have a complete picture of everything that had taken place, nor did I know what their assets were worth. To me it sounded like they were trying to throw out a quick offer and then run for the hills. I was not prepared to play by their rules, so I instructed counsel to continue the action against the Bauers.

Between a Rock and a Hard Place
Angela did not defend the action or file any affidavits in response. She essentially gave up. This was pretty much as I had predicted; after all, she really had no defense. She had been caught red-handed. Until this point I only had a portion of the Bauers’ financial records. This meant that the picture was not complete, and I couldn’t show the full extent of Don’s benefit from Angela’s scheme. If Don was going to defend himself, he was going to have to disclose all of his financial records, which I could use to strengthen the case against him. If not, I would get a default judgment. It was a classic
Catch-22. Don was legally entitled to half of the family assets. A successful defense for him would mean that he would walk away with money that I was hoping to get back. He continued to deny any involvement in Angela’s scheme, and elected to defend the action. I had no evidence to show that he was actively involved or knew anything about her scheme, yet he had benefited from it. As a result, it was not going to be easy to obtain a judgment against him. I would need to show that he had actual or constructive knowledge that Angela had improperly taken money from Agassiz and that he received those funds.
In order to avoid the time and expense of a full trial, I opted to try for a summary judgment. As part of the legal process, Don was required to provide an affidavit, his

Wells4689_c11_1

106

05/31/2007

106

chapter 11

a taxing problem

financial records, and submit to an examination under oath. For Don, having to turn over the additional financial records simply made a bad situation worse. With the additional information he provided, I was able to show that over the period of the scheme, the Bauers had spent in excess of $900,000 in cash yet had brought home only $330,000.This left an unexplained shortfall of approximately $570,000.
While every fraud has its own unique set of facts, they all have one thing in common: victims. This case had more than usual. Not only had Agassiz been victimized by Angela, but her family had been, as well. Their children were in for a very rough and undeserved ride in the months to come. Whether Don was also a victim is a matter of opinion. On the one hand, there was nothing to show that he knew what she was doing. But he had lived in the house and driven the truck that had been paid for, at least in part, by the fruits of Angela’s fraudulent labor. Regardless of how you look at it, there is no doubt that it was a sorry situation. Don was clearly a broken man. Not only had he been blind to what was going on, but he had been blindsided. In his words, ‘‘I’m just telling you that from the time that Angela and I got married to the time I found out about this, nothing ever changed. Nothing drastic enough to catch my attention.’’
Four hundred sixty-eight days after Diane’s original discovery, the attorneys presented their case to the judge. My analysis clearly showed that the Bauers had been spending like there was no tomorrow. During the period of the fraud, they withdrew over $120,000 in cash from their accounts, wrote checks totaling more than $150,000, and made over
$250,000 in payments to their credit cards. While I did not know who the Bauers had written all the checks to, the credit card purchases clearly included trips, furniture, expensive clothing, appliances, and electronics. It was obvious to me that that the funds had been used to benefit the Bauer family and increase their assets. I only hoped that the court would see it the same way.
While it took over six months to render a decision, the court granted judgment against Angela for the full amount of the fraud. The decision against Don was not what
I hoped, but it was pretty much what I had expected. The court ruled that there was ample uncontested evidence to show that this was not a case where Angela has squandered the money on a gambling or drug addiction, but instead had used it for the betterment of the family, including Don. Given that, the court found him liable for 50% of the funds that had been credited to his accounts, which totaled approximately $193,000.
With the judgment, there was really nothing left for Don and Angela to do but turn over the proceeds from the sale of their assets. I understand that they are no longer living together. Don has apparently left the province, while Angela has remained where she was, but without the ‘‘country mansion.’’

Lessons Learned
This case provided an interesting lesson in recovering losses from an alleged nonparty to a fraud. I have recovered funds from financial institutions on several occasions and even had spouses not involved in the fraud agree to turn over certain low-value assets. The issues are

Wells4689_c11_1

05/31/2007

107

recommendations to prevent future occurrences

107

complex and the burden of proof required is understandably high, so there is a lot of work required, and this option is not appropriate for every case. To get the biggest bang for your
‘‘legal buck,’’ it is important to retain counsel familiar with this type of litigation. Most important, never forget that litigation is expensive and the justice system moves forward on its own schedule, not yours.

Recommendations to Prevent
Future Occurrences
Segregation of Duties
From a strictly ‘‘mechanical’’ point of view, the main reason that Angela was able to continue her scheme for such a long time was the lack of segregation of duties. Angela was responsible for issuing the checks and reconciling the bank account. This left her with the ability to walk through Agassiz’s records and erase her footprints afterward. Had the bank reconciliation been the responsibility of another employee, the fraud would have been uncovered shortly after it started.
Update Controls as Company Grows
It would have been beneficial for Agassiz to have reassessed its controls on an annual basis.
While the company had expanded over the years, its controls had not. This is a very common occurrence, particularly in closely held companies.
It is important to realize that controls will not stop an employee from stealing. The best they can do is to minimize the opportunities and maximize the chance that a fraud scheme will be discovered early.
It would be easy to end the discussion by saying that Agassiz should have had tighter controls or paid more attention to the finances, or that the auditors should have done a better job, but I think it is more complicated than that. I believe that the real issue involves the trust that Agassiz placed in Angela. They believed that she would do her job to the best of her ability and took for granted that she would not do anything to harm the company.
Unfortunately, they were wrong.
Trust your employees, but spend that trust wisely.

Andrew H. Kautz, CFE, is a senior corporate risk adjuster with The Guarantee Company of North America, Toronto, Ontario. Mr. Kautz has over 25 years of experience investigating fraud and pursuing recovery. He has also designed fraud-related policies and procedures and is a frequent speaker to groups interested in fraud prevention, detection, and investigation.

Wells4689_c12_1

05/31/2007

108

chapter

12

&
Phantom Links In The Supply Chain
CHRISTOPHER J. KELLY

y all appearances, Tom Kellogg was a rising star in the field of supply chain management. His duties included coordinating the flow of raw materials and components to ensure that finished products are completed cost-effectively and on time, while also minimizing the inventory. Tom had recently held this position at a manufacturer of computer peripherals, providing him with seemingly good experience. He claimed to have received an undergraduate degree from a West Coast university and completed some graduate work in accounting toward an MBA. A large and imposing man, he towered well over six feet tall and had the physique of an NFL lineman. His hair and his bushy mustache were always carefully groomed and his nails were neatly manicured. Armani suits and colorful ties contrasted with his starched white silk shirts and well-polished shoes. He drove a Cadillac, one of several luxury cars that graced his suburban home’s driveway. He was a dedicated family man who reveled in the position as coach of his son’s Little League team. His employment history was less than ideal, with his two previous positions lasting for less than one year each. However, Tom’s impressive credentials, his dapper image, and his ambition were features that most employers found attractive when International
Electronic Assemblers Inc., known as IEA, hired him.
IEA is an automobile, aviation, and computer components subcontractor headquartered in a suburb of Dallas, Texas. Wholly owned by a regional private equity fund,
IEA emerged from Chapter 11 bankruptcy protection after the disastrous acquisition of a printed circuit board manufacturer. Unlike many companies reorganized in bankruptcy,
IEA’s management remained intact. The chief executive officer (CEO) also functioned as the primary salesman and marketer. Other longtime members of the management team anchored production, engineering, and finance.
IEA based its business model on the labor-intensive manufacture of products such as automobile and airplane wire harness assemblies and industrial lighting products for various industrial uses. Its primary customers were government entities, both foreign and domestic, and a substantial base of relatively small businesses. The company struggled with the development of profitable customer relationships after its reorganization and emergence from bankruptcy. The lack of profitability forced budget and salary reductions that were painful for employees and management alike.

B

108

Wells4689_c12_1

05/31/2007

109

held accountable

109

Liquidity for IEA was provided by a $6 million asset-based loan from American Bank of Dallas. The loan was collateralized by inventory and customer accounts receivable less than 90 days old. The amount outstanding under the line of credit usually came perilously close to the maximum allowed by the loan agreement. The CEO, Matt Kramer, was on the brink of signing a major new customer contract that he was convinced would be the breakthrough required to obtain more favorable financing and produce long-term profitability for the company. Matt needed short-term forbearance from the bank, which was currently concerned about the breach of loan covenants based on financial statement ratios. He also needed some patience from the owners, who thought they might never see a return on an investment that had already been reduced in bankruptcy court.

Held Accountable
In April of that year, a Dallas bank was alerted by its security software regarding a possible check-kiting scheme. Sirens sounded as the result of a large number of checks deposited and paid of similar amounts—approximately $18,000 to $25,000—processed through these suspicious accounts. The bank demanded that all of the accounts, which had a variety of names, be closed immediately. Although IEAwas the payer or payee on these checks, the company was not notified. Shortly thereafter, the owner of the closed accounts reopened them at different banks in the same area. Unbeknownst to the account owner, the Federal
Reserve Bank of Dallas identified the newly opened accounts as money laundering suspects. Though they were at different banks under different corporate names, they all used the same taxpayer identification number. Further investigation by the Federal
Reserve Bank disclosed that all of the items being deposited into the accounts were drawn on IEA. This discovery prompted a warning call to American Bank, the payee bank on
IEA’s checks.
The American Bank security officer noted with concern that IEA was not only their checking account customer, but also had a multimillion-dollar loan. He immediately conferred with the company’s loan officer and launched an investigation including a field audit of the accounts receivable pledged by IEA as collateral. The report identified a total of $4 million of accounts receivable under the suspicious customer names, out of a total of less than $8 million on IEA’s books. The other accounts having the same tax identification number were recognized as suppliers to IEA. As a result of cooperation among the banks,
American Bank determined that Tom Kellogg’s wife was the owner of the suspicious accounts. She had used her maiden name to open them, and Tom himself was listed as an additional signer. The bank requested a meeting with IEA’s management to inform them of its findings—a meeting to which an unsuspecting Tom was invited.
Tom, upon being confronted with American Bank’s investigative report, admitted both the supplier and customer accounts were under his direct or indirect control.
However, he maintained that the ‘‘suspicious’’ suppliers were real companies that sold genuine components to IEA. Even if these claims proved to be true, this was a blatant violation of the company’s conflict-of-interest policy. The company terminated Tom but

Wells4689_c12_1

110

05/31/2007

110

chapter 12

phantom links in the supply chain

inexplicably did not require him to vacate his office and turn over his computer for more than a week.
Tom’s admitted involvement with these customers and suppliers dealt an additional blow to American Bank’s already-diminished confidence in IEA. The bank was concerned about the lack of profitability, inadequate liquidity, and anemic sales growth at IEA even before it had been notified by the Federal Reserve Bank of suspected irregularities. The possibility that a significant portion of the accounts receivable might not be collectible became a source of grave concern. Following the meeting with the company, American Bank adjusted IEA’s borrowing base calculation to exclude the
$4 million of accounts receivable attributable to the Tom Kellogg–related customers. As a result IEA was thrown into default of its loan covenants. The bank then made demand for repayment of its loans, offset the remaining balance in the company’s checking account, and began returning checks drawn on the account. Not honoring checks payable to the company’s suppliers would trigger an immediate crisis of confidence among IEA’s suppliers and customers, casting doubt on the ability of the company to continue operations and meet payroll. The downward spiral of IEA appeared fatal.
However, later on the same day as the meeting with the bank, Matt proudly announced that a major new customer had committed to orders that would increase IEA’s sales and profitability by about 50% over the next two years. This new customer, a division of a respected public company, initiated several large purchase orders, clearly indicating a valuable relationship that would change IEA’s future prospects. Based on this new development, which American Bank verified directly with the customer, a decision was made to forebear on the loan repayment demand and to resume payment of checks. The bank decided that it was worth a small additional risk to wait until the smoke cleared and see if the company could be turned around and the loan repaid. The alternative—to liquidate the remaining receivables and inventory—would result in a large monetary loss to the bank and elimination of IEA’s jobs when the doors were closed. The private equity fund that owned the company agreed to make a substantial injection of capital to restore the liquidity necessary to meet operating requirements. The capital would enable the company to hire and train the additional employees necessary to handle the new customer orders. IEA was stabilized and the bleeding stopped, but the questions regarding Tom’s actions were unanswered.

Fraud Dismissed
I had not heard from Patterson Hewett, managing director of a Dallas-based private equity fund, for several years until his phone call. I previously assisted IEA, one of his portfolio companies, with its restructuring while it was in Chapter 11 bankruptcy. During that project I became familiar with IEA’s business and established a good rapport with the
CEO, Matt. While Matt initially had been supportive of my suggested changes to the IEA management structure, I heard from others that it was ‘‘business as usual.’’ Finding out that
IEA might once again be in financial trouble was not a surprise.

Wells4689_c12_1

05/31/2007

111

fraud dismissed

111

As he recounted the matter concerning Tom, Patterson was obviously distressed. ‘‘I’m under a lot of pressure on this one,’’ he said. ‘‘Both American Bank and my investors are all over me, and they expect a complete investigation.’’ He was eager for me to start on the project as he remembered that I was a Certified Fraud Examiner and familiar with
IEA.
Since my prior engagement had been financial rather than operational, my direct contacts at the company had been limited to Matt and to James Porter, the chief financial officer. During the bankruptcy restructuring I recommended that James be assigned to a less demanding position. Matt, however, felt that James should be given a chance to redeem himself as CFO. James continued in this function until being reassigned to an operational area within the company pending the outcome of my investigation. Patterson brought in a certified public accountant (CPA) who worked on other projects for their firm to replace James. This change provided American Bank with assurance that funds were released only for legitimate supply and operating expenses.
On Friday afternoon I met with IEA’s senior management team to go over the investigation process. Ken Daley, outside counsel for the company, attended as well. Ken had a background in prosecuting white-collar fraud from a stint with the U.S. Attorney’s
Office. I presented an overview of the investigation plan along with a list of the specific documents and reports needed to start. I would later schedule interviews with select employees and managers. The IEA management team assured me that I had their full cooperation, and expressed certainty that Tom had acted alone. Ken and I agreed to stay in touch as my investigation progressed.
The following Monday morning I arrived at the IEA facility to find the requested documents stacked on a conference room table. There were purchase orders and invoices for the suspicious suppliers and customers for the past four years. The documents also included IEA’s monthly accounts receivable and accounts payable.
Custom reports showed the detail of each invoice sorted by account and date, and this information was also provided in electronic form for my further analysis. I had a great deal of information but not much time, since Tom had agreed to be deposed by Ken the following week.
I began by reviewing the suspicious customer accounts. There were six different ones, and all of the purchase orders were identical except for the customer name and logo. The same products were being ordered over and over again. Repetitive orders are not unusual; however, each of these resulted in IEA invoices between $18,000 and $24,000. The interim CFO confirmed that the cut for review was $25,000, putting these invoices just under the radar of IEA’s auditors.
I also requested suspicious customers’ credit files. I found that each had been set up within days of the others, and all had local addresses that were fictitious—either vacant lots or residences where the occupant had never heard of the company. The ‘‘salesman’’ assigned to all of them was Tom, even though his job did not include sales. The contact phone number for each belonged to his wife. All of these customers had been approved for credit sales by James, the CFO.

Wells4689_c12_1

112

05/31/2007

112

chapter 12

phantom links in the supply chain

I then tracked the path of the ‘‘products’’through the IEA plant. Each was shown on the work-in-process reports as being assembled; however, none of them could be found in the finished goods inventory. The shipping dock was my next stop. Since all of the invoices indicated the products were sold for ‘‘customer pickup,’’they should have been recorded in the shipping log. There was no record of the products being picked up. Because these phantom customers had been making real payments for nonexistent products, I next wanted to confirm that IEA had received them. I matched copies of the customer checks to the invoices and found that payment was received just before each invoice reached
90 days. Past that time, the delinquent invoices would have been put on the collection list and eliminated from American Bank’s allowed borrowing base. After confirming that
Tom’s phantom customers had purchased phantom products with real money, I was ready to investigate the suspicious suppliers.
I had determined that payments made by IEA to the six suspicious suppliers accounted for a substantial percentage of the company’s cost of goods sold. Each of these purchase orders showed Tom as both the buyer and the approver of the order. He also initiated the check request and authorized the issuance of checks on the same day that the purchase order was received. I confirmed with accounts payable that Tom personally picked up these checks to pay the suppliers. Tom’s paper companies were folding. The difference between payments made to the phantom suppliers by IEA and cash received from the phantom customers was $1.5 million. This was the amount of cash stolen from the company. There was also the matter of nearly $4 million of bogus accounts receivable that IEA had to remove from its books. Tom’s complex fraud scheme had apparently been a full-time job.
Ken and I met to prepare for Tom’s deposition. I designed questions that Ken could use to walk Tom step-by-step through my findings. Tom arrived for his deposition impeccably dressed and accompanied by his wife and attorney. After he was sworn in and answered background questions, Ken proceeded with a line of questioning that destroyed any illusion that these companies were ‘‘real.’’ Rather than deny the scheme, Tom admitted that he had initially lied. ‘‘Yes, I created these phony suppliers and customers,’’ he said.
‘‘But it was with the express knowledge and consent of the company.’’ When asked to identify specific individuals he said, ‘‘Matt Kramer and the IEA management team.’’ Ken then asked Tom, ‘‘Can you explain why management encouraged you to steal from the company?’’ Tom’s response was disturbingly plausible: ‘‘IEA needed the additional accounts receivable as collateral for the American Bank loan that was keeping them afloat until they could land a large and profitable customer account.’’ He added, ‘‘They were willing to let me take a commission in order to create the phony collateral.’’
Had Tom really been following orders, or was he just using the facts as a justification for his actions? After the deposition, Ken reminded me that Tom had admitted fraud, even if other members of management were involved. The new issue was whether Matt and the management team had been complicit. American Bank had continued to loan operating

Wells4689_c12_1

05/31/2007

113

a long run for a short slide

113

funds to IEA based on those fraudulent accounts receivable, and the company would probably have collapsed if it had not landed the large new account that dramatically improved its fortunes.
At his deposition, Tom produced his personal tax returns and the most recent bank statements for the customer accounts. The tax returns showed a half million dollars of
‘‘commission income,’’ none of which was supported by W2 or 1099 forms, in addition to his base salary from IEA. The only evidence that Tom offered to support his claims of management complicity was his own testimony. Matt and the other managers adamantly denied Tom’s allegations.
After Tom’s deposition, I interviewed IEA’s accounts receivable and accounts payable clerks, both of whom reported to the former CFO, James. They thought that there was
‘‘something fishy’’ about these particular suppliers and customers, but neither clerk felt that he could afford to question Tom. The fact that James signed checks payable to the suppliers and accepted payments from the customers seemed to make it legitimate.
Although I was eager to interview IEA’s senior management team individually, Patterson, who represented the private equity fund, asked me to discontinue the investigation.
Patterson also rejected Ken’s suggestion that IEA management submit to lie detector tests.
The investigation was over.

A Long Run for a Short Slide
I submitted my written report to Patterson several days later. I did not have an opportunity to review the suppliers and customers’ bank accounts because the private equity fund was unwilling to absorb the additional cost. Patterson told me that he and his partners had decided to build on the new customer opportunity at IEA and try to make the company profitable and valuable. A search of Tom’s assets indicated that prospects for any form of monetary recovery were minimal.
With the additional capital injection into the company, American Bank had confidence that its loan would be repaid. The private equity fund hired a new chief operating officer for IEA so Matt could focus his efforts on developing additional new customer relationships. An experienced CFO replaced James, who continued as an employee of the company in an operations area. American Bank did not suffer any loss from the fraud, so the owners were unwilling to file charges that might implicate IEA’s management and imperil their investment. Tom filed personal bankruptcy and moved to
Chicago, where he reportedly landed a job as supply chain manager for a computer peripherals company.
I was frustrated because the investigation was incomplete. Tom had confessed to fraud, but the authorities would not proceed without a complaint. The owners and the bank were determined to focus on the future rather than the past. Had Tom acted alone in creating and executing this complicated scheme? Had he planned, if discovered, to implicate management and cause a standoff? Had management been complicit in order to buy time for the company to become profitable? Or had Tom planned to drive IEA into

Wells4689_c12_1

114

05/31/2007

114

chapter 12

phantom links in the supply chain

bankruptcy in the hope that his phantom customers would get lost in Chapter 7 liquidation? The unfinished investigation left me with many more unanswered questions:


Why didn’t the field auditors from American Bank discover the phantom customers?
Nearly 60% of the accounts receivable of the company, which served as primary collateral for the bank’s multimillion-dollar loan, were fraudulent. When confirming the validity of accounts receivable at IEA, it appeared that the bank’s field auditors contacted Tom’s wife for customer verification of amounts owed.



Was it possible for a fraud of this magnitude to succeed without detection by other members of IEA’s management team? Matt was not only the CEO but the primary salesperson. Tom had no responsibility for customer relationships, yet his phantom customers accounted for a significant percentage of IEA’s total sales. Hindsight is a great benefit, but it is hard to believe that management was totally unaware of the fraud. 

Why didn’t the outside auditors notice the growth in accounts receivable while sales were flat and cash was decreasing? The changes in the balance sheet and cash flows over the four-year period of the fraud should have clearly indicated that something was wrong. By keeping each transaction below the $25,000 review threshold, Tom avoided auditor scrutiny of his phantom suppliers and customers.



Was James merely incompetent, or was he an active co-conspirator with Tom? James permitted Tom to pick up large checks to pay his suppliers immediately rather than using the mail. He also allowed Tom to submit large payments for his customers— just in time to avoid collection efforts for being 90 days delinquent. James appeared to be more ineffective than dishonest.



Was Matt directing his CFO to allow Tom to generate the accounts receivable that would enable the company’s continued borrowing from American Bank? The bank made demand on its loan as soon as it determined that elimination of the phantom accounts receivable from the borrowing base left it undersecured. If not for the major new customer and a large injection of capital, IEA would not have survived.



Why did Tom complicate his fraud scheme by setting up phantom customers, when he could have simply stolen the funds paid to his phantom suppliers? The suppliers took cash out of the company, while the customers brought some of that back and provided receivables as collateral for the bank’s loan. Either IEA management encouraged the scheme to supply collateral for the loan (possibly being unaware of
Tom’s massive theft), or maybe Tom thought he had a better chance of avoiding prosecution if he could implicate IEA’s management.

The bottom line is this: Tom stole $1.5 million from IEA over a four-year period.
He provided sworn testimony and submitted personal tax returns claiming $500,000 of the missing $1.5 million as ‘‘commissions.’’ Unless the owners sued Tom, the case was closed. Wells4689_c12_1

05/31/2007

115

recommendations to prevent future occurrences

115

Lessons Learned
The red flags surrounding Tom and his activities should have been obvious, yet he continued his fraud over a period of four years. How was it possible that IEA’s management, owners, auditors, and bankers did not detect any of these warning signs?
There were many reasons why this fraud succeeded.
First of all, IEA hired Tom to fill a critical and sensitive management function without performing a background investigation. The company should have questioned his short tenure with previous employers. Later it was confirmed that his academic credentials were false or enhanced.
Second, IEA did not have a formal procedure for approving suppliers and customers.The only outside verification was a phone call to the number included with other new account information provided by Tom. The person who answered the phone and provided the confirmation was his wife.
James Porter attained his position as CFO because of his long-term ‘‘loyalty to the company’’ rather than his experience or competence.His entire career was with IEA. His narrow scope of work and lack of professional training failed to provide the preparation necessary to function as an effective CFO. James wanted to please Matt, his CEO, and avoid any friction with other members of the management team. He allowed Tom to set up the phantom suppliers and customers without formal approval, and permitted payments on nonstandard terms.
Finally, IEA’s corporate culture discouraged employees from reporting situations that were overtly suspicious. The accounts payable clerk allowed Tom to pick up payments from IEA to the phantom suppliers on the same day that he submitted purchase orders. In addition, the accounts receivable clerk permitted him to deliver payments to
IEA from the phantom customers immediately prior to going 90 days past due. Although both of these clerks knew that the transactions were irregular, neither of them reported these concerns.

Recommendations to Prevent
Future Occurrences
As a result of the investigation, I made these recommendations to the client:
Background Checks
Careful screening of prospective employees, especially those who will have access to key accounting and process systems, is critical. Background checks should always include
´
´ employment and education verification, with zero tolerance for resume enhancements or omissions. Prospective suppliers and customers must be evaluated as carefully as new employees. The verification process should confirm their good standing, trade references, corporate identity, and creditworthiness.

Wells4689_c12_1

116

05/31/2007

116

chapter 12

phantom links in the supply chain

Encourage Tips
The company should contract with a third-party corporate compliance agent. Employees should be encouraged to report fraudulent activities or suspicious behavior via a confidential hotline.
Tone at the Top
Management must set standards of performance, honesty, and integrity that apply to all employees. The corporate culture within any organization follows the tone at the top. In an open culture, managers do not intimidate employees into making exceptions to approved operating procedures.
The absence of these controls and disciplines at IEA brought the company dangerously close to the brink of destruction by a fraudster. Although Tom was caught and admitted his scam, he was not prosecuted. It is likely that he is continuing his fraudster career with his new employer in Chicago.

Christopher J. Kelly, CFE, is a director at the Dallas, Texas, office of LECG, LLC, a global expert services firm that provides independent expert testimony, original authoritative studies, and strategic consulting services. Mr. Kelly received his BBA and MBA from
Creighton University and has been involved in litigation consulting and fraud investigations for over 16 years.

Wells4689_c13_1

05/31/2007

117

chapter

13

&
The Trusting Business Owner
DAVID H. GLUSMAN

n his stylish office, the impeccably dressed chief executive officer ( CEO) of American
Men’s Clothing (AMC) placed the telephone receiver into its cradle and paused for a moment. Joseph Jones’s muscles tensed. His mind raced as he considered the demands the person on the other end of the line had just imposed upon him. Then he stood up from his desk, walked into the controller’s office, and invited him on an errand to the North
Region Bank. At the bank, Joseph requested a $500,000 wire transfer to an attorney in
Pennsylvania. The bank officer knew the company’s owner well and was aware that the
CEO was still relatively new to the company, but he also knew that the owner trusted
Joseph completely. They had discussed business with the bank together, and the CEO was permitted to sign all checks and bank documents on his own.
Joseph had indicated to the banking officer at North Region Bank that the wire transfer was necessitated by some quick-moving business transactions. Joseph told the bank officer that the wire transfer was to go to the offices of an attorney in Pennsylvania who was acting as an escrow agent on the pending purchase of a substantial quantity of fabric for the fall line of suits. The owner was out of the country and the documentation for the wire transfer was in order, so the banker executed the transfer.
What wasn’t known to the banker or to the owner of AMC at that time was that
Joseph had previously pleaded nolo contendre to a charge of defrauding his former client. Joseph was a certified public accountant (CPA) who had used his position of trust to defraud clients out of hundreds of thousands of dollars. As part of his plea, he was making restitution payments from his salary. He had told the AMC Human Resources
Department that his payments to a Pennsylvania court were part of a child support issue from his earlier marriage. In fact, as would later be revealed, Joseph was not being honest with his probation officer. When he was hired by AMC, he provided the probation officer with a copy of his pay stub, and his restitution was based on that information.
Also, when the arrangements were made with the probation officer, Joseph was living in a rented home. He subsequently received a substantial raise, which, as part of his initial negotiations, provided for a very low starting salary and an increase 60 days later to a salary comparable to his experience level and the position’s responsibilities. Joseph never showed the probation officer an updated pay stub. This allowed him to arrange for low payments

I

117

Wells4689_c13_1

118

05/31/2007

118

chapter 13

the trusting business owner

for restitution while enjoying an increasingly lavish lifestyle and a newly purchased multimillion-dollar home. The call he had received was from the probation officer who had just found out about Joseph’s real earnings, as well as the value of his home. She made a demand that he could not meet on his own. Joseph would have to make alternative arrangements. American Men’s Clothing was founded in 1946 by cousins Albert, Marvin, and
Charlie Schwartz, who were tailors. Years later, Marvin died and his portion of the company had been purchased from his estate. Charlie died shortly after Joseph was hired to run the company and keep it alive after all of the cousins had passed away. Charlie had been impressed when he met Joseph and recommended that Albert hire him to work for AMC.
AMC was a high-quality manufacturer of men’s suits, some women’s business outfits, and men’s separates. It was one of the few remaining such manufacturers that had all of the manufacturing facilities in the United States. At the time of the defalcation, AMC employed over 150 staff in the manufacturing plant and the outlet.
The company had grown over the years, but still operated much like it had when the three cousins had started out. Many of the employees had been with AMC for much of its history, and the accounting controls had not changed much over the years. One of the owners had always signed the checks, so Albert thought that employee theft could not occur. There was simply too much checkbook surveillance. In addition, as occurs in many small family businesses, the owners used the company coffers for personal expenses, including gifts for their wives, nonbusiness travel, and related items. The accounting department did not question expenditures for the top brass.

Where There’s a Will, There’s a Way
The following week, when Albert returned from his business trip abroad, the banker called and advised him that the company had nearly exhausted its line of credit and was desperately close to a cash shortage. He wanted to know if Albert was in a position to put up additional collateral to extend the corporate line of credit. This confused Albert, as he was sure there was at least an additional $500,000 available in the line of credit. After reviewing company financial records with the controller, Albert was advised of the transfer that Joseph had authorized during his absence. He was flabbergasted. Albert knew there was no reason for a wire transfer to an attorney in Pennsylvania. His pulse quickened as he thought about the current condition of his company. He placed a call to his longtime trusted attorney, Bruce Roth.
I was just finishing my morning cup of coffee at my desk on the 24th floor of 1601
Market Street when I received a call from one of my partners. I was the director of
Litigation Support Services at the firm.
‘‘Come down to my office. I have an attorney named Bruce Roth on the phone, and he needs us to do some checking for him right away. He thinks his client, a menswear clothing store owner, may have been ripped off by an employee.’’ A short telephone conversation

Wells4689_c13_1

05/31/2007

119

the big idea tm

119

with legal counsel revealed the essence of the concerns and helped me set the initial course of action.
I started organizing the forensic accounting engagement at AMC just a few hours later.
It was the beginning of Memorial Day weekend, and my initial thoughts were to safeguard the assets of the company, making sure the financial records could be secured, and schedule the staff to leave for the job site on Monday morning. I arranged for a private guard service to be put in place right away. I was advised that the primary suspect in the misappropriation was away for the holiday weekend and wasn’t expected to return to the company headquarters until Wednesday morning.
The initial concerns that related to the shortage in the line of credit expanded within a very short period of time. Even before I started investigating the details of the defalcation, I initiated an investigation into the background of Joseph, CEO and suspect. Together with the attorney, we determined that he had a criminal record. Then something eerie happened. Without being alerted to the possible fraud, a former employee faxed the owner of AMC a photocopy of a newspaper article that had appeared in a Pennsylvania paper explaining Joseph’s previous nolo contendre plea.
When Albert, who at that point was the sole owner and chairman of the board of
AMC, asked the controller whether he knew anything about a $500,000 wire transfer, he acknowledged that he had accompanied Joseph to the bank the previous week. When
Albert asked the controller why he had done that, he replied, ‘‘Mr. Schwartz, you told me to trust him; you told me that he had your full faith and trust and that I was to follow his orders explicitly. I have done that since the day you hired him.’’
During the holiday weekend, additional calls with legal counsel led us to also understand the degree to which Joseph had ingratiated himself with the chairman of
AMC. Albert had rewritten his will less than a year earlier and had made Joseph a 10% owner of the company upon his death. We worked with Albert’s lawyer over the weekend to add a codicil to the will, eliminating Joseph from any eventual inheritance.

The Big IDEATM
Our preliminary discussions and review of documents revealed Joseph’s history of deception and a long list of misappropriated funds that severely undermined the company’s financial stability. We determined that the purpose of the attempted wire transfer was to make restitution for the prior defalcation that Joseph had committed at his previous company. This was not known by AMC or Albert, despite the routine background check conducted by AMC attorneys. In addition, numerous payments were made to a female friend of Joseph, authorized by the CEO as casual labor, when in fact no work had been performed. There were payments to contractors for maintenance and improvements made to Joseph’s new home, which was determined to be worth $1.8 million based on an appraisal. The original purchase price was $300,000 and the house had been extensively renovated and expanded in the meantime. Joseph routinely submitted exorbitant expense account statements without supporting receipts. He gave himself unauthorized salary

Wells4689_c13_1

120

05/31/2007

120

chapter 13

the trusting business owner

increases, in addition to several salary advances that were provided to him under rushed circumstances. Joseph initiated payments to the controller and other employees to obtain their participation in the deception. AMC’s telephone expenses included seven cell phones, including Joseph’s own, his girlfriends’ (2), his ex-wife’s, and his three children’s, totaling over $600 per month for almost three years.
In just over 30 months, Joseph had misappropriated over $1.4 million from the company he was entrusted to lead. By utilizing a variety of techniques over the Memorial
Day weekend, I was able to determine most of the issues that had been revealed in the preliminary discussions in significant detail.
With IDEATM software, I performed an analysis of the accounts payable and cash disbursement records for the entire time frame of Joseph’s employment at AMC. IDEA allowed me to perform an analysis of several million transactions without spending significant staff time. By utilizing IDEA, we were able to perform cross-reference checks between vendor names, vendor addresses, telephone numbers, and, in the case of payroll records, Social Security numbers.
The use of the IDEA software allowed for a complete computer-based analysis of the various transactions that were initially uncovered. My interview with the controller, as well as an interview with the director of human resources and the head of the accounts payable department, allowed for a fairly rapid understanding of the various methods that were used and the places that would most likely reveal the depth and scope of the employee defalcation orchestrated by Joseph.
Buried among the repairs and maintenance expenses for the company’s two physical locations were payments for expenditures ranging from routine weekly lawn service to the installation of a state-of-the-art bathroom/spa facility in Joseph’s home. Additional expenditures included fencing, a security system (both the installation as well as the monthly monitoring expenses), and a telephone system.
‘‘Casual labor’’—a category that is utilized for hiring temporary workers for moving large quantities of finished goods—was used for part of the fraud. The documentation that had been provided to the accounts payable department included photocopies of money orders. The money orders had been purchased by Joseph in denominations ranging from $25 to $100. He made photocopies of the money orders (often 5 to 10 at a time) and submitted them for reimbursement of his payment for ‘‘casual labor.’’ In fact, when the banks were questioned with regard to the ultimate disposition of the money orders, it was determined that Joseph had purchased them, made the photocopies, and deposited each of the money orders back in his own bank account, generally within a
24- to 48-hour period. ‘‘Casual labor,’’ which previously ran between $3,000 and
$5,000 per year, was now costing between $20,000 and $25,000 under Joseph’s method of reimbursement. The accounts payable department and the controller had previously handled expense accounts for the owners without documentation. So the accounting department thought nothing of routine reimbursements on expense accounts without any documentation. Even on the face of the expense reports, most of the expenditures were clearly without business purpose. Joseph’s expense reports often had

Wells4689_c13_1

05/31/2007

121

greasing the wheels

121

headings as obfuscating as ‘‘dinner,’’ without any indication of where, why, or who might have accompanied him.

Greasing the Wheels
Upon questioning the controller, the accounts payable director, and the human resource director, I also determined that each of them was provided with relatively small perks after Joseph joined AMC. Individually, none of these perks was extraordinary or exorbitant, but they helped Joseph smooth the way for each of these individuals to inadvertently assist him in more significant frauds. The controller had a minor emergency in his family; his daughter had run over some nails in the road and needed four tires, but did he not have a credit card to pay for it. With Joseph’s approval, he used the company credit card to arrange for the replacement of his daughter’s tires.
When the bill came in, the controller attempted to repay the company for the borrowed money, but Joseph waved him away, saying ‘‘Don’t worry, you worked a lot that month; it’s on the house.’’ Although the man indicated that he felt slightly uncomfortable with the company taking responsibility for his personal expenses, he accepted Joseph’s generosity. The accounts payable supervisor was provided with a vacation package on AMC’s tab when, instead of paying for four or five hours of overtime during a particularly difficult period, Joseph suggested that the supervisor and his wife ‘‘go somewhere warm.’’
Then he scheduled a flight and a weeklong vacation in the Caribbean, all expenses included. The human resources director was also given an extra week of vacation time at one point. When she indicated that she wasn’t going to make any plans because her budget was tight, Joseph again offered to pay for the airfare and accommodations at the same
Caribbean resort he had previously used for the accounts payable manager.
The documentation of each of these items was completed by obtaining photocopies of the underlying checks and/or other records, and preparing them for submission to the insurance company. Fortunately, AMC had fidelity bond insurance during Joseph’s entire tenure.
During the second week of my investigation at AMC, I received a telephone call from legal counsel for the company indicating that I was going to be visited at company headquarters by an FBI agent. The bank officer, upon learning that the transfer that he had authorized was, in fact, fraudulent, had notified his manager. Because a federal bank institution was involved, the bank’s legal counsel decided it was appropriate to notify the federal regulatory authorities, who would then notify the FBI. During the ensuing meeting, the FBI agent asked for photocopies of all of the documentation that I had put together. When the research on the first charges concluded, I learned that the original crime was a theft from a client, as well. Joseph held a CPA certificate and had a part-time practice.
He cheated a client out of over $650,000 by using the client’s bank account information to transfer funds to an account he had set up to support a girlfriend.

Wells4689_c13_1

122

05/31/2007

122

chapter 13

the trusting business owner

Subsequently, the federal government indicted Joseph. About two years later, he pled guilty and received a five-year minimum sentence for a single count of federal wire fraud.

A Last-Ditch Effort
While the fraud in this case far exceeds the average amount across all businesses, the losses were not unusual for a family-owned business. In addition, the types of fraudulent transactions and the factors that allowed them to occur at AMC are very common.
In terms of the resolution of the fraudulent action at AMC, I conducted a detailed analysis of all of the company’s payroll and financial transactions over the course of
Joseph’s tenure. A variety of computerized transaction analysis methods were used to identify possible fraudulent activities. I then sought supporting documentation for possible illegal transactions. All of these data were then assembled into a claim that was filed with the company’s fidelity bond carrier. The claim totaled $1.6 million. Initially the bonding company rejected the claim under the theory that the company’s oversight of its financial transactions was so inadequate that the transactions were not fraudulent. We worked with the company’s legal counsel and together were able to establish that fraud indeed existed and that it was properly defined under the employee fidelity bond that was in place. That resulted in a $1.4 million insurance payment (the policy limits). As these proceedings were occurring, we worked with AMC to establish proper financial control procedures and management reporting procedures, which have continued to work effectively at the company.
The original background check was performed by AMC’s law firm, but the company never clarified exactly how it had missed Joseph’s previous criminal activities. When I uncovered the criminal history, my investigator suspected that timing was the issue. The investigation into Joseph’s background had been performed so soon after his plea agreement that the system might not have recorded the event at the time of the initial inquiry by the law firm.
To make the case even more tragic, two weeks after the fraud was uncovered, Albert had had a fatal heart attack on the shop floor. Fortunately, Albert’s attorney had written that codicil to the will during that fateful Memorial Day weekend, eliminating Joseph’s bequest.

Lessons Learned
Pressure to commit fraud can come from personal financial problems, personal vices such as gambling or excessive debt, and unrealistic deadlines or performance goals. In the AMC case, Joseph was under extreme financial pressure; he owned a very expensive house with a mortgage that he could not afford on his salary. He lived a very lavish lifestyle characterized by the newest and most expensive possessions, including the newest girlfriends. Joseph was also hiding his previous fraud case and was worried about this information being uncovered. All of these pressures led him to commit fraud.

Wells4689_c13_1

05/31/2007

123

recommendations to prevent future occurrences

123

Family-owned businesses are especially susceptible to employee fraud because they may not have the staff or organizational structure to implement adequate financial controls efficiently. A variety of other situations may explain the absence of proper financial controls at AMC. For example, as the company grew and evolved, the informal financial procedures of its early days were never updated.
At AMC, several factors created an open opportunity for fraud. The financial controls in the company never changed, even though it had grown to $35 million in annual sales. The company employed only a controller and an accounting manager. It did not employ a chief financial officer with the proper perspective and skills to lead financial operations. The past ‘‘minor’’ indiscretions by the owners in making personal payments from the company coffers allowed the controller and the accounts payable staff to view ‘‘personal’’ expenditures by the upper echelon of management to be acceptable. The company’s founder and owner was in his 70s and was not as active in day-to-day management as he had once been. As the CEO, Joseph could authorize large expenditures and could sign checks without a second signature. He was able to gain the support of the controller and accounting staff through subtle coercion and financial rewards and reimbursements.
The company had fallen on hard times as competition from overseas manufacturing increased. Joseph was hired to rejuvenate the business and restore it to its previous position. He was able to achieve some initial success, which resulted in the owners giving him unusual latitude in financial matters. In addition, he was able to charm the owners and establish a close personal relationship with Albert. The situation of the trusted employee is one of the most common elements in employee fraud. With blind trust, employees are more likely to commit fraudulent transactions.

Recommendations to Prevent
Future Occurrences
Segregation of Duties
Proper segregation of duties is important so that there are built-in checks and balances whereby a single employee is not able to complete a financial transaction on his or her own.
For example, in the area of cash receipts, one employee should gather all of the funds received and prepare a bank deposit. A second employee should verify the amount of that deposit and actually make the deposit. One employee should approve expenditures, and a second employee should make the actual payment (write the check). A third employee should sign the check, reviewing all of the underlying paperwork and documentation.
Check for Supporting Documentation
All financial transactions should have proper supporting documentation. Expense account reimbursements must be supported by receipts, paychecks must be supported by proper time recordings, and accounts payable items must be supported by detailed invoices.

Wells4689_c13_1

124

05/31/2007

124

chapter 13

the trusting business owner

Limit Authorized Size of Transactions
Strict limits on the authorized size of each transaction before a review or countersignature is required. For example, there should be a specific dollar limit on the checks that can be signed by one individual. All checks greater than this amount must have two signatures.
Proper Reporting
With today’s computerized accounting systems, it is easy to create management reports that highlight the financial transactions that are susceptible to fraud and of interest to the company’s owners. The purpose of these reports is to allow owners the ability to review important financial transactions to ensure that they are in line with established policies and limits. In small family-owned businesses, where efficiency is especially important, this reporting process can focus only on the exceptions—those transactions that exceed the dollar amount or other parameters that management wants to review.
Periodic Audits
The third component of fraud prevention is periodic audits of transactions and procedures that are subject to fraud. Family-owned businesses usually do not have an audit staff that is separate from the accounting and financial management staff. Therefore, it may be difficult for the company’s staff to conduct an objective and independent internal audit. This task may be handled by the company’s accounting firm as part of its annual engagement.
Separate reports on possible duplicate payments and review of the payees’ addresses can also be helpful in preventing fraud.
Communication
Another component of prevention is communication. Owners and senior management should clearly express their concern for employee honesty. Management should set high standards for honesty and communicate the expectation that employees comply with them. This will go a long way in deterring fraud and will indicate support for any employees who may be aware of fraudulent activities.
Background Checks
Conduct thorough background checks on all employee candidates. The law firm did not conduct a thorough enough background check on Joseph before he was hired at
AMC. It is important to keep in mind that fraudsters often go to great lengths to protect themselves, even fabricating previous employment history and education. To flush them out, it can be important to arrange for a second search of public records by a competent and ethical investigator more than 30 days after the initial search. Review all

Wells4689_c13_1

05/31/2007

125

recommendations to prevent future occurrences

125

application information with candidates, ask detailed questions to reveal gaps in employment history and education, and explore red flags.
Conduct complete reference checks—including criminal, education, employment, residence, credit, Social Security, driving record, and professional affiliation and license. Ask schools—not the applicant—to send transcripts, and make sure they agree in all material aspects with the representation of the applicant. Administering psychological and behavioral testing for management positions should also be considered. David H. Glusman, CPA, CFS, is the director of forensic accounting and litigation support services at Margolis & Company, P.C., of Bala Cynwyd, Pennsylvania. His firm provides forensic accounting and business valuation services. Mr. Glusman is also the lead author of Fiduciary Duties and Liabilities: Tax and Accountant’s Guide (CCH,
2007).

Wells4689_c14_1

05/31/2007

126

chapter

14

&
The $13 Million Man
JOHN FRANCOLLA

hen Jerry Terranova, a 20-year-old from Chicago, moved to New Port Ritchie,
Florida, a suburb of Tampa, a family member who was employed by American
Insurance Company suggested that he apply for a position there. Shortly thereafter, Jerry was hired as a data entry clerk in the Corporate Controllers Department of the insurance company. A minimal background check was completed since this was a low-entry position.
From the beginning, Jerry was well liked by his associates and his management team. After one year, his supervisor rated him above average and quickly provided him with many new challenges and additional responsibilities. Jerry gave everyone the impression that he had plenty of money. His hobbies, like refurbishing antique automobiles, were expensive. Jerry constantly offered advice on how to make fast cash. His favorite pastime was betting on sporting events, especially football games, with a local bookie.
The American Insurance Company (AIC) was established in 1867 and is considered one of the strongest financial institutions in the world. The headquarters is located in
New York City and has representation in 20 countries around the world. AIC sells life and health insurance, pensions, annuities, 401KS, and auto and home insurance. AIC employs millions of people in sales and back-office operations in 30 dispersed locations.
The administrative office in Tampa handles the accounting function for the company.

W

On the Radar
I was in my office in New York City as part of a Special Investigation Unit when I received a telephone call from Dan Murray, a collection manager of a federal credit union in
Sonoma, Arizona.
‘‘How can I help you?’’ I asked.
‘‘Well,’’ he began, ‘‘my president has released a memorandum to all employees that any deposit of $20,000 or more should be reviewed and possibly investigated. On the date of the memorandum, I observed that a $6,490,357.69 check made payable to a Magnolia
HealthCare LLC and issued by AIC was deposited into the company’s account. I tried to contact AIC to verify this check. I noticed that it was being sent to a nearby residential address in a low-income area of Sonoma, AZ. When I visited the address, I saw that it was a
126

Wells4689_c14_1

05/31/2007

127

on the radar

127

run-down single-family home. Finally, I spoke to someone in the Tampa, Florida, office whom I asked to verify whether or not the $6,490,357.69 check was bona fide. An unknown female indicated that she had reviewed the electronic check register and it appears to have been approved and issued properly.’’
Dan, who previously worked for an investigative unit at another company, found this to be suspicious and asked her to contact the authorizer of the check and get back to him.
When nobody returned his call, he reached out to my company’s Special Investigation
Unit.
‘‘Would you fax me a photocopy of the check?’’ I asked.
Once I received the copy I would complete a preliminary investigation. Dan placed a voluntary freeze on the account until I verified the check and we agreed to complete a joint investigation.
Next I contacted the officer in charge of the Tampa office and asked if he could have one of his directors provide me with copies of the paperwork authorizing this check. Taylor
Dooley, the vice president, said he would obtain the information and deal directly with me. He mentioned that he believed that one of his employees did contact the authorizer of the Magnolia HealthCare check: a woman by the name of Mary Barillo.
When questioned, she stated that she did not authorize the issuance of the check.
The next day, Taylor contacted me and advised that several people from his organization had investigated this case by interviewing coworkers and documenting their responses.
The employees determined that on the same day, another sizable check for the amount of
$6,225,165.06 was issued to Real Estate Investments Professionals LLC on North 73rd
Avenue in Sonoma, Arizona.
I suggested that Taylor instruct his employees to stop contacting anyone within or outside the company and that I would lead the investigation from here on out. Last, I recommended that whoever was involved should document their efforts. As part of my investigation, I would speak with each of the members.
I contacted Tom MacDonald, director of accounting in Tampa, to determine what was completed by his unit. Tom told me that Jerry Terranova, one of his employees, had allegedly received a telephone call from our Bridgewater, New Jersey, office, and that an unknown caller wanted two checks issued as soon as possible: one for Magnolia
HealthCare LLC and the other to Real Estate Investors Professionals LLC. Jerry provided the caller with a voucher number for the two checks. Jerry told Tom that he did not recall whether the caller was a female or a male. After receiving the fax, he prepared the entries necessary to issue the checks. Jerry then went to his associate, Rhonda Madison, whose job was to approve the entries prior to having the checks issued. She verified the authorizing signature on the two accounting forms by comparing it with a signature on an electronic file. The signatures appeared identical to that of Mary Barillo, the approver. The two checks totaling $12,715,522.75 were then issued electronically and mailed to the designated addresses. When Rhonda was interviewed, she acknowledged making sure that
Mary was within her approval limit of $50 million for requesting checks to be issued by the company to a provider.

Wells4689_c14_1

128

05/31/2007

128

chapter 14

the $13 million man

I called Dan, who answered his telephone on the first ring.
‘‘Hello, John. Do we have a check fraud?’’
‘‘We sure do,’’ I replied, ‘‘and American Insurance Company will always be grateful to you.’’ I told Dan that on the same day, a second check was issued improperly to Real Estate
Investors Professionals, in the amount of $6,225,165.06. Dan reviewed his online credit union system.
‘‘I don’t see a check for that amount and that date,’’ he said.
He agreed to send a message to other banks and credit unions to see if anyone local had deposited the Real Estate Investors Professionals LLC check.
I told him two stop payments had been placed today on our administrative electronic check payment file, just in case the checks resurfaced at another financial institution. This internal action would minimize the potential loss for AIC.
Next, I told Dan that the U.S. Postal Inspection Service was aware of this situation and that they had suggested that I work jointly with them. Dan was willing to help and promised to send me copies of the documentation used to open the Magnolia HealthCare
LLC account on East Scenic Avenue in Sonoma, Arizona. He said that the ownership of this account changed from Frank Tilos to Jorge Castera two days after the issued date of the check. Furthermore, the prior address on the credit union records was the same as the address shown on the Real Estate Investors Professionals LLC check: North 73rd Avenue in Sonoma, Arizona.
I told Dan that James Turner, a U.S. Postal Inspector, was assigned to this case and we were planning to visit the Tampa office next week to interview Jerry Terranova regarding his involvement in this case. Then we would interview Frank Tilos and Jorge Castera, his account holders.

That Guilty Look
The day of the interview, we reserved a small conference room. James Turner, my partner in the investigation, felt that I should begin by myself and invite him into the interview after a few moments. I contacted Jerry’s supervisor, Tom MacDonald, and asked if he would accompany us in the conference room. He entered the room and introduced me to Jerry. When I initially made eye contact with the suspect, I noticed that around his neck, he wore a gold chain that had to be worth more than $1,000. Jerry’s attire was flashy, overall. He reminded me of John Travolta from Saturday Night Fever.
‘‘Jerry,’’ I began, ‘‘you are being interviewed because you were the one who apparently received a telephone call from someone claiming to be from the Bridgewater, New Jersey, facility. Can you tell us exactly what transpired with the issuance of the two checks to
Magnolia HealthCare LLC and Real Estate Investors Professionals LLC?’’
Jerry said that he received a telephone call from an unknown person which he believed then to possibly have been a man; earlier he had told Tom that he could not remember the gender. This individual said that he needed to have two checks issued as soon as possible.

Wells4689_c14_1

05/31/2007

129

that guilty look

129

Jerry began the story: ‘‘I furnished the caller with voucher numbers that needed to be entered on the accounting form. Then I received a fax from Bridgewater, New Jersey, and the accounting forms listing the two checks that needed to be issued and mailed to the
Arizona addresses. As usual, I prepared the jackets for the two check requests and gave them to Rhonda Madison for approval. She verified the signature on the accounting form and that the two checks were within her approval limit. Next, the checks were sent to the addresses on record.’’
We asked Jerry who entered the voucher numbers on the accounting forms and who sent the fax addressed ‘‘Attn: Jerry.’’ In all instances, he stated that it had to be the person whom he believed to be an unknown male from the Bridgewater facility.
I told Jerry that I had reviewed the telephone records from Bridgewater and another local installation in New Jersey and no one had contacted him requesting the issuance of the two checks. He insisted that someone did telephone him that day, but changed his story to claim that possibly the call could have been made from another facility. I reminded him that the emergency contact at the Tampa office was Rhonda Madison, not him. Next, I pulled out his employment application and the fax from Bridgewater, along with other accounting forms, and arranged them on the desk before Jerry.
‘‘Do you see the similarities in handwriting on your application and the rest of the forms
I have here?’’ I asked.
Jerry agreed that his writing compared favorably to that of the alleged unknown person’s handwriting, but he would not admit to completing these forms.
I asked him why on the Bridgewater, New Jersey, fax sheet, his fax number appeared rather than the sender’s fax number. Jerry could not offer a reasonable explanation.
‘‘Jerry, I want to point out that the area code of the number listed on the fax memorandum and the area code on your employment application are identical,’’ I said, hoping to break him.
‘‘I did not write the fax document received from Bridgewater, New Jersey!’’ he swore.
I asked Jerry to review an old original accounting form that was completed by Mary
Barillo a couple of weeks prior to the two checks being generated. He agreed that the approver signature on the original form and the two recent accounting forms were identical and that someone could have superimposed her signature on the recent accounting forms. He also agreed that the accounting form shown to him had to be the one that was used to superimpose her signature. Jerry suggested that the unknown person in the Bridgewater, New Jersey, office probably created the duplicates prior to sending them to him.
I informed Jerry that Bridgewater personnel did not have any original forms since the accounting forms are FedExed directly to Tampa. We concluded that the improper forms had to be created in Tampa, Florida, prior to faxing the information to him.
I offered a possible scenario, suggesting that by using the original accounting form, an individual could have scanned the document, creating a new file on a computer. The writings on the new document located on a computer could be modified by name or amount of check, producing an accounting form with the approver’s signature.

Wells4689_c14_1

130

05/31/2007

130

chapter 14

the $13 million man

He’s Gotta Go
At this time, he showed concern and asked me if we could take a bathroom break. As Jerry and I left the conference room together, he asked me what was going to happen to him regarding his employment or with law enforcement. I advised him that it was a very serious situation and that the person who was instrumental in issuing these checks could face criminal charges. Then we entered the men’s room and he went into a private stall. He was there for a long time without speaking.
When he finally emerged from the stall, he said, ‘‘Why don’t you hire a forensic handwriting expert to find out if I did actually write those documents to generate the two checks?’’ ‘‘Why don’t we just return to the conference room?’’ I replied.
It was now time to update James, my partner in the investigation, so that he could enter the interview and begin the second phase of our plan. James decided that he would play the
‘‘bad guy’’ and wanted to take a couple of minutes to interview Jerry.
James explained to Jerry that he was working with me on an investigation for the
Sonoma, Arizona, grand jury under an assistant U.S. attorney.
‘‘Jerry, you are a target of the investigation because you are the one who improperly requested that the two checks be issued and mailed to the Arizona addresses. The Assistant
U.S. Attorney believes that the investigation will point to potential federal criminal violations of mail and wire fraud. This is very serious,’’ he continued.
James then presented Jerry with a subpoena to testify before the grand jury in Sonoma,
Arizona. The subpoena also requested that he provide sufficient quantity of fingerprints, palm prints, and handwriting samples for expert comparison. James advised the suspect to engage the services of a criminal attorney.
At this point, Jerry was unsettled once again. He did not provide any additional information, so I advised him that I was in touch with our Legal Department and that, effective immediately, he would be placed on administrative leave of absence until a decision was made by senior management. Finally, I asked for his badge and escorted him out of the building.
I returned to the conference room, where James and I discussed the case. We agreed that Jerry Terranova was the one who had the two checks issued and mailed to the
Arizona addresses. But the question remained: Why would Jerry be part of a scheme to issue two checks totaling approximately $13 million? I suggested that gambling was probably part of the problem. James felt that it had to be more than just gambling.
Maybe Jerry felt that if he was already breaking the law, then why not write the check for more than the amount he owed to a bookie? That way, he would make a profit from the deal.
James and I decided that we needed to review telephone records for a couple of months originating from or received by Jerry Terranova’s Tampa office. Also, we needed to identify all the players in this check fraud scenario. We would have to travel to Sonoma,
Arizona, to interview Frank Tilos and Jorge Castera, the account holders.

Wells4689_c14_1

05/31/2007

131

he’s gotta go

131

The following week, James and I decided that we would go unannounced to interview
Frank Tilos. Through reviews of external databases, we were able to determine that Frank
Tilos had many companies, one being Dynamic Realty, located on North 59th Avenue in
Sonoma, Arizona.
When we approached Dynamic Realty, the plan was that as the business investigator, I would enter first, followed by James. In this manner, if anything went wrong, my savior, the U.S. Postal Inspector, would have enough time to react. The room was reasonably large with many desks and people working. I approached the receptionist’s area close to the door and asked the woman behind the desk if I could speak with Frank Tilos. She pointed to an elderly man, short in stature, in his 60s.
The receptionist asked us to follow her to where her boss was sitting. I introduced myself. Then James told Frank that he was a U.S. Postal Inspector. I mentioned that American Insurance Company was investigating the issuance of two checks: one to a Magnolia HealthCare LLC and the other to Real Estate Investors Professionals LLC. I asked Frank if he could shed some light on why these checks were issued. Frank Tilos explained that he created Magnolia HealthCare LLC with a former partner a couple of years ago. He subsequently bought his partner’s share and became the sole owner. Later he transferred the ownership to Jorge Castera. Magnolia HealthCare LLC was an adult care home with no clients. This company operated out of a single-family home on East Scenic Avenue. Frank mentioned that Jorge Castera lived at that address and was responsible for managing the property.
He confirmed that the $6,490,357.69 American Insurance check payable to Magnolia
HealthCare LLC was mailed to East Scenic Avenue. Frank said he had received a telephone call from Jorge Castera who had said, ‘‘I’m rich!’’ and explained that he had received the check. Jorge thought that the check was ‘‘play money’’ and jokingly referred to it as
‘‘money from heaven.’’
Frank continued, ‘‘I instructed Jorge to deposit the check into the Magnolia
HealthCare credit union account. I never expected that it would clear the credit union.
I also remember telling Jorge that it was possibly a gift or a settlement from a prior adult care home client that had resided at the Scenic Avenue address. When the credit union rejected the check, I told Jorge it could have been due to the recent change of ownership from between us,’’ he explained.
Then we asked Frank about a company called Real Estate Investors Professionals LLC.
He stated that he created this company to serve as a ‘‘shell company’’to purchase real estate.
Once again, Frank changed the ownership over to Jorge. He said that the North 73rd
Avenue, Sonoma, Arizona, was his home address.
‘‘Do you remember receiving a check payable to Real Estate Investors Professionals totaling $6,225,165.06 at your home address?’’ James pressed on.
‘‘No,’’ Frank contended, ‘‘I never received this check.’’
‘‘Are you aware of any scheme to obtain fraudulent checks, Frank?’’ asked James.
‘‘No.’’

Wells4689_c14_1

132

05/31/2007

132

chapter 14

the $13 million man

Reach Out and Touch Someone
As part of the investigation in Arizona, James was able to obtain telephone records from
Frank’s residence through a subpoena. Utilizing an external database, we identified additional individuals who could have been involved in the scheme. At this point in the interview, James began throwing these names at Frank. This proved to Frank that we knew a lot about the fraud.
‘‘Vincent Tusso, David Romito, Hilario Romito, and Larry Romito? Do any of these names ring a bell?’’ James asked.
‘‘No,’’ Frank replied.
´
‘‘Do you know a Vincent Tusso, Cappios Cafe, Barter Brokers, or Child’s Play
Computer?’’ James listed.
‘‘No.’’
Finally James told Frank that at the time the two fraudulent checks were issued from
AIC, there were numerous telephone calls back and forth from his two residential telephone lines to these entities and individuals.
‘‘I don’t know these people, nor did I make any of these telephone calls!’’ Frank exclaimed. We asked him if Jorge Castera was in the office or if he would be expected later.
‘‘He’s over there.’’
Once again, the two of us walked to Jorge’s work station, introduced ourselves, and began the interview. Jorge confirmed that his address was 1517 East Scenic Avenue. He also confirmed that he managed Magnolia HealthCare LLC and admitted to receiving the
$6,490,357.69 check payable to Magnolia HealthCare. Jorge mentioned that he contacted
Frank Tilos, who suggested that possibly an insurance company issued the check on behalf of an elderly client.
After Jorge consulted with Frank, he deposited the check into his account at the credit union. Later, when Frank contacted the credit union to determine if the check had cleared, he was told that the check was cancelled. Next, he confirmed that he was the current owner of Real Estate Investors Professionals LLC. When asked if he received a
$6,225,165.06 check from American Insurance Company, Jorge denied ever having received it.
We concluded the interview by asking him if he knew a David Romito, Larry Romito,
Hilario Romito, John Terranova, or Vincent Tusso. Jorge swore that none of the names sounded familiar. James mentioned that Larry and David Romito had contacted Frank
Tilos’s residential telephone number on regular bases.
‘‘I told you. I do not know any of those people,’’ Jorge replied.
‘‘Well, then,’’ James said, ‘‘I advise you to hire a criminal attorney, since this case is currently with the Sonoma, Arizona, grand jury.’’
In following the remaining leads from the telephone records, the investigation returned to New Port Ritchie, Florida. We had to determine who else was involved in this fraud scheme. We needed to identify and interview Larry Romito, who had made several phone

Wells4689_c14_1

05/31/2007

133

reach out and touch someone

133

calls to Frank Tilos. Through an external database we were able to find that Larry Romito lived in New Port Ritchie. At times, there had been telephone calls from Barter Brokers to Arizona. The owner of Barter Brokers was a Vincent Tusso, who also lived in New Port
Ritchie.
James and I drove to the address where Larry Romito supposedly lived. I knocked. A woman opened the door and introduced herself as Ella Romito, who was apparently divorced from Larry. I asked if Mr. Romito was at home and Ella began to cry. After some questioning, she explained that yesterday morning a couple of men came to her home and took her former husband away. We found that Larry’s real name was Hilario.
´
When we mentioned the name Cafe Caprios, she said that her son, Michael Kennedy,
´
was the owner and that the cafe was no longer in operation. She provided us with her son’s address.
As we left the house, James contacted the local U.S. Postal Inspection Service to find out if Larry had a criminal record or was currently incarcerated. On the way to Michael
Kennedy’s home, James received a call confirming that Larry was in jail and had been arrested recently. He apparently had a revolver with no serial number in his possession.
The individual James was speaking with stated that Larry—or Hilario Romito—had been arrested several times for bookmaking, robberies, and other crimes.
We contacted Michael Kennedy, a nurse in his early 30s, and the owner of the defunct
´
Cafe Caprios. When asked of his relationship to Larry Romito, he stated that he was his stepfather. Michael told us that, for approximately six months, Larry took over running
´
the cafe while he was recovering from a motorcycle accident.
James once again mentioned some of the names of the people in Arizona, but Michael
´
did not know them. We also cited the many telephone calls that were made from Cafe
Caprios to Arizona. Michael concluded that his stepfather must have made the calls, since he was at home during that time. When James asked about Vincent Tusso, Michael said he knew him and his two sons.
‘‘Vincent Tusso Sr. owns a pawnshop and a computer company in New Port Ritchie,’’
Michael said. ‘‘My stepdad and Mr. Tusso are close friends. Larry used to work for him at the pawnshop.’’
The next day, James and I drove to Barters Brokers, a pawnshop in New Port Ritchie.
When I opened the door, I saw an elderly man sitting behind the desk.
‘‘Are you Vincent Tusso?’’ I asked.
‘‘Who would like to know?’’ replied the man.
‘‘An investigator from American Insurance Company,’’ I responded.
‘‘Can I see some identification?’’ Vincent asked.
I reached into my pocket. ‘‘Here’s my business card. The other gentleman is James
Turner, U.S. Postal Inspector.’’
We asked him if he knew Larry Romito.
‘‘Sure, I’m friendly with the Romito family. I’ve known them for 13 years. Romito was arrested last week by a federal agency for an illegal firearms sale. I’m trying to raise money for his bail.’’

Wells4689_c14_1

134

05/31/2007

134

chapter 14

the $13 million man

‘‘Do you know anything else about the Romito family?’’ I asked.
´
‘‘Larry hangs out in Cafe Caprios in New Port Ritchie. My son, Vincent Jr., and his friend Jerry Terranova—’’
‘‘Jerry Terranova? What can you tell us about this man?’’ I asked.
‘‘Well, he spent a lot of time with my son. Vincent Jr. helped the boy fix his computer when it crashed.’’
James and I concluded that Vincent’s son must have shown Jerry how to scan a document to produce two accounting forms with Mary Barillo’s signature.

It’s Child’s Play
Next, we told Vincent that a number of telephone calls between suspects in an investigation had been made to and from both Barter Brokers and Child’s Play Computer, both of which he owned. Calls were also made to Romito’s mother and brother in
California. Vince admitted to speaking to David Romito on the telephone but claimed he never met him. We asked for directions to Child’s Play Computer Store.
‘‘It’s next door,’’ he said.
‘‘A pawnshop and a computer store side by side. Very unusual,’’ I whispered to my cohort. Since my investigation was in conjunction with U.S. Postal Authorities, and under direction of the Sonoma, Arizona, grand jury, the Assistant U.S. Attorney handling the case was contacted by Frank Tilos’s attorney. He said that his client would testify in substance to lessen his future sentence. He indicated that Frank had received a telephone call from Larry Romito, the nephew of his ex-wife. Larry was trying to obtain guidance on how to establish a new or use an existing corporation. Frank advised that he had two dormant corporations, one called Magnolia HealthCare LLC and the other, Real Estate
Investors Professionals LLC. After hearing about the two corporations, Larry decided to visit Frank in Sonoma.
At Frank Tilos’s home, Larry Romito told him that he had ‘‘legitimate claim checks’’ coming from an AIC. Larry wanted to invest some of the funds in real estate and to withdraw some of the money. He claimed to have done this before, using a coffee shop in
´
the name of his son (Cafe Caprios) and a computer company in Florida. The checks were tax free since they were personal injury claims. He also mentioned that he had a relationship with an insider at the American Insurance Company who could issue the checks. They decided to use the two corporations owned by Frank Tilos. Frank suggested that he would transfer the corporations to Jorge Castera so that he, Frank, would appear to be uninvolved. On one occasion, Larry had Frank fax the exact name of the corporation to an individual at American Insurance Company to issue the check in question. A subsequent check payable to Magnolia HealthCare LLC was received. Frank and Jorge were dumbfounded at the face amount. They discussed this matter with
Larry Romito, who advised them to deposit this check. A few days later, they were

Wells4689_c14_1

05/31/2007

135

recommendations to prevent future occurrences

135

advised that the check did not clear. They contacted Larry; he told them that there was some problem with the check and that they would receive smaller-denomination checks in the near future.
Jorge and Frank copped a plea to furnish documentation against Jerry Terranova and
Larry Romito. Two years later, the Sonoma, Arizona, grand jury indicted Jerry, a former
American Insurance Company employee, and Larry Romito on three counts: two on mail fraud and one on conspiracy under U.S. Mail Fraud Statute.
James’s assumption had been correct. Jerry admitted that because of his gambling habits, he needed to issue a couple of checks to Larry Romito, his bookie. Initially, the amounts were supposed to be a lot less. However, he felt confident that no one would be able to implicate him in this fraud and decided to make the checks greater in anticipation that a portion of the checks would come back to him. Due to the watchful eye of the credit union, AIC, and the U.S. Postal Service, Jerry was convicted and sentenced. The $13 million man received five years probation and 200 hours of community service. Larry
Romito received additional probation time, to be completed after serving his previous sentence. There was no monetary loss to American Insurance Company, which stood to lose
$12,715,522.75. The credit union emerged unscathed, as well.

Lessons Learned
This investigation took several years from start to finish and revealed the importance of involving law enforcement agencies as soon as possible. Through combined efforts, we were able to identify at least four individuals in the fraud and identify another
$6,225,165.06 that would have been a loss for AIC.
The investigation revealed four internal control weaknesses, which related to the inappropriate approval limits across lines of business and the check approval process:
1. Approval limits were excessive for employees in the company.
2. The approval system for issuance of emergency checks was not subject to proper internal controls.
3. Fraud awareness throughout the company was necessary. Employees should know whom to contact when a fraud may exist.
4. We should have requested assistance from law enforcement agencies early in the investigation. Recommendations to Prevent
Future Occurrences
Although fraud is impossible to eliminate completely in a company, there are many ways to reduce it.

Wells4689_c14_1

136

05/31/2007

136

chapter 14

the $13 million man

Approval Limits for Checks
Internal auditors should be assigned an audit across all lines of business to establish approval limits by level. Even at the senior vice president level, additional checks and balances should be established. The emergency approval system should be strengthened by involving a quality control group, as well as supervisory involvement. One should not be able to authorize the issuance of over $1,000 without multiple approvals and verification with the source.
Fraud Awareness
Fraud awareness should be a key component throughout the company to assure that the right people are notified when a fraud may occur. American Insurance Company has established, on a yearly basis, a weeklong fraud awareness training. The clear message given to all employees is this: ‘‘Undetected fraud directly impacts a company’s bottom line.’’
Fraud Hotlines
Ongoing advertisement of a company fraud hotline that provides an efficient notification process is vital. This hotline should be manned by experienced investigators.
Update Technology
Updated technology helps investigators identify fraud quickly. Information system security personnel work hand in hand with the Special Investigation Unit to establish controls and monitoring tools to minimize fraud with and through the computer.

John Francolla, CFE, FLMI, retired from MetLife after 41 years of service. During his career he conducted thousands of investigations on internal and external fraud. He also trained employees in fraud awareness. Mr. Francolla is a graduate of Capital
University and has over four decades of experience in detecting, preventing, and assisting in prosecuting white-collar crime.

Wells4689_c15_1

05/31/2007

chapter

15

&
They Didn’t Know Jack
JANET MCHARD

he management of Garden Grove was pleased with their technology manager, Jack
Gallegos. By all appearances, he was keeping both the Internet and storefront services of the business supplied with computer hardware and software. But Jack was good at hiding things. It turns out that Garden Grove didn’t know Jack.
Jack was 23 years old when he responded to Garden Grove’s ad seeking an
´
´ information technology (IT) manager. On his resume, he listed a bachelor’s degree in
´
´ business with an emphasis in management of information systems. The resume also sported logos indicating he was certified in both Microsoft and Cisco computer systems and networks. For so young a professional, he appeared to have had a remarkable education and career.
Jack loved muscle cars. He even owned a restored classic Mustang with a shiny black coat and purple flames whipping down the sides. This was not a vehicle to commute in; this was to show off, to take to car shows, and to brag about. Jack even posted a picture of it on his Web site.
´
´
When he applied to Garden Grove, he stapled his resume to his application rather than providing the information requested. He did not furnish contact numbers for his previous employers, his supervisors’ names, or the reasons for leaving. But Jack did sign the application, giving Garden Grove explicit permission to check references. The company did not, which turned out to be a costly mistake.
Garden Grove was the professional passion of Mike King, who had earned a degree in horticulture and was fond of creating new plants. He had spent his entire life in the desert.
Having seen many droughts, he developed a knack for making water-hungry plants tolerant to dry weather. He founded Garden Grove so he would have a market for these plants. Mike’s particular skill was in maintaining the lush beauty of plants while reducing water usage. Located in the desert Southwest, Mike had found himself a niche that everyone in the community could use. He found it easy to market in communities that were subject to mandatory water rationing. With Mike’s products, customers could relandscape with bright, colorful, and lush plants.
Mike and his wife, Sandy, shared the management responsibilities, and under their direction, the company had grown from one small storefront to a robust retail business with

T

137

Wells4689_c15_1

138

05/31/2007

chapter 15

they didn’t know jack

several locations and thriving Internet sales. Their inventory was grown onsite at Garden
Grove’s main location, which also included a retail store.
I didn’t know any of this the bright, sunny day I received a call from Garden Grove’s general counsel, Lyle Washington. He asked me drive out to Garden Grove and meet with him, Mike King, and their new IT manager, Cathy Delamar.
I worked for a public accounting firm in the desert Southwest. My practice was exclusively litigation support, primarily involving fraud examination and prevention.
Over the years, I was used to hearing from potential clients shocked to discover that a trusted employee may have stolen from them. Garden Grove was in exactly that state when their attorney called asking for my help.
When I arrived, I noticed that the gardens were vibrant with flowering plants. The cherry sage and the vitex both were gathering bees by the dozens. I found my way across the lot to the metal building bearing a small ‘‘Office’’ sign.
I was surprised to find that there was no secretary. I wandered down the hall that bisected the building and was looking for anyone who could direct me to my meeting. I stuck my head in a couple of open office doors, only to find warrens of cubicles, some of which were occupied, but no one turned around to greet me. It seemed that the office was truly an employee-only area and that it didn’t get many visitors.
Finally, a casually dressed woman in her early 30s saw me from the corner of her eye.
She held the phone away from her ear and mouthed to ask if I was the fraud examiner.
When she hung up, she introduced herself as Cathy Delamar. Then she gathered some papers and showed me to our meeting.
Cathy introduced me to Mike King, a fit man in his 40s with close-cropped hair. His demeanor was direct and businesslike. His pride for creating new plants was obvious as he told me the history of Garden Grove. Lyle Washington was fit, too, with hair as silver as Mike’s was black. Lyle and Mike were both in khakis, with Mike’s shirt bearing the
Garden Grove logo. We sat down in an airy conference room. Mike, Cathy, and Lyle told me about Jack Gallegos, their former technology manager.

May I Quote You on That?
Jack had recently left his job, saying that he needed to care for a sick relative and would not be back. Jack’s resignation phone call coincided with the deadline Mike had given him to provide copies of the Microsoft and Cisco system and networking certificates
´
´
Jack claimed on his resume. A short time later, Garden Grove hired Cathy as Jack’s replacement. She got to work doing the equipment inventory that Mike had been requesting from Jack for months but had never received.
Cathy’s project turned out to be more difficult than expected. At first, she thought the easiest way to proceed was to take the list prepared by the Accounting Department and then find the equipment. It wasn’t that easy. When Cathy found many items missing, she decided to examine the purchases to get a better description; then she could just match them up. But when she pulled the invoices, she knew something was wrong and

Wells4689_c15_1

05/31/2007

may i quote you on that?

139

immediately informed Mike. He told me that Garden Grove had recently experienced a period of significant growth. In fact, Jack was the company’s first IT manager. Previously they had outsourced the function, but with continuing expansion, they felt they needed someone dedicated to their IT system. Mike and Sandy had just opened a third retail store and the hits to their Web site increased. They were hoping to find some technology solutions for their inventory and Internet sales challenges. When they interviewed Jack, he seemed to have the expertise they needed.
Not long after he started working for Garden Grove, there had been a fire in one of the portable buildings of the office complex, which appeared to have been caused by an electrical problem and was completely accidental. But it had set Garden Grove back technologically because several computers and the backup system were in the building.
For the first few months of his tenure, Jack’s primary duty was to repair, replace, and reconstruct the infrastructure. Mike had seen and approved higher-than-normal purchases coming from his technology manager and thought the increased spending was as a result of the fire.
I spent some time with Mike, Cathy, and their attorney learning about their company and industry. Sometimes a case is made on the details particular to a specific business.
We talked about the mail and Internet ordering systems they used. I inquired about the location of Jack’s workspace and found that Cathy now occupied his cubicle. I made a mental note about the isolation of the employees I had seen during my search for the meeting, realizing anyone could easily conceal his or her activities due to the physical layout of Garden Grove’s office space.
Next Cathy outlined her discoveries during the equipment inventory she performed.
She saw the first red flag when she started looking for a particular server. She knew Garden
Grove didn’t have any of them from the manufacturer listed, so she started digging deeper and found more missing equipment. Mike and Cathy realized that the server and the other items that she couldn’t find had been purchased from Wired World—Jack’s previous employer. Mike asked Cathy to pull all the invoices from this business and determine if those items were on site.
Cathy gave me copies of the paperwork and explained why they didn’t seem right.
She noted that since computer equipment, particularly hardware, had serial numbers, suppliers almost always list those numbers on their invoices. The ones from Wired World had no serial numbers. Then I pointed out that there was another problem: These documents were merely quotes and did not show that the products had actually been purchased. Nevertheless, Garden Grove’s accounting department had paid Wired World, and Mike had signed his approval on all of the large invoices.
Cathy and Mike had made another interesting discovery. The quotes listed the salesperson as ‘‘Mary’’ and gave her phone number. Mike handed me a ‘‘Personnel Information Sheet’’ that Jack had filled out when he was hired. The sheet listed his emergency contact as Mary Montgomery at the same phone number. The salesperson at Wired World and Jack’s personal emergency contact were one and the same. With this combination of facts, I knew I had grounds to launch an investigation.

Wells4689_c15_1

140

05/31/2007

chapter 15

they didn’t know jack

Wired Up
After leaving the meeting, I began my investigation in earnest. I turned to my computer and started by researching the players in this case. I first ran a public records check on Jack
Gallegos. I didn’t find any criminal actions filed against him, but I did find a civil action against someone with the same name and date of birth. It was a few years old, and the cause was unpaid debt.
Next I focused on Wired World. I discovered that the company did not have a listing in the online phone book; clearly it was not a retail company depending on walk-in traffic.
I then searched the secretary of state’s corporation listings to see what was on public record. Wired World had been incorporated five years ago and was active but not in good standing. This usually meant that it had not kept up with its annual filings or was delinquent in taxes or fees.
Finally I found that the principal address of the corporation was different from the street address printed on the quotes. The one registered with the secretary of state appeared to be in a residential area. The quotes showed an address on Camino Norte while the state records showed an address on Oakland Drive. The corporate inquiry record listed two officers, Mary Kane and Arthur Holmes. Mary was also the sole director listed.
Mary was a director of Wired World; ‘‘Mary’’ was the salesperson on the quotes; and
Mary Montgomery was the name of Jack’s emergency contact. Even though the last names didn’t match, I decided to look further to see if these ‘‘Marys’’ were, in fact, the same person. I searched the records of the local tax assessor’s office, which showed that Arthur
Holmes was the owner of the Oakland Drive property, a residential address. The owner of the Camino Norte property listed on the quotes was Mary Kane.
Now I needed to determine why Mary had so many last names and what her relationship was to Jack. Searching the state court records, I found a divorce proceeding with Mary Montgomery Holmes as the petitioner and Arthur Holmes as the respondent. When I got a copy of the final decree, I found that Montgomery was her maiden name, restored as part of the divorce proceedings. I also found that she got possession of ‘‘the business Wired World, Inc., including all assets and liabilities,’’ and the real property located on Camino Norte. Arthur Holmes got possession of the
Oakland Drive home.
I performed some broad Internet searches hoping to hit on the relationship between
Jack and Mary. That’s when I found out about Jack’s love of classic cars. I also discovered that Mary was a former Miss Kansas, having won that crown in the late 1970s. Up to that point in the investigation, I had hypothesized that Jack and Mary were romantically involved. Now, knowing Mary’s approximate age, I adjusted my hypothesis to a possible mother-son relationship (which we found out later was the case).
Some things I didn’t find in my research were also fascinating; Jack seemed to have fallen off the earth. His old phone number was no longer connected. He had no new listings. I could find no references to him following his departure from Garden Grove. It had been three months since Jack resigned, and in that time he seemed to have disappeared from

Wells4689_c15_1

05/31/2007

just the facts, ma’am

141

public view. The police were going to have to locate this suspect if they wanted to talk to him. As a private consultant, I didn’t have the legal muscle to require him to show up to any interviews, and I didn’t have legal access to the law enforcement databases that might have given me a clue to his whereabouts.
A few days later Garden Grove gave me a copy of all of the documents they had concerning Jack and the equipment purchases, including the inventory Cathy had prepared and the equipment they had apparently paid for but could not locate. She also provided copies of the supporting documents from the Accounting Department, which were primarily the quotes from Wired World, and the cancelled checks used to pay them.
As I analyzed the information, I realized that the invoice number was constructed in this format: yymmddxx. Thus, a quote dated June 5, 2007, would be numbered 07060502. I was unable to determine the meaning of the last two digits. Nine of the quotes showed purchase order numbers that were exactly the same as the invoice. Since purchase order numbers are assigned by the purchasing company, and invoice numbers are assigned by the selling company, it is unlikely for them to match. I also found two quotes that carried identical invoice numbers, even though they were issued two weeks apart.
The cancelled checks revealed their own host of clues. Twelve of them issued to Wired
World were endorsed by hand with ‘‘Wired World’’ and a signature written in the endorsement area. Comparison of this signature to that of Mary Montgomery on the divorce documents showed enough similarity to make me believe that professional handwriting analysis might prove fruitful if the case required it.
I also found one check written to Wired World that was endorsed by Jack Gallegos.
Three without signature endorsements showed only checking account numbers; the writing of those numbers appeared consistent with Jack’s handwriting on his application and personnel information sheet, particularly since he had a specific way of writing a ‘‘5’’ that made it look more like an ‘‘S.’’
After comparing the supporting documentation to the missing equipment listing,
Cathy and I identified three overlapping classes of problem transactions. The classes concerned equipment:
1. Purchased from Wired World that could not be located on the premises
2. Bought from Wired World at a price far greater than normal market price
3. Not produced by the manufacturer listed in the description
All of the problem transactions fell into the first category, and about half of them also fell into the second or third. The final analysis determined that just over $26,000 of equipment had been purchased from Wired World that could not be located.

Just the Facts, Ma’am
Mike and Lyle wanted to file criminal charges against Jack. Having completed my preliminary analysis, it was now time to contact law enforcement to see how much of my

Wells4689_c15_1

142

05/31/2007

chapter 15

they didn’t know jack

help they needed. I called the best white-collar investigator at the local police department,
Detective Jerry Martinez, and I walked him through the investigation to date. We discussed my findings, my interviews of the employees at Garden Grove, and my analysis and research. He was intrigued by the relationship between Jack Gallegos and Mary
Montgomery.
One of the county prosecutors Detective Martinez worked with regularly was a white-collar crime specialist. We both knew this increased our chances of getting an indictment on the charges. Finally, he told me what the county prosecutor would need to take the case to grand jury for indictment. There were two things in particular:
(1) a concise set of documents with a summary cover letter and (2) an interview of the suspect by law enforcement. The first item would be easy because I had already assembled most of that information. Since I was unable to locate Jack, the police would have to handle the other.
I went back to my office and began preparing a report for Detective Martinez. My first step was to go back through the information I had collected with an eye toward what would be necessary to prove the legal elements of embezzlement:


Converting to the person’s own use



Anything of value



With which the person has been entrusted



With fraudulent intent to deprive the owner thereof

My letter concentrated on the facts of the case, leading off with contact data for Garden
Grove and the last known address for the suspect, Jack. I then laid out what I had gathered, including the information about Wired World and Mary Montgomery. For each piece of information, I attached the documents that supported that fact. I included all of the quotes/invoices from Wired World paid by Garden Grove and copies of the cancelled checks, front and back.
I put the letter and all the exhibits, tabbed to match the references, into a three-ring binder and sent it off to Detective Martinez. Garden Grove also got a copy; they would use this to file a claim on their employee dishonesty insurance policy.
After receiving my notebook, Detective Martinez called to tell me that he was going to present the case to the prosecutor and that he would contact me if they needed any further help. He said that with the information I had collected, he was certain that they could get an indictment.
Two months later, I received a grand jury subpoena. I had been notified about testifying for the Garden Grove case. The subpoena was for an appearance tomorrow. First, I called my client to let them know I’d been summoned. It was a surprise to them; they didn’t know the case had progressed that far. They asked me to inform them of any updates after my appearance. Next I called Detective Martinez. He said the prosecutor would have him provide all the basic information of the case. My job would be to be available to the grand jury in case

Wells4689_c15_1

05/31/2007

recommendations to prevent future occurrences

143

the jurors had specific questions. The detective expected the whole appearance to be shorter than 30 minutes for both of us.
So, the next morning, I donned my best suit and reported to the courthouse. I ran into
Detective Martinez in the hall outside the grand jury room, and he and I traded stories until the time came for us to testify. He told me that he keeps my report on his desk and shows it to victims as a guide for what a good case file should look like. I was gratified by the compliment. Just then, the door opened and Detective Martinez was called in to give his testimony using my file copy of the report and documents. He was in front of the jury about 20 minutes, as I paced the hallway outside the jury room. As Detective Martinez came out, I was asked to go in.
The grand jury convened in a large sunlit room around a conference table big enough to seat the 20 or so members of the jury comfortably. The clerk directed me to a seat at one end of the long table. The jury foreperson was a middle-age man with dark, curly hair. I made eye contact and answered his concerns about the inventory methodology.
The rest of the jurors had clearly been working together for a while. I answered their questions, most of which concerned computer jargon in the inventory listing. Inside of 10 minutes I was back out in the hallway, waiting with Detective Martinez to see if the jury would return an indictment against Jack Gallegos for embezzlement. They did.
Unfortunately, although we had an indictment, we had no Jack Gallegos. It took more than a month for him to be found and arraigned, and another six months before an attorney entered an appearance on Gallegos’s behalf. The case is still pending.

Lessons Learned
This case drove home the point that personnel files often contain crucial information that can make or break a case. It is surprising that many times this file is overlooked. I’ve often used the direct deposit information provided by the employee to show that company funds were diverted into personal accounts. This case showed me that emergency contact and previous employer information is just as important as banking data.

Recommendations to Prevent
Future Occurrences
Background Checks
A criminal background check would not have helped in this case; Jack had not been indicted or convicted of any crime. However, calling previous employers might have provided Garden Grove with some clues about the kind of employee Jack would be. An interview with his prior employer, Wired World, might have provided the interviewer with information to make a decision either not to hire Jack or to at least analyze purchases from his former employer more closely.

Wells4689_c15_1

144

05/31/2007

chapter 15

they didn’t know jack

Garden Grove did not require copies of professional licensing certifications. Although
Mike had asked for these all along, he did not give any deadlines and let Jack work without providing them. When Mike insisted on these certifications—prompted after Jack had supposedly gone to a continuing education conference but couldn’t produce anything to prove attendance—Jack quit. If Garden Grove had been more persistent up front about getting copies, Jack might have gone elsewhere to find a job.
Now Garden Grove requires all applicants to provide employment dates and supervisor
´
´ contact information for all prior employers. Attaching a resume to the application is acceptable only if the applicant also provides all the information requested.
Review Payment Documentation
No one at Garden Grove looked closely at the documents supporting payments to Wired
World. No one noticed that these were quotes, not invoices. No one was aware that Jack was buying most of the IT supplies from one small vendor. There was no policy requiring multiple quotes or price shopping for purchases.
These days, Mike reviews invoices carefully. He looks for more than just his employees’ initials and request for payment. Now he makes sure invoices appear genuine. Mike asks more questions of his employees about the purchases they make. He also checks to make sure the vendors are reputable and legitimate.
Fraud Education and Reporting
Garden Grove has consciously created a safety net to help protect against fraud. They now educate their staff about how fraud can occur in the workplace and how to report any actions that might seem unethical. They have set up an internal communication policy so that people who have concerns can call Mike and Lyle directly. In doing this, Garden
Grove has added all their employees to their antifraud system, and everyone knows that fraud is something that Mike will be looking for.
With the changes to its hiring policies and communication methods, Garden Grove knows all of its workers. Had all these systems been in place when they hired him, they might even have known Jack.

Janet M. McHard, CFE, MBA, CPA, CFD, is a senior manager in the Litigation and
Valuation Services Department of Meyners & Company, LLC, in Albuquerque, New
Mexico. She leads the firm’s fraud investigation and prevention team, working with privately held companies, nonprofit organizations, and governmental entities. Ms.
McHard is also a popular speaker on fraud-related topics.

Wells4689_c16_1

05/31/2007

145

chapter

16

&
The Skim Sisters
ADAM K. BOWEN

rom an early age, Ellen Lowry and Josephine Rodriguez were inseparable. Like sisters, these two childhood friends grew up just three doors from one another in the suburbs of Atlanta, Georgia. Both were from middle-class families. Ellen’s father was a small business owner, her mother a teacher. Josephine’s mother passed away when she was very young. Her father spent most of his time working, often picking up graveyard shifts to make ends meet. As a result, Josephine spent many nights at the Lowry dinner table, even joining the Lowry family vacations on occasion.
When the time came, Ellen went off to college and Josephine entered the workforce.
Despite their differing paths in life, they remained close. The two spoke often, doubledated, and even promised each other that their own children would grow up together, just as they had. After graduation, Ellen married her college sweetheart. Josephine was, of course, the maid of honor.
After Ellen settled down, the bond between her and Josephine strengthened. A few years later, when Josephine married, Ellen arranged for the reception to be held at the hotel where she managed front desk operations. Josephine felt indebted to her friend for arranging such a beautiful location for her wedding reception, complete with catering from the hotel restaurant. Ellen had been so supportive throughout Josephine’s life; she wished she could repay the favors.
Shortly after getting married, Josephine became pregnant. With a new family on the horizon, she scoured her local community for a better-paying job—one with the health benefits every future mother needs. She wasn’t surprised when Ellen stepped up to the plate and offered her a position as a housekeeper in the Atlanta hotel where she worked.
The job didn’t pay much above minimum wage but offered advancement opportunities and great benefits, including health insurance. Ellen also promised her that she would have a job to return to after the baby was born. Josephine was grateful; Ellen had always been more like a sister than a friend.
Several months after starting to work with Ellen, Josephine gave birth. To show appreciation to her friend for years of kindness, she and her husband named their baby girl
Ellen. Six weeks later, Josephine returned to work to find that her previous supervisor, the director of housekeeping, had quit. Ellen was on the search for a new housekeeping

F

145

Wells4689_c16_1

146

05/31/2007

146

chapter 16

the skim sisters

director—one she could count on. She offered Josephine the job, which paid significantly more than her current wage.
Josephine was again extremely appreciative but hesitant to accept a job with so much responsibility, especially with her new family. Nonetheless, Ellen convinced her to take the position.
‘‘I’ll be here to support you,’’ Ellen promised. ‘‘Just like always.’’
Even Josephine was shocked by her friend’s generosity with this gesture.
‘‘Why would she entrust me with such a huge responsibility after only a few months of being on the job?’’ she wondered. But Josephine was eager to help Ellen in return for her generosity in the past. She would do anything she could to repay her. After all, that’s what sisters are for.

All That Glitters Is Not Gold
The Excelsior Inn, located in Atlanta, Georgia, is your typical antebellum southern hotel. It had existed in one form or another since 1859. The clientele were uppermiddle-class travelers coming to and from Atlanta on vacation. The Excelsior frequently had business clients, as well. A modest sales and marketing department had opened in recent years to attract convention groups and wedding receptions. The new additions to the hotel were such a hit with the wedding crowd that hotel management decided to construct a new 15,000-square-foot convention and reception center in 1989 to host large events.
In 1994, the Excelsior went through a massive renovation and reorganization. The inn was acquired by Premier Properties Limited, a hotel management company headquartered in Charleston, South Carolina. Construction crews spent months restoring the inn’s vaulted ceilings, floor-to-ceiling windows, restaurant, and 215 guest rooms. When construction and restoration was complete, the hotel had regained its illustrious splendor.
Entering the hotel lobby, guests encountered large, round mahogany columns that rose elegantly from the travertine floor 15 feet to support the ornate gold-leaf ceilings. Crown molding, expensive wallpapers, and designer carpets were installed throughout.
Guest rooms at the Excelsior were wonderfully appointed. Most featured luxurious bedding and expensive Egyptian cotton linens. High-end bath soaps, shampoos, and lotions were provided free of charge. Business centers with computers and fax machines were installed throughout the property so business clients could work during their stay.
The hotel restaurant provided a free sit-down breakfast to each guest and offered a sumptuous menu for both lunch and dinner.
Premier Properties also brought an experienced hotel management and housekeeping team on board to take the new Excelsior to the peak of success. I was hired as hotel general manager in 1994 and oversaw the hiring of the remainder of the staff and subsequently the hotel’s renovation. To manage front desk operations, I hired a young and fresh hospitality management graduate from the area, Ellen Lowry. The hotel soon became quite popular among travelers to Atlanta. The Excelsior was even featured in a 15-page spread in the

Wells4689_c16_1

05/31/2007

147

cleaning up money

147

travel magazine Tourism Today in the summer of 1995, just in time for the Summer
Olympics held in Atlanta the next year.
By 1999, the Excelsior was posting record profits. Occupancy rates before renovation had approximated 53% per year. After the renovation and reorganization, the Excelsior had reached an astonishing 92% occupancy rate. At an average rate of $225 per night, the hotel was earning well over $16 million in revenues annually. Premier Properties was happy, I was happy, and our guests were happy.
I left the day-to-day operations of the hotel to my staff. I had the utmost trust and confidence in my team that everything would be handled while I attended primarily to sales and marketing for large groups. Premier Properties set an occupancy goal of 95% for the Excelsior by 2001. I was determined to hit the target. With such a great property and wonderful team on my side, I was sure it could be done.

Cleaning Up Money
As the Excelsior’s general manager, I had total responsibility for all hotel operations.
Although the Excelsior was a well-oiled machine by the fall of 1999, I routinely spent one to two days a week in the office handling the usual guest complaints, staffing issues, and vendor calls. The remainder of my time was spent on marketing, sales, and the future growth of the Excelsior. Despite my erratic schedule, I always phoned my department heads each morning I was away for a status update. One Thursday morning in October of
1999, I phoned the Excelsior’s front desk from my cell phone while I was traveling to a marketing opportunity.
My call was answered by one of my best desk agents, Edgar Riley, a young man who worked the morning shift so he could attend night classes at the local university. When I asked for Ellen Lowry, still the front desk operations manager, Edgar informed me she was out sick. Concerned about Ellen, I went on to inquire about the hotel’s status. Edgar informed me that a gentleman had been calling the front desk all morning demanding to speak to Ellen. He had been screaming something about his refund and insisting on a call back from management. When Edgar had tried to access his records on the hotel computer, they were nowhere to be found. According to hotel records, the gentleman had never been an Excelsior guest.
I decided to return the call. Obviously the man had an issue that needed to be resolved, and I had always striven to make guest satisfaction my highest priority. I took the gentleman’s name and number down and hung up with Edgar. I pulled over to a local gas station to refuel. Atlanta was very cold that October; it felt as if the frost would never melt from my windshield. I could still see my breath as I exhaled inside the car. The gas station attendant ran out and began to fill up my car. I picked up the phone and dialed the gentleman. A sharp but soft-spoken voice answered and I identified myself as the Excelsior Inn’s general manager. ‘‘My front desk agent informs me that you had an issue with your recent stay at our inn,’’ I said. ‘‘Can you tell me about your experience?’’

Wells4689_c16_1

148

05/31/2007

148

chapter 16

the skim sisters

‘‘Well,’’ the man began, ‘‘I checked in your hotel with that front desk manager, Ellen, paid her $760 cash for three nights, and didn’t see a housekeeper for two days! It was like
I wasn’t even there!’’
Disturbed that one of the Excelsior’s guests would go without housekeeping service for over half of his stay, I inquired further. ‘‘Sir, did you inform the front desk of this issue?’’ I asked. ‘‘You bet I did,’’ he exclaimed. ‘‘Every day! But they kept saying they didn’t show me in the computer and would have the manager call me back.’’
‘‘Did she?’’ I wondered.
‘‘Yeah, finally. Then the housekeeping manager, Josephine, showed up and cleaned my room. I was promised some sort of refund that I haven’t received. I think I deserve at least partial compensation,’’ he said. I hung up, promising to get to the bottom of the situation and resolve his issues.
While the gas station attendant finished filling up my car, I made another call: this time, to cancel my marketing appointment. Several things about my discussion with the mystery guest just didn’t make sense. Why wasn’t he documented as a guest in the hotel computer?
Why wasn’t his room cleaned until the third day of his stay? And why did the housekeeping manager clean his room herself? The housekeeping manager rarely cleaned rooms unless the department was extremely shorthanded, which hadn’t been the case at the Excelsior since I took over.
I drove back across town to the hotel. When I arrived, I went straight to my office and began accessing the hotel’s accounting records. Indeed, records failed to show the gentleman as having been a guest of the Excelsior. Furthermore, the cash accounting system showed no cash transactions taking place on the day in question. I was perplexed.
Could this guy be crazy?
I almost abandoned the issue altogether until I decided to look at the housekeeping records for the room. I accessed the hotel’s housekeeping system and discovered that 198 sets of linens and bath towels had been washed and signed out of the laundry for housekeeping’s daily rotation, 13 by Josephine herself. But hotel accounting showed only
185 suites had guests on the same day. Where could the additional linens have gone? Either laundry had made a mistake, or there were additional guests who had not been accounted for. Either way, I was determined to get to the bottom of it.

Not Quite a Full House
I have never been a person to start in the past and work my way forward. I knew that the best place to begin to understand this situation was to see if it was currently taking place.
The quickest way to determine if the Excelsior had unregistered guests was to pull a list of vacant rooms per the hotel accounting records and personally inspect each room. From my tiny office on the Excelsior’s second floor, I accessed the hotel’s active inventory. From my terminal, I generated a report that listed each unoccupied unit.
Out of the 215 guest rooms at the Excelsior, 179 were listed as occupied that Thursday.
Another 5 rooms had been taken out of service by the inn’s maintenance staff, which was

Wells4689_c16_1

05/31/2007

149

not quite a full house

149

routine for carpet cleaning, painting, and other repairs, leaving 31 guest rooms vacant. I journeyed down the hallway from my office to the stairwell and then around a corner on the ground floor to the first room on my list: 106. I inserted my master key and opened the door. The room was vacant. The bed was made. The carpet still had vacuum marks from the last housekeeping service.
I moved on to the next room: 110. Same process, same result. I continued to inspect all of the remaining vacant rooms with no sign of occupation. I wasn’t surprised; my team was top notch. Perhaps they had just made a mistake in the linen count that day. I was sure now that the guest who had complained was just wrong. Maybe he had called the wrong hotel, or perhaps he was trying to swindle the Excelsior. People tried that all the time, calling up with crackpot complaints demanding a refund or cash payment.
‘‘Yes, that’s it,’’ I thought. ‘‘This guy is lying and he’s trying to defraud the hotel.’’ I couldn’t believe I had been duped by this person! How could I have cancelled such an important marketing appointment to participate in some wild goose chase after a guest that had never even stepped foot in the Excelsior? ‘‘Oh well,’’ I thought. I suppose it was better to be safe than sorry.
‘‘Maybe I can reschedule my marketing meeting for this afternoon,’’ I pondered, returning to my office. Rounding the corner from the second-floor elevator bay, I spotted
Josephine Rodriguez, the director of housekeeping. She reached down to the bottom of her service cart to retrieve a set of bed linens. Her vacuum cleaner was sitting off to the side.
The vacuum’s cord was lying in a bundled mess on the floor, as if it had just been used.
I noticed the room number next to the open door: 218.
I thought quickly. I just knew I had seen 218 somewhere recently. ‘‘On a report maybe?’’ I wondered. I passed by Josephine and we exchanged the usual pleasantries. I inquired as to why she was cleaning rooms that day.
‘‘Are you shorthanded?’’ I asked. ‘‘Oh, yes sir, several girls have been out sick recently and I’m picking up the slack,’’ she replied.
‘‘Great work, Josephine! You’re a great team player.’’ I remarked. She was visibly nervous. I dismissed her behavior as simply a result of her demanding workload and I continued on to my office.
The bright, warm sun began peeking through my window, which overlooked the hotel’s courtyard, gardens, and pool. These were the days I really enjoyed making sales calls, when the sky was clear and the sun was shining. I couldn’t wait to reschedule my meeting and get out of the office, forgetting all this worry about someone stealing from the
Excelsior. I sat down at my desk and reached for my Rolodex. The business card I needed was neatly tucked away there.
As I pulled the business card out with my right hand, I reached my left hand over to begin dialing the telephone. Just as I placed the phone receiver to my ear, I glanced down at my desktop. Directly in front of me was a maintenance request. In order to take a room out of active inventory, a maintenance request must be completed and submitted to the front desk for processing. The request form required several things, namely a valid reason and two signatures from management.

Wells4689_c16_1

150

05/31/2007

150

chapter 16

the skim sisters

This particular maintenance request was signed by Ellen Lowry and Josephine
Rodriguez. The reason for taking the room out of service was ‘‘routine deep cleaning.’’
This was a common reason, actually. Deep cleaning usually included a carpet and bedding shampoo, fresh paint, and a service of the room’s air conditioner. Premier Properties required each room to undergo a deep cleaning annually. Because the Excelsior’s inventory included over 200 rooms, several rooms were out of service at any one time for deep cleaning. Routine deep cleanings were always performed by an outside contractor hired by Premier Properties. None of the Excelsior’s staff was allowed to participate in the deep cleaning of any room. This was a way for the parent company to have an independent annual inspection of each unit to ensure the hotel was being properly maintained. The unusual thing about this particular maintenance request was that it was for room 218. And I had just seen Josephine Rodriguez, an Excelsior employee, working in 218.
The pieces were coming together. I stood up from my desk, walked toward my office door, and exited into the second-floor hallway. I stared down toward the end of the corridor, where I had seen Rodriguez cleaning room 218 just 10 minutes earlier. My heart was racing; I suddenly realized I had walked right by and didn’t even notice what was happening. ‘‘How many times have I walked by and not noticed?’’ I wondered. Josephine was gone now. I walked down the hallway, toward 218. I approached the door and inserted my key.
A red light flashed, a sign my key wasn’t going to open the door. Only two things could prevent my key from working: Either it had been deactivated by the front desk, or someone in the room had locked the door from the inside. My key had worked just
10 minutes earlier when I was inspecting rooms, leaving the obvious choice for why it suddenly stopped working. Someone was on the other side of the door, occupying room 218.
I knocked. No response. I knocked again, this time harder, louder and faster. Someone shouted from behind the door. ‘‘Hold on a moment, I will be right there,’’ a female voice called out. I waited.
‘‘Who is that?’’ I thought to myself. I heard the door latch swing back, the handle turn.
The door opened in front of me. A tall young woman in her early 30s stood before me. I looked around her; a laptop sat on the bed and papers were strewn about the table and floor. The smell of fresh deodorizer emanated from the room.
‘‘Excuse my interruption, ma’am,’’ I said politely. ‘‘I am the hotel’s general manager, and
I’d like to personally inquire about how your stay has been so far.’’
‘‘Oh, just wonderful,’’ she exclaimed. ‘‘I have just been so pleased with the accommodations. I will definitely visit again when I return to Atlanta.’’ I began to inquire about the specifics of the young woman’s trip. She had checked into the Excelsior without a reservation on Monday evening, was staying for four nights, and had paid cash at check-in. Ellen Lowry had assisted her in the check-in process. Josephine Rodriguez had cleaned her room every day since she checked in.

Wells4689_c16_1

05/31/2007

151

facing the music

151

I thanked the woman for her comments, apologized for interrupting her, and went on my way. I paid a visit to each of the four other rooms listed as out of service in the hotel accounting system. Each room was occupied by a guest or guests. In each case, I introduced myself as the hotel manager, gathered information about their stay, and thanked them for their patronage. I didn’t want to let on that my visit was any more than a courtesy call.
My conversations with these guests were similar. Every guest had checked in over the past week with Ellen Lowry and had paid cash at check-in. They were each paying an average of $115 per night, about $100 less per night than the Excelsior’s standard rates. Not only was the hotel being cheated on the revenue from the skimmed cash, but these guests were getting great deals. I hypothesized that the discounted price contributed to the slim likelihood for complaints for subpar service in the way of housekeeping and other typical guest amenities.
I now had enough information to report my concerns to Premier Properties and await further guidance on the investigation. Within days, an internal audit team and fraud investigator from the company’s home office reported to the Excelsior. Ironically, Ellen escorted them to my office. Her look when I welcomed them said it all: time to face the music. Facing the Music
Once the initial meeting with Premier’s auditors was complete, the team set out to comb through the hotel’s accounting and housekeeping records. The goal of their analysis was to uncover how the fraud had been perpetrated and approximately how much had been compromised. Another goal was to estimate how deep inside the organization the fraud extended. How much was lost? How many people were involved? Who was involved?
These were all questions the investigation attempted to uncover.
After the auditors’ first day at the Excelsior, Ellen and Josephine were aware their scheme had been discovered. Nonetheless, the investigation continued as every hotel employee was interviewed by investigators. Because evidence pointed to Ellen as the lead fraudster in the scheme, Josephine was interviewed first. Shortly after the discussion began, she broke down in tears and divulged the details of the plot.
Ellen had pressured her into going along with the scam. Josephine claimed to have been compensated an extra $100 a week in cash by Ellen to continue cleaning the unregistered rooms. Ellen used Josephine’s personal feelings of indebtedness for her wedding and job promotion to pressure her into assisting with the fraud. Josephine wanted to give her daughter the home she herself had always dreamed of as a child. She didn’t want to spend her nights away at work to provide for her family, as her father had done.
With Josephine’s signed confession in hand and a mountain of evidence to support it,
Ellen Lowry was called in for her interview. The interviewer from Premier confronted her with tough questions about the out-of-service rooms and unregistered guests.
‘‘I don’t know anything about this!’’ she exclaimed.

Wells4689_c16_1

152

05/31/2007

152

chapter 16

the skim sisters

When the interviewer provided a copy of Josephine’s signed confession, Ellen claimed she had been working undercover for the hotel, gathering evidence to support terminating Josephine for stealing. Of course, the evidence showed otherwise. Ellen ultimately admitted to the fraud and signed a confession of her own.
‘‘I feel as if the world has been lifted off my shoulders,’’ she said with a sigh.
Ellen Lowry provided investigators with a detailed journal she had maintained that accounted for almost every dollar of skimmed funds. She had perpetrated the fraud for over a year, beginning shortly before the Excelsior’s previous housekeeping director had been fired. According to her confession, the prior director had refused to go along with the scheme, which led Ellen to find an excuse to terminate her. When Ellen Lowry hired Josephine as director, all the pieces of her plot came together. For 14 months, Ellen had defrauded the Excelsior out of approximately $95,000 in revenue. To entice guests to pay cash for their stay, instead of the more popular credit card used by frequent travelers, she offered them a special discount. The substantial discount, almost 50% in most cases, resulted in more guests paying cash than would have usually, giving her even more opportunities to skim.
When the corporate office or I analyzed key front desk ratios as part of our internal controls, we noticed that the level of actual cash inflow at the front desk remained steady.
Because sales for the Excelsior were rising so rapidly during that time, Ellen was able to combine her discount scheme with increasing business to defraud the hotel without raising suspicions. Since her theft was small at first, usually only one to two guests a week, she was able to fly under the radar.
In the end, Ellen just got greedy. When her fraud was uncovered, she was up to over
10 guests a week. This number of rooms exceeded Josephine’s capacity to clean and service on her own. Ellen’s greed did her accomplice in. When Josephine was unable to keep up with all the unregistered rooms, guests started complaining. And they were complaining to more people than just the Skim Sisters.
Both women were terminated from their positions at the Excelsior and the fraud was turned over to legal counsel and ultimately the authorities. Before trial,
Josephine cut a deal with the district attorney. In exchange for no jail time, she testified against Ellen at her trial. Josephine served three years of probation and repaid over $10,000 in restitution to Premier Properties. Ellen was convicted and spent five years in state prison. She was also ordered to pay over $100,000 in fines and restitution. Lessons Learned
I learned a great deal about methods to prevent and/or detect fraudulent activities throughout the investigation. Most important, I now have a better understanding of the importance of employee background checks. During her trial, it was uncovered that Ellen had been terminated from a prior position with another hotel due to suspicions of fraud.

Wells4689_c16_1

05/31/2007

153

recommendations to prevent future occurrences

153

This was a very important fact; if I had known about it, I would not have hired her as the
Excelsior front desk manager.
I also realized that a significant number of frauds take place in environments where strong fiduciary relationships exist. As the Excelsior’s general manager, I was preoccupied with sales and marketing calls. Even though I spent two days a week in the office, I left the lion’s share of responsibilities for the hotel’s operation on Ellen’s shoulders. She was able to use, or misuse, my trust to perpetrate her fraud. The one or two days per week I spent in the office weren’t enough to address all the issues of a large hotel. Ellen knew that and used it to her advantage.
Properly implemented segregated duties are vital to prevent frauds of this kind from occurring. Because Ellen was managing the front desk, she had the responsibility of filling in when a clerk called in. This often left her working two shifts a day, five or more days a week. With that kind of exposure to incoming guests, she had ample opportunity to perpetrate and cover up her crime. Because only one clerk worked the front desk at a given time, Ellen had no other hotel employees to contend with.
Mandatory vacations and time off are essential to ensuring that fraud is detected early.
Ellen’s scam was uncovered when she was home sick, a rare occurrence given her dedication to working uncovered shifts. If she had been required to take vacation, or had rotating days off each week, it would have been easier to detect her fraud. Employees should be required to take suitable time off.
After I contacted the corporate office to report my suspicions, I was advised to discuss my discoveries with no one. I later understood why this was important. Fraud investigators spent significant time in the Excelsior case to determine how and where Ellen was placing the skimmed cash. An analysis of bank records showed that she had set up a separate checking account at her bank where she was depositing the cash proceeds from her fraud.
She was then transferring the cash to several investment and personal loan accounts she had opened. If Ellen had been tipped off earlier in the investigation, she could have potentially moved the cash, making it difficult for investigators to track down. Luckily, she had spent only approximately half of her take. Premier was able to recover the remaining amount, in addition to Lowry’s restitution.
I also learned the importance of establishing a concern hotline for guests and employees.
Unregistered guests who had complaints about their stay and service were reporting their concerns to the Excelsior’s front desk — in essence, to Ellen. If an outside line, a thirdparty concerns system, had been established, then perhaps the fraud could have been detected sooner.

Recommendations to Prevent
Future Occurrences
Based on the lessons we learned from Ellen and Josephine, the Excelsior changed its policies and procedures to include the measures that follow.

Wells4689_c16_1

154

05/31/2007

154

chapter 16

the skim sisters

Background Checks
The Excelsior now conducts background screenings prior to hiring employees in sensitive positions. Even though the cost of these screenings can be prohibitive for some organizations, the potential savings in fraud and other losses is often more than enough to compensate.
Segregation of Duties
Effectively segregating certain duties among personnel is vital. Now at the Excelsior, two clerks always occupy the front desk. The desk clerks work on a rotating schedule, so the same two rarely work together twice in any seven-day period. When a guest checks in and pays cash with one desk clerk, the other desk clerk must verify the cash amount received, as well. When each shift ends, both front desk clerks independently count the cash proceeds from their shift and deposit them in the hotel’s safe together.
Additionally, management at the Excelsior is now prohibited from working more than one shift per week in a fill-in capacity. Any shift left open by a sick or vacationing employee must be offered to another existing front desk clerk before being taken on by management.
In the event that a manager does have to fill in for a desk clerk, the general manager verifies all cash activity the following business day.
Surveillance
Premier Properties also invested in a small, in-house surveillance system for the Excelsior’s front desk area. This type of system is a must-have at many hotels to ensure any instances of robbery are caught on tape. Furthermore, the surveillance system, which was relatively inexpensive, monitors each guest as they check in. The videotapes provide an independent resource for management to verify certain transactions, should the need arise.
Mandatory Vacation
It is essential that employees be required to take frequent time off and use their vacation time. The Excelsior now requires employees to take time off. A cross-training program has also begun where, for two weeks prior to taking vacation, an employee will train another hotel employee in his or her job responsibilities. Not only does this practice better prepare existing employees to take on other roles at the hotel, it also puts a fresh set of eyes on each position, which contributes to fraud prevention and detection.
Hotlines
Every company should have a hotline number for employees or customers to report concerns. Since the Excelsior’s fraud, Premier Properties has contracted with an outside

Wells4689_c16_1

05/31/2007

155

recommendations to prevent future occurrences

155

agency to provide employee and guest concern hotline services. All reports of fraud are forwarded to the corporate office, not the individual property, to ensure each report is appropriately investigated.
Other Measures
Premier Properties still requires the Excelsior to take each room out of service once during a 12-month period for deep cleaning. Now, however, the corporate office reviews the
Excelsior’s inventory records via a remote Internet connection and selects the rooms that will be taken out of service and when. This level of independence regarding out of service rooms has helped to prevent a recurrence of the Skim Sisters’ fraud.
Hotels and other lodging establishments face unique risks regarding vacant inventory.
Astute fraudsters realize that with hotels, there is no missing merchandise to count when theft has occurred. Therefore, it is incredibly easy to fill a vacant room, pocket the proceeds, and clean the room without being detected. Now at the Excelsior, a manager independent of the front desk must personally inspect every room that is out of service for maintenance reasons. Additionally, a random sample of vacant rooms must also be inspected weekly.
The best recommendation for managers to prevent fraud in the future is to always be visible, attentive, and involved. Businesses that have managers who espouse ethical behaviors throughout the organization will have less occurrences of fraud than organizations that do not have these individuals. Potential fraudsters are less inclined to act on fraud opportunities in organizations where management emphasizes and enforces ethical behavior standards both internally and externally.

Adam K. Bowen, CFE, CPA, M.Acc, is an accountant with Georgia Power Company, a subsidiary of Southern Company. Based in Atlanta, Southern Company is one of the largest generators of electricity in the nation. Mr. Bowen is a graduate of the University of West Florida.

Wells4689_c17_1

05/31/2007

156

chapter

17

&
No Such Thing as a Free Lunch
SUZANNE COGGINS

atti Clinton was a struggling 23-year-old mother with a 5-year-old son. She rarely referred to his father, and it was common knowledge that she couldn’t count on child support. Little was known about her family background, but she was an intelligent young woman just trying to make a decent living.
Patti applied for a position as a front desk assistant at the Family Wellness Practice
Center. Though she had no experience in medical offices, she was willing to learn. Her pleasant smile and demeanor led the office manager, Lucy Green, to believe that Patti would be a wonderful match for the practice.
During the interview, Patti admitted that her work history was spotty, but attributed it to constant chaos in her relationship with her son’s father. She declared that she was now focused and ready to start a career in medical office assisting.
When the Family Wellness Practice Center opened, Dr. Richard Steever had a vision to provide top-notch medical care. After finding an easily accessible first-floor office suite in an ideal location, he proudly had his name painted on the double doors.
With everything in place, Dr. Steever’s practice began. Soon after, his appointment book filled up. He and his staff were overwhelmed. Not anticipating such rapid growth,
Lucy scrambled to hire additional help. Before long, the office staff had grown from two to six. Scheduling patients and exams and calling in prescriptions became paramount. Patient satisfaction was high.

P

The Lunchtime Bandit
In Dr. Steever’s office, there was a rule: The rookie employee covered the workplace while the rest of the personnel went to lunch. Day in and day out, Patti was left alone, manning the front desk while everyone but the doctor ate out.
It wasn’t long before she started showing suspicious behavior. First, Lucy noticed that
Patti’s wardrobe was undergoing a transformation.
‘‘Sandra, have you noticed that Patti seems to be wearing a lot of new clothes these days?’’ she asked the insurance clerk. ‘‘How can she afford them? I don’t even have the money to dress like that, and I’m married—with a second income!’’
156

Wells4689_c17_1

05/31/2007

157

the lunchtime bandit

157

‘‘I’ve noticed the new clothes,’’ Sandra answered after a long pause, ‘‘and she has also been buying her son some expensive toys during her lunch breaks.’’
Sandra leaned over her turkey sandwich and whispered, ‘‘Do you think she could be stealing money from the office?’’
Both women made a decision to keep their eyes and ears open. They would not say anything to the doctor because at this point, it was merely speculation.
Lucy and Sandra didn’t have to wait long. As luck would have it, later that week a patient came in with a statement that she had received from Dr. Steever’s office. Mrs. Dawson was quite upset about her bill. Included in the amount due was a $50 copayment.
‘‘I don’t owe this,’’ she explained to Lucy. ‘‘I paid $50 cash to the girl at the front desk.’’
Then she produced the receipt. Mrs. Dawson claimed that at the time she paid the copayment, the girl at the front desk took the money but did not voluntarily give her a receipt. ‘‘I practically had to beg for it,’’she said. Lucy apologized profusely, made a copy of the cash receipt, and assured the patient that she would not be billed for the $50 copayment again. When the office closed for the day, Lucy went to the cash receipt book to try to find the carbon copy of the receipt issued. The book was a generic fill-in-theblank type. In the upper right-hand corner there was a blank place for the person filling out the receipt to hand-write a number. The space was always left blank.
Numbering receipts was not a procedure that was followed. So, she went to the date indicated and tried to find the carbon copy. But she couldn’t find one. Looking carefully to see if any pages had been ripped out, she noted that none were missing. Could someone have a duplicate receipt book? It seemed possible since it was available at any office supply store.
Next, Lucy accessed the insurance file. She pulled Mrs. Dawson’s chart to see if there was any indication of a $50 cash payment or to see if there were any errors. To her surprise, she discovered that the paperwork for billing the insurance company was not in the file.
Then she pulled the master list and searched for Mrs. Dawson’s name. She scanned the list three times but was unable to find any documentation stating that the insurance company had been billed for this visit.
The next morning, Lucy called a private meeting with Sandra. She inquired about a backlog of unbilled insurance issues. Sandra assured her that all the paperwork had been submitted. Since completing a daily cash log was not part of the office procedure, they could not check if a cash entry had been made. They did, however, go to the patient signin list for that date. A cursory check of two patients that had been seen before and after
Mrs. Dawson revealed that there was no insurance activity and no paperwork for those patients, either. Before they went any further, Lucy and Sandra decided that it was time to call in the doctor. Neither one of them wanted to approach Dr. Steever with this discovery. He was a kind and generous man, a physician they admired and respected.
Most of all, they knew he completely trusted his staff. He would be devastated. Dr.
Steever was committed to his staff, having said on many occasions, ‘‘My success will be reflected in your paychecks.’’ Lucy and Sandra contemplated how this situation would

Wells4689_c17_1

158

05/31/2007

158

chapter 17

no such thing as a free lunch

reflect on them since it was their responsibility to see that all office and insurance functions were accurate.
After hours, the women approached Dr. Steever to explain what they had found. He was shocked. ‘‘How could this be happening?’’ he asked.
Everyone was silent. Finally the doctor said, ‘‘This is out of my league. I’ll call the police for advice. I don’t want to accuse her if she’s innocent.’’

Trail of Tears
Soon after, I received a call from Detective Duane Lunsford. He was one of three local police officers who had accepted our invitation to attend an all-day fraud seminar with our
Certified Fraud Examiners. As president of our local chapter, I decided that one of our goals for the year was to involve local law enforcement officers in our training. We knew that every policeman or woman knew exactly how to handcuff and arrest someone. But fraud investigation education was minimal. Detective Lunsford asked if I could come by to review the case with him.
He informed me that Dr. Steever had met with the chief of police that morning and the matter had been turned over to him. Detective Lunsford was tall, and wore a starched white shirt with a blue pin-striped tie. The only indication that he was a police officer was the shiny police badge clipped to his belt. The following day we visited Dr. Steever’s office.
Initially we met with Lucy. Clearly, she felt some responsibility for the circumstances.
During the interview, she repeatedly said, ‘‘I guess I should have checked her references more carefully.’’
I requested that she take us through a typical day at the office. We started with the morning appointments. When patients come in, they are given a copy of the sign-in sheet.
The requested information consisted of a date, name, the time of sign-in, and the insurance company. There was a column beside that was to be filled in with a checkmark when the patient was called back to the examination room.
‘‘Almost all patients are seen by scheduled appointment. It is rare that we would have any drop-ins,’’ Lucy explained.
Next, I wanted to start an information trail for all patients from the time they made an appointment until their visits were paid. I asked her if the schedule was listed in a computerized module or in a book. No, she said, they were in an appointment book, written by hand in pencil.
I asked if the appointments were transferred to a daily master sheet, which could help me determine the payment method for each visit. Lucy said that the only sheet with names was generated by the appointment clerk who calls the day before to remind patients of their appointment. Detective Lunsford had already told me about their method of collecting cash. I reviewed that procedure with Lucy, who confirmed that when cash was taken, it was placed in a cardboard box under the reception counter. There was no cash log at all. I then asked how often the cash was counted and a deposit made.

Wells4689_c17_1

05/31/2007

159

trail of tears

159

‘‘Whenever,’’ she replied. Lucy said that sometimes they were so busy that there was no time at the end of the day. In that case, they deferred the task until someone had the time. A review of deposit slips showed intervals of up to five days between deposits.
Intrigued by the cavalier attitude toward cash collection, I asked if there was ever reconciliation between the cash receipt book and the amount of money in the brown cardboard box. Lucy said that they had always just counted up what was there and entered it as ‘‘cash’’ on the deposit slip. No effort had been made to show a correlation between the cash receipt book and the money collected.
‘‘Some people never ask for a cash receipt,’’ she explained. ‘‘However,’’ she added,
‘‘payment information is also contained on the three-part insurance form. The last, or yellow sheet, is the patient copy. The office copy also shows if a patient paid with cash.’’ But
I discovered that there was no tracking of cash payments from those forms, either.
A quick review of the cash receipt book revealed a generic, unnumbered, two-part book. Over half of the copies were barely legible and the space for the signature of the person authorizing the transaction was blank. Lucy explained that the top copy was always stamped with the doctor’s name. Thus, it was impossible to tell who had issued the receipt.
She sensed my surprise after she described how the funds were handled. Lucy proceeded to explain that the cardboard box was almost like a petty cash fund to them.
Even the doctor had taken money out of the box to pay for pizza and drinks for an impromptu office party.
Next, we interviewed Sandra. She explained the check-in procedure, which was pretty straightforward. At the time the patient registered and presented insurance information, a three-part insurance form was completed then placed in the person’s file. It was then handed to the front desk clerk, who passed it to the nurse. After the appointment, the nurse handed the entire file back to the front desk clerk, who totaled the charges for the visit and handled copayments, ranging from $15 to $75. If the patients had not met their insurance deductible, the full amount was due, which varied from $150 to $500.
Occasionally there was a cash-paying uninsured patient. But these were rare occasions.
The files were then filed in a portable plastic container, which Sandra picked up daily to perform her entries into the insurance billing system. I asked her if she ever ran a checklist against billable visits and the sign-in sheet for the day. She looked at me over the top of her glasses and sighed. ‘‘No,’’ she said, ‘‘we really never felt the need to do that.’’
Lucy then helped us by reconstructing the schedule of the office personnel. She showed us the calendar for everyone involved in front desk activities. After carefully reviewing the schedule, Detective Lunsford and I determined that Patti was responsible for front desk collections approximately one and a half to two hours per business day. Because she covered lunch, she was unsupervised during this time. Furthermore, our suspect shared the same lunch block as the doctor. Hence, patients were not seen when Patti was on break. Lucy also indicated that our suspect readily volunteered to cover the front desk if someone needed to leave for an appointment.
Feeling confident now that Patti had been given the opportunity and means to steal cash from the office, we conducted a thorough paper audit of daily patient sign-in sheets against

Wells4689_c17_1

160

05/31/2007

160

chapter 17

no such thing as a free lunch

insurance billings. Each business day for the past six months was pulled and a chart was established, matching patient sign-in sheets with insurance claims.
After this task was completed, a clear picture developed. Each week, several patients who had signed in did not appear on the insurance billing. When we discovered a case like this, the person’s file was pulled to make sure that unbilled insurance papers hadn’t been accidentally left there. When we were satisfied that none of this documentation existed, we contacted the patients to verify that they were in Dr. Steever’s office on the day indicated on the sign-in sheet. We were able to confirm with several people that they were, in fact, in the office for treatment. Thankfully, most of them agreed to provide us the patient copy of their insurance form.
We guessed that Patti had destroyed the insurance paper and returned the patient folder to the filing area. She had unlimited access to the records room. Although there was a procedure for signing patient charts in and out, certain aspects of it had not been followed. It was impossible to determine who pulled the chart and for what purpose. The investigation revealed that every patient who had been seen by the doctor, but did not have corresponding insurance paperwork, had appointments when Patti was covering the front desk alone. All insurance billing omissions occurred between the hours of 11 a.m. and 1 p.m.
The doctor used a payroll billing service, so there was excellent documentation of days and hours worked. Time sheets were filled out and signed by each employee. The office manager had kept meticulous time and attendance records. Next, we created a spreadsheet of Patti’s daily schedule. A second spreadsheet was made to show the days and times of the appointments that had insurance billing omissions. We then reproduced the second one on a transparent overlay. When we placed the transparency over Patti’s schedule, it matched perfectly. Compiling this information had been a lot of work, but the two spreadsheets spoke volumes. There was no doubt that we had the right suspect.
Detective Lunsford wanted to take one more step. He reconstructed everyone’s schedule on a spreadsheet. By doing this he wanted to show that the other employees were not at the front desk when these patients were seen.

All’s Well that Ends Well
We reviewed our findings with Dr. Steever and Lucy. Detective Lunsford informed them that he felt he had enough evidence to charge the perpetrator for embezzlement. The following day, when Patti reported for work, Detective Lunsford was waiting for her.
He took her into a private room and explained that there was money missing from the office and that they would like to talk with her at headquarters. She agreed and they left in the cruiser for the police department.
Detective Lunsford had previously agreed that actions in the doctor’s office would be low key. His approach with Patti would be ‘‘firm but supportive.’’ He wanted to gain her

Wells4689_c17_1

05/31/2007

161

all’s well that ends well

161

trust and be able to question her without evoking an emotional component. Hence, there were no handcuffs and no dramatic arrest scene.
Once they arrived at the police department, Detective Lunsford took Patti into his pink flamingo interrogation room. While I was not present, I could visualize the entire scenario—the slender young woman sitting across from this imposing figure in a room designed specifically to wear a suspect down. Detective Lunsford spared me no details later as he explained the interrogation. Patti denied any involvement. Then he left her in the room for 20 minutes, allowing her some time to think. When he returned, the detective brought the spreadsheets we had constructed.
‘‘When I told her that we had documentation that the missing cash occurred while she was alone at the front desk, she started to cry,’’ he explained. Patti then told the detective her version of what happened. When she first started at Dr. Steever’s office, everyone was nice and helpful. A month into her job, coworkers began leaving her alone at the front desk while they all went to lunch. Patti said she had never stolen anything before, but one day she needed $20 for her son’s preschool field trip. After she took the cash, she realized that she would have to destroy the insurance paperwork.
Patti explained that she did not take money for a few weeks after that. Then she gradually began taking more cash copayments. To conceal the evidence, she folded the insurance paperwork and put it in her purse, destroying it when she got home. After patients began requesting receipts for cash, she went out and bought a duplicate receipt book. The embezzlement slowly escalated. Patti said she realized that no one missed the money and no questions were asked, so she continued to dip into the cash box. The day
Mrs. Dawson came in with the bill for the copayment, she remembered that she forgot to destroy the woman’s insurance paperwork. After she explained everything, the confession was written and signed. The following week, Detective Lunsford called me.
The day after signing the confession, Patti had hired an attorney and was claiming that the confession was forced. She alleged that the detective had terrified and intimidated her into signing it.
For the next couple of months, I did not hear from Detective Lunsford. When I called to inquire about the status of the case, he chuckled.
‘‘Well, I had to jump through some hoops, but we re-arrested her, and guess where she was?’’
‘‘Where?’’ I asked.
‘‘In another doctor’s office!’’ he exclaimed. ‘‘This time we marched in with a warrant for her arrest, handcuffed her, and brought her right to jail.’’
Because this was a first offense, Patti was given suspended jail time, community service, fined, and ordered to make restitution. Her family stepped in and repaid the embezzled money. Dr. Steever was able to recover about 75% of his unfiled insurance claims by submitting them to some insurance companies with a letter of explanation.
The amount taken was estimated at $2,500 to $3,000. The unbilled insurance claims totaled $15,000.

Wells4689_c17_1

162

05/31/2007

162

chapter 17

no such thing as a free lunch

Lessons Learned
Assisting in this case showed me how important it is for law enforcement to have the knowledge and the skills to investigate financial crimes. Even prosecutors say that as attorneys, they know the law, but do not have enough expertise in fraud to prosecute the increasing volume of cases.
The doctor was completely committed to providing the best possible medical care. In fact, he was so focused on that aspect that he neglected to address critical areas in his practice that involved money—the very thing that would permit him to continue to offer the best service. Regardless of your career path or business, it is important to know the risk of fraud and ways to prevent it.
When establishing setup costs for his practice, Dr. Steever had splurged on medical equipment, office furniture, and a state-of-the-art patient filing system. But when it came to the financial aspect, he relied on a bare-bones setup of records and documentation, along with a family member who helped with the accounting procedures. This was a system that had no methods to prevent embezzlement of cash.

Recommendations to Prevent
Future Occurrences
Establish a Clear Procedure for Collecting and Storing Cash
A cash log with the amount, time, date, and name of the client should be established and maintained. All cash should be kept in a locked box. There should be no reason whatsoever that cash should be removed until it needs to be counted and reconciled. Cash should be reconciled on a daily basis. In case a discrepancy is discovered, it is much easier to review one day rather than reconstruct a long period of time. If employees are aware of this practice, it can also serve as a deterrent. Furthermore, large amounts of cash should not be kept in the office.
Record All Petty Cash Withdrawals
A petty cash box needs to be established with a designated amount of money for expenditures like office parties. A valid receipt should be deposited into the petty cash box for every purchase. That reconciliation should be done at least on a weekly basis. It should be the objective of the office to purchase as much as possible by company check, purchase orders, or authorized credit.

Extensive Cash Receipt Documentation
I recommend preprinted, numbered cash receipts with the name of the firm, address, and phone number. A review of the carbon copies should be conducted routinely.

Wells4689_c17_1

05/31/2007

163

recommendations to prevent future occurrences

163

A procedure should be established for voiding receipts that include approval from a supervisor. Start-Up Businesses Should Monitor Accounting Closely
For any start-up businesses, it is critical to give careful attention to all aspects of accounting.
While I realize that leather furniture and ambient lighting all make for a comfy waiting room, I would rather know that my money and my assets were protected by solid accounting procedures and fraud deterrents. Relying on family or friends to help set up office accounting procedures can be a mistake. When it comes to the books and the money, seek qualified and experienced professionals.
In addition, plan for growth. As in Dr. Steever’s case, the rapid increase in patients was surprising for both him and his staff, and he was not well positioned for expansion. Chaotic cash-handling led to destruction of insurance billing documents. The loss was not just the cash copayment. The entire documentation of the office visit was destroyed. Equip small businesses with up-to-date software programs to prepare for growth.

Suzanne Coggins, CFE, is the owner of Lindsey Consulting in Fort Mill, South Carolina.
She provides proactive fraud consultation to small start-up companies. Ms. Coggins holds an associate’s degree in industrial health and safety and a BS from Liberty
University. She has 30 years of experience in worker’s compensation fraud and fraud education, prevention, and detection.

Wells4689_c18_1

05/31/2007

164

chapter

18

&
The Dirty Custodian
PAUL J. HARVEY

n the outside, Art Dixson appeared to be a simple, hardworking, middle-age man.
He was never noted for flashy clothes or fancy cars. For many years, his home was a modest rental apartment unit. He was single and not socially active.
To the few who knew him well, Art was a fan of horse racing. To them, he boasted of winning substantial wagers at a local track. Art was also proud of his history as a statelicensed boxing promoter. His fighter was an impressive 21–4–2 with 19 knockouts. And, known also only to a few people, at one time Art had been a reserve deputy sheriff who completed a very tough training academy in Los Angeles.
Art was one of those guys who seemed to be working all the time. While employed full time as a custodial supervisor in the Unified School District, he also maintained a position with a very large hospital as a contract custodial supervisor. Given his two jobs, his management of a successful boxer and his frugal lifestyle, Art was not a person who would be a likely suspect for large-scale theft of public funds.
Unfortunately, what people didn’t know about Art was that at the time he was employed by the Unified School District, he was already a felon. In the early 1980s he was convicted of burglary and grand theft after stealing property from his employer, where he had worked as a custodial manager.
The Unified School District consisted of nearly 20 campuses and several noneducational facilities. It had an enrollment of over 18,000 students and employed hundreds of teachers, administrators, and clerical and facilities persons.
The district was well known throughout the state as a poor minority school system— it was actually bordering on insolvency—and it had become a near-academic failure, as well. After receiving a $27 million modernization grant from the state, things were looking up. Unfortunately, trouble was coming. While it was promising to see 16 of the school sites renovated, the survival of the district was doubtful. The County Office of Education had hired a fiscal advisor, Greg Richards, to oversee and control the finances and deal with a fiery, no-nonsense superintendent. There was little peace in this organization, which served a community of over 110,000 residents. Nepotism, favoritism, and outright indifference to fiscal problems were sending this organization into a downward spiral.

O

164

Wells4689_c18_1

05/31/2007

165

the dirty custodian

165

One October day I received a call from my chief, asking me to report to the city manager’s office with him and my captain. I had been a police officer for more than
22 years and a fraud investigator for over 16. I had just received my CFE accreditation six months earlier. The district was not a new target for my investigations; I had been there many times before.
The meeting was intriguing. The city manager, police chief, and my captain were there as well as Richards and the new superintendent. The discussion focused on an impending fiscal crisis that could have criminal ramifications and then a plea for the police department to provide assistance. Richards—a retired longtime school administrator and one of the most brilliant men I’ve worked with—told us what he had found. In the grant to modernize the campuses, almost all of the work was to be done by outside contractors through a project manager. Yet there were substantial budget provisions for services, particularly for the substitute custodial account. According to the district’s organizational chart, there were between 35 and 40 regular custodians and no more than 3 substitutes.
While the regulars provided typical janitorial services, the others filled in for ill or injured regulars. They also provided general clean-up assistance where the school sites were being renovated. The budget for the past school year provided $160,000 to cover the substitute custodians. Richards said it was peculiar that this account was so heavily funded. At an approximate gross payroll cost of $9.25 per hour, the three substitutes would cost about
$70,000 per year if they worked the maximum 208-hour months. But during his review,
Richards said that expenses for substitute custodians for the first quarter had already reached $320,000. At this rate, the yearly cost would be more than $1.2 million, a figure four times greater than allocated in the budget.
In an attempt to verify this anomaly, Richards contacted Art’s supervisor, who confirmed that Art had actually hired seven, rather than three, substitute custodians.
Later in the day, Richards spoke with Art, who said he had to hire extra substitutes to cover the workload created by the modernization project. Richards found these explanations to be feeble at best. Art bragged about winning a sizable amount of money at the horse track and commented that his business venture involving the promotion of professional boxers was really taking off. Richards told me that he thought it odd that Art would mention these things unless he was trying to lay a foundation for an explanation of recent wealth. Shortly after this conversation, Richards learned that
Art had purchased a new luxury automobile, which we later found cost $40,000. It was even more interesting to note that there was no lien holder listed, which was a sure indication that it was purchased for cash.
The fiscal advisor looked at the payroll records and discovered there were neither 3 nor 7 substitute custodians, but actually as many as 77! Investigating further, he found that each had been paid a staggering amount of money. The most glaring detail was that many of them were paid for more than 40 hours per week, yet not a single one was paid overtime.
Although they worked far in excess of regular hours, they were consistently and without exception paid at straight time. None was receiving any form of fringe benefits.

Wells4689_c18_1

166

05/31/2007

166

chapter 18

the dirty custodian

Richards then examined many of the personnel applications on file for the substitute custodians and saw that every one had been given preliminary approval by Art. Only a handful had undergone the normal and required process of school board approval. It seemed that whoever Art approved was hired.
Finally, Mr. Richards contacted two very trusted employees in the payroll department.
It was then that he learned that on paydays, the district office was so overrun that they decided to hand out the checks to supervisors for distribution to their employees. They remembered that every month for about a year, Art picked up a large stack of checks by
9 a.m. on paydays. The payroll department was most appreciative. Of course, so was Art.
Richards turned to me and said that he had gone as far as he could without tipping anyone off, but thought that what he had seen so far constituted a strong suspicion that a fraudulent payroll scheme might be in progress. I had to concur, and based on the preliminary information, it was reasonable to conduct an investigation.

A Ghostly Payroll
Fortunately, I got the green light to proceed. Unfortunately, everyone wanted it done yesterday. There were myriad issues to deal with, not the least of which were legal considerations. Some wanted me to apply the idiot test, which says that given the circumstances, any imbecile could see that a crime had occurred—now go and arrest him! While there are many different legal theories that might fit the circumstances, they require the requisite intent. Many also require proof of the suspect’s knowledge. Each statute involves elements that have to be proven individually. It was obvious that hundreds of thousands of dollars had been wrongly expended, but this alone does not establish that a crime occurred. There may be serious breaches of a fiduciary duty, carelessness, sloppy accounting, and reckless oversight, but under California statutes, such things amount to civil wrongs, not crimes. It was my job to establish that a criminal offense occurred and that the standard of proof was beyond a reasonable doubt.
I used a timeline to understand the patterns of the system and the actions of the suspects.
During the prior six months, the payroll was always closed by the twenty-fifth of the month. By the tenth of the following month, always on a nonholiday Friday, the checks were distributed. At this point in my investigation, November 25 had passed, and the next distribution was to be December 8. This left me two weeks to find and examine evidence and implement a plan.
The first step involved collecting every evidentiary document available. In my experience, these things have a habit of growing feet and walking away if not seized very early in an investigation. Over the next several days, I had personnel files and time sheets removed from the district office, sometimes after midnight. The superintendent helped in accessing the prior-month payroll warrants from the County Office of Education.
Next, I put all of the information in a simple spreadsheet that included name, address, telephone, Social Security number, date of birth, and emergency contact name(s). With this, I could access motor vehicle, arrest, victim, and witness records from police files.

Wells4689_c18_1

05/31/2007

167

a ghostly payroll

167

These revealed aliases, addresses, Social Security numbers, and dates of birth that in several instances differed from the employment records. Some of the suspects had felony convictions that should have disqualified them from employment with the district. It was obvious that required background checks were not run on these individuals.
The spreadsheet showed commonalities. Several of the suspects had the same address.
Two of them were issued traffic citations at different times for an identical vehicle. One was reported as deceased a year before he applied for the job—yet payroll warrants were issued to him under two aliases for several months. Another phantom employee and his wife were identified as receiving money each month in their real names, as well as in aliases.
I cataloged the payroll warrants from the prior month by name, check number, location cashed, and endorsement information. I found the markings on a cashed check very helpful in establishing how, when, where, and by whom it was negotiated. The data showed that many of the suspects cashed their payroll warrants at the same time at the same establishments. Most of these businesses take photographs of their customers and checks, which is priceless evidence. The vast majority of the warrants were negotiated for cash; only a few were deposited into bank accounts. This is consistent with phantom payroll.
The employees had not been approved by the school board as required. None of the files contained I-9 forms and only a few had W-4 forms. Art Dixon had signed the applications, and each bore his initials. When compared to legitimate personnel files, they were very obviously fakes.
I next entered the prior six-month payroll records and time sheets in another spreadsheet. When I sorted them by the number of hours worked in a given month, I found the most significant patterns. With the exception of just a few names (later determined to be genuine employees), each and every suspect was paid for more than 40 hours a week. All were in whole numbers (no partial hours), and the gross amounts were the same in each month. As Richards had already found, none of these individuals was paid at the overtime rate even though they supposedly worked more than 40 hours each week. Art Dixson approved every time sheet, as evidenced by his signature on each.
Finally, I needed to corroborate my findings. With dozens of possible perpetrators, there just had to be one who would be willing to cooperate without jeopardizing the investigation. I decided to interview a young woman named Lynn Powers who had received just a few payroll warrants and had no criminal history. My partner and I arrived at her house early one evening. As she opened the door, I could see small children playing in the living room. I gave her the usual cop greeting: ‘‘Hi, Lynn. We’re police officers. Can we talk to you for a moment?’’ She said, ‘‘I know what this is about. Come on in.’’ Art
Dixson’s life was about to change.
Lynn said she had expected us to come one day and ask her about her ‘‘work’’ at the school district. She told us a man who owned a hair salon had enlisted her to fill out a phony employment application. She knew him only as Mr. T. Thereafter, she had to fill out a time sheet and turn it in before the end of the month. Around the tenth of the next month, she was given a check, which she cashed and kept about $200. The remaining money (usually more than $1,000) went to Mr. T. Based on her information, I was able to

Wells4689_c18_1

168

05/31/2007

168

chapter 18

the dirty custodian

identify him and determine that he was receiving checks in two different names, as was one of his employees at the hair salon. Lynn furnished information about several others in the neighborhood who were also participating in the scheme; these names matched ones I already had. She confirmed that none of these people, including her, ever worked for the district. It was time to prepare the case. Art was clearly the major figure in the scheme to introduce phantom employees into the district’s payroll. Mr. T was also a player in this scheme, so he was also named.
Our arrest-planning meeting included a captain, a sergeant, and our narcotics surveillance team whose specialty was undercover work. We excluded all other backup personnel from this meeting because fewer people involved lessened the risk that the operation would be compromised before being executed. I obtained a search warrant for
Art’s home and automobiles as well as Mr. T’s business and cars.
On December 8, the surveillance team watched Art as he left his apartment at 5:30 a.m., followed him to several school sites, and tailed him as he picked up the checks and drove outside the city, where he met with three women and handed out the payroll warrant envelopes to them. At this point he was detained. I arrived just in time to watch.
The women, mother and daughters, admitted they had no right to these checks and confirmed they never worked for the district. They gave the same statements as Lynn
Powers, except they received their checks directly from Art, and had done so for many months. For each one, they were paid $200 and gave the balance directly back to Art in cash—about $1,000 per check.
We searched Art’s car and found the remaining December payroll warrants on the front seat. They had been carefully sorted with true employees in one small stack and phantom employees in another, much larger stack. We also found handwritten ‘‘Pay-Owe’’ sheets from prior months listing the phantom employees, which clearly showed Art’s primitive tracking of who received a check and when the person paid him his cut.
Before the day was out, we searched Art’s other cars and home and Mr. T’s business and seized over $60,000 in illicit payroll warrants. I spent an hour and a half interviewing Art.
He admitted to receiving around $150,000 from the scheme and claimed that ‘‘Mr. T’’ had gotten about $250,000. Most important to the investigation was Art’s admission to being the main perpetrator behind the entire fraud. We arrested Mr. T.

The Cleanup
I spent the next seven months hunting down more than 70 phantom employees and interviewing them before the case could be filed. Surprisingly, most were fairly cooperative. They all offered the same story—that they were acquainted with Art or
Mr. T and were solicited to participate in the fraud at a very difficult time in their lives.
Many believed that they were selected because they were on relief.
The district brought a civil action against Art. Judgments totaling $150,000 were obtained. Art’s bank accounts and luxury car were levied by the civil court.

Wells4689_c18_1

05/31/2007

169

lessons learned

169

The case was presented to the district attorney’s office for consideration of a criminal complaint. This is where the real work began. We were gifted with a very talented and energetic prosecutor. Together, we sorted and marked the huge volume of documents. For compliance with discovery, we duplicated dozens of taped interviews that had been transcribed. The case was meticulously prepared.
Toward the end of the trial, the prosecutor showed the video of Art’s confession.
The defense lawyer objected, arguing, unsuccessfully, that Art was coerced into being interviewed without an attorney. This is where video evidence was crucial. When Art took the stand, he turned out to be our best witness! When confronted with inconsistencies between his taped statement and testimony, he said he had not lied but offered
‘‘nontruths’’ when interviewed after his arrest. The jury took just over an hour to convict him on all counts.
Art was sentenced to five years in state prison, followed by a three-year parole period.
Several others, including Mr. T, were separately prosecuted for their parts in this scheme and other crimes that were discovered during the investigation.

Lessons Learned
Every case should be carefully critiqued at its conclusion. All aspects, from inception to conclusion, need to be reviewed. There are always things that we can learn to do differently and more efficiently next time.
Urgency and Secrecy
In this case, both urgency and secrecy were required. That severely limited the time before making an arrest and the number of personnel needed to get to that point. Each time a payday came and went, so did over $60,000. The best time to intervene in this case was on a payday, when the suspects could be caught in the act. In smaller municipalities or corporations where word travels quickly, it doesn’t take much for someone to catch on. So, the longer it takes to make an arrest, the more likely it becomes that the secrecy will be breached. The fewer people ‘‘in the know,’’ the better.
The Effect of Publicity
In a criminal case arising from a public entity, we learned that some consideration should be made about how the publicity is handled. After the arrest, the district seemed to come apart at the seams. Everyone demanded to know what happened and why. Many different political machines went into motion. Elected officials were incensed that they weren’t briefed prior to the arrests. Publicity also affected the process to fire Art. There actually were some in management of the district who believed that Art should not have been fired until convicted, but rather put on paid administrative leave. More important, I knew that other crimes were being committed within the district. The last thing that I wanted was for any potential whistle-blowers to fear that their tips might not be dealt with professionally. Also, I found

Wells4689_c18_1

170

05/31/2007

170

chapter 18

the dirty custodian

that having the search warrant affidavits sealed during the critical investigative stages was helpful in not adding fuel to the fire. Release of such information often compromises the investigation and parallel investigations that may arise.
Interviewing a Perpetrator
There is nothing more important to an interview than planning. After all, Art confessed, and the confession was admitted into evidence. I had formulated the questions and prepared for his responses. I was thankful we had videotaped the interview. It played very well to the jury and really sank Art’s claim of being under duress to give a statement without an attorney being present. When interviewing Art, I learned how important it was to control the questioning, allowing him time to fully answer my questions, especially when he was not being truthful. Nothing derails a perpetrator in court faster than his or her own lies, especially when viewed by a jury on a large-screen television display.
Evidence Handling
In a case like this, where there are literally thousands of pieces of evidence, there must be a system for cataloging, copying, and securing it. One of the best systems today is digital storage, although it was not available during this investigation. Digital audio and video recordings, photographs, and document scans can be priceless in large cases. When working on any investigation, use what has been referred to as the vertical system as opposed to horizontal filing. The vertical system involves the orderly sorting and keeping of documents in clearly marked folders, stored vertically in boxes. The horizontal system involves sloppily laying all documents horizontally in a box (or boxes) until needed.
When preparing for discovery or any other copy processes, first create a folder as a
‘‘master copy file’’ of all documents that will be needed. Carefully produce clear photocopies of every piece of evidence. Reduce the size of legal documents to fit onto letter-size paper. Later, when a copy job is required, this master can be used to produce as many sets as needed, all of which will be of the best quality possible. I could have saved many hours of tedious sorting of evidence by doing this during the district’s investigation.
And remember those simple spreadsheets? They are wonderful until your computer locks up and your last several hours of work are lost. That happened twice in this case. I found that setting frequent backups and backing up every computer session virtually eliminated data loss caused by crashes and freezes.

Recommendations to Prevent
Future Occurrences
It must sound like a broken record to anyone who investigates financial crimes: ‘‘There were no controls in place . . . someone circumvented the controls . . . we’re too shorthanded to have duties segregated . . . we don’t usually run background checks.’’ So we must continue to preach the same message.

Wells4689_c18_1

05/31/2007

171

recommendations to prevent future occurrences

171

After Art Dixson was arrested, the superintendent issued an executive order to all employees. It was posted on the entrances to the district office and at all school sites.
Anyone with any information regarding fraud committed against the district was to report it immediately—and we were the only two persons to whom fraud tips were to be made.
Failure of any employee to adhere to this order would result in his or her dismissal.
While this method may seem unusual, it worked. Over the next three years, more than a dozen workers were arrested and convicted of various fraud offenses. Many of the leads came from anonymous tipsters employed by the district.
This case resulted in major personnel, payroll, and accounting office policy change recommendations: 

All prospective employees are fingerprinted and checked for criminal convictions prior to being submitted to the board of education for approval.



No prospective employee is permitted to commence work until approved by the board and entered into the personnel and payroll systems.



No employee is entered into the payroll system without a supervisor’s written approval. Those approved for inclusion must first have complete personnel packages
(I-9, W-4, employment application, criminal history check, and board approval).



All payroll warrants are distributed at the district office or at the various school sites by the principal or his or her designee.



Budgets for most noncertificated positions are reviewed every month.

Paul J. Harvey, CFE, is a retired detective sergeant with over 28 years of experience in criminal and civil fraud investigations. Mr. Harvey is the owner of Victory Investigations in Redding, California, providing consulting and investigative services for victims of fraud-related crimes.

Wells4689_c19_1

05/31/2007

172

chapter

19

&
The Video Game
CARLOS L. HOLT

oe Detmer and his family had come to know and love their community. The military base was the center of life. Despite being classified as ‘‘remote and isolated,’’ this large installation was located in a town with a population of 40,000. The base itself was home to almost 10,000 military personnel and approximately the same number of dependent family members. Many of the town residents were employed there. Life in the town had benefits, including clean air, low crime, and an unusually inexpensive cost of living. Housing was particularly affordable. With so many residents connected to the base, the entire community was completely supportive of military operations. Patriotism was high. The annual Fourth of July event included one of the largest fireworks shows around, as well as bands, food, and military displays. The commanding general was more recognizable than the town mayor.
Joe, a married military retiree, had been the manager of the video rental store for five years. His paycheck, on top of his military retirement funds, provided a nice living in this rural setting. He was selected as manager because he seemed stable, committed, and responsive to direction from Samuel, the services manager.

J

Supporting the Troops
There is a kinder and gentler aspect of the U.S. military, known as Morale, Welfare, and
Recreation (MWR). This service includes family counseling, organized sports leagues, financial planning, child care centers, a golf course, a bowling center, and numerous business operations. The business operations branch includes six convenience stores, four restaurants, a high-volume gas station, car repair and rental, two barber shops, a beauty salon, vending machine operations, movie rentals, and a large retail store called the PX or
Post-Exchange. Together, these generate over $48 million in annual revenue. Profits are funneled directly back into the community for ventures such as gymnasiums, child and youth programs, and family events.
The video store was a cross between a concessionaire vendor and a direct sales operation. The contractor acquired and provided the movies and equipment, and MWR employees ran the store. A percentage of sales was sent directly to the contractor, and the
172

Wells4689_c19_1

05/31/2007

173

supporting the troops

173

remainder was retained by MWR. The contractor happened to be a disabled individual who rarely visited the operation and lived across the country. He sent the movies by mail and spoke with personnel on a regular basis. He also provided the software and stand-alone computer system used in the video store. He had personally written the software and tailored it to the video rental operation. Monthly reports were generated and sent to him by mail. Older movies were sold at the store and the proceeds split 50/50 between him and MWR.
Daphney Ingersol, the new MWR director, was quickly coming into her own and feeling very comfortable instituting change in order to effectively serve the wide customer base and carry out the wishes of the commanding general. By all accounts, MWR was doing an excellent job in many areas and was receiving many accolades. Daphney, however, was pushing ahead, never content with the status quo.
Her staff was strong. Ruth Bard, the business operations head and a recently retired military officer, was extremely committed to supporting military members and their families. If a product or service was needed or desired, she would see that it was provided by the most convenient method at the lowest price. In some cases, she knowingly lost money in order to provide necessary products for low-ranking military families. Milk, diapers, formula, and children’s needs were marked up a maximum of 5% over cost. Dry cleaning and tailoring services were priced only to break even. Near–first-run movies were free at the base theater. Car washes were only 50 cents.
Another valuable member of Ruth’s team was Samuel Washington, the services manager. His responsibilities included the dry cleaning/tailoring facility, barber and beauty shops, movie rentals, vending operations, phone centers, the car wash, all concessionaire vendors, and several other small-service businesses. Samuel worked endless hours, sometimes seven days a week. He never turned anyone down who asked for his help.
As a result, his plate was about as full as it could be. He was in his late 50s and had worked for
MWR for over 10 years. He expected to stay in the area indefinitely and had no plans to retire. Samuel was frequently on the defense about the video rental store. Ruth had never been happy with its bottom line and always believed it was run inefficiently. She questioned
Samuel many times, but he always provided some reason as to why sales were lower or costs were higher than expected. Samuel often related Joe’s recent excuses, which seemed to placate Ruth only temporarily.
Meanwhile, I had been assigned duties as a contracting officer with MWR and was still an active-duty military officer. In my previous assignment, I served as the accounting officer and had just obtained my Certified Internal Auditor (CIA) designation. Daphney tasked me with taking over the Management, Analysis, and Control (MAC) office. At the time, I was collecting information and preparing to write a new internal control instruction.
Daphney had asked me to create a proactive approach that identified and assessed risk areas.
She wanted scheduled and unscheduled reviews of each activity to be conducted by the
MAC office, with an emphasis on efficiency, effectiveness, and fraud detection. My twomember staff and I had scarcely begun our assignment when Samuel, the services manager, piqued my interest.

Wells4689_c19_1

174

05/31/2007

174

chapter 19

the video game

‘‘Officer Holt, I have some information that might concern you,’’ Samuel called out.
‘‘One of the video store employees came over a short while ago and mentioned a strange occurrence with one of the customers.’’

The Buck Stops Here
A private by the name of Marvin Buck had stopped by the video rental store to pay for a past-due rental. His name was on the list that MWR sent to the first sergeant of each command once a month, which was composed of the names of all service members who had bad checks, overdue movie rentals, overdue library fees, or any other debt owed to
MWR. When Private Buck was contacted by his first sergeant about his movie rental fees, he promptly went into the video rental store and paid what he owed. Since he was due to transfer in a few weeks, he decided to close his account. Later Private Buck discovered he had lost his receipt and went back to the store. Wendy Parnell, the clerk on duty, printed a copy of his account, which showed he had received a large refund as his last transaction. She was unable to explain the transaction since the video store did not offer refunds. Any customer desiring a refund was to be sent to Samuel. Refunds were rare, usually necessary only when someone paid the cost for a lost movie, then located the original one.
Since Joe was off for the day, Wendy took the matter to Samuel, who then brought the matter to my attention. I first asked him if Wendy was a reliable source. He advised me that she seemed to be an honest college student with a good reputation. Next I spoke on the phone with Wendy and asked her to bring me copies of the mysterious transaction, reminding her keep everything strictly confidential. I called together my MAC crew. We discussed the possibilities and ultimately decided to interview Wendy to determine if she had any additional information. We would begin reviewing the MWR daily activity reports (DAR) and accompanying paperwork from the store. In particular, we would keep an eye out for anything that might be related to refunds.
Later that day, Wendy showed me a printout of the customer account in question. As had been related, there was a refund listed as the final transaction on Private Buck’s account in the amount of $131.69. This seemed like an odd total, but I kept an open mind. It could have been some sort of legitimate attempt to balance an account, even out inventory, or some other nonstandard but innocent action. The refund was entered at closing on a night that two part-time employees were working. I asked Wendy to search through a few days’ final transactions to see if any more were present. The next time I saw her, she brought me printouts of several more refunds, which resembled the first one. All of them had similar surrounding circumstances. Each was the final transaction of the night, and each ranged from $20 to $200. Looking over the work schedules and time cards revealed that no single person was present on all of the nights the refunds were issued. From this, my staff and I reasoned that either multiple employees or Joe himself had to be involved. We decided that we could no longer continue the investigation in secret. We would need to interview all of the employees, look at all of the books and records over the last year, and take a full account of funds, sales, and inventory. It was our conclusion that Joe could not be present in the

Wells4689_c19_1

05/31/2007

175

beating the system

175

video store during this investigation. If he was involved, he would be in a position to destroy information and influence the staff during interviews.

Beating the System
In my update to Daphney, I told her that I was asking Ruth to place Joe on paid administrative leave until the investigation was complete. Needless to say, neither Daphney nor Ruth was happy to learn of the possibility of theft. Daphney wanted to root out the problems quickly. I was very impressed when just a week later she informed the commanding general of the possible fraud. This worked to motivate our small MAC team to unveil the truth as quickly as we could. In the past, when leaders react to bad news by trying to minimize the problem, investigations were delayed.
While waiting for the finalization of Joe’s administrative leave, we learned that the contractor had provided new hardware and software almost two years ago but had never been installed. The system kept only the last three transactions of any customer account, along with the current balance and a listing of all movies in the customer’s possession. In order to view any of a particular customer’s transactions, other than the last three, one would have to sequentially scroll through each day’s business looking for ones belonging to that account.
Meanwhile, my MAC staff found some surprising results from the review of the DARs and computer printouts. Refunds were not broken out separately on the computer printout. Looking at any particular day, it was impossible to determine if any refunds had been issued. The system-generated reports had been designed by the contractor.
Apparently, he had not solicited input from a CFE when he designed them, and they were insufficient for recognizing strange transactions. The accounting technician who handled video store paperwork said that she had thought it very odd; since she joined
MWR a few months ago, the store had balanced ‘‘to the penny’’ every single day. She knew that five or six employees worked out of the one cash drawer seven days a week and could not understand how they could be so precise. Not one of the 40-plus activities within MWR—not even the library—came close to such a record.
We decided that Samuel and I would present to Joe the administrative leave order early on Thursday before the store opened. We included a computer specialist on our team. At
8:30 a.m. we entered the store and informed Joe of the bad news. Samuel asked him for his keys and if he had anything else on his person that belonged to the store. He answered,
‘‘No, not a thing.’’ Joe seemed very surprised as the events unfolded, although he didn’t ask any questions or attempt to protest our actions. This was something I thought particularly telling. I noticed Joe’s hands tremble quite a bit as he handed his keys to Samuel. We had planned not to question Joe until after we had obtained some of the facts about what was going on. We recognized that the store manager might never return, as nothing prevented him from turning in his resignation at any time.
Joe was long gone by the time his closest ally and self-titled assistant manager, Sally, arrived. By all accounts, Sally and Joe seemed to be an odd pair, but each fiercely protected

Wells4689_c19_1

176

05/31/2007

176

chapter 19

the video game

the other. As we expected, she immediately began a series of seemingly unending questions about what was going on and why Joe wasn’t at the store. ‘‘This is all unnecessary. Everything was going just fine around here,’’ she exclaimed repeatedly. Even after being assured that this was just a routine audit, Sally continued to be confrontational. Surprisingly, she did manage to finish out her shift that day. The following day, she arrived for work five minutes late and said she had forgotten something in her car. She came back in after a few minutes and stated that she was quitting. Sally left the building and never returned. She even waited several weeks before contacting MWR about her final paycheck.

Honesty Not the Policy
The MAC staff quickly found that there were no procedures and policies to deter or prevent fraud that were specific to the video store. New employees learned what old employees taught them, which were verbally related by Joe and sometimes posted on the wall. The unwritten procedure for closing the store was simple. First, they were to lock the doors at 10:00 p.m. and finalize any customer purchases. Then the computer system printout was to be obtained and the cash counted. The MWR daily activity report was completed the next morning by either Joe or Sally, who then filled out the deposit slip and walked the deposit bag to the finance center.
Store policy allowed any employee to open a new customer account, but only Joe was allowed to close them. He kept a list of accounts that had no activity for six months or more so that he could close them out ‘‘when he had time.’’ Wendy stated that on occasion, Joe asked her to review the several thousand accounts at random, looking for ones with no recent activity, then to make him a list of those account numbers. He kept the list underneath the cash register. On the morning of the ‘‘takeover,’’ as we had begun calling it,
I located the one-page list of account numbers. About half of the names and numbers had been crossed off, as if they had already been closed. I decided to pull up a few of those accounts to see what might be revealed. We found that each account number had already been issued to a new customer. Most interesting was that the initial transaction for each new customer was a large refund. A close analysis revealed that all of the refunds had actually been issued on the day before the customer opened the account, yet it was still displayed on the customer’s statement. I had already tasked our computer rep with installing the new software and hardware and moving all of the account data over.
As we began plugging refund transaction times and amounts into a spreadsheet alongside employee work schedules, it became apparent that only one person had any correlation to the refunds: Joe. As we had already seen, the refunds were the final transactions of the night, all recorded within several minutes of 10:00 p.m. Joe was present on each day following this activity. Not one refund had been issued when he didn’t work the following day. The transactions were inputted using various cashier IDs.
Our hypothesis took shape. Joe was somehow entering refunds on the previous night’s sales, and only on accounts he was about to close. He knew closing the account caused the account number to be reassigned. Because the system only showed the last three

Wells4689_c19_1

05/31/2007

177

honesty not the policy

177

transactions for each account, the false refund would likely be more than three deep in a very short time. Thus, the customer would probably never see it. Joe would have to print a new system report each morning before filling out the DAR. He would then destroy the original system report and remove the ‘‘refund’’ cash from the safe, leaving enough money for the deposit and the change fund. On his last day, Joe had not yet opened the safe. Since we did find a $200 refund on the previous night’s sales, we concluded that he had the original system report on his person, as we didn’t find it in the trash or anywhere in the store. Of course when we counted the cash, we found the extra $200.
After reviewing each and every entry, we plugged all refunds into our spreadsheet. It became clear that the scheme had been occurring for some time and steps had apparently been taken to cover it. First, only transactions going back eight and a half months were present, and one of those months contained no information. It appeared that Joe was erasing data as far back as he could in order to hide the fraud. It was January at the time, and the figures only went back through May. The entire month of July was also missing. We began guessing that Joe either erased the wrong month accidentally or eliminated July’s entries in particular due to the large amount of activity. The total of the seven and a half months of data showed $13,264 in refunds had been entered. They were all found to be among the last transactions of the day. In 225 business days, 140 of them showed refunds.
There was every reason to believe the missing months contained similar activity.
Analysis of some of the particular transactions revealed the following interesting data.
Transaction
Sequence #

Time

Transaction

03 Nov

165 of 166
166 of 166

10:05 p.m.
10:01 p.m.

$1.90 rental fee
$102.20 refund

05 Nov

93 of 94
94 of 94

9:53 p.m.
10:00 a.m.

$5.30 rental fee
$100.00 refund

15 Dec

216 of 218
217 of 218
218 of 218

10:09 p.m.
10:01 p.m.
10:02 p.m.

$1.90 rental fee
$50.00 refund
$3.24 refund

Date

These transactions reveal that the time is out of sequence with the transaction number.
It appeared that whoever was entering the transactions had gotten lazy and careless. Instead of ensuring the refunds were always entered at a time after the last legitimate transaction, the fraudster was carelessly using 10:00 p.m. and 10:01 p.m., believing that since the store closed at 10:00 p.m., there would be no further entries. (The store did not usually have late business.) Even more careless was the November 5 transaction, when 10:00 a.m. was used instead of 10:00 p.m.
We still didn’t know how the times were being manipulated. One good aspect of the computer program was the transaction sequence numbers, which could not be overridden. Without them, it could have been made to appear as if the transactions took

Wells4689_c19_1

178

05/31/2007

178

chapter 19

the video game

place in the middle of the day’s sales, instead of always at the end. Another striking realization was that if the fraudster was resetting the time to make it appear that the entries were at night, it wasn’t someone working that night. Night-shift employees would not need to reset the time. They would have been free to enter transactions immediately after closing. Thus the time/sequence errors provided valuable information. One final telling observation was of a small $3.24 refund. The perpetrator had felt it necessary to go back and balance the books after entering a fraudulent ‘‘overpayment’’ for $50.00. Although perpetrators sometimes use odd amounts so that the false transactions won’t stick out, it appeared that the fraudster was doing this so that the cash would balance ‘‘to the penny,’’ as the accounting clerk had already told us it had. Who, other than the manager, would be interested in ensuring that the books balanced? We theorized Joe was incorrectly assuming that having the cash balance perfectly would prevent scrutiny.

The Missing Movies
One by one, we interviewed each of the other six employees. Among the information we obtained was that in years past, it was necessary to back up the computer each night at closing. The accumulated monthly data were then sent to the contractor. Almost three years earlier, Joe announced he would begin doing all of the backups himself. He eventually announced that they were no longer required. Another item of interest was the night Sally asked a fellow employee for a ride home. When the coworker dropped her off, she asked Sally if she could go inside and use the telephone. While making a call, she noticed what appeared to be about 30 videos, very similar to what the store rented, still in the boxes on Sally’s living room floor. Not wanting to sound accusing, the coworker never asked about it. But most surprising of all was the fact that most employees stated that despite the afternoon or the nightly cash count sometimes coming up short, Joe always claimed to find it later. One employee was very concerned when she was short $130 for the evening—only about five days before our ‘‘takeover.’’ In an attempt to protect herself, she took the extra step of printing two system reports from the computer, taking the extra copy home for safekeeping. The next day when she phoned Joe, he told her not to worry, that all was fine, and the shortage had been found. Fortunately, she still had the extra report, which she gave to me. After looking at the document for only a few seconds, I knew Joe was our guy.
The computer specialist had implemented the new software with all of the account data within two days. This system was much faster and contained many new features, including the ability to view all of the transactions related to each account, not just the last three. By experimentation, we learned that in order to enter information at a time other than the current one, the computer clock could be reset, and the system could completely shut down and be restarted. Then the computer time was reset to the actual time and the system again shut down and restarted. It was not possible to override the transaction sequence number. Our computer specialist was unable to retrieve the apparently deleted account data from July and all months prior to May.

Wells4689_c19_1

05/31/2007

179

a mostly happy ending

179

Conversations with the contractor were quite revealing. He stated that for some time, he had been unable to obtain any backup data from Joe. He needed the data not only to verify sales and the percentage he was due, but also to know which movies were renting well and which ones weren’t. He was operating almost blindly since the only information he obtained was from the infrequent verbal conversations with Joe and his monthly check from the
Finance Department. He believed Joe had been avoiding most of his calls. As far back as three or four years ago, the computer disks were sent less and less frequently and finally not at all. He continued to send new movies each week, sometimes several copies of each, hoping this is what the military members wanted to rent. Joe had not provided him with an inventory in a long time. He was disturbed by Joe’s failure to install the new computer system. The contractor said that Joe initially seemed pleased to receive the new system, but then began offering excuses not to use it. He was confused by Joe’s initial expertise with computers and software then later his apparent lack of abilities. He suspected Detmer played dumb when it suited him. The contractor agreed to send us a new list of the movies he had furnished during the last year. We soon received the list and compared it to the on-hand inventory. This revealed yet another problem that I already suspected. Many of the new movies were not in the store. In fact, the computer data showed they had never been rented.
The final tally revealed at least 300 different movies, and several copies of each, that were not present and had apparently been stolen. Since several copies of each had been provided, we calculated that over 1,500 tapes could actually be missing. All of the employees believed that
Sally was the sole person responsible for putting new movies into service. This, coupled with the sighting of movies on her living room floor, indicated she had something to hide. We tried several times to reach her by calling and knocking on her door but were unsuccessful.

A Mostly Happy Ending
After reaching our conclusions about the thefts and putting together the report and supporting evidence, I reviewed the information with Daphney. She contacted the criminal investigation agency and updated the commanding general. The criminal investigator needed little time to understand the matter. By that point, we had enough evidence to call Joe in for an interview, during which we would seek his admission. He appeared pale and scared when he showed up at the investigator’s office. During the initial information verification with the investigator, Joe surprisingly admitted to taking small sums of money from the store. He said he had taken $5 to $20 on only a few occasions, amounting to no more than $100 during his employment, but he adamantly denied anything else. His denials became less and less credible as I showed him how his work schedule coincided perfectly with the false refunds.
Next, we displayed the out-of-sequence transactions. This really seemed to shock him;
I believe he never knew he had made these slip-ups. We also showed him the sworn statements from all of the employees, reading selected sections from several. Joe winced at some of the information, as if he were being shot with a pellet rifle. As the interview proceeded, he became quiet. Last, I decided to reveal the two different system reports,

Wells4689_c19_1

180

05/31/2007

180

chapter 19

the video game

from the same night’s business. One had sales of $130 more than the other one. The lesser one, which Detmer had turned into the finance office, had his signature on it and the deposit slip, and the DAR showed that the cash had balanced to the penny. When I pressed play on the VCR that I already had cued up, I showed Joe the security video of the employees leaving the store that night around 10:30. I fast-forwarded all the way until Joe arrived early the next morning. I was able to show him that no one else had entered the store during the entire period between when the employees left and when he could be seen arriving. No one else had yet entered when he could be seen leaving with the DAR, his doctored computer printout, and the deposit in his hand.
I told Joe the local DA would likely find it impossible that anyone else had entered the
$130 refund transaction and printed a new computer report after the employees left that night. I pointed at the stack of about 30 tapes and asked if he would like to view each one of them. At this point, he began to discuss his options. He finally decided to submit his resignation and sign a statement admitting to stealing $13,264. We explained that making an admission, and possibly being issued a summons for a court date, was preferable to having law enforcement come into his home unannounced and arrest him. He claimed to have ‘‘no knowledge’’ of why the computer files were erased and said that he didn’t make any false refunds in those months anyway. Although neither of us believed him, we decided to take the admission statement he was offering to sign. We could always take any additional information to the DA’s office after a forensic computer examination was completed. Joe steadfastly denied knowing anything about the missing movies.
Two of the criminal investigators tried numerous times to have Sally come in for an interview, but each time she flatly refused—slamming down the phone or shutting the door in their face. The only information we ever obtained was an old flyer found posted in her trailer park offering movies for sale. Although there was no name on the flyer, the phone number was traced to Sally’s old cell phone, which had since been disconnected.
With nowhere to go, we dropped further attempts to tie Sally into the missing movies, later estimated to be worth over $40,000.
Joe quickly obtained a lawyer and recanted some of what he earlier admitted and attempted to minimize the rest. The forensic computer examination turned up no usable information except that special software had apparently been used to delete the files. The
DA called me to testify to the methods, extent, and amounts of the fraud, and Joe decided to plead guilty. He received six months in the county jail, restitution of $13,264, court fees, and a fine. The military staff judge advocate also sent Detmer a letter advising of him that except to receive medical care, he was no longer allowed on the military base. In our remote area, this was a harsh penalty.

Lessons Learned
The most striking and basic element of this case was the absence of proper internal controls. Processes were not reviewed or documented in the first place. The contractordesigned software and system reports were woefully deficient. No one had reviewed either

Wells4689_c19_1

05/31/2007

181

recommendations to prevent future occurrences

181

for weaknesses prior to placing them into use. Once Joe discovered a flaw in the software and the report, he exploited it to the maximum extent. He knew that neither Samuel nor the distant and disabled contractor was likely to uncover his scheme. Samuel’s busy schedule did not allow him enough time to monitor the video store. No audits or inspections had taken place to discover the scheme. Thus, Joe continued unabated for a long time. He successfully erased all but the last few months’ computer files so that evidence of thefts only amounted to $13,264, even though he likely misappropriated upward of $60,000. Joe admitted to taking his wife on twice-monthly gambling trips to his favorite casino, where he was well known. Like many embezzlers, he fit the classic ‘‘Fraud
Triangle’’ developed by Dr. Donald Cressey: unshareable need, perceived opportunity, and rationalization. Joe’s unshareable need was his gambling habit; his perceived opportunity was the software weakness and the lack of adequate oversight. During his initial confession, he related that he had worked many extra hours that he never turned in, thus rationalizing his actions.

Recommendations to Prevent
Future Occurrences
Updated Technology
The software that Joe used was out of date. Because it was not advanced, he could easily reset the time on the computer, making his refunds appear to have been made at the end of a business day. Furthermore, the reports failed to show refunds. This program was insufficient. Software that is used to account for assets should undergo complete review, including risk management and certification by qualified individuals.
Segregation of Duties
Staff should be cross-trained in order to alternate duties. This would eliminate cases like this one, where Joe Detmer was solely responsible for system reports and closing accounts.
He and Sally, his likely cohort, completed the daily activity reports, filled out the deposit slips, and took the bag of money to the finance office. No one watched to ensure that they were being honest. Samuel could not adequately supervise the many businesses that he oversaw. All activities should receive proper oversight. In addition, all major processes should be documented and reviewed. Standardized processes would have provided a basis for review by others.
Surprise Audits
Even though the movies belonged to the contractor, they were under custody of MWR.
An inventory would have uncovered the many missing movies. An audit would have uncovered numerous weaknesses and indicators of possible fraud.

Wells4689_c19_1

182

05/31/2007

182

chapter 19

the video game

Also, sales receipt deposits should be made out and the amounts of those deposits called in nightly if the deposit itself cannot be made. This would have required a noticeable effort to change the deposit amount after the previous days’sales were altered. Finally, accounting personnel should be trained to report out-of-the-ordinary occurrences. Had the accounting technician reported the unbelievable cash over/short history to the MAC office, a review could have taken place.

Carlos L. Holt, CFE, CIA, CGAP, is an auditor and investigator for the United States federal government in Charleston, South Carolina. He also teaches accounting and finance courses at Park University. Mr. Holt earned his graduate degree at Central
Michigan University and has over 10 years of experience in fraud-related cases.

Wells4689_c20_1

05/31/2007

183

chapter

20

&
Bet Your Life on It
HOWARD B. GROBSTEIN AND JOSHUA R. TEEPLE

t only five feet tall, Tasanee Pho had a slight presence wherever she went. Her brown hair was cropped in a bob around a dark-complected face. She bore a distinctive mole on her right cheek. Tasanee’s customary anonymity stopped at the doors of the community casino in New Jersey, where she was pleasantly greeted by many dealers and other casino employees who recognized her as a valuable and long-standing patron. Over the years, she racked up over $1 million in activity on her preferred player’s card. Though this seems to be a lot of money for someone with a modest background and less than
$80,000 of annual household income, it’s easy to do when the stake money is not your own.
Tasanee was a simple person; her home life as a little girl in Thailand was basic. Because of the lifestyle she had grown up with, she did not dress expensively, drove a basic fourdoor import sedan, and appeared unpretentious to most everyone she met. Her only real extravagance in life was her insatiable desire for gambling, which ultimately led to her downfall. She and her husband were married 30 years ago, when she was only 20. After immigrating to the United States, they built a loving home for their family and made the most of what they had. Tasanee was a resident alien and green card holder.
Her family plodded along as solid middle-class citizens. They were by no means wealthy, but they did more than just eke out a living. Tasanee had some failed sideline businesses in the health care industry, but aside from her gambling habit, no other significant financial obligations weighed her down.
Tasanee worked with the Big Apple Special Events Foundation for nearly a decade.
Until her criminal habits were uncovered, her reputation among coworkers was untarnished. Her peers not only held her professional abilities in high regard, but found her a pleasant and caring person to be around. Over the years, Tasanee changed positions within the Accounting Department, eventually serving as the accounts receivable clerk.
Her duties in that capacity included, among others, receiving all incoming checks and cash from all departments and the mail room; making up the deposit slips for those funds; and physically depositing the funds in the foundation’s bank account. Unfortunately, Tasanee was also tasked with receiving the bank statements and preparing the reconciliations for that very same account.

A

183

Wells4689_c20_1

184

05/31/2007

184

chapter 20

bet your life on it

The accounting department in which Tasanee worked was on the foundation’s top floor. She shared offices with other accounting personnel including her immediate officemate and friend, Gloria Richardson, who was the foundation’s accounts payable clerk. Upon entering their shared office, one could not help noticing the stark difference between Tasanee’s and Gloria’s work spaces. While Gloria’s desk was the definition of efficient order and cleanliness, Tasanee’s cubicle appeared to have been struck by an indoor hurricane. Stacks of papers piled up on her desk in utter disarray, following some arcane filing system known only to Tasanee. Her filing cabinets and drawers overflowed with half-completed files, wrinkled invoices, and a seemingly endless supply of personal memorabilia including photographs, correspondence, bank statements, deposit slips, and documents related to other business endeavors in which she was engaged.
Perhaps no one else in the foundation was as surprised by Tasanee’s arrest as
Gloria, who said, ‘‘She is such a sweet person. Always happy to lend a hand or offer a kind word when I was feeling a little down. I cannot believe that she has done something like this.’’ Interviews of more foundation personnel revealed that others shared Gloria’s incredulity. Tasanee, it seems, was a well liked and respected long-term employee. A Big Apple in the Big Apple
The Big Apple Special Events Foundation resides in the heart of Manhattan’s art and culture district. Its primary purpose is to serve as a host venue for musical acts, theater performances, and special exhibitions. The foundation houses modern theatrical equipment with superb acoustics on its main stage. For exhibitors and performance groups, the foundation provides ancillary services, such as box office operations, beverage sales, maintenance, and security.
The foundation enjoys an impeccable reputation among its patrons and greater New York in general. Organized as a not-for-profit organization, the foundation’s superior standing attracts some of the largest performance groups in the country, in addition to special exhibitors. It is not unusual for it to run critically acclaimed musicals and top-billing dramatic performances. The foundation operates with an annual budget of $60 million. Over the past several years, it expanded its facilities by adding an $80 million state-of-the-art exhibition hall.
Due to the normal bureaucracy accompanying such a large capital project, the accounting department processed a large amount of financial activity. The stress of the additional activity and the abnormally high volume of financial transactions on the department made it easier for Tasanee to cover her tracks.
The foundation maintains a staff of nearly 150 full-time employees and a board comprised of 20 influential socialites. Employees enjoy the culture they work in, although the deadlines and the constant turnover of performers and exhibitors can become stressful.
Its staff and board members consistently strive to be consummate professionals. The foundation’s success rate in fulfilling its commitment as a superior special events facility has been nothing short of phenomenal. Unlike its contemporaries, its philanthropy elevates it

Wells4689_c20_1

05/31/2007

185

black tuesday

185

above the for-profit enterprises, allowing it to be more discriminating in the events it hosts. The foundation operates with four significant revenue streams. The first results from donations elicited from the business and private community. These funds typically arrive in check form. The second source is incoming checks derived from the use of the events facilities by outside parties. Often the foundation runs special programs on behalf of outside parties in conjunction with use of those facilities. The third revenue stream comes in from performance and exhibition ticket sales. These sales are made through the box office, in person, on the phone, or through Ticketmaster. Although most ticket sales are rung up in credit card or check form, some currency is also taken in. The fourth revenue stream results from the cash-only bars run at the performances and exhibitions themselves.
The revenues from the bars can be significant, depending on the particular event and day of the week, sometimes approaching $20,000 for a busy weekend. To a lesser extent, the foundation also earns commissions on concession sales made by event coordinators themselves. For the last five years, all of this money passed through Tasanee’s hands.

Black Tuesday
Colin Reznik arrived at work on a brisk Tuesday morning in October, expecting an average day. He liked his job and had showed superior ability as the foundation’s chief financial officer for the last two years, serving as the controller for several years before that position. Although his external accountants were in the offices for the annual financial statement audit, he felt that his department was in order and that the engagement had been going quite smoothly. The accounting firm’s partner in charge of the foundation’s audit,
Bob Ross, had nurtured the relationship for over 10 years. Although the foundation was a relatively small client for a national accounting firm, the prestige associated with servicing the account made it worthwhile. The audit team thought they had the engagement dialed in and knew exactly what to look for. As it turns out, this seemingly typical Tuesday was to be full of unpleasant surprises.
The foundation’s controller, Herbert Kolowitz, served as the primary liaison between the accounting department and the auditors. He would often pass on standard document requests to his subordinates, Tasanee and Gloria. As she had for the prior four financial statement audits, that Tuesday morning Tasanee handed the audit team’s accountant in charge, Suzanne Ortega, the bank reconciliation file, replete with the year’s bank statements. Suzanne took Tasanee’s file to the boardroom where they were sequestered and asked a staff person to review the year-end bank reconciliation and trace the book and bank balances to their respective supporting documentation. While looking at the bank statement, one of the staff accountants signaled for Suzanne’s attention. ‘‘Will you take a look at this? It might be my imagination, but something looks funny on this bank statement.’’ Wells4689_c20_1

186

05/31/2007

186

chapter 20

bet your life on it

Intrigued, Suzanne leaned over the accountant’s shoulder to scrutinize the document.
After several moments of study, she responded in kind. ‘‘I think I see what you are talking about.’’ She placed her finger on the section of the statement where the beginning balance, less payments, plus deposits equals the ending balance. ‘‘It looks like the ending balance is crooked or something, and it feels like it has an edge. Almost like it was taped there.’’
She held the statement closer to the light. The staff accountant nodded in agreement and said, ‘‘That number is definitely taped on there.’’
Suzanne absorbed the significance of this discovery and started to have an awful feeling in her stomach. Going off a hunch, she instructed the staff accountant to review the balances on the other bank statements in the file to see if any of those numbers matched the modified year-end balance. As the staff accountant began that process, Suzanne did what was natural for any auditor to do upon encountering some impropriety in their engagement. She called the partner in charge.
As Suzanne was explaining the situation to Bob on the phone, the staff accountant hastily interrupted the call. Within minutes, he had found the same balance to the penny on a bank statement from three months prior. Now, Suzanne thought, we really have a problem. Bob arrived at the foundation shortly after lunch. After reviewing the documentation himself and knowing that Tasanee was responsible for preparing the bank reconciliations, he decided to call her in for an interview to get to the bottom of the story.
After inviting her to sit down at the conference table, Bob began his questioning: ‘‘We noticed something a little weird with this bank statement. It looks like this balance from three months ago is cut and pasted onto the new one. Any idea why that would be?’’ His query was met with silence from the other side of the table, so he pressed his point.
‘‘Tasanee, I really need to understand what is going on here before we speak with Colin and Herbert. I want you to help me understand why a bank statement would be modified in such a way. Do you know why this would happen?’’
‘‘No,’’ Tasanee replied.
Sensing that he would get nothing further from Tasanee, Bob decided to have her return to her office and move up the food chain to Herbert.
As soon as he posed the same questions to Herbert, Bob could tell that he was absolutely in the dark. Herbert appeared stunned that something like this could happen when he reviews and signs off on Tasanee’s bank reconciliations. Bob knew it was time to present the situation to Colin.
As Colin entered the conference room, the tension was palpable. Bob immediately showed the suspect bank statement to Colin, explaining the situation as best he could.
There was no soft way to break the news. Bob read the crushing effect of the discovery on
Colin’s face. Colin turned to leave the room and said, ‘‘I have to talk to Tasanee.’’
Back in his own office with Herbert, Colin called in Tasanee. She stood in front of him while he asked, ‘‘Why is this number taped on this bank statement?’’ Tasanee’s head slumped onto her chest as she started crying. She did not need to say a word; Colin knew right then that she had robbed the foundation. ‘‘How bad is it?’’ he asked.

Wells4689_c20_1

05/31/2007

187

calling in the cavalry

187

Tasanee wiped her eyes on the back of her sleeve, took a deep breath, and in a barely audible whisper, she gave Colin the tragic news: ‘‘Over one and a half million.’’
Fifteen minutes later, Colin had recovered from the shock enough to proceed with the next step in damage control. He first called the president of the foundation and the chairman of the board. Telling them about the fraud was one of the most difficult things he had ever done. Next, he called the foundation’s attorney to give him the story. The attorney advised that Colin should contact the police and file a report with them. The
New York Police Department (NYPD) arrived, took several statements from foundation employees, and arrested Tasanee, hauling her away in handcuffs. The foundation was rocked to its core.

Calling in the Cavalry
Two days after the arrest we arrived at the offices of Gary West, the foundation’s outside counsel, for an interview to determine whether we were the right forensic accountants to investigate Tasanee’s actions. In addition to the three of us, Colin and the foundation’s president were also in attendance. Gary West is a stone-faced all-business litigator who had no compunctions with raking us over the coals about our professional qualifications and relevant experience. After an hour of Gary’s inquiries, he came to realize that we were the perfect forensic accountants to investigate this type of fraud.
We were hired to identify how Tasanee perpetrated the fraud and quantify the amount of the loss so that the foundation could file a claim with its insurance carrier. The insurance company required that the foundation provide evidence supporting the nature of the loss and quantify the loss up to the insurance policy limits. In addition, the insurance company required that such information be provided within 90 days of reporting the loss. This deadline was moot, however, because the foundation’s charter required audited financial statements in half that time. When the audit team discovered the impropriety, it put further work on the audit on hold, pending the results of a forensic investigation into the fraudulent activities. Thus, in actuality we had only five weeks to complete our investigation; thereafter the foundation’s auditors would complete the audit.
Given the tight timeline, we started our work the very next day. Our initial on-site visit to the foundation began with an interview of Colin. He expressed utter shock and dismay over the events that had transpired over the preceding days. Colin felt as if he had failed in his duties to the foundation and its board of directors since this horrible crime had taken place under his watch. He also experienced a sense of betrayal of the trust he had placed in a long-term employee.
Colin provided us with background information regarding the foundation. He explained how Tasanee worked with others, named those foundation employees she interfaced with on a regular basis, and described certain aspects of her personality and her general daily routine. Colin explained how he, as chief financial officer, worked with
Tasanee. He detailed the nature of her interactions with Herbert, as her immediate supervisor and the foundation’s controller. Essentially, Colin was responsible for

Wells4689_c20_1

188

05/31/2007

188

chapter 20

bet your life on it

overseeing all of the strategic and financial functions of the foundation. He was also responsible for the financial aspects of building the multimillion-dollar exhibition hall.
Colin relied heavily on Herbert for monitoring the more detailed accounting and general ledger functions. The two met formally once a week to review financial activities, but interacted daily to discuss current and ongoing issues related to the accounting function of the foundation.
The interview with Colin was very insightful. He painted a picture of how the foundation was supposed to operate under normal conditions. We next turned our attention to Herbert, a stressed-out man with thinning silver hair that always seemed out of place. His responsibilities were crucial to the foundation’s operation. He managed the general ledger and oversaw the accounts receivable and accounts payable functions.
Herbert was also the primary reviewer of the foundation’s bank reconciliations.
Immediately after beginning our interview of Herbert, we became concerned about his apparent lack of control over those critical functions. We learned that Herbert was several months behind in his detailed review of the general ledger. He also acknowledged that he performed only a superficial review of the monthly bank reconciliations. When we relayed this information to Colin, he was very disappointed to learn that his controller was not performing the functions he expected of him.
The most informative part of Herbert’s interview occurred when he described the individual responsibilities of the personnel he supervised in the accounting department.
He explained that all funds received by the foundation, whether donations, bar receipts, ticket sales, event programs, or concessions, ultimately passed through Tasanee’s hands. On an almost daily basis, Tasanee walked down the block to the bank’s branch office and personally made the foundation’s deposits. Her visits were so frequent that she was on a first-name basis with many of the branch’s employees. The foundation’s deposit slips were stored in the drawers of Tasanee’s desks, where she was in sole control of them.
We absorbed Herbert’s words as he described the extent of the responsibilities placed in
Tasanee’s hands, but were amazed when he casually indicated that in addition to the myriad of duties she performed as the accounts receivable clerk, she was also solely responsible for preparing the foundation’s monthly bank reconciliation. We came to understand that
Tasanee exercised complete control of the cash function within the foundation—from the time the cash came in the door, to delivery at the local bank branch, and finally to the reconciliation of the monthly bank statements. Herbert’s Adam’s apple became stuck at the top of his throat as if it had knotted up as he described the extent of power the slight woman wielded within the foundation.
Later that day, we met with Gloria Richardson, the accounts payable clerk, and Mario
Hernandez, the foundation’s bar manager. These were two people who interacted with
Tasanee on a regular basis, and it was important to determine their professional and personal involvement with her. We tend to approach our investigations assuming that all parties are guilty of some participation in the crime. In essence, we play an elimination game, narrowing down all suspects and methods to perpetrate the crime. During our interviews of Colin, Herbert, Gloria, and Mario, we were able to eliminate them as

Wells4689_c20_1

05/31/2007

189

calling in the cavalry

189

accomplices with a high degree of certainty. Of course, we would not be completely comfortable with that assessment until we had documented exactly how Tasanee perpetrated the crime.
After completing the initial round of interviews, we thoroughly examined Tasanee’s work space. The desk in her cubicle was in utter disarray. The NYPD had been the first responders to the crime scene and had rifled through the drawers. At the investigating officer’s direction, many documents had been removed as evidence for the criminal investigation. Colin and Herbert directed us to a drawer in Tasanee’s desk that was stuffed with bank documentation including bank statements, cancelled checks, deposit slips, and bank reconciliations. There was no discernible method to the filing, so we began sorting through the information and organizing it based on type of document and relevant dates.
Because we still did not understand how Tasanee committed the fraud, we methodically examined the bank statements and deposit slips in search of unusual transactions or other evidence. We also examined cancelled checks to see if there were payments made to related or unusual parties. We knew that the auditors had been provided with a bank statement that appeared to be altered, and we were looking for this kind of documentation as a lead.
Our search did not take long to bear fruit.
We came across multiple copies of bank statements for the same account and month; however, the various statements reflected different ending balances. The statements looked legitimate; they contained the bank’s emblem in color and had some bank information printed on the reverse side. We then found multiple bank reconciliations corresponding to the different versions of the bank statement. Various aspects of the bank reconciliations agreed with the various bank statements. Looking at the documentation, we were unable to distinguish the legitimate statements from the altered ones. We knew that obtaining original copies of the foundation’s bank statements directly from the bank would be critical to our investigation, since we needed access to a reliable set of records.
The next morning, Colin arranged a meeting at the foundation’s local bank branch down the block. Not surprisingly, the bank was very familiar with the foundation’s account. This was due not only to the large balances maintained by the foundation (even larger in recent times as a result of the massive expansion taking place), but also because the foundation was an icon that garnered well-deserved respect in the community. It was an honor for the bank to be chosen by the foundation. We met with Henry Jones, the bank’s vice president. He was extremely accommodating and expressed willingness to assist the foundation in any way he could. We advised Henry that we needed a clean set of all bank statements including copies of all deposit slips, cancelled checks, and other enclosures for a three-year period. In the interest of time and because we did not know when the fraud began, we asked that the bank provide the most recent documentation first and work backward in time. We also requested that the documentation be delivered directly to our team in order to maintain its integrity. This was crucial as we had not completely eliminated the possibility of collusion among any of the remaining foundation employees.
We had asked Colin to arrange another meeting for that day—this time with the original discoverers of the fraud. We traveled to the offices of the foundation’s external

Wells4689_c20_1

190

05/31/2007

190

chapter 20

bet your life on it

auditors and sat across the shiny granite conference table from Bob and Suzanne as they detailed the initial discovery of the crime and the implications of that discovery on the foundation’s audit. Although the crime would be memorialized in the foundation’s financial statements and a loss from the defalcation recorded therein, the auditors would need to gain a certain comfort level that the fraud was isolated to Tasanee. Bob and
Suzanne were unable to enlighten us as to how the crime was perpetrated.
After concluding our meeting with the auditors, Colin took us on the subway to One
Police Plaza for a meeting with the detectives working on the case. This encounter turned out to be extremely productive for the detectives and us. We provided the NYPD with the multiple iterations of various bank statements and bank reconciliations we had identified as suspicious. They, in turn, allowed us to view the actual altered bank statements with taped numbers that had been confiscated at the foundation when they arrested Tasanee, in addition to ancillary documents that would be used in the criminal case against her. While the police had what they felt was sufficient documentation—including Tasanee’s confession—to warrant an indictment, they still had not figured out exactly how she committed the fraud.
Nor had we, for that matter.
After two intensive days of developing background and acquiring information, it was time to figure out how the fraud was committed and how we were going to quantify it. We knew that Tasanee was altering bank statements and manipulating false bank reconciliations to cover her tracks, but how was she actually stealing the money? In her confession, she indicated that she had manipulated the timing of checks that came in the door. What did this mean? We were not going to get any information from her. As a foreign national, she was deemed a flight risk and was incarcerated in a jail cell. Colin had some intriguing thoughts on the matter that pushed us in the right direction. He had figured that Tasanee had somehow concealed the cash defalcation by utilizing checks made payable to the foundation for various purposes, such as donations and event programs. How could she have accomplished this concealment? Wouldn’t the donations be understated if this were the case? Wouldn’t there be other red flags popping up in the review of the foundation’s financial activity? The answer was simple. Because Tasanee had full control of many of the related accounting functions, compounded with a lack of oversight from Herbert, she manipulated the financial reporting to very effectively cover her illicit activities.
We undertook an even more thorough review of the bank documentation in Tasanee’s work area. While examining the records, we identified a key piece of evidence that allowed us to better understand the fraud and how it was being reported on the books and records of the foundation. We began comparing foundation deposit slips to each other.
Some of the deposit slips attached to the monthly bank statements did not have the mechanical stamp customarily imprinted by the bank teller when the deposit is made.
Duplicate deposit slips for the same days were found under stacks of papers on Tasanee’s desk. These deposit slips showed more checks and less cash being deposited. They also differed in another key way: They had stamps indicating that these were the deposits that had actually been made with the bank. We had found the smoking gun.

Wells4689_c20_1

05/31/2007

191

calling in the cavalry

191

After that point, the investigation really started to come together. Tasanee controlled all of the funds that came through the foundation. Donations were routed to her in the envelopes in which they arrived. No one logged these donations or matched them to pledges prior to Tasanee taking control of these checks. Tasanee also received checks for event programs. Bar receipts from the previous evening’s performance—all cash—were accounted for by the bar manager and then forwarded to Tasanee for deposit in the bank.
The same process applied to concession sales. Tasanee completed the deposit slips, walked the funds to the bank, received and opened the monthly bank statements, and prepared the reconciliations on them.
The seasoned accounts receivable clerk stashed checks that came in for donations and special events. As cash became available from bar and concession sales, she exchanged cash meant for deposit for checks in equal amounts so that the total deposits for bar and concession sales reconciled to bar and concession sales reports. At the end of the month,
Tasanee altered the bank reconciliations using ‘‘plug figures’’ to show an ending cash balance that agreed to bank statements that she had altered through a detailed process in which she cut and pasted ending balances from prior statements to more recent statements and reproduced using a color copier to complete the illusion. This process was necessary because Tasanee actually recorded the correct balances and transactions in the general ledger, thereby overriding any red flags that might be raised in a review of the general ledger and its subsidiary reports. Over a five-year period, the variance between actual cash in the bank and the amount recorded in the general ledger had grown to over $1.5 million.
She accounted for this in ‘‘plug figures’’— a fictional mix of outstanding checks and deposits in transit that Herbert did not catch on to. The breadth of her thievery was more easily concealed because of the large deposits being made for the funding of the construction project and the additional strain on the accounting department that capital project caused.
Armed with the knowledge of how the fraud was perpetrated, it was time to develop a methodology to quantify and report it. The other piece of the documentation was compiled from all of the foundation’s deposit slip carbon copies attached to the daily deposit detail—often there was more than one deposit for a single day. Although we looked at every deposit slip carbon copy for the previous three years, we paid particular attention to those that did not have the mechanical bank stamp on them. We immediately identified those as suspect or false deposit slips, as Tasanee had destroyed many of the actual carbon copies of the deposit slips presented to the bank. Our approach was to record the amount of cash and checks recorded on the deposit slip carbon copies maintained within the foundation to the corresponding deposit slips obtained from the bank and tally up the difference between cash deposited per the carbon copy of the deposit slip and the cash deposited per the bank documentation. The excess of cash recorded on the false deposit slip carbon copies over the amount actually deposited to the bank equaled the amount of the defalcation.
In order to record these variances methodically and keep track of the massive amount of information we were processing in a very limited amount of time, we designed a custom

Wells4689_c20_1

192

05/31/2007

192

chapter 20

bet your life on it

database application using Microsoft Access. We utilized the interface form in this application to record all of the pertinent information from the foundation and bank documentation. By applying a high-tech approach to a relatively low-tech document review, our team was able to record the requisite information in a very efficient manner all the while minimizing the risk of data entry errors through the use of double-entry and hash total reconciliations. The investigation was further enhanced by making the interface screens in the database application intuitive, thereby easing the laborious data entry process.
All told, we examined 1,539 deposit slips covering a three-year period in a matter of three weeks. The amount of the allowable insurance claim was $1 million. We identified and documented a cumulative variance closer to $1.05 million, so there was a little wiggle room within the insurance claim. Having reached this amount, our goal was accomplished. Gambling on Prison
From the foundation’s perspective, we helped make the best of an extremely unpleasant situation. Not only was the foundation remunerated for a substantial portion of the theft, but Tasanee was also successfully prosecuted for her crime.
We produced a comprehensive report for the foundation that detailed how the crime was committed. We documented over $1 million of theft and secured the foundation’s insurance claim. The findings that resulted from our investigation enhanced law enforcement’s understanding of the crime and enabled the foundation to put measures in place to protect against future occurrences of such crimes.
The foundation’s board members were aware of the difficulties associated with filing criminal charges in a white-collar fraud scheme. Would the district attorney make an indictment? Was there enough evidence for a conviction? Would the punishment fit the crime? Despite these uncertainties, the foundation proceeded with the criminal action to demonstrate that this type of behavior would not be tolerated.
Tasanee pled guilty to nearly 30 felony counts, including grand theft, embezzlement, and computer fraud. She was sentenced to 10 years in prison and immediate deportation to Thailand upon her release. She is also compelled to return the stolen funds to the foundation plus 10% interest. It is highly unlikely these monies will ever be recovered as they appear to have all been squandered on her gambling habit.
Tasanee’s criminal actions affected a great many people. Not only did she destroy her future and split up her immediate family, but her crime also brought to light Herbert’s weaknesses as a controller, which resulted in his termination.

Lessons Learned
While this investigation presented several unique challenges, we saw it as a tremendous opportunity for us to hone our interviewing and organizational skills. During the initial phases of the engagement, we spent several entire days interviewing foundation personnel

Wells4689_c20_1

05/31/2007

193

recommendations to prevent future occurrences

193

at all levels and in all areas in addition to bankers, accountants, and law enforcement.
Dealing with the latter was particularly exciting as the investigation detectives made us feel that our contributions were of particular value to the criminal matter. We have gained a true appreciation for face-to-face interviewing techniques and the information that can be elicited through proper application of those techniques.
The second most important aspect of this investigation relates to organization and document management. By obtaining third-party documentation from the bank, we had a master set of indisputable records. When we combined the bank documentation with the boxes and boxes of paper held at the foundation, we had a bona fide library of records to sort through. We verified and streamlined our work by developing a custom Microsoft
Access database application to review and record the contents of the documents. We methodically maintained originals in a massive set of binders that referred back to a master inventory. A reference was placed on each database record so that the paper document could be located in the binders in no time. This referencing was of particular use during the insurance company’s examination of our report and findings.
One other lesson that stands out for us is the importance of recognizing luck in an investigation. If we had not determined the significance of the missing bank stamps on the deposit slips—the smoking gun—our investigation would not have come together as quickly as it did, nor would we have been able to quantify the theft as efficiently. We believe that the outcome at the end of the day would have been the same, but we do value having this bit of serendipity occur at the beginning of the investigation.

Recommendations to Prevent
Future Occurrences
Our report on the investigation of Tasanee’s fraud did not necessarily outline remedial steps for the foundation. Rather, it highlighted certain weaknesses within the accounting function. As a result of recognizing those weaknesses, Colin implemented several accounting controls to help protect against future instances of fraud.
Segregate and Rotate Duties
The foundation now segregates duties for the cash function. A different employee performs each of these functions: receiving and opening the bank statement, preparing the bank reconciliation, receiving incoming checks, preparing deposit slips, and physically making deposits. It is also important for duties of key accounting personnel to be rotated so that no employee exercises all power in any single area.
Review Bank Reconciliations
Now there is a higher-level review of the bank reconciliations at the foundation. In particular, there is greater scrutiny of the deposits in transit and outstanding checks.

Wells4689_c20_1

194

05/31/2007

194

chapter 20

bet your life on it

Mandatory Vacations
The foundation also implemented mandatory vacation time. This allows the company to discover possible fraud while the employee is away.
Use Protective Services to Transport Cash
Perhaps the most effective new control in place is the most simple. The foundation now utilizes an armored transport service to deliver its incoming cash to the bank’s drop box.

Howard B. Grobstein, CFE, CPA, is a partner in the Litigation & Insolvency Department of Grobstein, Horwath & Company LLP. He provides litigation consulting, expert witness testimony, fraud examinations, and forensic accounting services. Mr.
Grobstein is a graduate of California State University, Northridge, and has 15 years of experience in handling fraud and litigation matters.
Joshua R. Teeple, CFE, CPA, is a partner in the Litigation & Insolvency Department of
Grobstein, Horwath & Company LLP. He provides litigation consulting, data extraction and manipulation, fraud examinations, and forensic accounting services. Mr. Teeple is a graduate of University of Colorado and has nine years of experience in fraud and litigation matters.

Wells4689_c21_1

05/31/2007

195

chapter

21

&
When Petty Cash Isn’t Petty
KAREN FREY

n upstanding member of the community, Jeri Hansen was active in her church and the school’s PTA, and served as a troop leader while her daughter was a Girl Scout.
Married to her high school sweetheart for 14 years and now a mother of three, she was one of the most trusted employees at Foster Foods. Short and attractive, Jeri dressed well without being ostentatious and lived in a frame house—nice but not extravagant—on a country road. Although she drove a new vehicle, it was leased, not purchased. Little about her lifestyle suggested that she was supplementing the family income at her employer’s expense.
Jeri had worked for Foster Foods in various positions for more than 15 years and had been in charge of petty cash accounting and reconciliation for the last 10. She also served as the accounts payable clerk. Her reputation was company-wide: If you want something reimbursed through petty cash, be sure that your documentation is both complete and accurate, or it won’t get past Jeri.
Foster’s finance and accounting staff was small, so Jeri knew a great deal about how the company worked, including the types of information the different officers wanted, expected, and relied on. She also knew how the independent auditors worked and the types of documents and summaries they normally requested. Occasionally Jeri appeared to resent her clerical status, believing that she knew more and could perform as well as some of the employees with better job titles and salaries. However, she was still diligent about making certain that her bosses and the auditors received everything that they needed to facilitate their work. ‘‘It would be a lot easier if I just get that for you’’ was her standard offer.
Founded in 1953 by brothers Arthur and Louis, Foster Foods began humbly in an old hog barn on the family farm, where they turned out a processed jam from excess fruit.
Andrew Foster (son of Louis) recalls his father describing some of the early days. ‘‘It took a long time to learn the best way to make it—our pigs were the happiest ones around, because every time we goofed up they ate the mistakes.’’ But learn they did, and despite some misadventures when fruitstuff ended up covering everyone and everything in sight, they developed a product that sold as fast as they could make it.
In 1975 Andrew assumed leadership as president and changed the strategy to an emphasis on research and development of specialty dried fruit products. By 1986 the changeover was complete, and the Fosters enlarged their product line and facilities in order

A

195

Wells4689_c21_1

196

05/31/2007

196

chapter 21

when petty cash isn’t petty

to satisfy the rapidly growing demand. Today the company continues to develop new and innovative technologies. Utilizing its core competencies in research, development, and process engineering, Foster Foods currently manufactures more than 200 products in two facilities located in a mid-Atlantic state as well as several facilities in the Fiji Islands, and exports to more than 80 countries around the world.
The transformation took its toll, however. In the late 1990s Foster Foods was working to recover from a difficult period. Having filed for protection under Chapter 11 of the bankruptcy code, the company found that many of its suppliers and former creditors would no longer accept its checks—they demanded cash. Many businesses maintain a petty cash fund in order to pay small expenses, such as postage due, delivery fees, and other small cash purchases. At Foster Foods, though, long-haul company truck drivers also used petty cash to pay for highway and bridge tolls, minor repairs, and fuel at gas stations that would not accept their company’s fuel charge cards. In addition, some deliveries to headquarters were on a cash-on-delivery (COD) basis.
For each petty cash disbursement, the custodian—Jeri—completed a petty cash voucher indicating the date and amount of the disbursement and to whom it was made.
The person requesting the funds signed the document to acknowledge receiving the cash.
Because drivers received cash before each trip, they did not know exactly how much they needed; the amount they received in advance varied depending on the length of their trips.
Upon returning, the drivers gave Jeri the receipts for cash they had spent, together with any remaining money. For example, if the driver started out with $250 and spent $160 for fuel and $19 for tolls, he would give her his two receipts totaling $179 plus his $71 remaining cash. Jeri would take the original petty cash voucher, cross off the $250 written there, and write in $179. She would complete the voucher by indicating the total of the expenses that were for fuel ($160) and tolls ($19), and attach the receipts to support the costs. Both the voucher (with its receipts attached) and the $71 went into the petty cash box.
After a number of trips, when the box filled up with vouchers and ran low, it was time to reimburse petty cash. As part of that process, Jeri completed a reimbursement envelope.
On its face, she summarized the petty cash vouchers inside with their dates, to whom each item was paid, and an accounting distribution of the expenses. After entering all of them,
Jeri added the columns, with the sum of the ‘‘Total’’ column indicating the amount of reimbursement needed. She placed the vouchers with their receipts inside the envelope and submitted it to the controller to request replenishment of petty cash. An internal control measure directed the controller to review the contents of the envelope before approving the replenishment. Then the treasurer would write a check to cash and give it to
Jeri, who took it to the local bank.

Taking a Vacation Day
He wasn’t looking when he found it. As the new chief financial officer of Foster Foods,
Dan Jenkins had many more important things to worry about than something as insignificant as petty cash. Besides, Jeri clearly had things under control. On several

Wells4689_c21_1

05/31/2007

197

a lack of support

197

occasions she had brought to his attention anomalies that a less astute person might have missed. No . . . petty cash could wait.
But one day Dan had a question and Jeri had the day off. In looking for the answer to his inquiry, Dan noticed a substantial petty cash disbursement to an equipment supplier— normally one paid by check. He remembers it well. ‘‘That transaction just didn’t pass the
‘smell test,’ so I called the controller and said, ‘We have a problem.’’’ By the end of the day, the two of them had found several occasions when invoices were indeed paid by check and the very same were ‘‘paid’’ again through petty cash. Dan Jenkins and Roger Stevens (the controller) began telephoning suppliers. ‘‘I have a question about this invoice—do you have any indication that we paid twice?’’ Their efforts failed to turn up a single supplier that had received duplicate payments. It was time to determine the nature and size of the problem.
Foster Foods asked its CPA firm to examine the petty cash records. The young accountant assigned to the case spent several weeks going through their records for the previous five years. He was able to identify more than 200 discrepancies totaling about
$60,000—enough that Jenkins decided to call in the police and file criminal charges. The accountant had found three types of discrepancies:


Duplicate payments where invoices were paid once by check and ‘‘paid’’ a second time through petty cash.



Incorrect totals reported, where the total was greater than the attached receipts.
Using the earlier example, the receipts for $179 may have been attached to a petty cash voucher that incorrectly read $279 or $379 or more.



Incorrect transfers of information, where the amount written was greater than what was inside the envelope. Returning to the original example, the reimbursement envelope might contain a petty cash voucher correctly completed for $179 with the two valid receipts totaling $179 attached, but the summary line on the reimbursement envelope would indicate a total of $279.

Of all the discrepancies identified, the third type was certainly the easiest to detect.
Because Jeri freely admitted that most of the petty cash vouchers and all of the envelopes bore her handwriting, it also provided the best evidence of intent to defraud the company.
‘‘I must have copied it wrong’’ would not serve as an excuse for the number and amounts of these issues. Things already seemed bad enough from Foster’s point of view, but they were going to get worse. . . .

A Lack of Support
Lindsay Dumont, the assistant district attorney assigned to investigate and prosecute the case, described herself as ‘‘not a numbers person.’’ Since she was not satisfied with her understanding received from the initial Certified Public Accountant report, Lindsay first asked for only one thing: a more specific, down-to-earth explanation of the findings that would help her to present the case in court. In her words, ‘‘All I need is an ‘accounting

Wells4689_c21_1

198

05/31/2007

198

chapter 21

when petty cash isn’t petty

information and evidence for dummies’ course.’’ So we sat down together at the police station to work with the sealed carton of evidence.
From the very first envelope, it was apparent that the young and rather inexperienced
CPA had missed a lot. We soon realized that what he had identified were only the most obvious discrepancies described earlier—just the tip of the iceberg. ‘‘I don’t think we can just let these other things pass,’’ Lindsay decided. ‘‘Can you check everything one more time?’’ The second review was eye-opening; I found not only additional occurrences of the types of irregularities just described, but several more methods that Jeri used to divert cash from the company’s coffers to her own pockets. If she had more ingenious tricks, I missed them. Most were fairly obvious if someone took the time to look. Here are some of the other things she did:


Submitted receipts to petty cash more than one time. When a driver paid cash for fuel and asked for a receipt, once in a while he received two copies. Jeri started submitting both of them for ‘‘reimbursement,’’ attached to two different petty cash vouchers. Of course, one represented a proper accounting of the amount spent on behalf of Foster
Foods for fuel, but Jeri used the second copy to divert cash for her own use. In more daring instances, two vouchers with identical receipts were in the very same petty cash envelope. Other times, some of them were dated weeks apart. In fact, that is what tipped me off. It made no sense at all to think that a driver would wait a couple of weeks to submit a receipt for reimbursement.



Used photocopies as support for additional payouts from petty cash. Some tolls and other receipts were photocopied and cut to size, and the copies were submitted as support for payments a second or even a third time. When you find several toll documents that are stamped with the same date, the same collection window, and the same time that is recorded to the nearest second, you can be quite certain that you have fakes. The
Massachusetts Turnpike was particularly prone to this type of problem because the records were printed in black ink on white paper stock—precisely what you would normally get from a photocopier. Receipts from other states would have been more difficult to replicate, and certainly not merely by photocopying them. The
Pennsylvania Turnpike, for example, issued receipts on a stiff, manila-colored ticket with a green stripe; others used a shiny silver paper, colored punch cards, or multicolored inks.



Altered receipts. Altered receipts can be tough to identify and even tougher to prove, but it can become quite obvious when it is combined with submitting both copies on two different vouchers, one of the schemes described previously. In one case, the first fuel receipt that came through was reimbursed for $60; the second copy, with the same service station location, date, invoice number, number of gallons, and price per gallon had a one (‘‘1’’) inked in ahead of the total, so that the new total read $160.
In another example, a UPS receipt for a COD package had ‘‘$1379.70’’ written in the ‘‘amount’’ box. The ink of the first digit was not quite the same color or thickness

Wells4689_c21_1

05/31/2007

199

a lack of support

199

as the rest, and it was squeezed in against the left side of the box. Most people who run out of room when writing crowd the right side of the available space; think of any particularly large check that you wrote out by hand.
Unfortunately, although it appeared that $1,000 was diverted for Hansen’s own use by entering a one (‘‘1’’) at the front of the receipt, the evidence was not sufficient to prove it. UPS keeps its copy of such records for only one year. In addition, because only the UPS receipt supported the petty cash voucher, I was unable to determine either the supplier or the correct amount.


Petty cash vouchers had no supporting receipts at all. By itself, this may not seem important. You might be able to imagine some circumstances that would result in a petty cash disbursement without a receipt. However, it becomes important if we examine the pattern. Arranging the items by date of occurrence revealed that, in the first three years, the only discrepancies involved the drivers’ records. That is, petty cash vouchers were for $100 or $200 or so more than the attached documents. Not until August of the third year was there a single example of a petty cash payment without a receipt. Yet by May, two years later, this had occurred on 44 separate occasions, almost impossible from a simple error.
Looking for patterns that evolve over time also provided additional evidence of some of the techniques described earlier. For example, Jeri did not use petty cash to
‘‘pay’’ for an item that had already been paid by check until the fourth year. Once she came up with that method, however, she used it on at least 25 more occasions between February and May of the following year.



Petty cash vouchers were made out for amounts where the ‘‘supporting’’ invoice specifically stated that no payment was due. Toward the end of the time in question, Jeri became more and more inventive in finding ways to take Foster Foods’ cash for herself. In one case, the company had a credit memo as a result of returning goods to a supplier;
Jeri attached that to a petty cash voucher and removed money in the amount of the credit. In another case, the supplier had been paid in advance and the invoice was clearly marked as such, but Jeri used it to divert the funds anyway.



Both original and corrected invoices for an item were submitted for reimbursement. In a variation of submitting both copies of a two-part receipt, two vouchers were made out to pay the same company for the same item, but for two different amounts. The second supporting invoice was clearly marked ‘‘revised,’’ but Jeri removed petty cash, once to pay the correct invoice, and once for herself.
By the time we identified all of these incidents, we had established that approximately $100,000 had been diverted, quite a sum for a petty cash account. At this point, Foster Foods decided not to pursue the investigation any further, reasoning that there was already enough evidence for the district attorney to secure a conviction. Regardless of what the total was, the company was unlikely to recover much of anything from Jeri. Perhaps they did not want to know the full extent of the damage.

Wells4689_c21_1

200

05/31/2007

200

chapter 21

when petty cash isn’t petty

Can We Renegotiate?
Lindsay Dumont was pleased with the additional information uncovered in the second investigation, and the district attorney’s office went to court with more than 200 counts against Jeri Hansen, including (1) theft by unlawful taking, (2) theft by failure to make required disposition of funds received, and (3) multiple counts of tampering with records or identification with intent to deceive—a separate count for each of the falsified petty cash envelopes and/or vouchers.
Although Andrew Foster wanted to see Jeri ‘‘hung out to dry in the town square,’’ that did not happen. Protesting to the very end ‘‘I didn’t do it,’’ Jeri was led in tears into the courtroom. However, the hearing proceeded and she admitted many incriminating things, including that the handwriting on all of the petty cash envelopes and vouchers was hers; that she was aware that amounts on credit memos indicated what the company should be receiving, not paying; and that she knew that certain vendors were to be paid through regular accounts payable procedures rather than through petty cash. Jeri and her attorney worked out a deal in which she was sentenced to 24 months of probation and ordered to make restitution—though in an amount substantially less than what she was found to have taken. She managed to repay nearly $18,000 right away, partly by cashing in her retirement fund. Unfortunately, she quickly defaulted on the schedule of payments set forth in the judge’s order, and she was soon back in court.
‘‘I know I haven’t complied with the order, but I just can’t come up with the money to make the payments,’’ Jeri insisted. Despite this claim, she proposed (and the court agreed to) a suspension of the probation provisions in order to allow her to get caught up on the payments. The judge also gave her a new, more lenient, schedule. As you might expect, within just a few months she was back in court—and she never made a single payment.
This time probation was revoked, and she was sentenced to serve the remainder of her
24-month sentence in the county jail.

Lessons Learned
Several internal control weaknesses contributed to the loss of so much money. Most likely
Jeri did not analyze them and plot to take advantage, but over time she noticed the controls were becoming automatic or skipped entirely. The first discrepancy involved a difference of just $20. But after five weeks passed and it remained undiscovered, she may have decided to test the system with the second $20 ‘‘error,’’ her first true attempt to defraud the company.
That one went undiscovered as well, and Jeri Hansen had found a new source of income. As the months and years went by, like a boulder rolling downhill, the discrepancies started coming faster—first only once, then twice, until toward the end she was stealing as many as 10 times a month. As the frequency increased, so did the amounts—first $100 at a time, then $200, then $300. They also started becoming more imaginative and diverse. When Hansen, in the last year or so of the fraud, began ‘‘paying’’

Wells4689_c21_1

05/31/2007

201

recommendations to prevent future occurrences

201

vendors a ‘‘second time’’ through petty cash, the amounts grew into the upper hundreds and then thousands per incident. The largest was a single withdrawal of $3,030.
Jeri had too much control and not enough supervision. She was the petty cash custodian and also served as the accounts payable (AP) clerk in later years. An AP clerk examines invoices and compares them to purchase orders, receiving reports, and other documents.
Upon finding proper authorization and support, the AP clerk forwards the documents to a different person, who writes the checks for payment. As both the AP clerk and the petty cash custodian, Jeri had full access to the information she needed to submit to petty cash items paid through regular channels. But how did she know she wouldn’t get caught?
This is where a lack of internal controls enters the picture. The company’s written procedures required Jeri to submit petty cash reimbursement requests to the controller for review and approval. However, no controller ever checked the receipts against the envelope summary. The reviews were nonexistent; approvals were automatic. Hansen had worked for Foster Foods for a long time. She was a valued and trusted employee, one who took few vacations and fewer sick days; one who was such a stickler for details—to the penny—that her reputation was company-wide. More than one controller apparently believed he had no reason to check the contents of the envelopes against the summary.
After all, petty cash represented such a, well, ‘‘petty’’ amount, and Jeri had the situation well in hand. More important things demanded their time.
You might wonder, ‘‘Wouldn’t the outside auditors have caught this?’’ And indeed, many of the things described here would be quite obvious to anyone who looked.
However, the auditors considered petty cash to be so small as to be immaterial; that is, whether it was absolutely correct or whether it contained some degree of misstatement would have no effect on the judgment of financial statement users. For that reason, the outside auditors ignored petty cash.

Recommendations to Prevent
Future Occurrences
One thing necessary to prevent future occurrences is to eliminate opportunities. Even in this age of technology, where computers have opened a whole new world of opportunity for fraud, the age-old themes still apply, such as segregation of duties and supervision.
Based on the lessons learned, Foster Foods instituted a number of changes to its policies and procedures. Segregation of Duties
One of the most basic yet often overlooked areas of fraud prevention is segregating duties so that any one person’s ability to both perpetrate and conceal irregularities is very small. In response to the findings, Foster Foods has separated the duties formerly handled by Jeri
Hansen so that petty cash and accounts payable are no longer handled by the same person.
Further, the procedures have been changed so that one person prepares the vouchers and

Wells4689_c21_1

202

05/31/2007

202

chapter 21

when petty cash isn’t petty

makes the disbursements, and a different person reviews the transactions, reconciles the cash, and prepares the summary when it is time to request reimbursements.
Supervision and Controls
Jeri never could have begun her five-year journey into fraud had the various controllers at
Foster Foods followed their own written procedures. With adequate supervision and review, the first $20 error would have been found quickly; Jeri would have been reprimanded and probably would have apologized profusely while making a solemn vow to herself not to let that happen again. Written procedures or controls are of little good to a company if they are ignored. Foster Foods now requires that the controller initial the summary envelopes to accept responsibility for their contents.
Another opportunity for fraud detection could have been realized with analytical work regarding the truck fleet’s fuel efficiency. Regular analysis of trucks’ mileage versus gas consumption—something you would think would have the ongoing attention of management—would have signaled a problem to the controller quite early. Almost from the first incident, he would have noticed that one of the company’s trucks was extremely inefficient in its fuel consumption compared to the rest, indicating either a problem with the truck or with purchases. Fuel analysis is now done regularly.
Mandatory Time Off
Combined with the lack of segregation of duties, refusal to take time off from the job is a red flag signaling possible fraud and cover-up. Foster Foods now requires that everyone in the accounting section be cross-trained and that each employee take a minimum of one week of vacation per year.
Be Aware
Because cash is the most liquid asset and can be transferred easily, the risk of theft is great. In addition to instituting effective control procedures, management needs to be aware of what employees are doing. Unfortunately, it is all too common that the most tireless and trusted worker, who never takes a day off, is the very one defrauding the company.

Karen Frey, Ph.D., CPA, is an associate professor at Gettysburg College. After more than a decade of practical experience in accounting and auditing, she earned a Ph.D. from the University of Maryland. Her research interests include managerial and forensic accounting, and she continues to consult on fraud cases.

Wells4689_c22_1

05/31/2007

203

chapter

22

&
Where Did My Money Go?
ROBERT BARR

heryl Swanson was a typical suburbanite from Galveston, Texas. A high school graduate, she had worked as the office manager for Dr. Roberta Martin for over
12 years. Her husband, Paul, was a physical education teacher and coach for the parochial high school. She had two teenage kids—one son and one daughter, a junior and a sophomore in high school. Cheryl and Paul each had a salary of $45,000 per year.
Dr. Martin’s husband and son had both died several years earlier, and she had no other living relatives. Due to the long relationship Cheryl had with the doctor, she was named the sole heir in the doctor’s will.
Family was very important to Cheryl. Any time she was not at work, she was doing something with them. Her son and daughter were very committed to school and community activities, and Cheryl and Paul attended events to support their children.
Though they were often short of cash, Cheryl liked to spend on her kids whenever she could. Cheryl and Paul were always saving to take nice vacations. They traveled all over the
United States, often driving rather than flying to save money.
Dr. Roberta Martin was a well-known psychiatrist in the Houston area. In addition to her M.D. in psychiatry, she had also gone back to school and earned a Ph.D. in psychology.
A Phi Beta Kappa, she was a very intelligent woman who thoroughly enjoyed her psychiatric practice. Dr. Martin had just turned 60.
She had a large practice, with a staff of 18 to 20 psychotherapists who specialized in drug rehabilitation. Dr. Martin had monthly accounts receivables of about $600,000, with the vast majority being billed to insurance companies.
For many years, the doctor had managed the business side of her practice with help from Cheryl. She had been rather meticulous in the management, reviewing the cash receipts and reconciling the amounts received to the number and types of patients seen that day. Although the checks were prepared and signed by Cheryl, Dr. Martin also cosigned every check, as she required two signatures. The doctor opened the bank statements each month before giving them to Cheryl. Once Cheryl had reconciled all three bank accounts, Dr. Martin reviewed and approved them. Dr. Martin also opened and reviewed the monthly account statements for her three investment brokerage accounts and one IRA account. Afterward, she gave the statements to Cheryl to file.

C

203

Wells4689_c22_1

204

05/31/2007

204

chapter 22

where did my money go?

Dr. Martin did a reasonably good job of maintaining supervisory control over all of the business activities in her practice.
Like many physicians, however, the doctor wanted to practice medicine, not manage a business. In March, a well-known psychiatric hospital company approached Dr. Martin with the idea of helping manage her practice so that she could spend more time with patients. The doctor was intrigued and asked what the management company would do for her. Dr. Martin had a list of required activities, and the management company was willing to take on all of those requirements. As part of the agreement, the office staff and psychotherapists would become employees of the management company and would be eligible for improved benefits that the doctor could not offer. In addition, the management company would:


Supervise the office manager and staff to ensure accurate accounting for the doctor’s practice business activities



Have management personnel onsite at the doctor’s office at least one half-day for three days each week



Maintain files on insurance claims



Oversee the bill payment function and cosign all of the checks prepared by the office manager 

Monitor all bank deposits and reconcile them



Review and approve the bank account reconciliations prepared by Cheryl each month for all three accounts



Review the doctor’s monthly brokerage statements for any unusual activity

For these services, the management company would be paid $7,500 per month.
The agreement was signed in late March, and the management company took over supervision of the practice as of April 1. The first week, they were in the office every day.
The doctor was elated with the company’s attentiveness and was thrilled to spend less time with the business side of the practice.
In the second week, once the procedures and accounting records had been established,
Bonnie, the management company representative, was in the office for three half-days to supervise the business and cosign the checks. Since Bonnie was only in the office for a few hours, Dr. Martin often did not even see her but assumed that matters were being handled as agreed.
But after three weeks, Bonnie quit and was not replaced. As a result, no one from the management company ever set foot in the doctor’s office again. With Dr. Martin no longer reviewing the details of the practice, and with no supervision from the management company, Cheryl had all of the opportunity she needed to get cash for her family. She started paying personal bills and sending the checks out with only one signature, and she quickly learned that the bank did not verify that there were two signatures on the checks.
For several months, Cheryl continued to keep the accounting records set up by the

Wells4689_c22_1

05/31/2007

205

the ira that was mia

205

management company. She also reviewed the brokerage account statements and learned how much money the doctor actually had.
In early August, Cheryl, Paul, and the kids went on a two-week vacation. As was generally the case, Cheryl spent lavishly on the holiday and had charged a large amount on their credit cards. With school about to start, both kids needed new uniforms. But there was a problem: Cheryl had charged the credit cards to their limits, and she had neither the cash nor the credit to buy the clothes needed for the kids. So Cheryl simply wrote a check on the doctor’s practice account to ‘‘cash’’ for $2,500. The tellers at the bank knew Cheryl and did not verify the signature, as was required by bank policy for checks over $500. The tellers gave her the cash, and Cheryl realized that it would be no problem for her to supplement her income.
Once Cheryl discovered how easy it was to steal from the doctor, she decided to try taking some money from the brokerage accounts. In her first attempt, she used the doctor’s signature stamp to prepare the request for withdrawal, but the brokerage firm would not allow a facsimile signature. So she forged the doctor’s name, withdrew funds, and put them in Dr. Martin’s practice account. From there, she could write checks and take money as she pleased. The IRA that Was MIA
By November the following year, Cheryl had withdrawn all of the funds from the doctor’s regular brokerage accounts along with $251,000 from Dr. Martin’s individual retirement account (IRA). In early December, the broker called to ask about the large withdrawal from the IRA account. He asked to speak to the doctor, but Cheryl told him that the physician was too busy with patients to talk and had decided to make some other investments. The broker again insisted that he speak to Dr. Martin, but Cheryl claimed the doctor knew about the withdrawals and was not interested in speaking to him.
Luckily for Dr. Martin, the broker persisted and called her home to inquire about the withdrawals from the IRA account and what Cheryl had told him. The doctor indicated that if she was going to make other investments, she would have used her other brokerage account, not the IRA. The broker then told Dr. Martin that the other brokerage account with his security firm had already been emptied to a zero balance. Dr. Martin was furious and asked why she had not been notified of such transactions.
Even though it was already 10 p.m., Dr. Martin immediately called her attorney. They discussed the situation and decided that Cheryl may have made the withdrawals. The attorney called me at 2 a.m. and asked me to meet him at Dr. Martin’s office at 6 a.m. He told me what they thought might have happened and that he wanted me to help investigate the matter. I am a practicing Certified Public Accountant with over 20 years of experience in auditing, fraud examination, and litigation consulting. I had previously worked for the attorney in other litigation cases as an expert witness.
On my suggestion, we called a 24-hour locksmith and had the locks to the offices changed before Cheryl could arrive. The attorney also arranged for an off-duty police

Wells4689_c22_1

206

05/31/2007

206

chapter 22

where did my money go?

officer to be in the reception room to keep Cheryl from getting into the offices. We checked the doctor’s mailbox in the office building and found the bank statements that had been delivered after Cheryl had picked up the mail the day before. I opened them and started looking at the cancelled checks, noticing numerous payments to members of the office staff, including a large number to Becky Bolton, one of the psychotherapists. Becky was always one of the first people to arrive in the morning, so when she got there, the attorney and I asked her about the checks. She claimed that Cheryl would make the checks payable to one of the office staff and ask them to go to the bank to cash the check for the doctor, who needed some cash. These checks were not for small amounts—they ranged from $2,500 to $9,000. Cheryl was always careful to keep the amount under the $10,000 limit so that the cash transactions were not reported to the IRS.
We asked Dr. Martin, and she indicated that she used her debit card to get cash and that she had never asked Cheryl to obtain money for her. When Cheryl arrived for work, the attorney told her that she had been terminated and that she would not be allowed to enter the offices. Cheryl said that she had some personal items and that she needed to retrieve them. The attorney told her to make a list and that we would make sure that they were delivered to her that day, but that she would not be allowed to enter the offices. Cheryl tried her key, but found that the locks had been changed. She even attempted to climb into the office through the reception window, only to be pulled out by the policeman who was there. After being carried out of the window three times by the officer, and warned that she would be arrested if she persisted, Cheryl finally left Dr. Martin’s office.
Dr. Martin and her attorney asked me to assist them in finding out how much money had been stolen, how it had been stolen, and how many people in the office were involved in the scheme. They also asked me to determine whether there was any possibility of recovery of funds from the management company, the bank, or the brokerage firms.
That first day in Dr. Martin’s office, I found that there were virtually no business and accounting records. The only check stubs were those written in the last two days— everything else was gone. We did have the November bank statements and cancelled checks, but that was it. There were no details of amounts that had been billed to the insurance companies or the patients directly. We also found that there were no copies of the brokerage statements any time after July of the previous year. By then I recognized that I had a big job ahead of me.

Cashing Out
Since we had only the November bank statement and cancelled checks available, I began looking at these items. The doctor’s attorneys filed a lawsuit against Cheryl, the bank, the management company, and all three of the security brokerage companies, and of course, we requested copies of all documents in connection with each of the defendants.
I began analyzing the November bank statements. Since there were a number of unauthorized checks that were payable to four of the doctor’s employees, we decided to question each of them.

Wells4689_c22_1

05/31/2007

207

cashing out

207

The first interview was with Gene Henley, who indicated to us that Cheryl had asked him to go to the bank and cash a check for the doctor. Cheryl told him that the doctor needed some currency and was too busy to go to the bank. She made the check payable to
Gene for $4,000 and instructed him to see one of three particular bank tellers, as they knew the doctor well and would take care of the transaction more quickly than anyone else.
Gene did as he was told, saying that he had done this at Cheryl’s request seven or eight times with amounts ranging from $4,000 to $9,000. He also said that almost everyone in the office had cashed checks like this at one time or another.
The next interview was with Laurie Dillon, a psychotherapist who had been with the doctor for about five months. I asked Laurie about two checks for $2,500 and $6,000.
Additionally, Laurie said that Cheryl had asked her to go to the bank three other times in
November, but Laurie did not feel comfortable with this process and had declined. Cheryl had told her that if she did not go, she would tell the doctor and have her fired. Laurie held her ground and refused togo to the bank because she did not like to carry that amount of currency with her and she did not believe Cheryl when she said the money was for the doctor. Laurie told me that she knew that the doctor did not carry cash—she always used her credit cards.
The interview with Becky Bolton, another of Dr. Martin’s psychotherapists, was very interesting. Becky felt a lot of pressure as a psychotherapist and had requested one hour off each morning and each afternoon so that she could ‘‘recharge’’ and be ready for the next patient. Cheryl often asked if Becky would go to the bank for the doctor during the breaks, which Becky was willing to do.
I asked Becky if she was aware of how many checks she had taken to the bank in
November. She said that it would be at least 12 because Cheryl asked her to go about three times each week. Becky said that the checks were often in the $3,000 to $9,000 range but that she really never paid much attention to the amounts since it was not her money. When told that she had gone to the bank 14 times in November, Becky was not at all surprised.
However, she was somewhat taken aback that these checks totaled $66,000.
Becky told me that Cheryl had started asking her to negotiate checks a little over a year earlier and that originally they were made payable to ‘‘cash.’’ However, one of the bank tellers told her that the bank’s policies were changing and that the checks would need to be made payable to an individual. When Becky informed Cheryl of this, she began making the checks payable to the person that she had go to the bank each time.
Becky also told me a bit about Cheryl—that she was very dedicated to her two teenage children and that they liked to take nice vacations. She indicated that last July Cheryl’s family, along with some friends, had spent two weeks at the nicest hotel suite in Aruba. I asked if she thought that Cheryl and her husband could afford a trip like that. Becky said that she thought that Dr. Martin might have helped them.
Once the bank finally provided all of the microfilm copies of the doctor’s finances, the detail work began. We had three years’ worth of transactions, which included about 400 checks and 35 deposits per month, many with 20 to 30 documents attached—nearly
40,000 pages of microfilm. The quality of the copies was poor at best, and some were completely illegible.

Wells4689_c22_1

208

05/31/2007

208

chapter 22

where did my money go?

I started preparing a database listing the check date, check number, payee, amount, and, if the check was cashed at the bank, the number of the teller. Once the information was completed, I went over the payments with Dr. Martin to determine whether they were valid expenses for the practice, or if they needed further investigation. She stated that she never sent anyone to the bank to get cash for her; for security reasons, she did not like to carry currency.
In going through the finances, the doctor identified a number of payments that she said were not for her medical practice and that were unauthorized. The first of these were several checks to a travel agency that Dr. Martin had not used since her last vacation three years earlier, when she went on a Mediterranean cruise. The travel agency provided copies of all of the invoices, tickets, hotel reservations, and other expenses. The records showed that Cheryl had charged her family’s entire trip to Aruba to the doctor’s travel agency account, including the four families that joined them. They flew first class and stayed in a suite at the finest hotel on the beach, all courtesy of the doctor. The total cost was in excess of $143,000.
I was able to interview one of the families that went with Cheryl to Aruba, who claimed
Cheryl told them that she had won over $500,000 at a slot machine in Las Vegas and that she had wanted to share the proceeds with her friends. But Cheryl was able to contact the other two families and tell them not to talk to us about the trip.
The doctor also pointed out questionable payments to clothing stores, consultants, construction companies, and certain of her employees. The investigation into these expenses showed that most were fraudulent. The clothing store payments were for purchases of clothing by Cheryl. The nearly $100,000 to the consultants and the construction companies were mostly for remodeling of Cheryl’s home.
The database also indicated several deposits that had unusual items, including large checks from insurance companies that were only partially deposited into the doctor’s bank account. The remaining balances were taken in cash, money orders, and cashier’s checks.
We found one check from an insurance company paying the doctor about $85,000. Cheryl had stamped the back of the check with the doctor’s signature and deposited approximately
$22,000 into the doctor’s bank accounts. She took the rest in several ways. First, Cheryl had obtained $21,500 in money orders. Four of them were payable to Ford Motor Credit for $413.50 each. The cancelled money orders matched Cheryl’s vehicle loan account number, the monthly payment on her vehicle. All of the other money orders were also used for Cheryl’s personal expenses, including $6,000 for the catering, bartender, servers, and maids for her family’s Christmas party.
Cheryl had also obtained $33,000 in cashiers’ checks from the proceeds of the insurance money. Two of the cashiers’ checks (one for $1,000 and one for $5,000) were paid to employees of the doctor for alleged Christmas bonuses. There were also two cashiers’ checks payable to American Express, one for $4,000 and one for $10,000. The account numbers revealed that the $4,000 cashiers’ check was credited to Dr. Martin’s American
Express account but the $10,000 check was credited to Cheryl’s American Express account. Moreover, there were two cashiers’ checks payable to Dr. Martin, one for $8,000

Wells4689_c22_1

05/31/2007

209

an unhappy ending

209

and one for $5,000. The $8,000 check was negotiated using the doctor’s signature stamp and was presented at the bank for cash. The doctor says that she never saw any of this money. The $5,000 check was actually deposited into the doctor’s personal bank account.
Dr. Martin told me that she had never authorized any payments like these.
I also tested the deposits made after Cheryl had been terminated as compared to the ones that had been made when she handled the office duties. Shortly after the management company had taken over, no currency was deposited into the bank for insurance copayments. Before the management company was hired, $400 to $700 per week was being credited to the doctor’s bank accounts. After Cheryl was terminated, there was again
$400 to $700 in currency being deposited into Dr. Martin’s accounts. Although I could not prove the exact amount taken, I estimated that Cheryl likely took about $2,000 per month in currency for copayments over a period of about 15 months, or an additional $30,000 in theft proceeds.

An Unhappy Ending
This investigation took several months to complete. Although Dr. Martin had sued
Cheryl, the bank, the management company, and the security brokerage firms, she also made it clear to her attorney that she wanted Cheryl to go to jail.
The bank had requested an analysis of the transactions in the 60 days before the discovery of the fraud. The liability of the bank, by federal law and by contract with the depositors, is limited to 60 days. In this case, that amounted to about $115,000. However,
95% of the checks in this branch were cashed by 3 of 29 tellers. Although we never said the word ‘‘collusion,’’ the facts spoke for themselves.
To start the pursuit of criminal prosecution, Dr. Martin’s lawyer called the district attorney’s office and scheduled a meeting to go over all of the evidence that we had compiled. At the end of the three days, the investigators said that this case would be a ‘‘slam dunk’’ because of the degree of documentation that I had provided and that it would be easy to get an indictment for a number of charges. I left the DA’s offices believing that charges would soon be forthcoming against Cheryl.
However, this was not the case at all. The district attorney’s office sat on this material for well over two and a half years before taking any of it to a grand jury. Calls to the DA’s office did not help move the case along. But after almost three years, the grand jury indicted
Cheryl Swanson on 34 counts. Cheryl was an insulin-dependent diabetic. The evening of the charges, she told all of her family good night and took an extreme dose of insulin just as she went to bed. Her husband said he knew she was dead when he tried to wake her up the next morning. Paramedics were called, but it was clear that Cheryl had passed away at least six hours previously.
After being terminated by Dr. Martin, Cheryl had gone to work in the office of the parochial high school in her community—the same one where her husband worked as a physical education teacher. Almost immediately after her death, news of the indictment was released, and the school began looking into their records, and found

Wells4689_c22_1

210

05/31/2007

210

chapter 22

where did my money go?

that in the almost three years that she had worked there, Cheryl had been able to steal almost $400,000.
Subsequent to Cheryl’s demise, settlement negotiations took place with the remaining defendants in the civil litigation. The bank did not want to go to trial because the tellers had not followed written instructions that required all checks presented for cash to be traced to the signature card. Since the litigation was filed before limits on punitive damages in Texas, the institution was sufficiently frightened of what a jury might do and so it settled for an amount in excess of $750,000.
Next was the deposition of the chief financial officer of the management company who negotiated the agreement for the doctor’s practice. Counsel started by asking whether the company had done the things that it had agreed to do.
Did it cosign all of the checks? Not after the first three weeks. Did it go to the doctor’s office and supervise the office administration? Not after the first three weeks. Did it review the bank account reconciliations? No. Did it review the insurance billings? No. Did it review the reconciliation of insurance billings to insurance receipts? No. Did it review the reconciliation of patients seen to insurance billings, patient billings, and cash receipts? No.
Did it review the doctor’s security brokerage statements to ensure proper accounting?
No. Did it ensure the maintenance of insurance billing files? No. Did it collect the fee of
$7,500 per month for providing these services? Yes, absolutely.
When counsel had finished these few questions, he said, ‘‘I have no further questions.’’
The entire deposition lasted less than 30 minutes. Less than a week later, the management company settled with a payment of $1 million to the doctor.
It took several more years before the three security brokerage firms settled with the doctor. After all of the expenses and legal fees, the doctor ended up with about $1.1 million of the $1.5 million that had been taken by Cheryl.

Lessons Learned
Dr. Martin found another management company to help her. At my recommendation, she obtained references from several other doctors who were using the management company to determine that they were legitimate and effective.
Dr. Martin negotiated several items to include in the new management contract. First, she demanded that the bank account reconciliations be prepared and approved no later than the fifteenth day of each month. Second, the management company would prepare and give to the doctor an analysis of insurance billings and collections no later than the tenth day of each month. Third, the company would prepare two accounts receivable listings—one for patients and one for insurance companies—and give them to the doctor no later than the tenth day of each month.
At my recommendation, the doctor began having the bank account statements mailed to her home rather than to the office. Dr. Martin now opens the bank statement, reviews the statement, and reviews the cancelled checks (and later the images of the cancelled checks) to ensure that all were paid to authorized vendors and are for reasonable amounts.

Wells4689_c22_1

05/31/2007

211

recommendations to prevent future occurrences

211

She then takes the statement to the management company so that it can prepare the bank account reconciliations. We initiated this compensating control due to the small size of the administrative staff and the inability to segregate functions as would be done in a larger company. Additionally, Dr. Martin reviews receivables each month and compares collections to the amounts deposited into the practice bank accounts. She also monitors the receivables with the insurance companies to ensure positive cash flow for her practice.

Recommendations to Prevent Future
Occurrences
Background Checks
Dr. Martin says that she wishes that the parochial school had called her for a reference about
Cheryl, as she would have told them exactly what had happened and that Cheryl could not be trusted. The doctor now checks references on all new employees. She obtains a release from the prospective employee to allow previous employers to release information without liability. The doctor asks to speak with the person’s direct supervisor for the previous three places of employment and makes specific inquiries about the integrity of the candidate. Dr. Martin says that this has caused her not to hire two persons for employment. In both cases, there were problems with the person’s integrity; in one case, the person had given a written statement admitting to theft from the company. Dr. Martin believes that getting these references has helped her to stop additional fraud losses at her practice and that similar procedures would help other companies to stop fraud losses.
Supervisory Review
At my recommendation, Dr. Martin now receives the bank statements for her accounts at her home address rather than the office. She reviews them and the images of the cancelled checks to ensure that the transactions are authorized.

Robert Barr, Jr., CFE, CPA, is a manager with Harper & Pearson Company, P.C. in
Houston, Texas. His firm provides public accounting, fraud examination, consulting, and expert witness services. Mr. Barr is a University of Houston graduate with over
25 years of experience in detecting and preventing white-collar crime. He teaches a graduate-level fraud examination course at UH.

Wells4689_c23_1

05/31/2007

212

chapter

23

&
Three Strikes and You’re Out!
MARY BEST

an Knorr was liked by everyone he worked with in the Lawrencetown Parks and
Recreation Department. Stocky, with an easy smile and an outgoing personality, he seemed much younger than his 45 years. Dan and his wife, Margie, often had parties at their large, pleasant house where coworkers and guests were treated to plenty of food and drinks. The Knorrs also liked to travel to popular places including Las Vegas, Florida, and the Dominican Republic at least a couple of times a year.
At work, Dan was a conscientious if somewhat unremarkable employee, having slowly worked his way up the ranks in the City’s Parks and Recreation Department. After an amalgamation of the city with several adjoining municipalities five years after his hire,
Dan’s responsibilities increased along with the population base using the recreation programs. Eventually his dedication and long service earned him the position of assistant department manager, where he performed administrative tasks, such as budgeting and approving invoices. When the department manager moved to another position, Dan replaced her as acting manager of Parks and Recreation. He was an easygoing boss and not too demanding of his staff.
The city and each of its surrounding regional municipalities had many organizations devoted to programs such as baseball, football, soccer. The Parks and Recreation employees were especially prized for their knowledge. As a result, Dan Knorr was invited to become a board member for a number of groups and generously consented to the volunteer time required. He became the treasurer for one of these nonprofits, the
Regional Recreation Association, an umbrella organization for activities around the area.
Generous and well liked, Dan Knorr was considered a solid member of the community.
The municipality of Lawrencetown was incorporated in the mid-1700s. Although it is situated on a natural harbor, its remote location, northern exposure, and cold Atlantic winter winds have kept the population growth at a standstill compared to the big coastal cities farther south. While it enjoys a seasonal population boost in the summer months,
Lawrencetown is a small city by most standards, with a permanent population of only around 60,000.
Lawrencetown’s staff consisted of about 50 employees prior to the amalgamation.
Afterward, most of the staff in the consolidated municipalities were given jobs in the new

D

212

Wells4689_c23_1

05/31/2007

213

a double header

213

structure, and the number of employees doubled overnight. They work in all the usual departments, including police, fire protection, public works, planning and development, water and sewer, and parks and recreation. There is no internal audit function.
Parks and Recreation is busy since Lawrencetown is a very sports-minded community.
Fall fitness classes are well attended and winter sports are keenly competitive. Even spring and summer teams, recreation programs, and water sports are very popular with students out of school with parents looking to keep their children busy.
Internal controls are made difficult by the perpetual registrations for programs—small dollar amounts, many different volunteer organizations to deal with, and lots of cash. The
Parks and Recreation Department is also responsible for operating certain athletic facilities, including several arenas and pools, soccer and baseball fields, and other venues.
In addition the department operates a subsidy program for various community youth sports organizations. To help them with their operating costs, Lawrencetown contributes a set amount each year for every child registered. For instance, a youth soccer association might get $50 per child; if 200 children are participating, the group would receive a total annual subsidy of $10,000.
Characterized by a busy environment, low staff turnover, lots of cash transactions, and a focus on the delivery of successful recreation programs, the Parks and Recreation
Department did not consider financial controls its top priority.

A Double Header
In late March, an innocent inquiry by the chairman of the Parks and Recreation
Committee one Monday morning started the ball rolling. The chairman asked Wendell
Short, an employee working in the Parks and Recreation Department, how much the city had paid to the East Town Minor Hockey Association for the current and previous year.
This group was in his municipal electoral district, and the chairman was anxious to know the level of support prior to his appearance at a major hockey tournament. Normally the chairman would have asked Dan Knorr, the acting manager. However, Dan was out of town. As a result, Wendell took the call. Wendell could only find the current year’s East
Town file. He asked the city’s Finance Department for the information it had. The Finance
Department produced the requested listing of payments made to this organization for both years. But when he received the list, Wendell was puzzled. Right at the top, it showed two large payments in the current year: one in January for $25,650 and one in March for
$25,000. Why two? Wendell recognized the March figure since he had requested that amount only a couple of weeks earlier. But what was the January payment? Wendell concluded that it must have been an accidental double payment.
Since he figured he’d have to get the earlier payment back from the association, Wendell decided to phone East Town’s treasurer, Charlie Howard. But when he called, Charlie said he didn’t remember receiving any January payment at all; in fact, he had been very late in requesting the organization’s annual subsidy. After checking, he phoned Wendell back to confirm that the only money the East Town Minor Hockey Association had received since

Wells4689_c23_1

214

05/31/2007

214

chapter 23

three strikes and you’re out!

early the previous year was in March for $25,000. This information substantially complicated matters. Wendell knew he still had to get back to the chairman, and to do this, he had to clear up the matter of the January payment for $25,650. His next move was back to the city’s Finance Department. He told the manager, Will LeMain, what he was looking for and got help from the staff to retrieve source documents for the two payments. The check requisition forms requesting the payments were pulled, along with the cleared checks. Wendell brought along the current year’s subsidy file, and he and Will began studying the paperwork.
First, they verified the March payment. The subsidy file from East Town contained an itemized listing of 500 children registered for hockey in the fall of the previous year. Along with this was a memo from Charlie Howard requesting the annual payment of $50 per child, or $25,000 total. The check requisition for payment by the city was prepared by
Wendell, properly approved by Dan Knorr, the department manager, and paid by the
Finance Department. The March payment was good. Wendell and Will then turned their attention to the January payment. The check requisition for this payment showed
513 children at $50 per child, or $25,650. However, there was no supporting information at all. The requisition was both prepared and approved by Dan Knorr. Both checks were made out in the name of East Town Minor Hockey Association, and the same address was printed on the face of the checks. However, the reverse of the checks were not the same.
The March cancelled check showed a stamp by Scotiabank. The January cancelled check showed a Firstbank stamp but a different bank account number.
Next, disbursements to a completely separate regional organization, the Halton County
Baseball Association, were examined. Wendell Short had been suspicious of a payment to them the year before, since the city generally funded only municipal organizations. But he was new in his position then, and Dan Knorr reassured him that the payment was okay.
Recalling this incident, Wendell now wondered whether looking at these transactions might help shed some light on the East Town Minor Hockey payments. Although the checks were made out to two completely separate organizations, they had been deposited to the exact same bank account!
Obviously, something was wrong. A telephone call to Charlie Howard, East Town’s treasurer, confirmed that their organization’s bank was Scotiabank, not Firstbank, and
Charlie reiterated that East Town had not received any payments from the city in January.
The president of Halton County Baseball Association confirmed that the organization’s bank was not Firstbank. In fact, the president told Wendell that the baseball association did not receive any funding from the city at all.
Check requisitions to the Halton County Baseball Association were also initiated and approved by Dan Knorr. No supporting documents were found. So far the investigation had taken about three days. At this point, Wendell and Will believed there was something wrong, that city funds were being somehow diverted, and that Dan Knorr was the only common thread that tied the transactions together.
As manager of finance, Will LeMain decided to present the information to the city’s chief administrative officer, who quickly informed other key people: the mayor, the

Wells4689_c23_1

05/31/2007

215

a home run

215

chairman of finance, the chief of police, the director of human resources, and the city attorney. They decided to move quickly. Upon his return to the office the next day, Dan
Knorr was confronted. When he offered no explanation, he was suspended from his position and escorted off the premises.
Since there was no internal staff to do a thorough investigation, the city looked to a professional accounting firm for help. Having recently assisted with several cases related to fraud, I got the assignment. My instructions from the city were to review the information that had been gathered on the suspected fraud and, if their suspicions proved true, to delve further to determine the time frame and methods used by Dan Knorr to divert funds and to quantify the amounts involved. All of these events, from the initial question by the chairman of the Parks and Recreation committee to hiring an investigator, took less than a week.

A Home run
After briefing me on the background, the chief administrative officer asked me how I planned to go about investigating the situation. ‘‘Oh, by the way,’’ he said, ‘‘there’s a city council meeting two weeks from yesterday, and we’re hoping you’ll attend it to explain things.’’ I thought to myself, ‘‘If Dan Knorr were actually responsible for the fake requisitions, he’d had 13 years of employment to perfect his technique. And they want me to find out all about it in 13 days!’’ I laid out my planned approach for the investigation. ‘‘I think I’d like to start the process on two fronts,’’ I explained. ‘‘First, we need to look at all payments from the Parks and Recreation Department to recreation or sports organizations. Starting with the current year and working back, we’ll identify any suspicious transactions. Second, I want to get into Dan Knorr’s office as soon as possible to see whether there’s any useful evidence there.’’ I met with Charlie McAskill, the big, burly chief of police for Lawrencetown, to get into Dan Knorr’s office. McAskill had locked the office soon after Knorr had been suspended. Now we were going to see what we could find. My first impression was that the workspace was messy. It was also big, with a large desk, a credenza on one side, and a floor-to-ceiling bookcase. Papers and files were everywhere.
Stacked loosely around the perimeter of the desk were several uneven piles, one leaning against the computer monitor for support. Boxes of papers were stowed under the desk and beside the credenza.
‘‘Whew!’’ Chief McAskill said. ‘‘You’ve got your work cut out for you.’’
We needed to catalog what was there, and we had to make sure we could identify where it came from.
‘‘Do you need a helper from the Police Department?’’ the chief asked. I quickly said yes.
I felt it was a good idea to have two people there at all times in case any questions arose later about chain of custody.
Once my helper arrived, I started by tagging all the boxes, shelves, and piles, working from the door around the office and back again in a systematic fashion. I began to hit pay

Wells4689_c23_1

216

05/31/2007

216

chapter 23

three strikes and you’re out!

dirt at the desk. In the drawers and in boxes underneath were bank statements and deposit slips from a Firstbank account called ‘‘Regional Recreation Association.’’ A quick comparison showed that the account number was the one identified by Wendell Short and
Will LeMain on the back of the suspicious checks to East Town Minor Hockey Association and Halton County Baseball Association. I also found some credit card statements in Dan
Knorr’s name, from several different credit card companies. A few personal joint bank statements and personal bills were also there. On the top of the desk were several old subsidy files from a previous year.
Meanwhile, upstairs in Finance, the tedious work of going through the general ledger accounts and pulling supporting documents was proceeding. Slowly emerging from the mass of transactions was a list of checks and payments that looked suspicious. Lack of support, authorizations by Dan Knorr for his own requisitions, and Firstbank endorsements isolated these payments from many legitimate ones.
Now that I had plenty of information to work with, I needed to figure out what was going on. As a starting point, I used the check dated in January of the current year for
$25,650 to East Town Minor Hockey Association. At Dan Knorr’s desk, I found a ‘‘Quick
Deposit’’slip to the Regional Recreation Association bank account, listing the check from the city along with a small cash amount. Since I happened to be a Firstbank customer myself, I recognized the ‘‘Quick Deposit’’ slip as the kind you just fill in and drop in a slot for the tellers to process later. I traced the resulting amount to the January Firstbank account statement for Regional Recreation Association found in Dan Knorr’s office. It exactly matched a deposit on January 22.
I thought, ‘‘How was a check made payable to East Town Minor Hockey Association able to get deposited into an account called Regional Recreation Association?’’ A quick flip-over of the cleared check showed the endorsement signature of ‘‘Charlie
Howard.’’ Later I would confirm with him that this was a forgery. So now I knew for certain that the city’s check had been deposited in Regional Recreation Association’s bank account on January 22. The next item was a check for $8,595 coming out of the account on January 23; the payment was made to Capital Credit Card Services.
Recalling that I had cataloged several Capital Credit Card bills in the personal information found at Dan Knorr’s desk, I pulled out the statement showing a payment on January 28 for $8,595. The credit card was in the name of Dan Knorr and was sent to his business address. The incriminating trail was now complete. Starting with a city check, the money had gone through an intermediate bank account and right to Dan
Knorr’s personal credit card.
As I investigated further, the details that follow began to emerge.
Eleven years prior, Dan Knorr became treasurer of Regional Recreation Association, an organization formed to promote and assist in offering all types of recreational activities in the Lawrencetown area. Three years later, this association merged with another recreational organization, keeping the same name but obtaining a broader countywide mandate and a larger budget funded by several levels of government. Dan was treasurer of both the old and the new organization, remaining in this position for five years.

Wells4689_c23_1

05/31/2007

217

a home run

217

A Firstbank account was opened in Dan’s first year on the job for the association. He and two other directors were signing officers, with two signatures required on checks. The bank account address was the association’s post office box number. When the new treasurer of Regional Recreation finally took over for Dan, she opened a new account for the organization at a different bank in a more convenient location. The new treasurer assumed the Firstbank account was closed. However, it wasn’t. Dan left Regional
Recreation Association’s Firstbank account opened, merely changing the address to that of the city’s Recreation Department. That way, the monthly bank statements were delivered directly to Dan at work. He used the Firstbank account as a conduit to cash improperly obtained checks and withdraw the funds for his personal use. I found that four years after the new treasurer took over, Dan Knorr began diverting money from the city through phony check requisitions for various sports associations into Regional Recreation
Association’s Firstbank account. These amounts started reasonably small, with check amounts between $900 and $2,500. However, they grew quickly to include individual checks as high as $9,500, $15,000, and the one that was ultimately found for $25,650 in
January. In total, Dan extracted approximately $500,000 in a little over six years. No wonder he was able to afford expensive trips and lavish parties!
In order to get the checks issued from the city, Dan had to prepare a check requisition. He cleverly used legitimate organizations as payees and reasonable explanations for the requests. As a result, authorizations by the Recreation Department manager were primarily a check to see if the budget for that particular type of activity was exceeded. Dan prepared a great many valid requisitions that looked no different from the fictitious ones. Supporting documents weren’t typically attached to the check requisitions, since it was assumed that the details of individual registrants were kept in files to be easily viewed at any time.
When Dan became acting manager of Parks and Recreation, he was able to approve his own check requisitions, along with those of others. This made the process of obtaining checks even easier, although budget constraints still remained as a ceiling on what was ultimately available. However, I later discovered that the dollar amounts of the fraudulent checks did not push the related accounts over budget because Dan was falsely inflating them. This was very ingenious on his part since he knew that budgets are watched very strictly in any municipality. For instance, if the proper amount of subsidy for a certain association was based on registrations of approximately 350 participants and the budget was inflated to provide for 500 participants, the excess would leave a slack amount available for Dan to divert without raising any red flags. Additionally, the amalgamation of the city and the municipalities afforded an opportunity to increase the recreation program budget areas substantially, as the numbers from the combined entities were not initially known.
Checks for a variety of recreational organizations were commonly addressed to the
Parks and Recreation Department at the City of Lawrencetown. Since many of these volunteer organizations had no permanent addresses and the treasurers were constantly changing, it was not unusual to have the city address listed and the checks picked up.
However, this practice allowed Dan to be able to intercept a check without it being mailed to the organization, something that may have exposed the scheme earlier.

Wells4689_c23_1

218

05/31/2007

218

chapter 23

three strikes and you’re out!

Accordingly, the sports organizations to which extra checks were payable did not know about them since they were receiving their correct subsidies through regular channels.
Similarly, the Regional Recreation Association did not know about the unusual activities in its unknown bank account. And finally the victim, the City of Lawrencetown, did not realize anything was amiss, since the checks were cleverly concealed amid other similar payments and the amounts did not exceed the previously inflated budget levels. It was almost a bulletproof plan, and I understood why the scheme had gone undetected for so many years.
Since the Regional Recreation Association sounded like an umbrella organization for several different sports groups, the bank never questioned any of the deposits. But just to make sure, Dan always used the drop box to avoiding any face-to-face questions from tellers. Payments were all done by check. Remembering that the account required two signatures, I noted that Dan Knorr was always one of the signers. I asked the other two signing officers to confirm their signatures on several checks made out to Dan Knorr’s credit cards or personal bills. They were forgeries.
Although the full investigation took the better part of a month to complete, I had enough details to attend the closed session of City Council as promised. I presented the
East Town Minor Hockey example. Seeing the incriminating trail with their own eyes saved a lot of explanations. However, there was still plenty of heated discussion and lots of questions. Dan Knorr had no doubt been clever, but the councilors agreed that troubling issues remained about the city’s internal controls.

The Final Inning
Based on the outcome of the investigation, Dan Knorr was charged by the police with theft and forgery. Not surprisingly, his temporary job suspension became permanent. Out of work and facing financial ruin and public humiliation, he was beginning to reap the ugly consequences of his illicit activity. Dan pleaded guilty to both charges. Prior to sentencing, his lawyer prepared a written request to the court for leniency. Everyone connected with the case was keenly interested to find out what Dan Knorr had to say about his actions. He began by corroborating the evidence outlined in my written report. This included key points on inflating city budgets in advance, obtaining checks through false check requisitions, and using Regional Recreation Association’s bank account as a conduit. The submission got more interesting after that, since it dealt with Dan’s motivation for the crime. It noted that he fully expected to get caught in ‘‘year one,’’ although it never stated exactly what year that was. He claimed that he fully intended on repaying the amounts he had ‘‘borrowed,’’ but this became increasingly unrealistic and eventually impossible as the amounts grew larger. One could argue that the underlying reasons for Dan’s behavior lay in a deep desire to please everyone around him: his family, friends, and coworkers. This caused him to do such things as always pick up the tab for meals, drinks, and entertainment and to make substantial donations to a variety of good causes. These expenses were well beyond his means, but the stolen money offered him the way to pay for them. Coupled

Wells4689_c23_1

05/31/2007

219

lessons learned

219

with this were two common vices: drinking and gambling. Dan played the lottery on an ever-increasing basis with the hope that he would win big and be able to repay the amounts he had stolen. That never happened. As a result, drinking became a problem.
The submission commented on the acute suffering Dan was currently undergoing as a result of his actions. Loss of prestige in the community was cited along with financial ruin and the prospect of extremely limited future job prospects. Also it was noted that Dan had received many letters of support from stalwart members of the community. The submission concluded that since Dan was no danger to the public, had always been a hard worker, and was extremely remorseful, he was a prime candidate for conditional sentencing. However, the submission did not generate much sympathy for him. While showing the human face of the crime, it also confirmed that Dan fully understood what he was doing.
Areas such as budget manipulation and the intricate mechanics of exploiting operating procedures at the city and the bank indicated a level of sophistication that went far beyond spur-of-the-moment actions. Also, while Dan accepted responsibility for what he had done, it didn’t appear that he accepted much blame for his actions. Instead he hinted that the situation resulted from the city’s poor controls and the bank’s lax procedures in not requiring financial statements or confirmation of signing officers. Finally, although the submission outlined the generous things Dan did with the city’s money, conspicuously absent was any mention of his purchases for personal gratification such as expensive trips to popular vacation destinations.
The sentence was delivered in the historic downtown courthouse, jammed with curious onlookers and people more directly affected by Dan’s activities. Although the judge toyed with the benefits of house arrest in the sentencing preamble, causing representatives of the City of Lawrencetown in attendance to hold their collective breaths, in the end that was not adequate punishment for such premeditated activity. Dan was sentenced to two years in prison. He served about half of the time in a maximum-security federal penitentiary, hopefully a grim deterrent to others who might contemplate similar activities. Since his release, Dan Knorr has led a quiet life out of the public eye. He keeps busy with jobs as a manual laborer and over the course of time has dropped out of sight almost completely.

Lessons Learned
Everyone connected with this case learned something. The City of Lawrencetown learned that gaps in internal controls are an open invitation to fraud. Accordingly, it moved swiftly to plug the leaks highlighted by the investigation. Managers were strictly reminded to review supporting documents carefully before approving check requisitions, and they were no longer allowed to approve their own disbursements. Mailing procedures for suppliers’ checks were revamped to minimize any possibilities for interception. Pickup of checks was discouraged. The sports subsidy program was reviewed carefully to determine the correct amounts, and the budgets were reduced correspondingly.

Wells4689_c23_1

220

05/31/2007

220

chapter 23

three strikes and you’re out!

In addition, the investigation had uncovered a couple of interesting side issues. The city had encountered considerable difficulty in finding documents from earlier years, and data kept in a software program no longer in use was unreadable. This prompted city leaders to look at better methods for cataloging paper-based financial information and to discuss with their computer consultants ways to access older electronic records.
Personally, I learned a number of things. I gained insight into some different methods used to conceal fraudulent activities, adding this information to my toolkit for future reference. Also, I learned a lot about how to deal with large groups of very different stakeholders. For example, the issues that were important to elected members on City
Council, who had to deal with the public, were entirely different from those of the Parks and Recreation Department, whose members were primarily interested in whether the investigation would affect their sports subsidy program.
I was intrigued that the fraud had gone on for such a long time without being detected. I saw that the reasons for this lay in Dan’s ability to seize opportunities to improve his plan each year to reduce the possibilities for detection. Inflating the budgets was a brilliant stroke.
Also, upon finding that a department manager could approve his own check requisitions,
Dan quickly shifted to this approach, which eliminated any concerns around getting fake disbursements approved. Ultimately, though, Dan made a key mistake in handing control of the sports subsidy program to another employee, which led to exposure of the plan.
Two final lessons were learned about public perception and punishment. The letters of support for Dan Knorr made me wonder whether people didn’t care or just didn’t understand how fraud ultimately affects everyone. However, perhaps these people were simply too close to Dan to see the bigger picture. I also observed that while the justice system may sometimes seem to be too lenient on white-collar crime, it isn’t always that way. In this particular case, the courts cracked down hard. Dan Knorr learned the tough
´
way that timeworn old cliche: ‘‘Crime Doesn’t Pay.’’

Recommendations to Prevent
Future Occurrences
Segregation of Duties
For small entities that have volunteers for treasurers, like Regional Recreation
Association, a regular changeover of signing officers is important to keep a situation like this one from going on a long time. It can be hard to find a competent treasurer, and as a result organizations tend to hang on to the good ones as long as they can. But a change brings in new thoughts and ideas as well as fresh eyes to review financial controls.
Communication with Banks
Authorized signatories for a nonprofit organization should make sure to confirm with the bank that the previous signing officers have been replaced. Any time an organization

Wells4689_c23_1

05/31/2007

221

recommendations to prevent future occurrences

221

changes banks, a letter from the prior financial institution should be obtained confirming that the earlier account has been closed and all funds have been transferred to a new account. Directors should be trained not only to find out what the organization does but what controls are in place. Finally, although a financial audit is not a panacea to uncover fraud, it would have been a deterrent in this case since covering up the amounts running through the bank account would have required extra effort.
Strict Enforcement of Organization Rules
For regular businesses and larger organizations like municipalities, fraudulent activity can result when existing rules are bent without anyone realizing it. In the City of
Lawrencetown, check requisitions were required to be approved, but somewhere along the way it became acceptable to allow the managers to approve their own requisitions. A good dose of common sense would tell you that this sounds like a dangerous practice, which it turned out to be. Accordingly, approvals need to be done by someone other than the person purchasing or receiving the items.
Required Documentation for Payments
As a final recommendation, payments should provide proof that the goods or services were necessary to the organization and therefore were properly authorized in the first place
(purchase orders), that they were actually received and used by the organization (receiving reports), and that there are valid requests to pay (suppliers’ invoices). Matching of these documents and adequate segregation of duties in these key areas helps to make internal controls work to prevent fraud.

Mary Best, CFE, CA, is a partner with Arsenault Best Cameron Ellis, a public accounting firm operating in Canada’s Atlantic region as part of the AC Group of Independent
Accounting Firms. Ms. Best has been in public accounting for over 30 years, including
14 years as a partner with an international chartered accounting firm.

Wells4689_c24_1

05/31/2007

222

chapter

24

&
Country Club Fraud—What a Steal!
JOHN BOEKWEG

elody Gunther was an unmarried 23-year-old woman who believed that life had treated her unfairly. She was not born into a wealthy family. In fact, her parents divorced when she was a teenager, and her mother and siblings struggled financially as a result. Although the neighborhood Melody grew up in was not in the most affluent part of town, she had friends and acquaintances from school who came from wealthy families.
Seeing the lifestyles and opportunities enjoyed by her peers caused her to want more in life than she could afford.
After graduating from high school, Melody worked a series of part-time jobs while still living at home with her mother. She was never paid enough to support her spending habits, so she was constantly looking for job opportunities with a higher hourly wage.
Eventually she found work as a teller in a local bank.
While employed at the bank, Melody fell deeper and deeper into debt. She had purchased a new car, was racking up credit card charges, and having trouble making the minimum monthly payments. In order to avoid bankruptcy, she stole some money from the till to cover some of her debt payments with the intention of paying it back as soon as she received her next paycheck. The theft was discovered immediately, and she was terminated.
After her termination, Melody quickly found employment at a local country club as a receptionist. Her position made her the first person members contacted when they entered the clubhouse. She charmed everyone with her smile and flirted with the older, wealthy men. When given the opportunity, she complained to them about her troubles to garner sympathy. Occasionally a member would even give her money to lend support.
Melody’s coworkers were becoming frustrated with her laziness. She was constantly filing her nails and doing her makeup. She arrived late, left early, and took long lunch breaks. The club’s board of directors had recently terminated the club manager and was in the process of hiring a new one. In the meantime, nobody was managing Melody or the office staff.

M

Welcome to the Club
The club features an 18-hole, par 72 golf course located on 7,000 square yards of real estate in Sanpete County, Utah. Additional amenities include a clubhouse, a swimming pool,
222

Wells4689_c24_1

05/31/2007

223

welcome to the club

223

and a pro shop. The club’s revenues consist of monthly dues and assessments from its 300 members, green fees, and restaurant and bar revenues. The year our firm was hired to conduct the audit, the club had gross revenues of $1.8 million and total assets of $3.7 million. The club’s management team consisted of Jake Trembell, the general manager, who was responsible for accounting and administrative operations; Barney Lewis, the head chef, who handled the club’s restaurant and bar operations; Lee Johnson, the golf pro, in charge of the golf course; and Ed Manning, the chief engineer, who was responsible for maintenance of the facilities and grounds. Each of these individuals managed a certain number of employees and reported directly to the board of directors.
Shortly after Jake hired Melody as the receptionist, he was terminated. The board of directors decided to combine the duties of the general manager with those of the head chef, making Barney the one responsible for the office staff. Since Barney was more concerned with the restaurant than the accounting or administrative operations, the office staff was often unsupervised—and accounting controls were largely ignored.
Barney relied on Colleen Peterson, the club’s part-time accountant, to oversee the accounting functions. She worked five four-hour shifts each week. Colleen used the other two office staff, Ruth Johnson, a part-time accounting technician, and Melody, the receptionist, to perform various accounting duties to assist her in the maintenance of the general ledger and member billing systems and to generate financial reports for the monthly board meetings. Ruth and Melody did not report to Colleen.
The executive committee of the board of directors assumed responsibility for monitoring the club’s finances and engaging an auditor to conduct the annual audit.
The committee would also meet monthly to review the financial reports prepared by
Colleen and her staff. Financial results were discussed and material budget variances and individually significant transactions were reviewed. The committee was made up of three or four board members with experience in finance or accounting who interacted regularly with Barney and Colleen during the course of the month.
As one might expect, the club’s culture was fairly laid back, and there were no formal internal control policies and procedures. To make matters worse, a lot of cash circulated throughout the club because that was the members’ preferred method of payment for restaurant and bar tabs. There were four different petty cash boxes. Each had up to $5,000 at any given time and was managed by four different people. All of the office staff had access to the key to the safe where the petty cash was stored at the end of the day. Petty cash was reconciled four to five times a year, and those reconciliations were performed by the same people who handled the petty cash boxes.
The receptionist was typically responsible for receiving payments from members at the front desk, opening the mail, preparing the deposit for the bank, posting member payments to the member billing and accounting system, and taking the deposit to the bank. While bank reconciliations were performed monthly, they were not reviewed by the general manager or an officer independent of the accounting process.

Wells4689_c24_1

224

05/31/2007

224

chapter 24

country club fraud—what a steal!

Member accounts were not reconciled on a regular basis, and there were ‘‘ZZ’’ accounts set up to record transactions arising from non–member-sponsored events, which included significant alcohol purchases and food consumption. These ‘‘ZZ’’ accounts were monitored only by the head chef.
The club functioned with Barney at the helm for about six months until Doug
Anderson, a new board member, was appointed to be the chair of the executive committee. Doug was a Certified Public Accountant with 32 years of auditing experience with one of the Big Six accounting firms. It didn’t take him long to notice some major problems with the way the club was being run.
The first change Doug made was to hire a general manager with a finance background.
The new general manager, Ed Wilkins, was given the charge to exert more control and oversight over the club’s accounting processes and procedures. This was a daunting task for
Ed since the office staff was not accustomed to following formal rules. He quickly realized that Melody was lazy and a potential liability to the club, so he terminated her employment about two weeks prior to the annual audit.
The second change Doug made was to fire the club’s current auditor, who had never provided the board of directors a management letter that would have revealed material weaknesses in internal control. In fact, the auditor never reviewed internal controls as part of his engagement. Our audit firm was retained to conduct the financial statement audit for the year-end. I was the lead auditor on the engagement.
My first task was to gain an understanding of the club’s internal control policies and procedures and significant accounting processes. In order to do so, I had to meet with
Ed and Colleen and interview them about their responsibilities and the duties of those in control of accounting, asset custody, and authorization. At the time, Ed had been employed by the club for only about a week, and wasn’t much help. But Colleen revealed several issues that were of great concern; lack of segregation of duties within the accounting department was foremost among them.
I asked Colleen if the club had experienced any fraud as a result of poor segregation of duties. She replied that there hadn’t been any to her knowledge, but that that would be difficult to judge since there had been no one overseeing any of the accounting functions, and she only worked in the evenings and early mornings, when there is little going on in the clubhouse.

Nothing Petty about It
A few weeks after my interviews and internal control walk throughs, but prior to Melody’s termination, we received a tip from Colleen that some petty cash was missing from the safe.
She had noticed the discrepancy that day when she was reconciling one of the petty cash boxes, as required by one of the new accounting policies Ed had established. She was not sure who had stolen it, or if it had, for certain, been stolen, but the amount missing totaled approximately $2,200, and she felt that she should inform the auditors. Little did she know that this would only be the tip of the iceberg.

Wells4689_c24_1

05/31/2007

225

nothing petty about it

225

After receiving Colleen’s phone call, I called a meeting with the audit team to discuss the tip and to assess the scope of the potential fraud. The audit team consisted of me, the audit manager, a senior auditor, a new staff auditor, and the managing partner.
In the meeting we discussed the phone call and the impact it would have on our assessment of fraud risk. Although we were all feeling somewhat uncomfortable about this new engagement, we did not consider it necessary to withdraw since the club appeared to have accounting records sufficient to conduct the audit. However, we decided to modify our standard audit approach to address the fraud risk factors identified in our meeting. The modified approach would incorporate all of our traditional procedures, but would focus more attention on areas with substantial inherent risk. Therefore, we discussed the process of each significant transaction class and the key employees involved. Our discussion led us to conclude that, among other things, our procedures would need to include an examination of all:


Petty cash disbursements and replenishments and related reconciliations. Specifically, we wanted to learn whether the use of all petty cash was authorized, accounted for, and supported by adequate documentation and reconciliation. We further wanted to determine whether replenishments to the petty cash accounts were properly approved and recorded to the petty cash subsidiary ledgers.



Bank reconciliations, paying particular attention to deposits, wire transfers, and general ledger adjustments to cash. We wanted to learn whether deposits were complete and valid, and whether they cleared the bank in a timely manner. We also needed to determine whether nonroutine wire transfers were authorized and appropriate. General ledger adjustments would be tested for adequate supporting documentation. 

Member accounts. We wanted to determine whether member accounts were being reconciled and payments were being properly applied.



Check disbursements from the operating account to ensure that vendors were approved and valid, payments were authorized and supported by adequate supporting documentation, and cancelled checks contained the proper signors, payees, and endorsements.

Fieldwork was scheduled to last one week. On the first day, I gave Diane, the senior auditor, the assignment of examining bank reconciliations and testing petty cash while
Tanya, a staff auditor, and I began reconciling and testing member accounts. Within an hour of commencing her examination, Diane noticed a strange trend occurring within the operating account.
‘‘Why would a deposit totaling $27,845 that was prepared November 30 fail to clear the bank until January 2? And why would a deposit totaling $28,779 made December 31 fail to clear the bank before February 17?’’ she asked.
I agreed that it appeared suspicious and requested to see the support for the November deposit. As I reviewed the support, I noticed that it contained copies of checks made by

Wells4689_c24_1

226

05/31/2007

226

chapter 24

country club fraud—what a steal!

members to pay their monthly assessment bill with payment dates ranging from November to December. I also noticed that there were no cash payments included in the deposit. As I reviewed the deposit, I wondered why a deposit dated November 30 would have member payment checks dated in December. This appeared very unusual, so I addressed the issue with Colleen.

Better Safe than Sorry
Colleen was perplexed by the problem and didn’t have an answer. After researching the issue for a few hours, she returned with Ed.
‘‘There appears to be a discrepancy in cash, but we don’t know why,’’ he said.
‘‘Several of the members’ accounts within the member billing system reflect balances that do not agree to the statements mailed to them. Since the statements were generated from the member billing system, the statements’ balances should reflect the balances in the system.’’
I asked who was responsible for controlling and mailing the member statements. Ed confirmed that it was Melody. She was also responsible for posting member payments to the billing system and preparing the daily deposit. It turned out that nobody independent of the billing function was reviewing the bills prior to mailing them.
Colleen compiled all of the member statements for one year that had been mailed to members, and prepared a schedule, by member, summarizing the invoice balances compared to the billing system balances at the end of each month. The differences between the invoices and the billing system were summarized and totaled approximately $50,000. It was noted that the invoices that differed from their related billing system balances had been obviously altered. Some of the fonts shown on the statements reflected what appeared to be those from by a typewriter.
After the differences had been quantified, the questionable payments on each account were traced through to the cash receipts subsidiary ledger within the accounting system and then to the bank deposit slip. All of the payments that cleared the bank were checks.
There were no cash deposits. Since many members paid their account balances with cash, it appeared that someone had been stealing the cash. All the evidence appeared to suggest that one of the office staff—probably Melody—was the perpetrator.
I was unable to interview Melody since she was no longer with the organization and was unwilling to cooperate with the investigation. So I interviewed Ruth Johnson, the parttime office staff member who was usually present during the hours Melody worked. I asked Ruth to describe her duties.
‘‘I am primarily responsible for helping Colleen pay the bills and post the vendor payments within the accounts payable module of the accounting system. On occasion, I assist her by preparing the monthly financial report to the board,’’ she replied.
Next I asked, ‘‘Do you have or have you had any responsibilities for opening the mail, collecting and processing cash or check receipts, making deposits, or posting transactions to the member billing system?’’

Wells4689_c24_1

05/31/2007

227

lapping up the cash

227

‘‘All of those duties used to be performed by Melody, but Ed is considering crosstraining me to perform the member billing function.’’
‘‘Did you observe anything unusual about Melody or how she performed her duties?’’ I continued. ‘‘Melody seemed to devote a lot of attention to the member billing statements each month. She would print them from the system, then manually type corrections to the ones that she claimed were generated by the system but that could not be changed within the system. I don’t know what those changes were. I suspect they were probably mailing address changes or member status changes. It’s not unusual for member data to change when members move or upgrade their memberships, and our system is old and doesn’t handle that process very well.’’
‘‘Did you ever observe Melody steal cash or assets, or has anyone ever communicated to you their suspicion that Melody might be stealing cash or assets?’’ I asked.
‘‘No,’’ she replied, ‘‘but I do recall hearing that someone saw her in the office after she was terminated, getting into the safe. When she was asked what she was doing, she replied that she forgot to reconcile petty cash and to make the last deposit. I guess the person who saw her didn’t realize that she had been terminated.’’
It began coming together for me. ‘‘How was she able to get into the clubhouse and the office without a key? Did she still have her keys?’’
‘‘Yes. When she was terminated, management obviously overlooked that one small detail,’’ Ruth said sarcastically.

Lapping Up the Cash
After my interview with Ruth, and based on all of the other evidence observed, it appeared that Melody had engaged in a lapping scheme, which involves stealing money from one member’s account and covering the shortage by applying a later payment by a different member. I met with Ed and Colleen, who were performing their own investigation in conjunction with ours, and communicated the results of my interview with Ruth. Ed mentioned that Ruth’s testimony was consistent with that of other employees who had observed Melody’s behavior in the final weeks leading up to her termination. He agreed that all of the evidence pointed to Melody. Colleen said that she had suspected her early on, even prior to her termination, when the $2,200 in petty cash came up missing. When Colleen confronted Melody about the missing cash, she denied any involvement and said that she would never have taken the money and suggested that the bar manager or restaurant manager were the ones who may have stolen it. Even though there was no conclusive evidence at that time, Melody was suspected because of rumors circulating about her termination from the bank and the events surrounding it. When I asked why she was hired and retained despite the rumors, Colleen said that Melody had been given a raise by the prior club manager and it was difficult for current management to justify termination for cause right after giving a raise.

Wells4689_c24_1

228

05/31/2007

228

chapter 24

country club fraud—what a steal!

After completing our preliminary investigation and compiling, analyzing, and evaluating the information available, we determined that Melody had perpetuated a lapping scheme for nearly eight months. Since she was responsible for opening the mail, collecting payments at the front counter from members, preparing the daily deposit, and managing the member billing system, she had access to and control of nearly the entire phase of the cash receipts transaction process. This enabled her to steal cash and cover it up easily. Her scheme would work, however, only if she retained exclusive control of the process. When she was terminated, her fraud was quickly detected.
Melody would keep the cash she collected from payments and replace it with checks subsequently received. She would hold the bank deposit open until she could replace the stolen money with later checks. This resulted in a lead time of one to two months from the date the deposit was initially prepared to the date it was actually made. Although the cash that was stolen was not applied to the member accounts within the system, Melody would manually alter the member statements that were generated from the system to reflect payments on the affected members’ accounts so that they were not aware that their account balances were misstated. Since the member accounts were not reconciled independently, the overstated member accounts were not detected.
After the audit was completed, it was determined that member accounts were short
$52,800. In addition, the $2,200 of missing petty cash could not be located. We concluded that Melody stole that money the night she returned to the clubhouse after her termination, before she surrendered her keys. This resulted in a total theft loss of $55,000.
After Melody’s termination, but before the fraud was uncovered, members began receiving statements reflecting higher account receivable balances than expected. At that time, things went from bad to worse. Ed began dealing with numerous complaints from members demanding an explanation. In order to address concerns proactively and to show that he was on top of the matter, Ed unwisely sent a letter to all the members without first consulting the board on the matter, which stated:
ÃÃ

ALERTÃÃ A message from your new Club Manager. Please check your statements carefully!

Over the last two weeks we have discovered numerous errors, discrepancies, and posting irregularities with regards to member accounts that have occurred over the last couple of months. Many of you have already called to ask what is happening with your account.
One of our goals is to provide you with ongoing current and accurate information on your account. To this end, I am asking that each of you review your last month’s statement very carefully and inform me of any inaccuracies in statement balances, monthly charges, or payments that may not have shown up on your account. Any questions or comments will be reviewed in an expeditious manner.

This letter was mailed before the investigation was effectively under way, and the ensuing controversy posed a major challenge to the board in resolving the matter in a timely and efficient manner. Alarmed members suspected that millions of dollars had been stolen by the board and club management. Lawsuits were being threatened, and several

Wells4689_c24_1

05/31/2007

229

recommendations to prevent future occurrences

229

board members resigned before the investigation was completed and a final loss had been determined. The good news was that the club had insurance that covered $50,000 of the loss. Melody paid the remaining $5,000 in a plea deal that allowed her to walk away without the club pressing charges.

Lessons Learned
The most significant lesson learned from this case was how important it is for an organization to have a strong control environment and a board of directors and management group that proactively and effectively communicates and enforces internal control policies and procedures. Melody would not have had the opportunity to commit fraud had management and the board been more attuned to the risks inherent in the organization and the access employees had to cash and other assets. Moreover, it was okay for employees to arrive late to work and leave early, or to have free meals from the restaurant or bar. The restaurant manager hosted parties at the clubhouse for his friends, and they would consume an inordinate amount of alcohol without paying for it. There was no accountability to anyone, because nobody knew who was really in charge.
Another lesson I learned was the importance of professional skepticism when conducting an audit. I have since approached every audit that I perform with the presumption that someone in the organization is committing fraud and it’s my job to find it. This attitude has dramatically altered my audit approach from one of a cookie-cutter, routine nature to one where procedures are crafted that directly address certain fraud risks assessed at the beginning of an audit. More specifically, my audits are focused more on testing internal controls, conducting interviews, and performing analytical procedures in order to identify potential fraud risks.
Finally, I learned the importance of communication. There are good times and bad times to communicate fraud to the stakeholders. Had Ed waited to inform all of the members of the problem until the scope of the fraud had been determined, the results of the investigation would have been less alarming. Furthermore, when the appropriate time to inform the membership was determined, it should have been done under the direction of the board and by the board, not the new club manager. This did not bode well for Ed in the long run.
Although he was competent, eventually he was terminated because he was a poor communicator. Recommendations to Prevent
Future Occurrences
Segregation of Duties
Melody was responsible for receiving payments from members, opening the mail, preparing and making the daily deposit, and posting the receipts to member accounts.

Wells4689_c24_1

230

05/31/2007

230

chapter 24

country club fraud—what a steal!

These duties should be segregated in order to prevent someone from having access to both physical assets and the related accounting records, or to all phases of a transaction.
An administrative assistant should continue to open the mail and prepare each deposit, but a prelist should be prepared that summarizes the cash and checks received. The prelist should be forwarded to another office staff member or the bookkeeper to post receipts to member accounts, and the deposit should be forwarded to the club manager for review. The club manager and one other person should take the deposit to the bank each day. Alternatively, the bank could arrange to pick up the deposit at the clubhouse.
This would ensure a timely deposit and eliminate the need for two employees to accompany the deposit to the bank.
The club manager should receive all bank statements and cancelled checks unopened.
The club manager should review them prior to delivering them to the accounting clerk for reconciliation. The club manager should also review the bank reconciliation after it is prepared. Office staff should be cross-trained and share certain aspects of each others’ duties. For example, some months Colleen could assume the cash receipts and deposit preparation duties, while Ruth posts those cash receipts to the member accounts. Cross-training may be accomplished for other accounting functions, as well. This would result in better controls over the various accounting functions and would allow employees to assume the responsibilities of coworkers in an emergency.
The club manager should periodically perform independent checks on the work completed by office staff involved in all accounting functions. A thorough screening process should be followed when hiring individuals who will have access to assets susceptible to misappropriation. Had the club performed a background check on Melody, the fraud may have been prevented.

Timeliness of Deposits
Although the board of directors passed a resolution requiring a daily bank deposit for all amounts over $500, this policy was never followed, as we observed. This was evidenced when we noticed that two deposits, one approximately $27,000 and the other approximately $28,800, did not clear the bank in a timely manner. Had these deposits been made in a timely manner, Melody’s ability to divert funds would have been greatly reduced. Deposits should be made every day. In rare circumstances when a deposit must wait until the following day, it should be secured in a safe with access limited to only a few key employees.

Cash Receipts
Although the club had a receipting function in place when cash was received from a member, it wasn’t being used effectively or consistently. The club should reevaluate its

Wells4689_c24_1

05/31/2007

231

recommendations to prevent future occurrences

231

policy on how members make payments on their accounts. Two options that may improve controls over the cash receipts process follow.
1. The club manager, or another individual independent of the cash handling and recording functions, should match the cash received to the prenumbered cash receipt when reviewing the deposit.
2. Have a ‘‘no-cash’’ policy. Accept only checks and credit/debit card payments.
If the club elects to continue receiving cash and checks at the front desk, a member should be required to place the payment in a drop box at instead of giving it directly to the office staff. Access to the drop box should be limited to a few select individuals who are always accompanied by another individual when retrieving cash and checks for deposit.

Petty Cash Procedures
The club’s petty cash was reconciled only four to five times a year and was located in a safe in the office that could be accessed by any of the office staff. Due to the significant balances in the petty cash accounts, two people should be present at all times whenever a disbursement from petty cash is made. All disbursements should be approved by an authorized and designated petty cash custodian and supported by a prenumbered petty cash voucher, together with a supporting invoice or receipt.
Reconciliation should occur regularly, and the club manager should review and approve the reconciliation.

Centralization of Authority
According to the club’s bylaws, the officers of the organization consists of four managers: a club manager, a chef/food services manager, a golf course superintendent, and a golf professional. These managers are responsible for their own departments and report directly to the board of directors. The problem with this organization structure is that there may be confusion about who is really accountable for particular areas within the club and to whom employees are responsible. The result, as evidenced by the lax control environment, was that some areas did not receive adequate attention.
Centralization of authority can prevent such misunderstandings and increase administrative efficiency and control.
The club should hire a full-time general manager. This individual should be ultimately responsible for all departments and should chair a management committee comprised of him- or herself and four department managers: an office manger, a chef/food service manager, a golf course superintendent, and a golf professional. The office manager should take charge and ensure that the office and accounting staff are adhering to established accounting policies and procedures. The committee should meet weekly to coordinate activities and responsibilities and to resolve issues relating to the general operations of the

Wells4689_c24_1

232

05/31/2007

232

chapter 24

country club fraud—what a steal!

club. The general manager should report to the board of directors regularly to receive instruction and ensure that resolutions are carried out.

John Boekweg, CPA, is an audit manager at HEB Certified Public Accountants in Salt
Lake City, Utah. His firm provides forensic accounting, auditing, litigation support, and expert witness services. Mr. Boekweg obtained an undergraduate degree in accounting and information systems from Brigham Young University and an MBA from Utah State
University. He has over 12 years of experience in auditing and forensic accounting.

Wells4689_c25_1

05/31/2007

233

chapter

25

&
Where in the World is Dina Sanchez?
BRIANA J. PACIOREK

aria Vasquez was a large, middle-age woman with short blond, layered hair. Her attire was never flashy or inappropriate. Rimless glasses and minimal makeup were all that accessorized her face. Her smile was pleasant and friendly. She looked like your everyday mom—someone who would go out of her way to help you.
Growing up in Argentina, Maria worked hard in high school and earned a business degree from the university. After marrying Pedro, her longtime love, she worked at various jobs, but her husband was the breadwinner. For a while, Pedro ran his own delivery business and Maria balanced the books.
With hopes of a prosperous life, Maria and Pedro moved to the United States.
They did not have children, so they brought Maria’s mother with them. The three lived together in a modest three-bedroom house in North Miami, surrounded by palm trees and situated on the Intracoastal Waterway. It was a dream come true for all of them.
Pedro was a self-employed painter who worked less than 30 hours a week. Maria found a job doing accounting for a small company but left after she had problems getting along with her boss. At that point, she contacted JobMart, a staffing agency, and was soon placed at Safe Protect, a subsidiary of a huge conglomerate known as Martz.
Safe Protect manufactured and sold safes to residential and commercial customers. A temporary employee, Maria worked in the tax department helping others perform various administrative tasks. Just one month after I was hired to work in the corporate internal audit department for Martz, Maria was given the responsibility of preparing sales tax returns for various states.
Safe Protect is a world leader in the security products industry. Headquartered in
Miami, the company has been in existence for more than 150 years and has had numerous acquisitions along the way. Since the early 1900s, the company’s way of ridding itself of competitors has been to buy them out. Starting out with just three employees and revenues under $50,000, today the company employs 45,000 workers and has gross revenues exceeding $4 billion.
As you can imagine, Safe Protect went through many changes as it developed and grew to its current size. In the beginning, the company catered only to small general stores and

M

233

Wells4689_c25_1

234

05/31/2007

234

chapter 25

where in the world is dina sanchez?

the wealthy elite. Today’s customers also include large corporations, hotels, governmental agencies, banks, museums, and casinos.
Safe Protect is the largest subsidiary of Martz. For this reason, I spent a significant amount of time performing audits and reviews at the company headquarters during my first year in internal audit. Other than a few minor issues here and there, the audits of Safe
Protect went smoothly. Overall, the company seemed to be operating efficiently.
Employees appeared happy and business was booming. In the process, I was fortunate to become very familiar with the organization and build strong relationships with senior management. One fall, I transferred into the newly developed forensic audit group and found myself traveling to many of Martz’s other subsidiaries.

Not a Genuine Endorsement
Thanksgiving had just passed and I returned to the office after a visit with my family. It was historically a quiet time of the year for my department, as everyone was preoccupied with holiday spirit and many employees were taking much-needed vacations before the end of the year. I was sitting in my windowless office catching up on e-mail when my phone rang. It was Peter Nellis, Safe Protect controller, with a request to meet and discuss an urgent matter. I grabbed a pen and a notepad and quickly made my way to his office on the fourth floor. I sat on the other side of Peter’s desk, joined by Margaret Lewis, director of the tax department. They believed they may have uncovered a fraud in the company.
Margaret had been out of the office on business the day before. Sometime that afternoon, she received a call from Bridget Kingston, senior legal counsel at the company, who told her of events that transpired during her absence. Earlier that morning, Sarah Jasper, tax associate, was engaged in a phone conversation with Bill
Trent, a representative from the State of Kansas Department of Revenue. Bill claimed he did not receive the June sales tax return and payment from Safe Protect. Surprised to hear this, Sarah offered to look into the issue and give Bill a call back. After phoning the accounts payable shared service center in Chicago, Sarah learned that there had been a check dated in July for $78,965 (for June’s payment) made payable to the
Kansas Department of Revenue that cleared the bank. Sarah received an image of the cleared check and forwarded it to Bill. Upon Sarah’s follow-up discussion, he said the endorsement was not genuine. He faxed Sarah a copy of a check with the proper endorsement stamp on the back as a comparison. Neither the account numbers in the endorsements nor the name on the account matched. The Kansas Department of
Revenue endorsement stamp read ‘‘Deposit only KS Dept. of Revenue.’’ However, the endorsement stamp on the suspicious check read ‘‘Kansas DOR.’’ Because Margaret was away on business, Sarah reported the suspicious activity to Bridget in the company’s legal department. Bridget immediately attempted to reach Margaret on her cell phone to explain what had happened. In the meantime, Bridget informed Peter about the matter. Following company policy, Peter turned the matter over to forensic

Wells4689_c25_1

05/31/2007

235

what’s my name, again?

235

audit for investigation. Maria was the only individual responsible for the Kansas account; her duties which encompassed preparing sales tax returns, requesting payment, and physically handling the checks before mailing. Strangely enough, Maria had recently left the company—her last day was on September 9, and it was now
November.

What’s My Name, Again?
Before I could dig deep into the investigation, I needed to learn more about Maria. I received only limited details on Maria’s background from Margaret, so I decided to interview her former coworkers, Sarah Jasper and Paula Martinez. But before I talked to them, I requested bank records for all checks that cleared the bank since Maria’s employment. I knew it would take a few days to get this evidence, and I didn’t want to lose any time waiting for it. Sarah, who handled the initial discovery with the State of Kansas, worked closely with Maria in the sales tax department. Paula, currently with the licensing compliance department at Safe Protect, used to work closely with Maria. They knew her for approximately two years and three and a half years, respectively. While Paula had a closer personal relationship with her, both socialized with Maria on several occasions outside of the workplace.
Sarah and Paula each described instances where they found that Maria was using a different name. Sarah recalled receiving an e-mail from someone named ‘‘Dina Sanchez’’ from an address she did not recognize. Sarah said she could tell the communication was from Maria because it read ‘‘Louisiana’’ in the subject line, and it was responding to a question she had asked Maria concerning the Louisiana tax return. Sarah replied, but never received a response from Maria. The e-mail was received between September 13 and 17, about a week following Maria’s last day of employment at Safe Protect. Paula described an instance where she heard Maria’s mother call her ‘‘Dina’’during a time in July when Maria and her mother visited Paula at her home. Upon inquiry as to why she was called ‘‘Dina,’’
Maria claimed that ‘‘Dina’’ was her middle name.
On another occasion, Paula also recalled receiving an e-mail from a ‘‘Dina Sanchez.’’
When asked if the e-mail was from her, Maria claimed she was using a friend’s account.
Once Paula stopped by Maria’s home in North Miami to see why she was not returning any phone calls or e-mails. At the door, Paula was greeted by a couple who recently moved into the house. She asked if they knew where Maria was. The couple replied they did not know where the previous owner was and that her name was ‘‘Dina,’’ not ‘‘Maria.’’ The couple showed Paula a stack of Dina’s mail that they didn’t know what to do with because they did not have her forwarding address.
Paula informed me of an incident that occurred approximately three years earlier, when
Maria had ‘‘run into some trouble with the law.’’ She recalled that Maria’s husband asked her if he could borrow $25,000 to help get his wife ‘‘out of trouble.’’ During my interview with Sarah, I learned that money was to bail Maria out of jail. Sarah didn’t know why
Maria was there, but believed that it was linked to one of Maria’s previous jobs.

Wells4689_c25_1

236

05/31/2007

236

chapter 25

where in the world is dina sanchez?

I learned many additional interesting tidbits about Maria during the investigation:


Sarah claimed she heard from Paula that Maria bought a Social Security card or was using a fake Social Security card after arriving in the United States.



Paula claimed Maria wore a Rolex watch and drove a Mercedes and that her husband drove a Lincoln Navigator. They were supposedly building a new house in Boynton
Beach, Florida.



Both Paula and Sarah said Maria never liked to talk about herself.



Maria had been to Paula’s home on several occasions, but Paula was never invited over for Maria to return the favor.



Maria had been offered a full-time position by Safe Protect on more than one occasion, but always turned it down.



Paula recalled that Maria wanted to become a regular full-time employee of the company but did not want to have a background check performed on her.



Maria supposedly had friends or some sort of connection to someone in Port St.
Lucie, Florida.

Could Maria really be Dina Sanchez? My next step was to examine the checks I requested from the accounts payable department. But before I performed this review
I did two things. First, I asked a colleague in the security department to perform a background check on ‘‘Maria Vasquez’’ and ‘‘Dina Sanchez.’’ Second, I decided to do some quick investigating into the bank where the suspicious check was deposited. When I could not reach the manager, I decided to call the bank’s fraud department. Although the representative could not divulge information about the owner of the ‘‘Kansas DOR’’ account, he was able to provide yes or no answers. As a result of my questions, he confirmed the names ‘‘Kansas DOR’’ and ‘‘Dina Sanchez,’’ and he said that the account was still open.
Feeling that I had made progress and that we had the right suspect, I performed a full examination of the cleared checks I had received. Out of 60 checks made payable to Kansas
DOR and requested by Maria during her employment at the company, 25 had been intercepted. I was able to determine this by comparing the endorsement information on the back of the checks to the actual endorsement stamp used by the Kansas Department of
Revenue. The total was just under $430,000. Now the investigation was getting interesting. After uncovering this information, an injunction and writ of attachment freezing
Maria’s bank accounts were immediately filed. Thereafter, I had a phone discussion with
Lucy Santos, an in-house counsel for the bank, who confirmed Maria had two personal accounts in the name of Dina Sanchez and one as ‘‘Kansas DOR.’’ According to Ms.
Santos, Maria opened the business account in February of the previous year under ‘‘Kansas
DOR,’’ filed by her as an ‘‘assumed name certificate’’ with the Florida Secretary of State.
Ms. Santos confirmed that the bank had frozen all of Maria’s accounts and ordered all bank

Wells4689_c25_1

05/31/2007

237

what’s my name, again?

237

statements and records relating to them. The balance in the Kansas DOR account was
-$5.90, and the balances in the two personal ones were -$7.02 and $187.52. In addition,
Ms. Santos provided a number of deposits made into the Kansas DOR account. Every amount was matched to Safe Protect checks that were known to be intercepted. It turned out that Maria had sent a request to the accounts payable department to change a vendor name in the vendor master file. The change request was to abbreviate the vendor name
‘‘State of Kansas, Director of Taxation, Department of Revenue’’ to ‘‘Kansas DOR,’’ and was sent from Maria’s Safe Protect e-mail account. Included were requests to change
‘‘State of Nebraska Department of Revenue’’ to ‘‘Nebraska DOR’’ and to change ‘‘State of Vermont Department of Taxes’’ to ‘‘Vermont Department of Taxes.’’
I obtained a copy of the e-mail and change request by Maria from the accounts payable department. There was clearly no supervisory approval. The hardcopy form did, however, contain initials and a date by the individual who processed the change in the vendor master file. According to the accounts payable supervisor, there was no process in place to ensure all changes made to master files were approved before or after being entered into the system.
Not long after uncovering all of this, I caught up with my colleague who performed a background investigation of ‘‘Maria Vasquez’’ and ‘‘Dina Sanchez.’’ As it turned out, our suspect’s real name was Dina Sanchez, and she was using the identity of Maria Vasquez, a woman who was more than 10 years older. It was revealed that Dina used Maria’s information in order to obtain a Florida driver’s license under the name of Maria Vasquez at her residence in Port Saint Lucie, Florida. Dina then used Maria’s Social Security number and falsified Florida driver’s license to apply for work with the JobMart temporary staffing agency. It was later revealed by a Miami detective that Dina Sanchez had a criminal record and had been arrested and jailed at her first place of employment after she arrived in the United States.
JobMart provided copies of the last two paychecks sent to Dina (under the name of
Maria Vasquez) to her home address in North Miami. The earlier check was endorsed using the same signature of ‘‘M. Vasquez’’ that she used on all of her documents while working at Safe Protect. The second check appeared to have been endorsed by someone else (a ‘‘Maria Vasquez’’ signature that did not match the other check), and was paid after we found out Dina had already left the United States. JobMart personnel records under the name Maria Vasquez (Dina) revealed that she had listed her home address as 19 W. Esimo
Avenue, Port Saint Lucie, Florida, the home of the real Maria. Research of the property revealed that the home was purchased in January of the previous year by Andreas Marco
Dion and Maria Estrellita Vasquez de Dion for $85,000. There was no mortgage or other lien on this property.
The real Maria claimed to have known Dina as her accountant. Maria said that Dina stole her identity, although she had not filed a police report. We had reason to believe these women may have conspired to commit this fraud because we found a photograph of Dina, her husband, her mother, and Maria together in the Port Saint Lucie home, suggesting they were friends. Maria refused to cooperate with the investigation and declined, through her attorney, to be contacted.

Wells4689_c25_1

238

05/31/2007

238

chapter 25

where in the world is dina sanchez?

The Well-Traveled Fraudster
Ultimately, I was able to determine what Dina had done based on a review of tax return documentation and discussions with Margaret. She had manipulated system reports, tax returns, and controls in order to intercept checks and conceal the fraud. Dina was responsible for running the monthly sales tax reports from the Safe Protect system; she was the only individual who knew how to perform this task. Most of the check interceptions were accomplished as a result of modifying total sales reported and then creating falsified returns.
For example, the April tax returns submitted for review in May showed sales tax due of
$58,300 and use tax due of $2,000, totaling $60,300. However, the check requests made by
Dina were for $35,700 and $24,600 (summing to the correct total due of $60,300). It is unknown why the approver of these check requests did not question why the amounts were broken out the way they were. The individual was no longer with the company at the time of the investigation.
Dina then prepared a second set of returns or, more precisely, a second sales tax return, as she rarely tampered with the use tax return. The numbers for this falsified sales tax return were derived by falsifying the system report to illustrate a lower amount of sales, which would ultimately calculate a lower amount of taxes due. Keeping with the April tax return example, the sales in the system report were lowered in order to calculate only $33,700 of sales taxes due and $2,000 of use tax due. The difference in total taxes due between the original system report and the falsified system report equals $24,600, the amount of the second check requested by Dina.
After she received the two checks requested from accounts payable, Dina attached the falsified system report with lower reported sales to the falsified sales tax return and the actual use tax return, included the check for $35,700, and mailed it to the State of Kansas.
She then intercepted the check for $24,600.
In February, Dina did not mail the January tax returns and checks to the State of Kansas.
She simply intercepted the checks. Subsequently, in March, she requested an additional check, under the guise of an unclaimed property filing, and used this to pay for the January and February returns together.
For the March returns, Dina presented the same sales tax return as backup to both the tax director and the tax manager, on separate occasions, and each person authorized a check request for the return. She mailed the first check with the return and intercepted the second check.
Another manipulation involved the April and May returns of the following year. The tax director reviewed the April sales tax return, which showed tax due of $82,200, and the use tax return, showing tax due of $1,005. He signed both of the returns and the check requests, ensuring that the individual checks requested matched each return. Dina did not mail either of the April returns or the checks to the State of Kansas. Instead, she intercepted both of them.
The following month, Dina prepared the May returns and submitted them to the tax director for approval. The returns signed by him showed sales tax due of $57,100 and use tax due of $1,300. Again, the tax director ensured that the individual check requests

Wells4689_c25_1

05/31/2007

239

lessons learned

239

matched each of the returns. Dina also failed to mail the May returns to the Kansas
Department of Revenue.
Instead, she created falsified sales tax returns for April and May in the amounts of
$28,495 and $26,300. These, along with the original April and May use tax returns and the
May check of $57,100, were submitted to the Kansas Department of Revenue. Both of the falsified sales tax returns contained a forged/photocopied representation of the tax director’s signature.
The most unbelievable aspect of this part of the story is that we were able to understand all of these methods Dina employed to cover the fraud because she was kind enough to leave the original and falsified system reports and tax returns in Safe Protect’s files.
There was just one unanswered question: Where was Dina Sanchez now? We found information suggesting that Dina and her family were now in Barcelona, Spain. With the perpetrator living outside of the United States, an arrest would certainly be more difficult.
Regardless, I completed a report containing the details of the investigation, the facts uncovered, and the evidence gathered. I also put together a timeline of the events that occurred during the fraud. I shared my report with local Miami police and the Secret
Service, walking them through information. Robert Murphy, a Miami detective, was so impressed that he offered me a job with his department! We hope that Dina will one day be caught and punished.

Lessons Learned
The most obvious internal control breakdown that enabled Dina to launch her scheme was in the maintenance and control of the vendor master file. The company did not have a process in place to approve changes being made to the file. I wondered why the accounts payable clerk never questioned Dina’s change requests.
When I found out that Dina was able to manipulate numbers in the system’s sales tax reports, I couldn’t believe there wasn’t a control in place to prohibit modification. Luckily, after talking with someone in the information technology department, I learned they had the capability of implementing this type of control.
Through her scheming and manipulation of tax returns, Dina had been late in mailing payments to the State of Kansas on at least two occasions. Because of the lack of a centralized process for the receipt and tracking of the tax department mail, she was able to get her hands on the late-payment notices before anyone ever knew they existed. Out of the kindness of her heart, and to keep her scheme going without raising suspicion, she paid these late payment fees out of her own pocket. Of course, it was with the money she had embezzled from the company.
I found some holes in the company’s control over making payments to state tax departments. While check requests (for payment to a vendor) appeared to be properly approved, there was no process to review payments in the aggregate on a weekly or monthly basis. For example, the tax director would approve Dina’s check request on one day. A few days later he approved a second check request in the same amount for the same

Wells4689_c25_1

240

05/31/2007

240

chapter 25

where in the world is dina sanchez?

tax return. Had someone been responsible for a week or month’s worth of check requests or payments, he or she could have caught the duplicates. Further, there was no system in place to ensure that all checks were accounted for and mailed to the appropriate vendor.
Throughout the investigation, I remember feeling bothered by the fact that Dina was a temporary employee at the time she defrauded the company. I naturally assumed temps would have little access to the company’s assets. But I uncovered these facts:


Signed contracts were not in place with JobMart, the temporary staffing firm providing services to the company.



There was no policy requiring JobMart to conduct and furnish background checks.



Temporary employees had physical access to cash and checks.



There was no policy regarding the length of time a person could work as a temporary employee. 

There were not adequate limitations on a temporary employee’s access to the company’s systems.

Recommendations to Prevent
Future Occurrences
Vendor Master File
All change requests to the vendor master file should be documented and approved by a supervisor prior to entry into records.
Safe Protect System
A system control was put in place. In addition, those that are exported into another program should not be able to be manipulated.
Payment Process—Tax Department
A complete listing of approved check requests and disbursements should be reviewed on a weekly and monthly basis by the tax director, who looks for unusual items, duplications, and split payments. In order to ensure the safeguarding of company funds, state tax departments are now paid via wire. For any state unable to accept wire payment, the supporting tax returns should be sent to the accounts payable shared service center, where they are matched to the checks and mailed directly to the appropriate state.
Mail Receipt and Tracking
The tax department assistant is now responsible for opening all of the mail, inputting the receipt of any notices received from state tax departments, and ensuring distribution to the

Wells4689_c25_1

05/31/2007

241

recommendations to prevent future occurrences

241

appropriate individuals. The tax director monitors the list of notices received from state tax departments to ensure timely resolution and reconciliation of the items.

Briana J. Paciorek, CFE, is a manager in the Fraud & Forensic Services practice at
Solomon Edwards Group, LLC, in Philadelphia, Pennsylvania. Her group specializes in providing fraud investigation, detection, and prevention services to clients. Ms.
Paciorek is a graduate of Babson College and has seven years of experience in external, internal, and forensic audits.

Wells4689_c26_1

05/31/2007

242

chapter

26

&
School of Fraud
NESSAN RONAN

oger Kaunda lived life in the fast lane. Tall and imposing, he had a well-deserved reputation for being a ladies’ man. Roger was about 35 years old when I met him.
He had a degree in public administration and worked as an administrative officer for the specialized accountancy college in the South African country of Lesotho. Before working there, he was a teller with one of the country’s major banks.
Roger was well liked as the administrative officer. The staff especially appreciated his willingness to recommend that the college repaint their houses. There was no doubt that he had great interpersonal skills. Roger knew the best person to contact when there was a problem or a difficult job to be completed. He had an excellent relationship with the director of the college, who relied heavily on him to keep the wheels moving.
Roger was married with two young children. His wife, Gladys, was a secretary in the same bank where Roger once worked. Rumor had it that she was not very happy in the marriage. Whenever Gladys would complain about the excessive time he spent away from home, he would retort, ‘‘I gave you two babies, what more do you want?’’
Some of his colleagues often remarked that Roger seemed to neglect his wife and children. He was fond of taking weekend trips with one of his many girlfriends. He was known to take plane trips to South Africa to visit one mistress in particular.
Roger was a great believer in the powers of the witch doctor. His friends thought that he was able to engage in risky behavior due to his belief in traditional medicine. His remedy was to get medicine from the witch doctor if he had a work or domestic problem. He believed that all he had to do in order to harm someone he didn’t like was to buy the appropriate medicine. Roger would laugh heartily when boasting about the latest concoction that he had acquired. He told everyone that he had the most powerful witch doctor in the mountains.
I never saw Roger in a bad mood. He seemed to go through life with childlike optimism. He was always on the move, trying to solve some problem or sort out some human relations issues. One day I remarked to a colleague, ‘‘I hope you realize the great job
Roger is doing for all of us.’’ My colleague readily agreed with my assessment of Roger.
The College of Accountancy was established in 1980 with financial assistance from the
World Bank. Its specific purpose was to train professional accountants for both the public

R

242

Wells4689_c26_1

05/31/2007

243

the letter

243

and private sectors. Most of central and southern Africa at that time was emerging from colonialism and was making serious strides in developing its professional cadre.
The college also received significant technical assistance from the United Nations
Development Programme (UNDP), the International Labour Organization (ILO), and the governments of Britain and the United States. As a result, the national government was very eager for the college to be a success. The technical help meant that international staff could be recruited to work alongside their national counterparts, who came from the
United States, England, Scotland, Australia, and Ireland.
The college had two campuses at that time, one in the political capital and the other in the commercial capital. It had about 2,000 students enrolled in accountancy, banking, and financial management classes. Most were graduate students studying commerce and economics. Because the country was ruled under British power until 1964, all of the courses offered at the college focused on internationalization. These students were trained for British professional accountancy qualifications; specifically, they were prepared to become involved in the Chartered Association of Certified Accountants and the
Chartered Institute of Management Accountants. The banking courses were offered by the Chartered Institute of Bankers in the United Kingdom. The financial management course was also UK-based.
When I arrived at the college as ILO Chief Technical Adviser in Accountancy, the institution was beginning a second phase of technical assistance. The first phase had by all accounts been a complete failure. During a period of 10 years, not one professional accountant had been produced. The image was so bad that the firms in the country had decided to establish their own college of accountancy. Both international and bilateral donors were extremely concerned with the clear lack of progress. It’s fair to say that they agreed to a second phase of assistance only very reluctantly.
Many explanations were offered for the lack of academic success, ranging from poor students to lecturers not committed to their work. There was also a strong suspicion that the director of the college lacked leadership and strategic skills. In reality, all of these reasons were true. The tragedy was that the lack of success was hampering the economic development of the country, the poorest in Africa. There was only one qualified accountant in the entire government. Among the chartered accountancy firms, all the partners were expatriates. In the private sector, there were about 20 qualified accountants.
It was urgent to increase the supply of accountants in a nation that screamed for development and the alleviation of poverty. This was the only public sector college of accountancy in the country, which meant that both the national government and the international donors were anxious for the college to start producing qualified professional accountants. The Letter
About six months after arriving at the college from Ireland, I was required to take over the directorship of the college. About a month into the new post, I was faced with the

Wells4689_c26_1

244

05/31/2007

244

chapter 26

school of fraud

biggest challenge of my career. I remember the day well. It was a Tuesday, one of those beautiful African mornings with blessed sunshine and only a hint of breeze. I looked out my office window and stood for a minute admiring the jacaranda trees waving gently in the wind.
After taking in the inspirational sight of the trees in full bloom, my secretary, Leomile, brought me the morning mail. One of the letters was unusually addressed to ‘‘The ELO man.’’ I laughed, realizing that they meant ‘‘The ILO man.’’ I can resist everything except curiosity, so I decided to open the letter immediately. It consisted of one page torn out of a child’s notebook. I must have read it 20 times. It completely bewildered me. Here I was in the middle of a foreign country with very little knowledge of anything African, and I was confronted with what seemed like a very sensitive issue. The letter, written in pencil, stated: Mr. ELO man, be warned. Your administrative officer is robbing the college. You don’t know him but be warned. He will come to a bad end. He is involved in a lot of things.
Don’t ignore this.

The letter was not signed. I wondered if the sender was playing a practical joke on me.
What credence should I give to an anonymous letter?
As I was pondering my next move, I remembered my experience in Ireland when I worked as an accountant. I had discovered two frauds as the result of tip-offs. With this in mind, I could not ignore the letter, but at the same time, I wondered how the authorities would react to my suspicions. After all, I was a Caucasian expatriate in a country that had only recently won its independence from white rule. If this had happened in Ireland, I would have no problem deciding what to do. However, I realized that if I did nothing (and that would have been easy), it might come back to haunt me later. I looked back out onto the peaceful jacaranda trees and thought long and hard about my decision for the rest of the day. Check-Happy
I decided that before taking any action that I would consult my friend, Marty, who had been working in the country for about two years. He had a strong appreciation of the culture and knew the local language. As soon as we met that day, Marty could see that I was very agitated about something. After I briefly described the situation to him, he scratched his head and warned me to be very careful. His main piece of advice was that I should work through the ‘‘national’’ employees.
I wanted to proceed carefully because I was suspicious of Happy Banda, the college’s accountant, and felt that he might be working in collusion with the administrative assistant, Roger, in a possible fraud. Happy was a small, middle-age man with a goatee. He was single and had a reputation for carrying a good supply of condoms in his briefcase, often boasting about his conquests. He had been with the college for about five years and had a relaxed style of management.

Wells4689_c26_1

05/31/2007

245

check-happy

245

The college had recently hired an assistant accountant due to the increase in the workload. David Mtonga was in his mid-20s, married with a young daughter. He had recently completed his technician accountant qualification. He was a quiet, introverted person with a serious outlook on life.
I decided that I would engage the assistance of David to carry out a preliminary forensic audit. I called David to my office and explained my concerns to him. I arranged to meet him at his house, and I put him on notice that the information was most confidential. If the two officers got any hint that we were investigating fraud, they would likely destroy the evidence.
David lived in a township within the suburbs of the college. I greeted him and his wife and then fully briefed him about my suspicions. We worked out a strategy to carry out a preliminary forensic audit. We would conduct the investigation after hours in order to avoid controversy. We agreed not to waste any time and to start the investigation the following evening.
We spent every evening for two weeks sifting through the latest purchase orders and invoices. The evidence was shocking. In our view, fraud was clearly visible from the financial records. We compiled a preliminary report, and I then called the permanent secretary in the Ministry of Education and explained that we had established what appeared to be a prima facie case of fraudulent activity at the college.
I recommended that he request two internal auditors from the office of the auditor general to assist us. Internal auditors in the office of the auditor general have extensive powers. They may go into premises and demand access to documents and compel testimony from people. They also have the powers of arrest. The permanent secretary took my advice. I decided to wait for the internal auditors and not to pursue the investigation on my own. About a month later, they arrived at the college.
The two auditors investigated the purchase of supplies, the rendering of services, and the operation of the transport system. The rendering of services appeared a prime candidate for fraud. The auditors discovered that Roger would issue a purchase order to a painting contractor who was hired to paint a staff member’s house. The college would be invoiced with the cost and Roger would approve it for payment. Happy would write a check for the invoice and pass it to the principal for signing. Then the check would be taken to Roger, who would take it to the painting contractor. The problem was that
Roger, Happy, and the painting contractor had conspired to defraud the college. In fact, no houses were painted and all the payments were fraudulent. The three conspirators shared the proceeds of their scam, which the auditors estimated to be about $50,000.
The next area of investigation was in the purchase of supplies. Some invoices were selected for scrutiny; there was no record of supplies having been received for many of them. The auditors visited the suppliers and found that a considerable number of the invoices were false. Although it wasn’t clear if the suppliers were involved in defrauding the college, certainly the invoices didn’t represent supplies.
We estimated that these fraudulent invoices amounted to about $40,000. Moreover, we determined that the accountant was in the practice of forging the college principal’s signature. The second signature on the check belonged to an academic, who was

Wells4689_c26_1

246

05/31/2007

246

chapter 26

school of fraud

apparently in the habit of relying on the principal’s signature and didn’t bother to check the supporting documentation.
The third and final area of the investigation dealt with the operation of the transport system. The college had about 10 motor vehicles, and the purchase of fuel was a major activity. Again, the auditors found massive fraud. The administrative officer would approve invoices and receive checks for gasoline that was never purchased. Since Roger controlled the transport system, no checks and balances were in operation. This fraud cost the college about $30,000. In total, the two officers defrauded the college of about $120,000.

Triple Threat
One of the auditors entered my office at noon one day. He told me that he had obtained all of the fraud-related evidence and was going to challenge the two suspects. He casually remarked that the accountant, in addition to forging the principal’s signature on the illegitimate checks, had also tried to forge my signature. It was one surprise after another.
Just two days prior, I had been threatened by Roger. He said that he was going to complain about me to the president of the country and ask that I be deported. I informed the auditors of this threat and they went to the secretary, who briefed the president on the matter.
Roger also said that he was going to poison me. So the auditors warned me not to go to the canteen during the investigation.
One day things came to a climax. I had a visit from one of the auditors, who told me that
Roger had threatened my sons. I reported this incident to the police, and they quickly drove up to the college to escort Roger and Happy to the police station in handcuffs. There they were interrogated and charged with fraud.
Although I was relieved that the two officers had been removed from the college, I still had many reservations. Would the evidence be sufficient in a court of law? Would the evidence be ‘‘lost,’’ and would these two men be found not guilty? Worst of all, the college might reemploy the men. As the alleged frauds had taken place over a period of six years and the college had the same public auditors during the entire period, I decided to visit the senior partner in the audit firm.
Before my visit, I made sure not to state my reason for making the appointment. I was shown into the plush boardroom of the firm and invited to pour myself a soft drink. Very soon the senior partner arrived and greeted me warmly. I told him briefly what we had discovered regarding the fraud at the college. The partner nodded and said, ‘‘Yes, I am very sure there is fraud going on there.’’ This came as a surprise to me. If he believed that fraud was going on, why had the auditors not taken any specific steps to report it when carrying out the audits?
I decided to also visit the chairman of the college’s finance committee. He was the chief accountant of a large multinational company. Unlike the audit partner, he didn’t suspect that fraud was taking place. He agreed that we should allow the law to take its course. But he suggested that we should request that the public auditors to provide us with a report on their observations on the fraud. In particular, we wanted to know why the public auditors had not discovered these frauds during the course of their audits over a period of six years.

Wells4689_c26_1

05/31/2007

247

when the end doesn’t justify the means

247

When the End Doesn’t Justify the Means
Finally, Roger and Happy were officially suspended from their posts at the college. The government auditors filed a detailed 100-page report on what they had discovered. I sent a copy to the Ministry of Education and convened a meeting of the College Board.
Our lawyers were briefed on the matter and given a copy of the auditors’ report. I also filed a report outlining the circumstances that led us to suspect fraud in the first place.
Roger and Happy were brought before a magistrate’s court. They pleaded not guilty to all counts of fraud and theft and were released on bail on their own sureties.
In the meantime, the public auditors responded to our request for an explanation of why they had not discovered the fraud. The auditors stated that their procedures were designed, among other things, to uncover fraud if it exists. But they pointed out that the discovery of fraud is not one of their functions. This is the responsibility of management.
They also emphasized that considering the annual expenditure of the college over six years, the amount of loss due to the fraud was not material. While the auditors may have been technically correct, some of us in management felt that they were not giving sufficient weight to the $120,000 that had been stolen as well as severe disruption to the functioning of the college. There was also the issue that the discovery of the fraud caused trauma to staff members and led to a lower morale. All in all, we weren’t impressed with the manner in which the auditors dealt with the fraud and, in particular, their attempt to hide behind the technicality of ‘‘materiality.’’
The college requested that the government auditors establish if there was collusion between the suppliers and the suspended officers. We also asked them to investigate whether the principal of the college, who was on study leave during this time, was in any way implicated in the fraud. In the case of the suppliers, the auditors were unable to establish a link which would stand up in court. But there was a strong suspicion that they must have had some involvement. Otherwise, it is difficult to see how the officers could have obtained the false invoices.
In the case of the principal, the auditors were satisfied that he was not involved in the fraud. But they did remark that he was certainly negligent for not ensuring that proper accounting controls were in place. It seems that he failed to exercise proper supervision over the work of the accountant and the administrative officer, both of whom reported directly to him.
When the officers’ case came before the courts, Happy was found to have fled the country and was working as a salesman in a neighboring country. Roger turned up for his court hearing, but when the case was tried, we found that most of the evidence was missing. Due to the fact that he was the nephew of the minister of education, his case was dismissed. Happy was subsequently shot dead in the neighboring country by bandits who robbed him for the large sum of money he boasted about carrying.
Some time later I saw Roger crossing the road in the town where the college was located. He was shabbily dressed and noticeably thinner. His suave appearance and confident smile had disappeared. His wife had left him, and he was unable to get another

Wells4689_c26_1

248

05/31/2007

248

chapter 26

school of fraud

job. In some ways I couldn’t help feeling sorry for him. I wondered if he would have taken the path to fraud if he had a chance to do it all over again.

Lessons Learned
The first lesson I learned was that investigating fraud in a Third World country is very different from carrying out such an investigation in a developed nation. It seemed to me that there was a greater tolerance of fraud and corruption in Africa. Even the public auditors seemed to accept that fraud was taking place in the college. I was surprised by the fact that Roger wanted to poison me. He didn’t seem to realize that the investigation would go on irrespective of whether I was there or not. I learned that it is crucial to have a sufficient knowledge of the country or region’s culture where one is conducting an investigation, to ensure that all precautions are taken to safeguard oneself and one’s family.
It’s important that a thorough investigation be carried out before any administrative action is taken. Looking back, I can see that if I had suspended the two officers before we found the evidence, they might have launched a legal action for unfair dismissal. This would have distracted us from our task of collecting evidence.
Carrying out a lifestyle analysis on one of the officers assisted in pointing us in the right direction. I have come to believe that fraud is committed by two groups of people: those in need and those with greed. Roger combined both motives to sustain his extramarital affairs.
I think it is fair to observe that an organization shouldn’t rely on its public auditors alone to discover fraud. The public auditors in this case have firmly rejected any attempts to hold them responsible for discovering the fraud. It is management’s responsibility, they claim, to ensure that controls are in place to prevent and detect fraud.
An investigator may do a tremendous job in uncovering fraud and may compile a solid file of evidence, but it’s worthless if the legal system doesn’t support the process. It’s not sufficient that fraud examiners do their work properly; they must also able to rely on a legal system that is efficient, transparent, and not corrupted by either political or financial influence.
The two fraudsters grew confident over the six years they had been perpetrating their financial crimes. It helped them that the same principal was employed during the entire time. They had studied his methods and knew how to outfox him. They also knew how to forge his signature. They came to recognize that the internal controls he exercised were designed to send a warning to employees, but they were not strong enough to prevent them from committing fraud.
Roger, who was clearly the leader in the fraudulent activities, worked himself into a corner with his extramarital affairs, which required more and more funds to sustain.
Clearly he was living beyond his means, and he exploited the weak financial controls of the college to fund a style of living that he had become accustomed to. It’s likely that he would have continued stealing from the college if he had not been discovered. There was a pattern to his frauds. He became more daring in his actions and steadily increased the amount of money he was stealing. Clearly the more frauds he was getting away with, the more confident he became and the more risks he took.

Wells4689_c26_1

05/31/2007

249

recommendations to prevent future occurrences

249

It became clear during the investigation that some of the staff members at the college knew about the fraudulent activities that were going on, but they decided to stay silent. It’s difficult to fault them, given the hostile environment that existed for whistle-blowers.

Recommendations to Prevent
Future Occurrences
Implement Strict Internal Controls
A strict system of internal controls is of paramount importance to prevent fraud in any organization. There should be clear division of labor in order to prevent one person from doing a number of different jobs, especially where it involves disbursement of funds. An important dimension of the system should be the rotation of staff, if feasible.
Mandatory Vacations and Time Off
Both the administrative officer and the accountant in this case had been at their respective posts for a considerable period of time without taking any mandatory vacations. In order to ensure that an organization can test the effectiveness of its internal control system, employees should be required to take mandatory vacations and time off. During the periods when the staff is away, take the opportunity to test the system of internal control and review a sample to make sure that everything is in order. Senior management should take an interest in the operations of the internal control system. They should arrange for random checks to be carried out on the accounting records. In this case the most senior manager, the principal, didn’t provide proper oversight of the work of his immediate staff.
This resulted in an exploitation of the obvious weaknesses in the system.
Conduct Lifestyle Analyses
I would recommend that internal auditors and senior management conduct lifestyle analysis to identify possible fraudulent activities. Also, it is clear that some staff know when fraud is taking place, even though they have no involvement in it. Staff should be encouraged to report their well-grounded suspicions to management. At the same time, management should ensure that whistle-blowers are protected from adverse consequences when they do report their suspicions.
Set an Ethical Tone at the Top
A code of ethics that is concise and coherent should be disseminated to all staff members to minimize the incidences of fraud. Top management should make it known that the prevention of fraud is everyone’s business. Good governance principles need to be announced, and employees should be made aware that their organization is serious about

Wells4689_c26_1

250

05/31/2007

250

chapter 26

school of fraud

fraud prevention. Top management should lead by example and observe the highest ethical and managerial standards. The board of the organization needs to put governance on the agenda and make it clear that observing good financial governance is a cornerstone of the management of the organization. There must be zero tolerance for fraud and corruption and no ambiguity about the issue.

Nessan Ronan is a professor of accountancy at the National University of Lesotho. He has extensive experience in accountancy theory and has worked for over 40 years for organizations in Europe and Africa. In teaching, research, and consultancy, Mr. Ronan specializes in forensic accounting and corporate governance.

Wells4689_c27_1

05/31/2007

251

chapter

27

&
Price Check on Register One
DWIGHT TAYLOR

lifton and Holly Harmon had been married for 14 years. They grew up in a small town and knew each other for most of their lives. Like many people, they struggled to raise their three children and meet the monthly bills with their paychecks from the local chicken packing plant. There wasn’t much work around Cherokee, Iowa, and what there was didn’t pay well.
They decided to pack up the family and move about three hours south to Des Moines for higher-paying jobs and an opportunity to improve their lives. They found an apartment in Grimes, a small town about 10 miles outside of town. After they enrolled the kids in school, Clifton landed a job in a food processing plant. The pay was better than he had been making in Cherokee, but it still fell short of what was necessary to support the family. Holly had held many different positions over the years, but she lacked specialized skills.
She didn’t want to go back to work but knew that it would take two paychecks to pay the rent. After working in the packing plant in Cherokee, Holly swore that she would never go back into a factory. She was thrilled when she was hired as a cashier at a large national superstore. Cathy Lester, one of Holly’s best friends, had moved to Des Moines about a year earlier and had encouraged Holly to do the same. Cathy was a single mother of two who, like
Holly, had grown up in Cherokee. She married young and had her first child soon after.
The second came along a year later—about the same time her husband decided he didn’t want to be married. Cathy worked as an office assistant, and although she was still struggling to make ends meet, she was better off than if she had stayed in Cherokee.
Shelly North was Holly’s sister. She was divorced with three kids, and also struggled to pay her bills. But unlike her sister, Shelly was satisfied with living in a small town. She had other family members around, and it was a safe place for the kids. Shelly rented a modest house in Cherokee and was doing fine until health problems forced her to quit her job.
Child support payments from her ex-husband were not always on time, and sometimes didn’t come at all, so she relied on government assistance.
Amelia Leach was born in California, but her family moved to Cherokee when she was a child. Even though she grew up in Iowa, she always wanted to see the world. So it was not

C

251

Wells4689_c27_1

252

05/31/2007

252

chapter 27

price check on register one

surprising to anyone when just after high school she left Cherokee to seek her fortune.
Amelia was a bright, attractive young woman. She had a magnetic personality and the potential to be successful in life. But a combination of growing up too fast, associating with the wrong people, and taking shortcuts led her to trouble. She was first arrested in
Colorado for forgery at age 20. That was followed by three more arrests within a year. Over the next two decades, Amelia would find herself in and out of jail, in and out of marriage, and finally back to Iowa.
But she was always on the lookout for the easiest way to make a buck. The fact that she always got caught didn’t stop her from believing that her next scam would be the one to put her over the top.

Caught on Camera
Thanksgiving had just come and gone, and I was gearing up for what I expected to be an active holiday season. I am a 20-year veteran in law enforcement and had been doing fraud and forgery investigation for the past 4 years. Since I am the only fraud detective in my department, my desk is constantly overloaded with paperwork. I usually have between 20 and 30 active cases, and sometimes as many as 50. With Christmas approaching and the stores filled with shoppers, there was more opportunity and motivation for fraud to occur.
I am also a questioned-document examiner. When I received a call from Chris
Lawrence, the loss prevention supervisor at a large national chain store, I was about one month into my studies to receive a Certified Fraud Examiner (CFE) certification. Chris told me that he suspected an employee had been involved in stealing merchandise.
This was not the first time that I had been contacted by the store. In the past, there had been numerous forged checks or stolen credit cards and the occasional employee caught taking a few bucks out of the till. The place was equipped with a state-of-the-art surveillance system, so if Chris had any of the larceny on camera, I was confident that I would have no problem identifying the culprit.
When I arrived at the store, I met Chris Lawrence in the security area. In the office are dozens of monitors where Chris and his staff are able to watch each cash register, aisle, entrance and exit door, as well as the parking lot. All of the equipment is digital, and each color monitor has high-definition resolution. The cameras can zoom in close enough to see pictures on the driver’s licenses that are presented to the checkout clerks. Video was kept for at least 90 days and could be accessed with the touch of a button.
Chris told me that he had footage of one of their employees scanning numerous items through the cash register checkout with false UPC labels, stickers with bar codes for pricing. He then showed me surveillance tape of a checkout lane during a recent twoweek period. On this tape were 22 suspicious transactions that Chris had documented involving Holly Harmon operating the cash register when three other females and a male subject brought items to her. One can clearly identify the items being scanned in the video, but when the cash register transaction log is reviewed, different items show up—items that

Wells4689_c27_1

05/31/2007

253

the bill comes due

253

ring up at a much lower cost. For example, Holly is shown scanning a clock radio, but the transaction log indicated that it was a bar of soap. It was clear that the items being scanned had UPC labels on them that were not ringing up at the proper amount. Chris also showed me several other times when Holly would scan at the regular cost, but then turn around and void out that item from the cash register. Every time, she would leave the item in the cart and allow the individual to leave with it.
As I watched the video, it was apparent that there was one particular woman who was very active in this scheme. She was shown numerous times going through the checkout lane, and Chris had shots of her leaving the store with many items. It was clear from the footage that Holly and this other woman were very comfortable with each other. They worked with the ease and speed of two people who knew exactly what they were doing.
This was obvious because as Holly was ringing merchandise out, the other woman would be placing those items in bags and putting them in her cart. Once the transaction was complete, this woman would take the receipt from Holly and quickly leave.
There were also two other unidentified women and a man who were seen performing the same transactions with Holly. Chris was able to provide me with a shot of the front license plate of the vehicle driven by the male suspect—as I said, these cameras were good.
I asked Chris how he found out about Holly’s actions. He said that she had been scheduled to work but failed to come in without telling her supervisor. It is store policy for the security department to perform a review of recent activity when an employee just doesn’t show up. As his staff began examining the transaction logs of Holly’s register, they noticed many items being scanned at the same price. That’s when they searched the videotape and started to suspect that false UPC labels were being used. Chris then had his staff look at all of Holly’s activity since she began working for the store. They discovered that within just a few days of being trained and put on a cash register, she began stealing.
I went back to my station and ran a check of the plate of the vehicle. It was registered to
Clifton Harmon, Holly’s husband. I ran a driver’s license photo of Clifton Harmon and identified him as the male subject on the videotape.
I contacted Chris and asked him to compile an itemized list of all of the fraudulent transactions and a dollar amount of the merchandise, which I would need for charging purposes. However, I knew after watching the video that we would not be able to recover everything because not all of the items could be identified from the tape. Some were placed in other containers and just removed from the store. Several times the suspects were seen loading suitcases or large plastic containers onto the checkout register’s conveyor belt. If those items were empty, the suspects could have moved them with little effort, but on the tape, it was clear that they were expending an enormous amount of energy to lift them onto the belt.

The Bill Comes Due
As Chris put together the video and compiled a list of transactions, I began an investigation of Holly and her husband. A criminal history check showed that they had both been

Wells4689_c27_1

254

05/31/2007

254

chapter 27

price check on register one

arrested for forgery, and Clifton had a previous theft charge. Now I needed to learn the identities of the other three women. Since no one at the store could tell me, there was only one choice—to contact Holly.
The Harmons’ rented apartment was located about five miles from the store. Since I didn’t know who might be at the residence, I took Detective Dan Stein with me. The complex where they lived consisted of several two-story buildings. Holly and Clifton lived on the ground floor, at the end of one of the buildings. I had to knock several times before
Holly answered the door. When she did, I identified Dan and myself as a police officers and asked if we could step inside and speak with her. Holly escorted us in to her living room.
The apartment was small and dimly lit. In the corner was a Christmas tree with giftwrapped presents around the base, stacked two and three high.
As I began the interview, I asked Holly if she had worked for the store. She said that she had but that she had recently quit. When I asked why, she said that the hours she was working did not fit with her family life. I then let her know that I was investigating a report from her former employer about merchandise that had been sold at below-retail prices. It was obvious that this made Holly nervous. She shifted in her chair and would not maintain eye contact with me. I continued by telling her that I had videotape of her operating the cash register when these particular sales were made. I immediately saw a dramatic change in her physical appearance. Her eyes became dilated, her jaw muscles tightened, and she had trouble swallowing.
I then took out still pictures I had made from the video and laid them on the coffee table in front of her. As she looked at them, I could not help but wonder about the thoughts running through her head. I then pointed to the first picture, which showed the woman who had been the most active in this scheme. I asked Holly who that person was. She answered in a soft voice, and without making eye contact: ‘‘I don’t know.’’ Each time I showed one of the other women and asked her who they were, she repeated the same answer. It was not until I pointed to the male subject that she finally looked up at me and said, ‘‘That’s my husband.’’
I told Holly that I suspected that she knew who the other three women were and that I also felt that she was involved in the theft of this merchandise. I advised her that she was not under arrest, she did not have to answer any of my questions, and she could consult an attorney if she wished. She no longer wanted to speak to me and asked me to leave her apartment. As soon as Dan and I left, I contacted two other detectives from my department, and asked them to meet with me. When Tim Pettit and George Griffith arrived, I advised them of the situation involving the Harmons and told them that I was going back to the station to get a search warrant for their apartment to look for stolen merchandise. I asked them to watch the apartment and make sure that the Harmons didn’t try to remove anything.
Just as I arrived back at the police station, I received a call from Detective Pettit. He said Holly had just taken some of the gift-wrapped presents from her place to the apartment next door. It certainly appeared that she was attempting to hide evidence.

Wells4689_c27_1

05/31/2007

255

the bill comes due

255

Because of the exigent circumstances, and not knowing who lived in the apartment where Holly was taking the items, I told Pettit to secure her apartment until I could get the search warrant approved.
As I continued to work on the warrant, I received another call from Pettit. He advised me that he was inside the Harmons’ apartment and that both Holly and Clifton were now more cooperative. They told him they would be willing to come to the station to speak with me. I advised Pettit that I was going to continue writing the search warrant, but to go ahead and bring them in. It was not long before Holly and Clifton arrived.
While Clifton waited at the front desk, I took Holly to the interview room to begin questioning her and set up the video camera to record the session. I advised her of her rights and asked if she would be willing to speak with me. I then gave her the Miranda waiver form to sign. Her attitude was similar to what she exhibited in the apartment. She would not make eye contact with me, and in a very low-toned voice she said that before talking with me, she wanted to speak with an attorney. Why she didn’t say that before I brought her into the interview room is unknown. It could be that once she sat down in the interview room, the reality of her situation sank in. But for whatever reason, once she told me she wanted a lawyer, the interview was over. I took her back to the lobby of the police station.
I then asked Clifton to come with me. I made sure not to allow any time for the two of them to speak to one another as they passed in the hall. When we got into the interview room and sat down, the only things on the table in front of him were the Miranda rights form and the stack of still shots I had from the video. I made sure that the picture on top of the stack was the one I had of him coming out of the store with some of the merchandise, and I also made sure it was in a position where he could easily see it.
Just as I did with Holly, I read Clifton his Miranda rights and asked if he understood them, and if he was willing to speak to me. Clifton hesitated to answer at first. He asked me what his wife had said. I told Clifton that Holly said she wanted to speak with an attorney before talking with me. I explained that he and Holly had every right to have an attorney present, but that did not change what had happened at the store. Regardless of whether they spoke to me, I was going to locate that merchandise.
‘‘Clifton, it is time that you step up and take responsibility for your part in the theft, if for no other reason than to show that you have some remorse for what happened, and because it’s the right thing to do,’’ I said. I made it clear to him that the whole scheme would eventually be uncovered and that the more he cooperated, the faster things would go, and the sooner he would be able to start to put this behind him.
This was a critical juncture in the interview. If Clifton did not sign the waiver and agree to talk to me, it would be much harder to identify the other suspects. That additional time would give each of the other participants the opportunity to dispose of the evidence and make prosecution more difficult. At that point I just laid my pen on the waiver form and slid it over in front of Clifton. Without staring too hard at him, but still watching his reactions, I just sat there without saying anything else; I let him think about what I just said. This is sometimes the hardest part for young officers to do in

Wells4689_c27_1

256

05/31/2007

256

chapter 27

price check on register one

order to get a confession. They are so anxious for a response that they don’t allow suspects to ponder what they’ve been asked to do. Rookies often only let a few seconds of silence pass before they jump back in with more coaxing or more rehashing of information. Once you have laid out the foundation to suspects and you’ve asked them a question, let them make the next move. In this case, I could tell from Clifton’s body language that he knew I had enough information to involve him in the scheme, and I just felt that he wanted to clear the air, so I let him sit and stare at the pen until finally he picked it up and signed the form. As soon as he did, his whole demeanor changed. It was as if someone took a weight off his shoulders. I actually saw a smile come across his face, and I knew that he would give me what I needed.
I started by confronting Clifton with the information I had received from the store. I showed him all of the still shots from the video and the cash register printouts of the transactions. I told him I knew that UPC labels had been changed in order to ring up the merchandise below its actual price. I gave him enough facts so that he understood that I knew everything about what had happened and how the scheme worked. Now Clifton had no reason to hold anything back. All I had to do was show him the pictures from the video, and one by one, he identified the three females seen on the tape.
The first person that Clifton identified was Amelia Leach, who was a friend of his wife’s. He said that Holly and Amelia came to know each other when they worked at the food plant in Cherokee. They talked on the phone a lot after Holly started working for the store. Amelia had also come to Des Moines several times to visit them. He said he felt that she was the one who concocted the scheme and that she talked Holly into participating. Clifton also identified the other two women as Shelly North, Holly’s sister, and Cathy
Lester, one of Holly’s closest friends. He told me that Shelly lived in Cherokee and Cathy lived in Grimes. As far as he knew, neither Shelly nor Cathy had ever been in trouble with the law. He also explained his participation in the scheme. On two separate occasions, he went to the store and had items that had false UPC labels taped to them placed into his shopping cart. He said that both times, Amelia had gone to the store with him. He had watched as she took UPC labels from her pocket (which she had previously taken from other items) and put those labels on the things that he wanted. He then took the merchandise to the checkout counter, had them scanned by Holly, and left the store with the merchandise. Clifton claimed that before going to the store for the first time, Holly compiled a list of things for him to get. He put most of the blame on Amelia as the instigator of this scheme. I asked Clifton if he knew where the merchandise was. He told me that some of it was at his house and the rest was at the homes of the other participants.
He said that he would go back with officers and retrieve all of the items that were in those two apartments.
After obtaining a written statement from Clifton, I contacted the county attorney, who authorized charges against Holly for theft. As Clifton went back to his apartment with the officers to retrieve the merchandise, I booked Holly and had her transported to the county jail. As it turned out, more than $4,200 in merchandise was found in the Harmon’s

Wells4689_c27_1

05/31/2007

257

wrapping up some gifts

257

apartment. But that was only a part of what was taken. I still needed his help in order to recover the other stolen goods.

Wrapping Up Some Gifts
Clifton wanted to cooperate. I had to take advantage of that and not allow too much time to pass before the other perpetrators could be contacted. I asked Clifton if he would be willing to call Cathy and try to convince her to admit to her part in the theft and turn over any of the merchandise she had. He said that he would do whatever I needed in order to get this cleared up.
After stationing officers outside her house, I had Clifton phone Cathy. He told her that the store had found out about the theft, and the police had video of her in the store. He let her know that Holly had been arrested and that all of the items they had in their apartment had been recovered; it would be in her best interest to cooperate.
Cathy consented to a search of her house, and all of the items she received in the scheme were recovered. Since she had children at home, Cathy was allowed to turn herself in the next day and was also charged with theft.
I knew that Amelia would be the most difficult of the entire group to get to cooperate, but since Clifton was still willing to help, and the approach we took with Cathy worked, we decided to try it again. Early the next morning, Detective Griffith and I drove three hours to Cherokee. After contacting the local police and getting one of their officers to accompany us, we drove to Amelia’s house and waited outside until Clifton called her. She was not as receptive as Cathy. Once Clifton explained the situation to her and told her
Holly had been arrested, she hung up on him.
After Clifton told me that Amelia was not going to cooperate, I decided to go ahead and make contact with her. I was a little surprised when after only a few knocks on the door,
Amelia answered. She was much friendlier than I thought she would be, and she invited us into her house. Once inside, she said that she knew why we were there and that she wanted to assist us. I have to tell you this startled me for a second. I explained that I had a warrant for her arrest and advised her of her rights. She immediately waived them and agreed to tell me what happened. She tried to put most of the blame for the planning of the scheme on Holly, but she admitted that she was a major player in putting false UPC labels on merchandise.
Soon we were going through her house and piling all kinds of things on the floor in her front room. By the time we were finished, there were so many items that we had to rent a trailer to haul everything back. It turned out that Amelia had more than $5,000 in merchandise.
We followed the same plan with Holly’s sister, Shelly. Clifton called her as we waited down the street. Shelly cooperated—she was crying when she opened the door. After being advised of her rights, she told us of her involvement in the theft. She then went around the house and brought everything she had stolen to us. The total of her theft was $1,500.
After all of the items were collected, we recovered more than $12,000 in merchandise and made five arrests. Clifton, Shelly, and Cathy were placed on probation and ordered to pay restitution for their parts in the scheme. Holly and Amelia were not so lucky. Since it

Wells4689_c27_1

258

05/31/2007

258

chapter 27

price check on register one

was obvious that they were the main planners of theft, they each received 10-year prison sentences in addition to orders of restitution.

Lessons Learned
We were lucky to recover the majority of the goods. The store had an excellent surveillance system. Without the videotaped evidence, it is extremely unlikely that things would have progressed as quickly and smoothly. It allowed us to identify the perpetrators, figure out the scheme, and identify most of the stolen merchandise.
It is good that the store has policies in place to check on employees who abruptly quit, but I wonder if they would have detected this scheme if Holly had not been so fast to leave.
What if she would have stopped switching UPC labels for a time and then submitted a twoweek notice? Would the store have been as diligent in going back over her cash register transactions? When I posed that question to Chris, he said he’s not sure if they would have caught it. After all, it was a very busy time of year.
I also learned that effective interview techniques can break a case wide open. Although
Holly refused to talk, my interview with Clifton turned the case. I laid out the evidence so that he knew I was aware of the scheme and his participation. I then waited for him to make the next move. He knew he was caught and that his best option was cooperation. Without his help, it would have taken much longer to track down the other suspects, and I have no doubt that we would have had a much more limited recovery of the merchandise.

Recommendations to Prevent
Future Occurrences
Background Checks
Holly had a previous criminal record. If the store had conducted a background check, it is unlikely it would have given her a position as a cashier.
Improved Monitoring
The store is in the process of redesigning its software to flag for unusual activity, such as numerous voided items from a single register. Also, the store will be more proactive in randomly reviewing register transactions logs and comparing them to the videotapes. Of course, no store can review every sale, but it can randomly select several transactions per day or per week to examine more thoroughly.
Increased Perception of Detection
The store should let its employees, particularly the cashiers, know that it is monitoring for unusual activity and that it selects transactions randomly for further scrutiny.

Wells4689_c27_1

05/31/2007

259

recommendations to prevent future occurrences

259

These measures will help, but I bet I’ll be back at the store again. There will always be people like Holly and Amelia who are on the lookout for that next scam to make a few quick bucks.

Dwight Taylor, CFE, DRE, is a detective who has been in law enforcement for two decades, a fraud and forgery investigator for five years, and a questioned document examiner for four. He is president of the DART Group, a firm that develops drug testing policies and training to aid companies in identifying fraudulent activity and drug use in the workplace.

Wells4689_c28_1

05/31/2007

260

chapter

28

&
The Sky Is the Limit
BRIAN E. BROWNING

r. Reginald Lear began his administrative career in higher education as the president of a small northern college. After eight years, he moved to Kentucky to take another job as a university president. There he was hailed for his vision and strong leadership. He increased the endowment from $183 million to more than $400 million.
Following an extensive search, Dr. Lear was selected as the next president of Hardwell
University. The school offered him a compensation package that ranked highly for college presidents, exceeding $700,000.
‘‘We’ve got to commit ourselves to giving the state the very best university it can afford.
That’s the philosophy that I’ll bring to this challenging position,’’ he said upon his appointment. Unfortunately, Dr. Lear’s idea of affording the very best was not what anyone had in mind.

D

Old School
Hardwell University is a well-established college with over two centuries of history. It began as a small school, but eventually became one of the few land-grant universities in the country. There are currently 9,000 faculty and staff and an annual enrollment reaching approximately 42,000 students. Several campuses comprise the academic system, with an annual operating budget of $1 billion; less than 40% is funded from state appropriations.
This institution prides itself on its efforts to become a top research facility. However, the school was struggling with a decline in state funding and increases in annual operating costs, which meant significant tuition hikes and cuts in departmental budgets, staffing, and salary.
My office was located off-campus in the bottom level of a converted department store.
Windowless and with poor artificial lighting, the moisture content was so high we had to use two dehumidifiers daily. It was the perfect place for a team of 13 internal auditors.
I was employed by Hardwell’s flagship campus and, as a senior investigative auditor, handled most fraud-related issues. The majority of the cases we received were the typical small-dollar shortages and thefts committed by employees with access to petty cash accounts or those who received money in their departments from students or staff. This investigation was different.
260

Wells4689_c28_1

05/31/2007

261

a lifestyle fit for a president

261

In Plane View
The fraud was not discovered by an anonymous phone call, nor was it the result of a routine audit. The controversy began when a local news outlet questioned Dr. Lear’s desire to purchase a new university airplane to replace the aging twin-turbo propeller plane that had been used for 20 years. The local media expressed concern about such an extravagant investment during a time of budget cuts, layoffs, and double-digit tuition increases. So they filed an open records request for copies of flight logs to determine if the president could justify spending an estimated $4 million on a jet plane.
The media discovered that the aircraft was used extensively; however, they decided to further scrutinize the actual destinations and purposes of the flights, starting at the time that
Dr. Lear was appointed at Hardwell. He was then questioned about several of the trips, particularly flights to Alabama, where it was rumored that he had a personal relationship with the president of a college there. When the local media outlet asked Dr. Lear about the purpose of a few of these trips, he replied he had attended meetings to search for a new athletic director. Of course, they sought to confirm his statement and discovered that few such meetings took place. In fact, Dr. Lear and the president of the Alabama college had attended a black-tie event at the same time as one of his supposed scheduled events.
This led the media to examine other activities. They found that he had used a company credit card for questionable expenditures, including a $6,000 overseas flight. Evidence also suggested that he awarded a $300,000 no-bid contract to a former business associate. It didn’t take long for the governor and chairman of the board of trustees to appoint a special committee to investigate these allegations. Finally, the chairman requested that the university’s internal audit department conduct a thorough review of all financial matters related to Dr. Lear.

A Lifestyle Fit for a President
I was determined, yet apprehensive, about preparing for what I knew would be a series of interviews with Dr. Lear. Undoubtedly there would be pressure from state and university officials, as well as the public, to get to the bottom of these allegations as quickly as possible. Although there were only 14 months of information to review, it included all types of expenditures as well as several contracts initiated and approved by
Dr. Lear. Mark Beasley, director of internal audit, determined that the best approach was to utilize the full resources of our office by assigning different areas of the investigation to all 13 auditors.
My role was to review and question Dr. Lear and other employees. Shortly after we began, Dr. Lear announced he would reimburse the university several thousand dollars for numerous private and commercial flights, regardless of the fact that some trips involved business. He felt this would clear the air and reduce further questioning. My investigative skills immediately told me this was a red flag. If I was in his position, and someone had questioned me about improper flights, I certainly would not pay extra for legitimate

Wells4689_c28_1

262

05/31/2007

262

chapter 28

the sky is the limit

business-related trips. Therefore, the logical place to begin the investigation was to review all flight logs for the university plane.
Our office requested a copy of Dr. Lear’s calendar, which listed all of his appointments, and compared them with the flight logs. In the associate director’s dimly lit office, we analyzed pages and pages of information and determined that Hardwell had incurred nearly $24,000 for air travel considered personal (or of incidental benefit to the school).
Some of the trips that Dr. Lear took included attending athletic events with the president of the Alabama school, visits to Kentucky related to his divorce, and certain occasions when the university plane flew empty to pick him up and return home. This was only the tip of the iceberg; we kept digging.
When he had begun his short tenure, the university had agreed to provide Dr. Lear a travel credit card, which is made available to all employees. Charges for travel are made to the card, statements are then sent to the employee for payment, and the employee submits appropriate documentation for reimbursement. However, an exception was made for
Dr. Lear. The school paid for his monthly statements in lieu of reimbursements—another red flag. One of the senior auditors reviewed the charges and identified several purchases, including clothing, flowers, restaurant charges, and a trip to Greece, totaling over $7,200 in personal expenses.
As the auditors continued to investigate, we felt it was time to begin questioning
Dr. Lear. The next day I drove to the state capital with three state auditors. I was surprised to find that the university president had an office suite in a rather lavish downtown building near the state capitol, away from the campus. We were led into a conference room with a large round table. Shortly thereafter, we were greeted by Dr. Lear. After brief introductions we commenced questioning.
‘‘Can you explain the nature of these purchases on your travel card?’’ I asked, pointing out some seemingly personal items on our review.
He replied that the clothing was an emergency purchase and the flowers were charged by mistake.
‘‘That seems to be a reasonable excuse, but it’s still personal,’’ I remarked. Next I showed him the airfare to Greece. ‘‘Now, can you explain this $6,000 airline ticket?’’
‘‘I attended a board meeting at New York College in Athens, and they were supposed to reimburse the university,’’ he replied.
They did, in fact, reimburse Hardwell after I contacted them several months later.
There were other charges, such as concierge-level hotel rooms and entertainment expenses on the travel card. One receipt for a hotel in Denver, Colorado, reflected a charge of $1,165 for one night. Dr. Lear claimed that $900 of this amount was associated with a meal at the hotel’s restaurant, but no receipt or further explanation was provided.
The president’s staff said they had a difficult time obtaining receipts for charges to the travel card. When asked about his lack of documentation, he stated, ‘‘I attempted to turn in all the receipts I had, but do admit I probably could have done a better job.’’ Although not necessarily fraudulent, this was clearly a violation of university policies. There was still plenty of explaining for Dr. Lear to do.

Wells4689_c28_1

05/31/2007

263

a lifestyle fit for a president

263

When he was hired, his contract allowed for reasonable moving expenses from his former residence. The key word here is reasonable. The cost of his move was, in fact, a whopping $14,000. A couple of weeks into the investigation, I called the representative for the moving company used to transport Dr. Lear’s belongings. He informed me that at the end of the move, Dr. Lear had instructed his movers to add 20% gratuity to the bill for a job well done, which they refused to do.
The next day I met with Dr. Lear and asked him if he recalled making the gratuity offer.
‘‘No, absolutely not,’’ he replied. ‘‘However, I did feel they deserved a tip and recall asking my chief of staff about the policy regarding gratuities.’’
‘‘Well,’’ I began, ‘‘I’ve already questioned your chief of staff and she does not recall any conversation with you or the moving company in regards to gratuities. Therefore, if you deny offering the gratuity, but recall asking your chief of staff who knows nothing about it, then why would the moving company report it? Do you think you could be confused?’’
Dr. Lear paused for a moment, then glanced away and replied, ‘‘I don’t know . . . I just don’t know.’’ I could hardly restrain myself from calling him out on what was obviously another dishonest answer. As the investigation progressed, we started to realize the effect our findings would have on the institution and on Dr. Lear’s presidency. There were numerous front-page headlines and state legislative inquiries as to the status of our inquiry.
One of the many fringe benefits Dr. Lear received as the president of Hardwell
University was the use of a large residence owned by the school. During his brief tenure,
Dr. Lear was allowed to make reasonable modifications to the home. Prior to his appointment, it had undergone a $787,000 renovation. Dr. Lear requested an additional
$400,000 in improvements. As our internal audit team began to review some of these expenses, we were astonished by the president’s lavish spending habits. This was an individual who just weeks earlier had explained to students that a 15% tuition increase was necessary to fund rising operational costs. He bought two entertainment systems totaling over $14,000, a
$7,000 Persian rug, two armoires, a $5,000 stainless steel gas grill, and a $1,200 invisible dog fence. Some of these items were in direct violation of purchasing guidelines. I met Mike
Lawler, the executive director of Facilities Services, at the residence to look at these items.
As I entered the foyer, I said, ‘‘Okay, where’s that famous Persian rug?’’
‘‘You’re standing on it,’’ he replied.
‘‘This thing cost $7,000? You have got to be kidding me.’’
In my view, it was the ugliest rug I had ever laid eyes on. I finished inspecting the remaining items with Mike and then asked Dr. Lear for a justification of the purchases. In short, he claimed to believe them to be reasonable and thought they would add value to the residence in the future.
One of the most surprising expenses was the amount spent on telecommunications—
$64,000 for residential installments. The telephone system alone was valued at $30,000. It consisted of five lines and a cordless speaker phone in nearly every main room. Also,
Dr. Lear requested a $20,000 telephone to be installed on the university plane. When asked, he stated he wasn’t aware of the cost. This seemed strange, as the bill was sent to his office account. Wells4689_c28_1

264

05/31/2007

264

chapter 28

the sky is the limit

No Parting Gift
The investigation seemed to end as quickly as it had begun. Normally, a fraud of this magnitude, with one or two investigators working on it, would have taken quite a while to put together. However, with the full resources of our office, we wrapped up everything in about a month. Once we issued our report, the media and state legislators were demanding answers: How could this have happened? Why were policies circumvented?
As the investigation progressed, Dr. Lear refused demands to resign. However, before the final report was released to the public—and after immense pressure and a meeting with the governor and the vice chair of the board—he relinquished his presidency.
The agreement included a $400,000 severance package, which the state felt was the best course of action to avoid a lengthy legal quarrel. As part of the settlement, Dr. Lear confirmed there were no other issues, which, if discovered, could void the deal.
Although the audit report had been released, the outcome of the investigation was still being processed as the university sought answers. Several senior administrators were requested to appear before a state legislative committee less than two weeks after Dr. Lear’s resignation. They all said that they should have done more to curtail Dr. Lear’s spending and that, ultimately, they were responsible. A summary of our findings included:


Dr. Lear’s travel was rarely handled in accordance with university procedures.
Questionable travel expenses exceeded $23,000.



Dr. Lear’s credit card was used to purchase nearly $1,200 in personal items, approximately $3,000 in excess lodging rates, and over $800 in entertainment and meal overpayments.



Dr. Lear requested nearly $500,000 worth of renovations done at the president’s residence, which included a $7,000 Persian rug and a $5,000 gas grill.



The university spent over $64,000 on telecommunications items for Dr. Lear, including a $20,000 phone installed on the plane.



Two no-bid contracts with friends of Dr. Lear were determined to have been unfair and consisted of favorable treatment.



Nearly $165,000 was spent on entertainment-related expenses for a single football season, and holiday receptions exceeded $73,000.

As the state legislators continued to grill administrators, and with the announcement of the president’s resignation, preparations were under way to collect and ship Dr. Lear’s belongings from his office. Another auditor and I oversaw the process to ensure that no university property was inadvertently packed with his personal items.
Upon arrival, I entered the president’s extravagant office. I sat down at his desk. My colleague and I began sifting through the desk drawers, removing any university records.
We never expected to discover anything surprising; however, we did find something eyeopening. I pulled out a hardcopy of Dr. Lear’s calendar, which listed all of his appointments dating back several months. At first glance it appeared to be a copy of what was already

Wells4689_c28_1

05/31/2007

265

lessons learned

265

provided to us. But as we scanned through the pages, we noticed some trips to the same destination in Alabama that were not on the copy we’d seen. I immediately contacted the audit director and explained what we had found. He instructed me to return to the office as soon as possible.
As one might imagine, this was damaging information for Dr. Lear. He had lied to us during the investigation by providing an alternate calendar. After further questioning of his staff, it was determined he had instructed Jan Blackledge, his administrative assistant, to remove certain personal appointments from the calendar. This action raised another issue—Dr. Lear had altered a public document.
‘‘He just highlighted the personal appointments he did not want to be shown on the calendar. I never gave it a second thought,’’ explained Jan.
The governor and legislators were infuriated once they were informed of the alterations. Without hesitation, the governor said he considered Dr. Lear’s severance package null and void. However, the state’s attorney general reviewed the matter and determined there was insufficient information to file criminal charges against Dr. Lear.

Lessons Learned
This case opened my eyes to the fact that anyone, regardless of his or her position, is capable of committing fraud. The president of a public university is no different. During the investigation we discovered that Dr. Lear had instructed his staff to run all information by him instead of the board of trustees. This was an obvious red flag. It provided him with relative assurance that he could authorize or make decisions regardless of the expense, including requesting exceptions to policies and spending as if the sky was the limit.
Caps on travel expenses are intended for all employees—even senior administrators. A travel card that the university paid for allowed Dr. Lear to charge personal items. Also, the opportunity existed to engage in wasteful spending, such as concierge-level hotel rooms and extravagant meals. The travel coordinator said Dr. Lear had a standing request for the best hotel rooms since he was the college president.
Budgets should be established to limit entertainment expenditures. Dr. Lear spent tens of thousands of dollars during a single football season; alcohol purchases totaled
$13,000. A few holiday receptions during the month of December alone cost over
$81,000. If budgets and proper controls had been in place, excessive spending would have been prevented.
The most fundamental breakdowns were the critical internal control deficiencies in nearly every financial aspect of the president’s office. The primary reason these acts occurred was the disregard of and exceptions to existing policies just to please Dr. Lear. Of the few times someone did question an expense, his response was ‘‘This is how things were handled at my previous institution.’’ The only way internal controls succeed is if they apply to everyone—even a university president.
Most of all, I learned the importance of having a hotline and ensuring people are aware of it. At the time of the investigation, the state had a tip line that allowed employees to

Wells4689_c28_1

266

05/31/2007

266

chapter 28

the sky is the limit

report allegations anonymously; however, it was not widely publicized. In addition, most employees I interviewed expressed concern over losing their jobs if they were to report suspicious spending.

Recommendations to Prevent
Future Occurrences
University Policies for Senior-Level Positions
Four policies were revised to prevent the president and other senior-level administrators from making exceptions without approval by the Finance Committee of the board.
1. Presidents should be reimbursed for expenses in the same manner as all other university employees, which should specifically prohibit direct payment of travel cards. Lodging should be paid only at the allowable rate, and the purpose of each flight taken on the university airplane should be documented in the flight log.
2. A formal housing policy governing the president’s residence should be adopted to address all expenses and major renovations. It should receive the appropriate approval from the State Building Commission. Additional projects and furnishings should be thoroughly documented and authorization obtained in writing.
3. Every organization has a responsibility to be good stewards of the taxpayer’s assets.
Budgets are essential. The university now requires documentation for all entertainment and special events initiated by the president’s office.
4. All no-bid contracts for consulting services should include a noncompetitive purchase agreement, and any potential client that is an acquaintance of a university employee should be removed from further consideration to eliminate the possibility of favoritism. In addition, steps should be taken to ensure contracts have completed the entire approval process before the contract period begins. This includes a review by the purchasing department.

Administrative Changes
One of the main reasons Dr. Lear was able to commit many fraudulent acts was the lack of appropriate oversight. The position of chief financial officer (CFO) was created to monitor all financial aspects of the university. Although the CFO reports directly to the president, he is required to provide the board regular updates on spending by the president’s office.
Additionally, an Audit Committee was created within the board, and the executive director of Internal Audit answers directly to the committee. Prior to this investigation, the executive director reported only to the president. Monthly and quarterly reports are issued to the committee along with face-to-face meetings. Also, annual audits are performed on the president’s office, chancellors, and vice presidents to ensure compliance.

Wells4689_c28_1

05/31/2007

267

recommendations to prevent future occurrences

267

Whistle-Blower Protection and Hotlines
Some form of a state statute was already in place prior to the investigation of Dr. Lear, but now more emphasis is placed on protecting an individual’s confidentiality. In addition, the university was required to create and widely disseminate brochures and posters informing employees and students about ways they can report suspected fraud or wasteful spending, including the use of the state audit hotline.
Proactive Approach
The internal audit department has begun conducting risk assessments of the university prior to routine audits. Part of this function includes a fraud audit. For example, once an auditor takes a sample of invoices to review for standard requirements (vendor name, date, total, quantity, etc.), he or she must physically verify the address of a few by driving by the business to ensure its legitimacy. Other examples may include verifying all employees listed in a department are actually there. These steps may seem trivial, but could uncover a fraudulent scheme.
Furthermore, fraud prevention and awareness courses are now offered to employees through the university’s human resources department. These presentations provide an understanding of how fraud occurs, potential red flags, and ways to prevent fraudulent activities in higher education.

Brian E. Browning, CFE, MS, is the business manager for the Division of Finance and
Administration at a public university. Mr. Browning, a graduate of the University of
Tennessee, served as a senior investigative auditor prior to his current position and has over 10 years of fraud prevention, investigative, and law enforcement experience.

Wells4689_c29_1

05/31/2007

268

chapter

29

&
Supplemental Income
JAMES E. WHITAKER

ike Riddle was a loner, but not a recluse by any standard. Married and in his early
30s, he had a young daughter who was the apple of his eye. On Mike’s desk sat a picture of the two most important women in his life: his wife, Sally, and his little girl.
Although Sally’s family didn’t approve of her marriage, he didn’t really care. She was not demanding, but she did expect to live in a nice house, drive decent cars, and measure up to the neighbors’ lifestyle. Mike always assured her that they shared common goals and that he would work as hard as it took to realize them. While they would never get rich from his income as an insurance adjuster, he promised her they could and would be financially comfortable. The company had a great profit-sharing plan, and he assured Sally that he would invest their money wisely. She trusted him completely and let him handle all of the financial planning. Sally didn’t agree with her family’s assertions that Mike would never have any real success. Considering that his company was well established and that they obviously thought highly of her husband (according to him), they were surely destined for a comfortable middle-income lifestyle.
Mike was a claims adjuster. He worked in a small office that included him, the manager, and the office secretary. Although he specialized in property claims, he was required to work many other different types as well. He thought bodily injury, auto damage, and similar claims were boring, and it irked him that the company didn’t appreciate his skills as a property adjuster and that his manager never sang his praises.
Mike thought his boss, Daryl Stepp, was a nice-enough guy but a bit of a pushover. Daryl never expected a lot and rarely, if ever, questioned Mike. He was content just to assign him files and to work the other ones himself. Besides, everyone knew that the philosophy of
Protection Mutual was to let the employees do their work without too much hindrance.
Although Mike had several years of adjusting experience, he was viewed as an average performer. He was fairly dependable as an employee—usually punctual, finished his assignments, but never asked for additional duties or responsibilities. Though soft spoken and courteous, Mike did not interact well with his fellow workers.
The insurance carrier, Protection Mutual, had an impeccable reputation among its agents and insureds. The company was founded in the mid-1800s and was one of the oldest in the Midwest. Its business plan was straightforward: Sell its products through reliable and

M

268

Wells4689_c29_1

05/31/2007

269

smelling smoke

269

honest agents; reward them for loyalty and productivity; treat the employees well and make them a part of the company; make sure the insured was provided insurance at a competitive rate; and—most important—pay the claims owed.
When Mike Riddle came to Protection Mutual, the company had barely changed in
150 years. Technology had advanced, but the operating philosophy remained the same.
Upper management believed that if the staff was treated fairly and shared in the profits, they would remain loyal. The very thought of an employee stealing from the company was unheard of.
Protection Mutual had grown quickly in the past decade and was confronted with new and increasing security and internal issues. The company’s structure included a separate corporate security department and a Special Investigation Unit (SIU) for claims issues.
Most internal investigations were conducted by human resource personnel in conjunction with the Security Department, which consisted mainly of auditors. There were several reasons for this structure, but it was predicated mainly on the mandates of the ‘‘old school’’ executives. They never wanted the SIU to be viewed as ‘‘the bad guys.’’ To them, it was more important to have a good working relationship so that claims adjusters would work with SIU to identify and resolve potential frauds.
Of course, there were several deficiencies with this process, the most notable being the lack of expertise in the Human Resource Department to adequately conduct internal investigations. They had no training in this area and had little, if any, knowledge of the criminal justice system. Their main goal was to remove miscreants from the position as expeditiously as possible, which usually resulted in a settlement with the perpetrator. In this manner, the ‘‘problem’’ was resolved with no embarrassment or liability. This philosophy was not lost on Mike Riddle. Even if he was caught, and he thought this highly unlikely, he would just be forced to leave.
I was familiar with many of the eccentricities of the company’s operations. After all, I had begun my career as an SIU investigator and had worked my way up to manager of that unit. Later I relocated to the home office and eventually became an executive in charge of other claims units, but retained direct responsibility for the SIU.

Smelling Smoke
One afternoon I got a call from the SIU manager, who reported to me directly. Bob
Temple was a retired police lieutenant. He was smart, articulate, well educated, and a good investigator. Bob asked if I had a few minutes to speak with him. As usual, he got right to the point. ‘‘I think we may have a problem with an employee in one of our out-of-state service offices,’’ he said.
Preliminary reports indicated that Mike Riddle may have been authorizing drafts to himself on the claims files he was working on. The secretary in the office wasn’t sure what was actually going on, but something ‘‘sure seemed fishy,’’ according to her. The checks written are referred to as ‘‘drafts,’’so we were looking at a situation where an employee was possibly authorizing checks to himself disguised as payments on claims.

Wells4689_c29_1

270

05/31/2007

270

chapter 29

supplemental income

I chose to take the lead when I found out that a new twist had been introduced: Mike
Riddle had just voluntarily terminated his employment with Protection Mutual. HR would no longer be involved in the investigation, and corporate security was not adequately equipped to deal with the situation. Bob and I would be conducting the initial investigation so SIU would be directly involved. I first advised him to contact Mary Stewart, the claims secretary in Mike’s old office. Mary was a long-term employee of Protection Mutual. She was detail-oriented and a hard worker. Everyone knew that she was the glue that held the office together. Because there were only three people in the office, Mary had to take on the entire clerical function. This included answering phones, setting up claims, and handling all correspondence. She was efficient and took pride in her work.
As directed, Bob contacted Mary, who told him that it appeared as if Mike had been authorizing supplemental drafts (checks) for some property claims. Over the years, both
Bob and I had spent some time in her office investigating cases. Mary told us she had received a call from an insured about a draft he received. The customer had some interior smoke damage to his house as a result of a kitchen fire. He had used the restoration cleanup service that Mike, his assigned claims adjuster, had recommended. As far as the insured was concerned, the company did a great job.
The insured was questioning why, several months later, he received a draft in the amount of $965.32 for supplemental work. He indicated that Mike had already had him sign off on the claim, and as far as he was concerned, it was over and done with. He made it clear to Mary he wasn’t complaining, he just didn’t know what to do with this check. It was made payable to him and the restoration company. He had asked, ‘‘Do I cash it, sign it over to the other company, send it back, or what?’’
Mary was very concerned. She knew something was wrong, so she immediately notified
Daryl, who told her to contact SIU. The draft was made out to the insured and to ‘‘Restorative
Professionals, Inc.’’ This name was very similar to Restoration Professionals, Inc., a service that
Protection Mutual frequently recommended to insureds as a preferred contractor. It was also the company that had done the cleanup on this particular claim. We had worked with this contractor for many years and knew the people there to be honest and dependable.

Curiosity Kills the Cat
First, we called Restoration Professionals to verify what services were performed. They confirmed that they did the initial work and closed the claim to the satisfaction of both the insured and the adjuster, Mike Riddle. They received a draft coendorsed by the insured and closed the file. There was no danger of Mike accidentally stumbling on us investigating his files since he no longer had access to the office, so we set about collecting and analyzing the information. I advised Bob to make a computer vendor run on any files that involved
Restoration Professionals in the past three years, including the ones that Mike had either assisted with or handled directly.
We matched the employer identification number (EIN) for Restoration Professionals with all the files that Mike had dealt with. I obtained copies of the front and back of all

Wells4689_c29_1

05/31/2007

271

curiosity kills the cat

271

drafts that had been approved by him for that EIN. Some of the checks were payable to
‘‘Restoration Professionals’’ and others to ‘‘Restorative Professionals.’’ We found two separate and distinct banks and deposit numbers found in these groups. The bank and deposit account numbers on all of those files matched perfectly with one of the accounts we found on the drafts made payable to ‘‘Restoration Professionals.’’ The other numbers only showed up on files handled by Mike with drafts made payable to ‘‘Restorative
Professionals,’’ and they also all had another common trait: All were supplemental drafts issued at his request. On them, where the name closely resembled the legitimate vendor, the correct EIN actually was present, which allowed the drafts to go through the system undetected, even though the name was not exactly correct.
We verified with Restoration Professionals that the bank name and deposit account number belonged to them. As their EIN showed up on the supplemental drafts, we asked about each draft in question, and they verified they had not performed the work as Mike had indicated. As Bob and I discussed where to go from here, our biggest concern was that
Mike was no longer required to assist in our investigation, as he was no longer an employee. We could turn it over the local law enforcement agency, but past experience told us that with their limited resources, it might be a long time before anything happened.
Bob didn’t think there was a snowball’s chance on a Florida beach in August that Mike would agree to speak with us. After all, why should he? I felt differently. Having had contact with Mike over the previous years, his smugness and aloofness always caught my attention. I thought that if I contacted him and told him we needed to speak with him regarding some investigative issues, he would be curious. I was banking on the fact that he would think he could outsmart us and find out what we did—and didn’t—know. Of course if I guessed wrong and he refused, we would then have no alternative than to contact the law enforcement authorities and hope for the best.
I packed my bag, and Bob and I flew out to the local service office. When I met with the staff, I reiterated the fact I wanted no one to discuss this investigation—even with other company personnel. Claims people, even after switching jobs, often still communicate with each other.
While we were driving, I called Mike from my cell. No one answered, so I left a message. I made it intentionally vague and just told him to contact me. I said I was leaving the day after tomorrow and if I didn’t hear from him by then, I’d have to explore other options. The web had been spun; we now just had to see if the fly would be caught.
Later that evening, my cell phone rang. It was Mike. We exchanged pleasantries and then he asked, ‘‘What exactly do you want to talk to me about?’’
‘‘It’s concerning some possible irregularities found while reviewing some of your files,’’
I responded.
‘‘What irregularities?’’ he inquired. I had to be ambiguous but give him enough to rouse his curiosity.
‘‘You know I won’t talk specifics on the phone,’’ I replied. ‘‘I’ve known you long enough to believe that we should discuss this face to face. You were too valuable of an employee to deserve less.’’ Silence ensued. After a few more moments, he said, ‘‘When do you want to

Wells4689_c29_1

272

05/31/2007

272

chapter 29

supplemental income

meet?’’ I suggested the next evening at 7:00 at the office. He said he wasn’t sure he could make it and that he had to call me back. I knew my response was critical to his decision, so I said, ‘‘Mike, I’m leaving the day after tomorrow whether I meet with you or not. If I don’t,
I’ll have to let someone outside the company handle this. That isn’t my first choice.’’
He pondered this for a few seconds and said, ‘‘I’ll call you back; we have a bad connection.’’ He then hung up. Bob was convinced we wouldn’t hear from him again, except maybe to say that we would need to speak with his lawyer. I was still betting on the fact that he understood the threat of us going to law enforcement, and he was deciding at that point whether to call a lawyer or to talk with us. The phone rang later. He would meet us at 7:00 p.m. the next day.
When Mike showed up, he had clearly considered that he may be arrested, so he was scoping out the office. Bob and I had strategically placed all the documentation on the table in huge binders so that Mike would see that we were prepared. Some of it was filler, but he didn’t know that. It was certainly an intimidating mound.
I knew that the first three minutes of the interview were critical. We purposely allowed
Mike to begin the conversation. Finally he said, ‘‘What’s this all about?’’
‘‘It’s about the bogus supplemental drafts you issued to yourself through your own account,’’ I replied. I let that sink in for a few moments. He didn’t deny it, but didn’t say anything affirmative either.
‘‘Mike, here’s the deal,’’ I said. ‘‘I wanted to hear your side of it before presenting it to senior management to decide the next course of action.’’
After pondering that for a few moments, he wanted to know what could possibly happen. I told him the options were to let him reimburse the company and possibly face a civil action or a criminal complaint. He asked why we didn’t contact the police already. I told him it wouldn’t have been fair to do so without learning his side of the story. I knew the issue of criminal prosecution was foremost on his mind, so I downplayed that aspect as much as I could. I told him all the possibilities and advised him that the extent of cooperation from him would certainly be considered. At that point, he said he would fully cooperate.
So Mike laid out the events of his fraud. He would fabricate a reason for additional work on a particular file and then add it to the claim. After waiting for a while—the amount of time he guessed it would take to complete the kind of job that he recorded—he’d make an invoice to reflect the job was finished. Having worked with
Restoration Professionals for many years, he knew what their invoices looked like.
Mike simply copied one and used it as a blank. As the adjuster, he was able to approve the invoice. Sometimes he would enter a note stating that he had personally inspected the work and had found it satisfactory.
He would then issue the draft to his bogus company, which almost duplicated the name of the legitimate one. As the EIN was correct, the secretary just issued the check. It would be made payable to the insured and the contractor, with both signatures being required.
Mike already had the signature of the insured; he simply duplicated it as best he could on the bogus supplement. He would then endorse it as a company representative with a FOR
DEPOSIT ONLY stamp and place it in his account. He was relying on the fact that since

Wells4689_c29_1

05/31/2007

273

surprise visit

273

he was using the real EIN of the company and a similar name, it would take a very long time to uncover the fraud.
Since the secretary prepared the drafts and mailed them out, it seemed reasonable that they would end up directly at the insured’s residence. Mike had this covered also. Being a small office, all three employees helped each other out. Mike, appearing to be a team player, often offered to drop the mail off at the post office. Of course, he would remove the envelope with the bogus supplemental draft. Unfortunately for him, he failed to catch the one that started the investigation.
We had drafts totaling a little over $50,000. That is all Mike would admit to, although we knewtherewasprobablymore.Hegaveuswrittenpermissiontorunacreditcheckandagreed to provide his bank statements and account information. When he was preparing to leave, he asked what was going to happen. I reiterated that once the investigation was completed, I’d let him know the disposition. As we were wrapping up the interview, he inquired as to how the fiscal year was going for the company. I told him we were having a good one. He then asked a questionsounbelievablethatBobandIjustlookedateachother inamazement.‘‘Afterallthisis finally over, do you think I’ll be able to get profit sharing again this year?’’
‘‘No,’’ I replied.

Surprise Visit
Mike was feeling pretty good about the situation when he left and probably thought he would only be facing restitution—on his terms. But things didn’t work out that way. As required by law, the incident was reported to the state Department of Insurance (DOI) as well as to the local authorities. The DOI was interested in the case. Insurance fraud is taken very seriously by most DOIs.
Mike Riddle liked being a claims adjuster, especially with the extra benefit package that he had set up for himself. He was later hired at a different carrier with basically the same duties. When asked on the application whether he had ever been convicted of a crime of theft or any insurance-related offense, he stated no. Technically, that was true—he had not even been arrested yet, let alone convicted. As several weeks went by, it appeared that he had dodged a bullet. Mike had voluntarily terminated his employment with Protection Mutual and had a clean record. On paper, he looked like the ideal candidate for a new claims adjuster. But imagine his surprise when at 1:15 p.m. on a weekday he was approached by
DOI agents and the local sheriff ’s deputy and hauled out of the workplace in handcuffs.
Mike was arrested and spent several days in jail until his wife posted his bail. Confronted with the overwhelming evidence against him, he pleaded guilty to embezzlement and insurance fraud. Mike received time served as the actual jail sentence, was placed on five years of supervised probation, and was ordered to pay restitution in the amount of $50,000 to Protection Mutual in monthly installments. His license to act as an insurance adjuster was permanently revoked.
Mike Riddle was forced to obtain a second mortgage on his home in order to pay the attorney fees and restitution that was ordered by the court. Although he avoided a jail

Wells4689_c29_1

274

05/31/2007

274

chapter 29

supplemental income

sentence, he no longer had a job with a steady source of income. His home was mortgaged to the hilt. Perhaps of most dire consequence was the felony record that would follow Mike for the rest of his life.

Lessons Learned
The person who first discovered this theft was a coworker of the offender. Often colleagues are reluctant to squeal on their associates because they don’t think that’s part of their job, or they are concerned about how the company will react if they are mistaken. In this case, when Mary came forward, the fraud was uncovered and eventually resolved. Protection
Mutual made sure she was honored for her honesty.
Another lesson learned centered on the risk of attempting to evoke a response from the offender in order to obtain an interview. Although it worked in this particular case, I caution other investigators in making that assumption. I carefully weigh the prospect that he or she would be alerted to the suspicion and would scramble to hide or destroy evidence. Investigators should remember that it is usually preferable to have all the evidence you can obtain before actually conducting the interview. The lesson is simple:
Go with your gut, but don’t rely on it. Most cases are solved by using a tried-and-true systematic approach that goes where the evidence leads you.

Recommendations to Prevent
Future Occurrences
Implement Controls
As we began to work with the internal audit department to ascertain what controls were in place, we were struck by the fact that there were few, if any. From an SIU perspective, we naturally assumed there were sophisticated controls and that Mike just managed to slip through the cracks. Although we were somewhat dismayed that this was not the case, we also recognized this was an opportunity to become more involved with internal audit to help implement proper controls.
Software
We made recommendations to the internal audit team to implement software that would scan vendors and look for any anomalies involving EINs, supplemental payments, misspellings of the vendor’s or insured’s name(s), and anomalies directly tied to any specific company employee or agent. Irregularities should be investigated promptly.
Follow-Up with Clients and Vendors
The company needs to have supplemental work for any property claim authorized by an office supervisor. This is an effective deterrent. The supervisor should also randomly call

Wells4689_c29_1

05/31/2007

275

recommendations to prevent future occurrences

275

both the insured and the contract vendor as a follow-up. This way, if an insured has had all of his or her work completed, the supervisor can get feedback on the handling of the claim, and the insured views the call as an act of goodwill. If the insured expresses surprise at a supplemental work order, the supervisor knows to investigate further. Calling the vendor to make sure the work was completed serves as a form of quality control. The supervisor should ask the vendor if he or she was paid on time and to evaluate the vendor’s overall experience in dealing with the adjuster. Again, if the contractor expresses concern or surprise at the prospect of performing supplemental work, further investigation is required. Employee Tip Line
I also suggest forming an employee tip line. Protection Mutual had one for reporting suspected external fraud but had no mechanism for reporting internal suspicions. One of the concerns that employees often have is that they are afraid their voice will be recognized.
Our experience shows that workers won’t come forward to leave a voice message either.
Therefore, we had to convince the company that the tip line had to be truly anonymous in order to be effective. The most effective way to ensure anonymity is to use a third-party hotline service, such as EthicsLine.
Besides serving as an effective crime deterrent, the tip line offers a potentially persuasive defense against legal liability. By its use, the company can demonstrate its resolve to detect and prevent fraud and misconduct. It shows the employees that the business cares about and honors those who are honest and hardworking. Conversely, it demonstrates that illegal, unethical, or potentially dangerous behavior will not be tolerated.
Formal Fraud Detection and Deterrent Training
It is helpful for companies to institute a formal training program for supervisors, managers, and executives. This program needs to address internal fraud and how to detect and deter it. Companies should not stop trusting their employees, but rather institute controls to catch those who violate that faith. The best deterrent to this type of activity is an employee workforce that is both vigilant and ethical.

James E. Whitaker, CFE, is the executive director of the International Association of
Arson Investigators. Mr. Whitaker is a retired police detective lieutenant and insurance executive with over with 36 years of fraud-fighting experience. He holds a bachelor’s degree in criminal justice and a master’s in business management.

Wells4689_c30_1

05/31/2007

276

chapter

30

&
An Innocent Perpetrator
HOWARD C. SPARKS

s usual, Christi Wenzel arrived at the office early—ahead of the other accounting and finance staff. As the chief financial officer, she liked the quiet time that the morning afforded and the fact that it projected an image of dedication to the other employees. Her day was usually an endless series of interruptions once the office filled with her coworkers. She sat at her desk sipping her first cup of coffee, sorting through messages from the previous afternoon and reviewing exception reports generated late the day before, after all the transactions had been posted.
Christi enjoyed being the controller of Northern Electric Cooperative, one of the largest businesses in the community. She had joined the company soon after earning her certified public accountant (CPA) license and had been assigned to the audit department as a new staff member right out of college. In her third year, she worked her way up to lead the audit team.
Now, just 12 years later, she contemplated her plans to retire. She and her husband had decided that they would both leave their management positions with Northern Electric in
18 months in order to travel.
A message from a customer pulled her out of a daydream. Brooks Inc., a large construction firm, was inquiring about a discrepancy in a recent bill for renting one of
Northern Electric’s cranes. She recalled a similar situation several months ago. In that case, she had requested an investigation and Brooks had produced a copy of a cancelled check that had been deposited into Northern Electric’s bank account. Based on that evidence,
Christi had approved a special adjustment to the balance.
Meanwhile, Susanne Simpson drove into the parking lot. As she passed the Employee of the Month’s space adjacent to her office building, she wondered if she’d ever have that privilege again. She pulled into an empty spot in the second row. Susanne was proud of her advancement at Northern Electric. Her employment had begun over 15 years ago, when she was hired as a temporary records clerk. Although she lacked any formal training, through hard work and dedication she had earned the respect of her coworkers and supervisors. Extensive on-the-job experience provided her with intricate knowledge of
Northern Electric’s accounting system, which had been the basis for her current position as accounting specialist. She enjoyed her work, largely because it offered more independence

A

276

Wells4689_c30_1

05/31/2007

277

an innocent perpetrator

277

and diversity than the other clerical jobs she had performed there. Suzanne was often called on to help train new hires or to fill in when a department was shorthanded. She didn’t mind these additional demands. In fact, they gave her a sense of security and importance. Northern Electric Cooperative was founded almost 60 years ago when the town of
Annelein, Massachusetts, was a booming mining community. It was formed when a large mining business offered its power-generating facilities for sale. Several local residents saw the potential for economic development that the availability of stable electrical power provided. They applied and were granted a loan from the Rural Electrification
Administration. The group formed a co-op and acquired the mining company’s central power plant and the surrounding land.
Over the years, Northern Electric prospered and grew along with the town. Operating as a co-op means that customers are also member-owners of the business. Annual elections are held to select directors, and members receive capital credits representing the profits earned by Northern Electric. These credits are redeemed periodically when funds are available. The board provides oversight of the chief executive officer who, in turn, appoints department executives and evaluates them. Today, the business maintains several power-generation facilities and a distribution network that extends over 100 miles, serving outlying communities and industrial operations. Northern Electric’s most recent annual report indicated that it had nearly 40,000 members and revenues exceeding $100 million.
Both residential and commercial customers are billed monthly for electrical services.
While most payments are received through the mail, customers can make pay over the phone or in person at the business’s customer service center. Because of Northern
Electric’s sporadic growth, its administration and finance offices were somewhat scattered around several buildings at the main physical plant. The Finance Department, including the cash control office, is located separately from the payroll, accounts payable, and customer service centers. The customer service center has representatives and several cashiers. Clients arrive at the center and enter a queue for assistance. A representative determines the customer’s needs, prepares and executes the appropriate forms, and finally sends them to a cashier if payment is required.
Daily cash collections are compared to the register totals for each cashier station and then sent over to the Cash Control Department, where they are stored in a vault overnight.
Payments received by mail are sorted by the mail room and forwarded to the Cash Control
Department. The customer’s remittance form is sent to the Customer Service Department for recording against their accounts. The cash control office combines these mail receipts with payments made in person and prepares a bank deposit the following morning. After the deposit is prepared, it is placed in a locked deposit bag for pickup by an armored car sometime in the afternoon. Each cashier prepares a daily report comparing collections to the register totals for each respective payment category. These, along with a copy of the deposit receipt, are forwarded to accounting for recording in the cash receipts journal.
To increase Northern Electric’s profit margins, management had pursued nonoperating-type transactions that included land and equipment rentals, sales of unneeded supplies

Wells4689_c30_1

278

05/31/2007

278

chapter 30

an innocent perpetrator

and equipment, and other services. As Northern Electric’s accounting specialist, Susanne had sole responsibility of recording and processing payments for these nonroutine transactions. The accounting department would receive a copy of any executed contracts between Northern Electric and customers. A debit to other receivables and a credit to miscellaneous margins would be created when appropriate. Statements and invoices would be prepared monthly by accounting and mailed to the customer. Susanne’s responsibilities primarily involved examining details of any payments received by the mail room or customer service and determining the application of the payment to Northern
Electric’s receivables accounts. She would then prepare and transmit a journal voucher to the accounting department for posting to the appropriate accounts.

Making a Statement
Christi reread the message about the billing discrepancy as she dialed Brooks, Inc.’s phone number. ‘‘Hello, may I speak to Bert in accounting?’’ she asked.
During the course of their conversation, she learned that once again, their most recent payment had not been reflected on their statement from Northern Electric. They even had a copy of the cancelled check to prove that they had paid their balance. Christi wondered how lightning could strike twice in just a couple of months—and to the same account. She decided to investigate the matter further this time. She requested that Bert fax her a copy of the cancelled check. Later in the afternoon, Christi visited cash control and had one of the clerks pull the deposit records for several days around the stamp date on the cancelled check. After hours of digging through papers, she could not locate any record of the customer’s payment on any date surrounding the cancelled date stamped on it by the bank.
She returned to her office to review her notes on this bill. Upon opening the file, she noticed right away that both missing payments involved a special receivables account handled by Susanne.
Christi decided it was time to delve deeper into this mystery. She requested to have
Northern Electric’s cash receipts and deposit records pulled for three days preceding the cancellation date on Brooks’s check. Later, after the finance staff had left and the office was quiet, Christi sat down and began examining records. She had planned to trace Brooks’s check backward from the deposit to determine what had happened. To her dismay, Northern Electric’s cash receipts records were a mess. Not only was she unable to determine what day the check had been received, but because the individual cashier cash receipts records were missing, she couldn’t even support the daily bank deposits. The next morning, Christi talked to Northern Electric’s chief executive officer (CEO),
Tom Bartlett. She related the details of Brooks’s payments not being properly credited and told him that she had not been able to trace the payments back from the bank deposit into
Northern Electric’s records. Christi agreed with Tom’s recommendation that outside assistance would be prudent. He left it up to her to arrange for a preliminary investigation.

Wells4689_c30_1

05/31/2007

279

jumping to conclusions

279

Jumping to Conclusions
Upon returning to her office, Christi located Heidi Roth’s phone number. She was an old college classmate of Christi’s who had recently opened her own firm in partnership with another local CPA. They had been good friends in college and had studied together for the
CPA exam. Christi called Heidi and told her that she had discovered some discrepancies regarding a customer’s payment and that management would like to hire an external investigator. She also related that her staff was too shorthanded to accomplish the task promptly. Heidi was very interested. Most of their firm’s services involved tax and bookkeeping services, and they had just entered the slow time of year. It would be a great opportunity when both partners would have significant free time available. Heidi told Christi that she could drop by later to review the details of the engagement.
When they met, Christi told Heidi the exact nature of the discrepancies occurring with
Brooks’s payments and the difficulties she had run into while attempting to analyze
Northern Electric’s cash receipts records. It was decided that Heidi would request bank copies of all the deposit items in order to determine exactly which one had included
Brooks’s check. Next, she would trace the deposit back to Northern Electric. Christi called Northeastern Bank. The manager said that it would take at least a week or two to have the files restored and copies generated.
Back at her office, Heidi discussed the engagement with her partner, Sue Hollingsworth. They both agreed that this would be a challenging assignment since neither of them had any prior experience with a company the size of Northern Electric. During the next week, while they awaited the bank copies, they would gain familiarity with internal controls involving the company’s cash receipts.
Just over a week later, a bank courier delivered several large boxes to their office. Heidi and Sue started examining the copies to find Brooks’s payment. They found that it was deposited the day before the cancellation date on the copy of the check. They then noted the deposit batch and worked backward into Northern Electric’s records to trace the amount into the cash receipts. This analysis was very troubling because while most deposits shown generally agreed with Northern Electric’s account, there were important differences. For example, the bank deposit containing Brooks’s check did not exactly match Northern Electric’s deposit total for the same day. Further, the check was not included in Northern Electric’s deposit records, consistent with Christi’s finding. There were, however, almost a dozen smaller checks listed by Northern Electric that were not in the bank’s records. It suddenly occurred to Sue that the sum of the small checks was almost the same amount as the Brooks’s check. Heidi found that although deposits were occasionally off by a few cents or dollars, the difference had not been followed up by
Northern Electric’s Finance Department.
Heidi arranged a meeting with Tom and Christi to discuss what she had found. Tom expressed concern over the apparent discrepancies. Christi understood. It appeared that
Northern Electric’s cash receipts procedures were weak and unreliable, possibly allowing

Wells4689_c30_1

280

05/31/2007

280

chapter 30

an innocent perpetrator

someone to embezzle funds. If news of this leaked to the local paper, it would generate considerable negative publicity. Tom decided that Heidi and Sue should expand the investigation to determine whether funds were missing and, if so, to ascertain the amounts.
Heidi mentioned that at some point they would probably need to interview some of the staff, but that they would use discretion.
After the meeting, Heidi proposed a time frame for continuing their investigation.
‘‘It isn’t feasible to reconstruct all of the deposits. Thousands of checks are processed through Northern Electric everyday,’’ said Heidi.
‘‘I know,’’ replied Christi, ‘‘but what do you propose?’’
Heidi thought for a moment before saying ‘‘We’ll start by examining all of the days around Brooks’s payments.’’
She was curious when the checks that were in Northern Electric’s records were actually deposited, but kept her thoughts to herself. Heidi knew they had their work cut out for them. About five weeks later, Heidi and Sue saw a pattern emerging in the discrepancies. The checks listed in Northern Electric’s account, but missing from the reconstructed bank deposit, eventually appeared in following weeks. They surmised that someone was substituting the initial larger payment for smaller ones that nearly exactly totaled the larger check. Then the perpetrator substituted the smaller checks over the next week or two. But why? And why didn’t someone performing the bank reconciliation ever investigate the differences in Northern Electric’s deposits? They had tried to trace the deposits back to the cashiers but faced either incomplete or illegible daily records.
Armed with this information, Heidi and Sue started interviewing Northern Electric personnel. During these initial interviews they learned that Susanne regularly accessed the locked deposit bag in the cash control office. When a staff member had questioned her, Susanne replied, ‘‘I am looking for a check to be sure that it was properly recorded.’’ Heidi was surprised at this revelation. Giving employees such easy access to deposit bags was not her idea of sound internal controls. She also learned that Susanne regularly used Northern Electric’s policy allowing employees to cash personal checks up to $500, and over this amount with a supervisor’s approval. One cashier noted that
Susanne would cash at least one check every day, and occasionally, they exceeded the
$500 limit.
Heidi felt it was time to confront Susanne about the discrepancies involving transactions under her responsibility. However, Suzanne and another finance clerk refused to be interviewed. Apparently they’d received word of the missing funds and the investigation. When asked to be interviewed, Susanne said to Heidi, ‘‘This is just witch hunt.’’
Based on her refusal to cooperate, Susanne was terminated that afternoon. She sat in her office for a long time staring at the pictures on her walls. She finally finished packing her personal things at 5:30. On her way out she gave Christi her keys and said, ‘‘I have always given my best to this organization and would never steal a thing.’’

Wells4689_c30_1

05/31/2007

281

guilty until proven innocent

281

Guilty Until Proven Innocent
Heidi and Sue focused on the payments under Susanne’s responsibility. They developed a theory that Susanne would receive a large balance from a customer for a nonutility payment. She would then visit the cash control office during lunch hours so that she could sort through the locked deposit bag uninterrupted. She would swap the larger check for smaller checks of approximately equal amount. She had worked at Northern Electric long enough to know the schedules and routines of most of the staff and the armored car pickup schedules. Since the deposits were equal, or nearly so, her switches could go undetected.
Susanne could then negotiate personal checks for identical amounts with Northern
Electric’s cashiers. The next day she would return to cash control and replace her personal checks with the Northern Electric’s stolen checks.
Northern Electric’s attorney, Jerry Evans, arranged a meeting with the local police and district attorney to see if they would launch a criminal investigation. The district attorney felt the evidence was good and obtained search warrants for Suzanne Simpson’s house and bank accounts, which was executed the next day. All of Simpson’s records were seized. No funds were recovered from their home, but some of Northern Electric’s records were found. When asked why she had taken the documents to her house, Susanne replied that she often brought work home when she got behind.
I received a call from Jack White, the local attorney who was representing Susanne and her husband, Ray. He briefly outlined the case against Susanne and said that she felt that she was being framed by someone, maybe Northern Electric’s chief financial officer. He asked if I had time to review the investigation. I told Jack it sounded interesting and to send me a copies of what he had received so far.
In reviewing Heidi and Sue’s report, I was struck by several holes in their investigation: an exact figure of the missing funds wasn’t reported, and they had performed only a partial analysis of the couple’s personal bank account, focusing on checks and deposits to
Northern Electric. They had failed to locate any of the misappropriated funds, and nothing observed during the search of the Simpsons’ home indicated that they were living lavishly. Plus, the plausibility of the scheme did not seem reasonable. For one, converting large individual checks into cash by substituting personal checks would have required
Susanne to cash at least three or more personal checks for $500 each every day for 7 to
20 consecutive days. This would have been very obvious to everyone and should have attracted considerable attention right away—not a year or more later.
Following my review of Heidi and Sue’s report, I decided it was important to investigate further. Specifically, I would need to complete an indirect reconstruction of the couple’s income based on all of their bank accounts. During an interview for the local newspaper,
Jerry Evans alleged that the couple had laundered the stolen funds through Ray’s painting business, despite the fact that Heidi and Sue’s investigation did not include a review of
Ray’s business account. This analysis would be difficult since all of the defendant’s records were seized by the police during the search. I contacted both of the couple’s banks and requested copies of bank records for the three years surrounding Heidi and Sue’s analysis.

Wells4689_c30_1

282

05/31/2007

282

chapter 30

an innocent perpetrator

I examined all of the couple’s deposits and couldn’t find any funds that were unaccounted for. Virtually every deposit was either a paycheck or bona fide business payment. Based on my reconstruction of their income, the couple lived very modestly. In fact, they were just getting by. I decided it was important to eliminate suspicion that Ray’s business had laundered stolen funds. I examined vendor statements and made inquiries about whether Ray ever made large cash payments in lieu of writing checks. I learned that
Ray had always paid his bills by check, never cash.
I called Jack to relay my preliminary findings. ‘‘Hi, Jack, I have some news regarding the Simpson case. From my analysis, I don’t reach the same conclusion as Heidi and
Sue. In addition, I think that you’ve got a good shot at getting their testimony and report excluded with a Daubert challenge, which ensures that the case is proved by scientific method, not just speculation. The judge has to verify that all evidence is reliable and relevant.’’
Jack’s tone indicated his surprise. ‘‘Really? What basis would I have for this challenge?’’ ‘‘Well,’’ I began, ‘‘Heidi and Sue’s report comes up short on just about every major requirement. They lack any fraud expertise, and neither partner has had professional experience with a company even a fraction the size of Northern Electric. Didn’t you find it strange that Northern Electric would hand off this kind of an investigation to a small local
CPA firm without any previous work in fraud? In addition, their investigation was grossly incomplete, and their conclusions are not supported by the evidence. Northern Electric’s internal controls and records appear too weak to even provide a reasonable basis to believe that funds are missing, let alone conclusively link Susanne Simpson to an embezzlement scheme. No monies have been recovered, nor have the Simpsons lived beyond the income
I imputed.’’ The news excited Jack and he asked me to compile my findings as soon as possible. Before I could complete my report, I learned that Susanne had been diagnosed with cancer in the advanced stage. She died before the Daubert motion could be heard. Ray was devastated by the loss of his wife. Based on my analysis, Jerry Evans offered to release Ray from the lawsuit and allow him to keep his house in exchange for a default judgment against Susanne’s estate. Northern Electric needed to pursue a judgment in order to collect a damages claim against their surety bond. On the advice of Jack White, the Simpsons’ attorney, with their finances exhausted and a pile of medical bills confronting him, Ray reluctantly accepted the terms of the settlement. Christi retired early, as she and her husband had planned. They sent a postcard from Brazil some time later.

Lessons Learned
It is still a mystery why an organization the size of Northern Power chose to hire grossly inexperienced investigators. To ensure a competent, reliable investigation, the company should have hired someone with requisite qualifications and experience—at the very least, someone who had experience with entities and accounting systems of this scale.

Wells4689_c30_1

05/31/2007

283

recommendations to prevent future occurrences

283

Mishandling of interviews and other evidence may permanently impair the quality of the examination. An important lesson to be learned is the need to remain objective in all phases of a fraud investigation. Despite the best work by a competent fraud examiner, there just may not be enough evidence to identify the perpetrator. Oftentimes an organization’s internal controls are simply too deficient or incomplete, which is what allowed this fraud to occur in the first place. Investigators have a professional responsibility to limit their inferences and opinions to just those that can be supported by the facts. It is incumbent on the investigator to resist pressures to point a finger at someone in order to justify the fees paid.
Conclusions are appropriate only when the examiner is confident that the investigation has applied the correct methodology and sufficient evidence has been collected to support it. Investigations lacking in some respect should be presented as a summary of the facts without an opinion. Then the investigator may, if necessary, testify as a fact witness as opposed to an expert.
Reaching incorrect or unsupported conclusions can impact on the admissibility of the investigator’s testimony. Failing a Daubert challenge can have a devastating impact on the investigator’s future career as well. Further, a botched investigation may also have the unintended result of allowing the perpetrator(s) to go free.
Another important lesson that can be learned from this case is the need to carefully control information about the nature of the investigation. Through office gossip channels, most employees learned quickly about a possible fraud at Northern Electric. This information undermines the reliability of evidence collected through interviews. Careful consideration should be given to the sequencing and selection of personnel to be interviewed. Interviewing skills are the key to collection of reliable statements that would withstand rigorous cross examination at trial.

Recommendations to Prevent
Future Occurrences
Bank Reconciliations
Bank reconciliations need to be performed in a timely manner, and discrepancies must be investigated fully. In this case, small differences in deposit amounts between the bank records and Northern Electric’s records were ignored on a regular basis, which may have caused the company to lose a great deal of money.
Audit Trails
Audit trails need to exist and records retained to ensure that transactions have been recorded accurately. It should have been possible to trace deposit amounts from the bank statement to specific sources (e.g., cashier batches or mail remittances) on a daily basis at
Northern Electric.

Wells4689_c30_1

284

05/31/2007

284

chapter 30

an innocent perpetrator

Segregation of Duties
Segregation of duties is necessary, especially in larger organizations. These segregations should be enforced through communication in procedures manuals, periodic training, and audit compliance testing.
Monitor Nonroutine Transactions
Nonroutine transactions often have a higher risk due to their smaller volumes. They generally do not receive sufficient controls and audits. To counter this increased risk, specific controls need to be developed. Periodic audits should be conducted, either by internal or by external auditors, to ensure that transactions are properly authorized and recorded. All receivables should be subject to periodic review for valuation. Direct confirmation is advisable for larger balances.
Prohibit Employees from Cashing Personal Checks at Work
Allowing employees to cash personal checks should not be permitted. This may provide an important employee benefit in some situations, but the risks should be carefully considered. If check cashing must be allowed, reasonable limits should be established.

Howard C. Sparks, Ph.D., CPA, is an associate professor of accounting and information systems at the School of Management, the University of Alaska, Fairbanks. He is also a senior associate with Northern Economic Research Associates. Dr. Sparks has over 20 years of professional experience. He holds a master’s and doctorate in accounting from the University of Iowa.

Wells4689_c31_1

05/31/2007

285

chapter

31

&
Dr. Amy
STEPHEN A. PEDNEAULT

r. Amy Daniels, known and referred to by her coworkers and patients as Dr. Amy, was the pride of her family. At age 33, her size and youthful appearance allowed her to pass for a college student. Amy was just four years out of dentistry school and already seeing her own patients. One of three dental providers at a small practice, Dr. Amy worked closely with Dr. Michael Grady, the owner, who offered her the rare opportunity of employment with little experience. Her family was so appreciative that at Amy’s wedding, her father personally thanked Dr. Grady for taking his daughter into his practice. The entire office attended the ceremony, like one big family.
Arriving early most mornings to get a jump on her day before her first patient arrived,
Dr. Amy was a hard worker. She was almost always the last to leave, finishing charts and preparing for the next day’s appointments. She turned the lights off at night and back on again in the morning.
Dr. Amy was also more fortunate than her peers when it came to her compensation.
Making close to six figures, her salary formula was easy and straightforward. Dr. Amy and
Dr. Gerard Barrett, Dr. Grady’s other employee dentist, each received a biweekly paycheck based on patient billings. Each received one-third of their total charges submitted for dental services performed during the previous two-week period. Much of
Dr. Amy’s salary went toward repaying her student loans.
The practice was opened almost 30 years ago by Dr. Grady and his wife, Judy. She maintained all the accounting and payroll records at their house to ensure employees had no access to these important documents. Located centrally in the city, the office was convenient for patients to walk or take the bus to their visits.
Dr. Grady’s reputation among his patients and employees was that of a compassionate person who truly cared about people. He frequently went to lunch or socialized with his staff, and took interest when anyone was having personal issues. Dr. Grady often performed much-needed dental work on patients who had no means of paying. Embarrassed to take any handouts, many would offer to pay him whatever they could afford in small installments over time. Amazingly, nearly every patient paid his or her entire balance.
Not surprisingly, once word was out about Dr. Grady’s practice, adding new patients was never a problem. The practice grew to three dentists, two dental assistants, two

D

285

Wells4689_c31_1

286

05/31/2007

286

chapter 31

dr. amy

hygienists, an office manager, and part-time clerical staff. Many of them remained loyal, long-term employees who had been with Dr. Grady for 10 or more years.
Dr. Grady and his family lived modestly. Having raised two children through college, he and his wife worked tirelessly in the practice by day and kept the books and records by night. Although a very talented and experienced dentist, Dr. Grady never looked to make a million dollars. He had reached a point in his career where his focus shifted toward grooming younger dentists to possibly buy in to his practice.
Dr. Grady’s plan was to discuss partnership opportunities with Amy as she continued to build her patient base. But Dr. Grady also knew not everything was stable within his office;
Dr. Amy couldn’t work amicably with her assistant, a long-term employee, and reassignments were necessary to accommodate her. Also, there were rumors and internal fights occurring between the hygienists and Dr. Amy, affecting both their professional and their personal relationships. Bite Marks
It was a Friday morning and I was catching up on things from earlier in the week. Both of my forensic associates were present. Kevin worked with me in my office, and Scott was finishing a project at his cubicle. Dan, one of the firm’s founding partners, walked into my office and asked me if I would be around for the morning. He said that Dr. Grady was coming in at nine o’clock to discuss a potential problem. Dan wanted me to sit in during the meeting. He knew I had worked with Dr. Grady on past projects, having installed his accounting package and trained his wife on how to use the system.
At nine o’clock, Kevin and I walked down to the conference room where we met Dan and Dr. Grady. On the table was a large box filled with documents.
‘‘How can we help you?’’ Dan asked.
Dr. Grady said he found a situation with his billing system and needed our help. Two weeks ago he overheard the receptionist discussing an account issue with a patient on the phone. The patient said she was in the office last week and had $450 worth of work performed. She made a partial payment of $200 toward her charges, and when she left she was provided a ‘‘walkout statement’’reflecting an unpaid balance of $250. She then received in the mail a statement reflecting a bill of $450. She couldn’t understand why her balance had changed. The office staff was unable to provide an explanation. They researched her history within the billing system, and the balance on her account reflected $250 due.
Dr. Grady asked the receptionist to have the patient come in with her paperwork.
Within a half hour the patient showed up with her receipt and statement. Everyone was puzzled as to how this could have happened. Determined to solve this mystery, Dr. Grady ran some reports and called the SoftDent billing software support center. When the support center had him check his configurations, he was surprised to learn of features within his system that were disabled or never properly initiated. He was guided through different menus and screens and ultimately ran a ‘‘Transactional Audit Trail’’ report on the patient’s account.

Wells4689_c31_1

05/31/2007

287

open wide

287

The report reflected the initial charges assessed as well as her partial payment. The next set of transactions was alarming. The charges were changed after the payment was applied, then on a later date changed back again. Dr. Grady showed the report to his staff, especially to those whose user names were associated with the changed transactions. That’s when he first learned his employees were in the habit of logging onto computers and never logging off. It was common for one person to log into one computer, and everyone else would simply use the computer under that person’s name throughout the day. He also learned that every user had the ability to change and delete transactions within SoftDent.
Dr. Grady went back to his office and revoked the rights of all the users. He then reset all their passwords, requiring his employees to set up new ones upon entering SoftDent, and returned to the front desk, where he called his staff together. He informed them they only had posting ability and that they needed to log out from SoftDent when they left their computer. He also told them there would be no more sharing of usernames and passwords.
Dr. Grady decided to see if there were similar transactions with other patients, and there were. He decided to run a complete report of the entire practice, every patient and every procedure, since the implementation of SoftDent 18 months earlier. He scanned the pages to find similar entries and highlighted them.
Now, in our office, Dr. Grady opened the box and removed the first 200 pages to show us examples of the transactions. There were over 1,500 printed pages in his box. He showed us where original charges were posted on page 25, then farther down the charges were changed on page 68, only to be restored to their original entry on page 193.

Open Wide
Based on experience, we knew something fishy had to be behind all the changed entries; we just didn’t quite know what. Dr. Grady said he was unaware of any way to provide us the report electronically, so into our cars we went. Kevin and I followed the dentist back to his office, where he guided us to his computer, then shut the doors. His staff stared as we walked through, wondering who we were and what was happening. Dr. Grady had told no one of the internal investigation he was conducting.
It took me just a few minutes to have the same report up on the screen. I smiled and looked back at Kevin when I saw the option to allow the report to be saved to a file rather than printed on paper. We now had the complete 1,500-page printed report in one computer file, which Kevin and I took back to our office. Using the patient identification number and date of service, we identified a total of 4,327 transactions that had been altered. We also learned the changed fields involved the dentist number for the dentist who provided the service for each patient. There was a clear pattern of which numbers were changed and then changed back.
Weekends always seemed to get in the way of solving a mystery, except in this case. Dr.
Grady was waiting for the results of our initial analysis and instructed me to call him any time, day or night. He said he wasn’t sleeping anyway. The whole mess was driving him crazy. I called him at home and shared with him what we found. I asked him what the

Wells4689_c31_1

288

05/31/2007

288

chapter 31

dr. amy

dentist numbers represented and for a list of all them assigned in his billing system. He provided me both. I then asked him if he had an attorney he used for legal work. He said he didn’t have one and asked me if I could recommend someone familiar with these types of issues. I knew exactly who was best suited for this case, but I wouldn’t be able to reach her until Monday. I provided Dr. Grady her name, and asked that he not talk to anyone about this matter until we spoke with counsel after the weekend.
In the meantime, I brought the file home on my laptop and performed every procedure
I knew on it: sort, extract, stratify, extract again, and so forth. By Monday morning I had the advantage over Kevin in that I knew who belonged to each dentist number, and I summarized who benefited from the changes. In almost every one of these transactions, an alteration was made from the original dentist number to a second, then subsequently the original number was restored. I needed the answer to one more question to better understand why the changes were made: How were the dentists and hygienists compensated by Dr. Grady?
Monday morning, I called attorney Lisa Woods, and she conferenced in Dr. Grady. I shared with her an abbreviated version of the case history and the transactions I had summarized. An experienced litigator in employment-related matters, Lisa was already asking the doctor how the members of his practice were compensated. Dr. Grady explained that his administrative staff was paid a straight salary. For the dentists, however, Dr. Grady told us each provider was compensated on a two-week cycle based on the procedures each dentist performed during that time frame. He said he typically ran the productivity report from SoftDent on Saturday mornings that showed the procedures for each dentist for the previous two weeks. Now we had a motive. If procedures performed by one dentist were changed to a different dentist, the ‘‘changed to’’ dentist would benefit by having more procedures than actually performed. The larger total would lead to a larger one-third share, and thus more compensation. While not the only explanation possible, it seemed to make sense to us that the changes posted to patient transactions were part of a scheme to obtain more pay than someone would have otherwise received.
The focus of our conversation switched to Dr. Grady’s dentists. Three worked at the practice during the last three years. Dr. John Stabler had worked for Dr. Grady for about four years, and left the practice 12 months previously. The changes to patient transactions continued to occur after he left and appeared in the audit report right up through the previous week. That seemed to rule him out, as he didn’t seem to benefit from the changes posted for the last year. In the SoftDent system, Stabler was referred to as Doctor #3.
Then there was Dr. Gerard Barrett. Barrett worked part time and was with the practice for only a short period after Dr. Stabler left. Barrett, Doctor #4, also didn’t seem to benefit from recent changes to the billings. That left only Dr. Amy, who had been with the practice the entire time. Dr. Amy was Doctor #2, and Dr. Grady was #1. I looked at the transactions extracted, and in almost every case, procedures were changed from Doctor #1 to Doctor #2, only to be changed back later to Doctor #1. I had also assigned the day of the

Wells4689_c31_1

05/31/2007

289

open wide

289

week to each questionable transaction. While the first changes occurred throughout the weekdays, the second change almost always occurred on a Tuesday. I told Dr. Grady and
Lisa Woods that I wanted to interview each of the employees, including Dr. Amy, as soon as possible. Dr. Grady confirmed that all the employees were present, except for his part-time receptionist, who wouldn’t be in until after lunch.
I arrived at the practice just after 10:00 a.m. The staff members stared at me and whispered to each other as I headed to Dr. Grady’s office. Dr. Grady greeted me and closed his door behind me. He said he told his staff I was coming this morning to meet with each of them. He also told them he had hired me to evaluate the practice and his internal controls and to provide him feedback and recommendations. Dr. Grady said he arranged for me to use a private office in his colleague’s practice one floor below for privacy purposes. The dentist introduced me to his staff, and I left with his office manager, Susan, to go downstairs. I explained to her that I was evaluating the practice and needed to understand each employee’s role and responsibilities. I also talked with her about computer usage, including her user ID and password. Susan provided much information about the operations and her different coworkers. She gave me a list of all the users on the SoftDent system, along with the names of the employees associated with each user
ID. I asked her about Dr. Amy, and learned that she spent significant time at the computer in the back and in Dr. Grady’s office. She said Dr. Amy always had computer printouts and schedules in her medical coat pockets and would check on and off the computer frequently between patients. Then I brought Susan back upstairs and met with the next employee.
Interview after interview, I learned of the person’s length of employment, different responsibilities, computer activity, and more facts about each coworker. I asked everyone about Dr. Amy. I listened to troubling statements about her attitude, length of time at the computers, and conflicts with fellow workers. I learned that Dr. Amy was nearly always the first person to arrive each morning and pretty much always the last person to leave each day, typically staying much later than everyone else. That was true even when she didn’t have any late-afternoon patients. I also learned that Dr. Amy was privileged to park in the adjacent parking garage. I asked how she gained entry to the garage, and was told she was issued an access card that she used at the gated entrance and exit.
This information was extremely helpful. I knew right then that there must be a system tracking the garage access. If I could compare this information with the computerized transactions and payroll records, I could determine whether she was in the office at the times the changes were posted to the system. My second-to-last interview was with
Dr. Amy. She was petite and looked much too young to be a dentist. I introduced myself and we went downstairs to the private office. I broke the ice by telling her of my recent debacles with my own dentist whom I recently fired after extracting a second tooth. I had learned it would cost me about $10,000 for implants to correct the problem. She seemed sympathetic and amazed that it could have happened. I believe we had established a good rapport. Wells4689_c31_1

290

05/31/2007

290

chapter 31

dr. amy

I started by providing her my background as an accountant who works with medical clients to improve the practice’s operations and efficiencies. I began to ask her about her background and her experiences at Dr. Grady’s practice. She seemed to enjoy working there. I had her describe her responsibilities and a typical day in her working life. Then I turned to the computer system, and asked her what doctor number she was assigned in
SoftDent. She said she was Doctor #2, and asked why I needed to know that. I told her that I would be looking at prior activity to gain a sense of the charges and collections and would be focusing on the practice as a whole as well as the performance of each individual dentist. She seemed fine with my response. I asked her what involvement she had with the SoftDent system, and she claimed she never posted transactions to the system. She told me that if I were to look I would never see her user ID. She said she was computer illiterate and intimidated by computers and that she had no posting responsibilities. She told me that with the number of patients she saw, she only had time to check her schedule between patients and that all the posting was done by the office staff. Dr. Amy said she hand-wrote out the charts and brought them to the front desk for posting and billing.
It was clear she wasn’t going to discuss anything specific regarding transactions, and since she was being less than truthful, I would save the real questions for a later date. With that I thanked her for her time and brought her upstairs. I asked her if we could meet again.
‘‘Anytime,’’ she replied.
During my seventh and last interview, I learned Dr. Amy was overheard at times telling patients not to worry about their balance due, that she could take care of it for them. She told one patient, ‘‘I’ll take care of your deductible for you by adding an extra filling or two, if that’s okay.’’ She told others not to be alarmed if they saw extra procedures on any statements from their insurance company, that it was customary to add procedures in order to have the insurance cover their portion. I also learned Dr. Amy was slow in turning in her patient files to the front desk for charge entry and billing, oftentimes with missing information. These new developments troubled me. If any of these allegations were true, each added new dimensions to the already expanding case against Dr. Amy. Procedures never performed could lead to criminal and civil claims by the insurance companies against
Dr. Amy and, more important, Dr. Grady. As I walked back to his office, the staff was paired up in different areas, whispering and watching me. I met with him and provided a summary of the interviews. He was not pleased with this new information. He had already looked at a few of Dr. Amy’s patient files and compared what was in their written charts.
Today’s information confirmed his worst thoughts: insurance fraud. We called the attorney and updated her on the situation.
Kevin and I spent the next two days obtaining background information on Dr. Amy to identify where she had worked, lived, banked, and owned property. We knew a civil case was coming to recover some of the proceeds, and time was of the essence. As she probably knew from the interview, the jig was up. It was Thursday and I had just gotten into the office. Dr. Grady called and said that Dr. Amy hadn’t been at work for the past two days.
He arrived in his office this morning and found an envelope on top of his desk. It was a

Wells4689_c31_1

05/31/2007

291

open wide

291

letter from Dr. Amy, presumably left sometime during the night. There was an office key in the envelope as well.
Dr. Amy’s letter said that Dr. Grady had harassed her and made her feel uncomfortable about her trying to have a baby. She indicated she saw in the media that he was advertising for a new dentist and that if he wanted her to leave, all he had to do was ask. The letter continued by making claims about the hostile workplace environment and that she had decided to resign, effective immediately. He was devastated by these unsubstantiated allegations attacking him personally. We called the attorney to update her on the letter and to tell her to expect a ‘‘smokescreen’’ from Dr. Amy to cloud the issue that she stole funds.
Fortunately Lisa Woods specialized in labor law and knew exactly what to do in anticipation of any claims or suits.
Kevin and I continued to search in light of the information learned from the staff.
We sorted by date, time, patient name, and user ID. We found there were no transactions within the database posted by Dr. Amy, but 48 patients had been deleted from the SoftDent system under her user name. Dr. Grady identified many of them as either her family or friends. Without a reliable backup prior to the changes, we were unable to locate more details. After talking with the office manager, Susan, I learned the garage access card number assigned to Dr. Amy. We met with a garage attendant who showed us the system, including tracking each cardholder’s activity. We had the attendant print out the complete history of Dr. Amy’s card number. The report showed us dates, times, travel direction (in or out), and the gate location. Back in the office
Kevin was able to import the file and compare dates and times with the SoftDent transactions. On Friday morning I decided to interview the staff again to learn more about Dr. Amy.
Using Dr. Grady’s office this time, I met with each of the five people working that day.
When I asked each employee directly about Dr. Amy’s habits and computer use, I learned she often was at the computer when she was not seeing patients. I was told that she knew how to post the change transactions because she watched other users do it all the time, and one employee told me she offered to teach Dr. Amy how to do it so she could post them herself. Dr. Amy responded that she didn’t want to know how to do it and that she was too computer illiterate.
Another staff member told me Dr. Amy never worked on Mondays and worked only every other Saturday. She said Dr. Amy constantly watched the screens while coworkers posted legitimate transactions or changes and was ‘‘damn quick on the keystrokes.’’ She stated Dr. Amy was, in fact, very good and confident on the computer. I showed her some of the changed transactions and asked how long it would take someone to post them. She said it would take under 10 seconds.
Comparing garage entry and exit times with the other employees’ time clock activity and to transaction times within SoftDent, Kevin and I identified a clear pattern. In most cases the changes were posted immediately after Dr. Amy entered the garage but before the first employee arrived, or immediately before Dr. Amy exited the garage after the last employee had punched out for the day. Some others were posted while the staff was at

Wells4689_c31_1

292

05/31/2007

292

chapter 31

dr. amy

lunch, potentially leaving Dr. Amy in the space alone. Another coincidence was that there were no changed transactions posted on Mondays. It became clear that while any one of
Dr. Grady’s employees could have perpetrated the changes to his SoftDent system, only one person financially benefited from the changes: Dr. Amy.

Paying the Bill
The next logical step was to reinterview our suspect. I left message after message, and finally Dr. Amy called me back.
‘‘What’s this all about anyway?’’ she asked.
I told her we were looking to understand how patient charges and billing occurred and thought she could shed light on process.
‘‘Do I have to meet with you?’’
I responded that she didn’t have to do anything, but that I thought a meeting would be helpful to understanding how things worked. Dr. Amy agreed to come to my office on
Thursday at 11:00. I had serious doubts about whether she would actually show up. So I was pleased when I saw her pull into our parking lot. But my pleasure was only fleeting when just moments later Dr. Amy backed out of the parking lot and drove off. Still wanting to resolve the case for Dr. Grady, I brought Bonnie from my office for a ride to
Dr. Amy’s house. I thought if I was going to confront Dr. Amy at her home, it would be a great idea to have a second person, a female witness, accompany me. We knocked on her door, and after what seemed like forever, Dr. Amy opened the door and asked, ‘‘Can I help you?’’ I asked her if she remembered me, and she said no. I told her I had sat and talked with her not a week or so ago at Dr. Grady’s office. That is when she reached out and opened her right hand, offering the name and phone number of her attorney. She said if I had any questions, then that’s who I should contact.
Before leaving, I asked, ‘‘Do you want to know what this is all about?’’
‘‘I would love to know what this is about,’’ she replied.
As I started to tell her about the charges, she abruptly stopped me, raised her voice and said that it sounded like I was accusing her of something and that I should get off her property. She closed the door, and we went back to my car. Mission accomplished. We now knew she had an attorney and how to contact him.
Five attorneys later, we had our first meeting with her latest legal representative. He listened to Lisa Woods and me tell the story, and when we finished, his opinion was that this case sounded complicated. That’s when I showed him our analysis of the transactions, along with statements from coworkers and some of the other evidence collected. Even after all of our efforts, it took the involvement of detectives from the local police department and the real threat of prison to get Dr. Amy and her attorney to come to terms with what she had done. In the end, Dr. Amy refinanced her home and wrote a check to Dr. Grady for $80,000, which covered all the ‘‘proven’’ thefts and his out-ofpocket costs for the investigation. The true amount of damage Dr. Amy caused may never be known, but we estimated it in the $150,000 range. Her restitution also kept her

Wells4689_c31_1

05/31/2007

293

recommendations to prevent future occurrences

293

from being arrested, and she has never acknowledged any wrongdoing or even apologized to Dr. Grady.

Lessons Learned
In most small businesses, and especially within physician and dental practices, it is easy to focus on generating revenue or providing medical care and leave the financial aspects to ‘‘trusted’’ employees. Even when an owner or provider starts out heavily involved in managing the day-to-day finances, over time there is a real risk of complacency.
Dr. Grady was doing many of the right things by writing all the checks, having his wife prepare the payroll off-site, and reconciling the daily deposits. What he didn’t contemplate was his staff sharing passwords, leaving themselves logged in to the systems, and delegating their responsibilities by teaching coworkers how to post transactions.
Dr. Grady also let his guard down when his SoftDent system was installed and configured, in that he didn’t thoroughly review the levels of access assigned to each user of his system.
He also never knew of the audit features, and therefore none were ever activated. Last,
Dr. Grady ‘‘trusted’’ his dental staff. He worked hard to create a family like atmosphere.
Although much of Dr. Amy’s ‘‘unusual’’ behavior was occurring right before his eyes, he never thought for a moment that she or anyone else within his practice would be stealing from him.
Unfortunately, the worst news for Dr. Grady was yet to come. Although we had identified the changes posted to transactions and the extra billings submitted to insurance companies for procedures Dr. Amy never performed, it wasn’t until Dr. Grady started seeing her former patients that he discovered she had performed poor dental procedures.
Further, she also billed for work she didn’t do but should have. Dr. Grady spent much of the next few months providing free dental care either to correct what had been done or to complete procedures that had already been billed and paid. Dr. Grady photographed the teeth of every patient he corrected, both before and after, and built a case for the state dental society and the insurance companies.
In the end, nothing happened to Dr. Amy or her dental license. Dr. Grady settled with the insurance companies that, amazingly, allowed Dr. Amy to continue billing as a participating provider under her new practice.

Recommendations to Prevent
Future Occurrences
Could Dr. Grady’s situation have been prevented? Maybe. Should he have detected the problem much earlier? If Dr. Grady had known about the disputes between his staff and
Dr. Amy, he may have become suspicious. Also, if he had compared what he was paying her to the actual number of patients she was seeing, he would have noticed that she was being paid more than she should have been. In his defense, the staff had begun to realize what Dr. Amy was doing and started their own mini-investigation before the case came

Wells4689_c31_1

294

05/31/2007

294

chapter 31

dr. amy

to light. Had they shared with Dr. Grady this information, her fraud might have ended sooner. To help prevent these types of schemes, employers should take these seven steps:
Step 1. Know your employees (and their habits).
Step 2. Listen to your employees. (They tried to tell Dr. Grady that something was wrong.) Step 3. Ensure audit features are turned on and review them.
Step 4. Perform spot checks comparing information for consistency.
Step 5. Review system user rights and access, and monitor them.
Step 6. Document personnel and computer policies, and enforce them.
Step 7. Trust, but verify.
Fraud can’t be eliminated, but attention and vigilance will help prevent many schemes and catch others before the losses mount.

Stephen A. Pedneault, CFE, CPA, is the founder of Forensic Accounting Services, LLC,
Glastonbury, Connecticut. His firm specializes in fraud examination, fraud prevention, and litigation services. Mr. Pedneault is a graduate of Eastern Connecticut State
University and has 20 years experience in detecting and preventing white-collar crime.

Wells4689_c32_1

05/31/2007

295

chapter

32

&
Patriotic Game
JAMES LEE

r. Jani Chin was one of the first to join the Red Sun Corporation in Shenzhen,
China. With only 50 employees, the company’s staff was like a family and everyone felt a personal connection to the chief executive officer (CEO). Chin prided himself on being quick to respond to the CEO’s demand to go overseas to explore new markets. Chin joined the company soon after he graduated from a local college with a degree in electrical engineering. He grew up in a rural area of Hubei. As a son of a peasant family, he was proud of having had an opportunity to study in a university. However, after graduation, he found it difficult to find work. He had been assigned a job in a state-owned enterprise
(SOE) as an electrical engineer. Salaries at SOEs are generally so low that recent college graduates could expect to make only $30 a month. Chin heard that higher wages were available in the southern part of China, particularly Shenzhen, where Premier Deng Xiao
Ping had just paid a visit to encourage more investments in this special economic zone. After several interviews with foreign joint ventures, Chin was dismayed when he was turned down. His last interview was with Red Sun, a small manufacturer of telecommunications equipment for companies in Hong Kong. Chin accepted Red Sun’s offer and threw away his train ticket back to Hubei.
During the first 10 years he watched Red Sun transform from a small manufacturer to a
$5 billion multinational corporation. He shared in the business’s success and was promoted from an engineer to a senior sales manager for two provinces in China. Then the CEO announced that since China’s telecommunications market was becoming saturated, the company would start exploring new areas. He asked for managers to go overseas. To encourage volunteers, Red Sun agreed to pay senior employees a stipend of $20,000 for each year they served in a foreign country. Chin quickly volunteered and was assigned to set up an office in Quito, Ecuador.
After three years, Chin had succeeded in building a profitable operation with annual revenues of $10 million. When he received orders to move back to China, he didn’t want to leave because he thought that he could increase sales even more if he were successful in winning several contracts for which he had recently submitted bids. He wrote to the
CEO, arguing that given the success of the operation, he intended to stay and continue to

M

295

Wells4689_c32_1

296

05/31/2007

296

chapter 32

patriotic game

make a contribution in Ecuador. The CEO demanded that Chin follow orders and return immediately; the plans had already been made, and his successor would be arriving in
Quito shortly. Chin was surprised by the hasty arrangement. He contemplated his past years of service and did not understand why he was being sent back to China. Except for a minor conflict with a senior sales manager and some arguments with the accountants at headquarters, his record with the company was good.
When he arrived back in China, Chin was assigned to look after two provinces. They were slightly larger areas than he had been in charge of in South America. Red Sun’s overseas strategy proved to be very profitable. However, success came with some costs. It was reported that a CEO of a subsidiary company in Colombia had embezzled more than a million dollars. He was arrested in China after being asked to return to attend a meeting in
Shenzhen. Additionally, two financial controllers submitted their resignations about having conflicts with local management regarding internal control issues. One controller hinted to the human resources department and group financial department during an exit interview that there were other suspected fraud cases in some of the South American offices. In response, Red Sun’s CEO, Mr. Sue, asked the audit director to look into these alleged frauds and to strengthen the internal controls.

A Long Trip
It is a long flight from China to Quito, Ecuador. Although I was exhausted, I found myself unable to get any sleep on the plane. As I closed my eyes, I began thinking about the events that led to this flight. A few weeks ago, the CEO’s secretary called me and said, ‘‘Mr. Sue wants you to meet him in his office right away.’’ To my surprise, Mr. Zhang, the human resources director, and Ms. Jing, the chief financial officer (CFO), were both in the CEO’s office. ‘‘Take a seat,’’ said Mr. Sue. ‘‘When will you set off your next overseas audit?’’
‘‘Next month, according to our plan,’’ I replied.
Ms. Jing added, ‘‘And if I recall correctly, your next overseas audit will be in Latin
America.’’
‘‘Yes, we’ll be visiting the regional headquarters in Brazil and one sales office in Lima,’’ I responded. ‘‘Good. I want your team to go to Ecuador as well,’’ Mr. Sue said. He paused and stared at me with his sharp eyes, as if searching for my response. Indeed, this was a strange expression that I had never seen. He continued, ‘‘As you know, Ms. Sheila Zhang, the regional compliance officer, completed her work a couple of months ago and submitted her report to Ms. Jing. She noted some problems in the expense accounts, particularly in
Ecuador. Afterward, Mr. Chin wrote a letter to Ms. Jing charging that Ms. Zhang was biased against him because of her close relationship with David Yi, who had been Chin’s previous assistant manager before Chin transferred him to Brazil. Rumor has it that the transfer was due to the fact that they were constantly arguing with one another. Chin strongly objected to the report, saying that Shelia had misinterpreted the financial data.’’

Wells4689_c32_1

05/31/2007

297

the best chinese restaurants in town

297

Ms. Jing explained further, ‘‘A few months ago, the financial controller in Ecuador,
Edmund Yee, also submitted his resignation. One week later, Chin made a complaint that
Yee had not sought his approval for some funds transferred to the regional headquarters. In fact, Yee is the second financial controller to submit his resignation in the past two years in
Quito. From what we’ve learned, Chin was apparently infamous for disregarding internal controls and fighting with the controllers in Latin America.’’
‘‘In his exit interview,’’ Mr. Zhang said, ‘‘Yee defended the transfers and said they were made under urgent circumstances and according to policy, but for some reason, Chin did not want them made. Yee also hinted that he believed something disturbing was occurring in Ecuador, but he refused to give any details about it.’’
Mr. Sue concluded, ‘‘Obviously, we need to look into this. I want you to fly to Ecuador and conduct an independent evaluation of the whole matter. If something is wrong, we need to know. However, I want this kept strictly confidential.’’
I returned to my office with a copy of Sheila Zhang’s compliance report and began to review it. She had made note of three points with regard to expenses:
1. Surprisingly, Mr. Chin incurred very few expenses.
2. However, sales managers had incurred exorbitant amounts of expenses, all of which were approved by Mr. Chin.
3. The business purpose of some of the gifts and entertainment expenses was in question. The report did provide some figures and account details, but nothing further. Nor did the report mention whether she had conducted any interviews to gather more information about the reasons for the expenses.
My reminiscing of the past few days’ events was cut short as the airline captain announced our descent into Quito. I looked out the window and saw the runway emerge in the middle of the high mountains. Although I had just finished a 28-hour flight, I knew the toughest journey lay ahead.

The Best Chinese Restaurants in Town
Despite having had 15 hours of sleep, I felt dizzy when I arrived at work at 9:00 the next morning. There were two facilities in Ecuador—the headquarters in Quito and a sales office in Guayaquil. Quito had about 50 employees, including seven in the Finance and
Accounting Department.
My first task was to meet with Tracy Wu, the new financial controller. She knew I had been asked to look into the problem areas identified in the compliance report. As we sat down, she told me her story. ‘‘You know, I arrived here only a month ago. Things were a bit of a mess, but I think we’ve finally gotten most of the important things straightened out.
It helps that we have a new person in charge of Ecuador. I’m sure you might have heard something about Chin. Amazingly, he always found some excuse or reason not to comply

Wells4689_c32_1

298

05/31/2007

298

chapter 32

patriotic game

with the procedures. Edmund Yee and our financial team in the regional headquarters often argued with him.’’
I asked her to elaborate. Tracy continued, ‘‘Well, for the last month, I have been busy clearing the expense reports. I did note that some of them lacked documentation. Edmund told me previously that he had challenged Chin on some of the items. But Chin just yelled at him and said that the business implications and strategy were so complicated and profound that an ordinary accountant could not be expected to understand.’’
We both agreed that the expense accounts needed a very thorough review, and she helped me get access to the files and documents I needed. Over the next four days, I downloaded all financial data from their computer system to my notebook computer.
Using audit software, I analyzed the office’s expenses. I started by analyzing the last
16 months, which was how long Edmund Yee had been the controller at this office. The top five categories of expenses during that time follow.
Entertainment
Travel
Salaries
Telecommunication expenses
Rental expenses

14%
19%
18%
17%
16%

Compared to the total, the entertainment expenses were very large, broken down as follows: Entertainment of customers (including meals and travel)
Gifts to customers
Sponsorship of events for promotional purposes
Exhibition expenses

21%
27%
28%
24%

I selected 10 of the most material from each account, along with 10 unusual items from them, and passed them on to my team member, Peter Wang, to check the respective vouchers and supporting documentation. Meanwhile, I immersed myself in other analyses and found that nearly 70% of all of the expenses were claimed by just two individuals: Francisco Lui, a sales and marketing manager, and James Guo, a senior sales and marketing manager.
As Shelia Zhang noted in her compliance report, Chin did not claim a lot of entertainment costs. In fact, he only claimed 1% of the total expenses, an abnormally low amount compared to the company’s other regional managers. I talked to Tracy Wu again to find out more about
´ ´
Francisco Lui and James Guo. Francisco was the protege of Chin because he was the only
Chinese employee who could speak fluent Spanish. Chin was dependent on Francisco’s translation skills when dealing with important customers. He had studied foreign languages in college, majoring in Spanish and English. Indeed, Red Sun recruited him directly from the

Wells4689_c32_1

05/31/2007

299

the best chinese restaurants in town

299

university campus five years ago. In addition, Francisco was a gambler. The local casino was a regular rendezvous for him. James was a capable and experienced salesman with an impressive track record. Before joining Red Sun, he had worked in the telecommunication industry for more than 10 years. Rumor had it that he had had a bitter argument with Chin six months ago.
I asked Tracy about the fact that Chin himself had very few expenses. She said that was odd because he had a reputation for being a big spender. She had heard that Chin was so lavish that he frequently flew with his team to Guayaquil, a popular vacation spot, on a
Friday for a two-hour meeting, and then they would remain the weekend before flying back to Quito on Monday. Chin’s wife supposedly accompanied him on many of these trips to do some shopping.
Based on this information, I selected some more travel and meal expenses to review.
I asked Peter to test these against the supporting documentation. In the individual expenses analysis, I focused my attention on Francisco Liu, James Guo, and Chin. We closely examined the major items, such as gifts, entertainment, and meals, particularly
Francisco’s expenses. Frankly, Chin’s expenses were not material when compared to the total, but I definitely planned to see whether his wife’s travel was paid for by the company per Tracy’s tip. As to the gifts claimed by James and Francisco, all were approved by Chin. However, there were no details about their purposes. The only description was ‘‘promotion of business and relationships with customers.’’ However, they were not in breach of the authorization policy, which stated that all gifts over
$10,000 should be approved by the regional director and CFO. Most of the ones given by Francisco were electronic products, clothing, and some luxury items with values ranging from $1,000 to $9,000. James’s gifts were mostly in relation to the exhibitions and conferences. Again, no details were present except for the invoices showing where they were purchased.
The next day, Peter popped in my office and told me that he had completed his review of the expense vouchers and supporting documentation. ‘‘Everything they claimed seems consistent with the group’s policy and procedures. All have been approved by Chin.
It’s really difficult for us to challenge his decision,’’ he said.
‘‘So did you see anything strange or unusual?’’ I asked. Peter replied, ‘‘Not really.
However, it seems they liked to go to two local Chinese restaurants for business dinners.
These must be really expensive places; some meals were over $6,000.’’
‘‘How many people were at those meals?’’ I queried. ‘‘Seven or ten,’’ he responded. ‘‘It seems they ordered a lot of expensive wines. My guess is they probably just took some of the bottles home with them.’’
I browsed through the vouchers attentively. The meal expenses were mostly from two restaurants. I couldn’t help but notice that the customer receipt numbers were surprisingly close. For example, a dinner on Monday would be 4210, but then the number for a meal on
Friday would be 4212. Also, I noted that some of the receipts contained the details of the order, but others only contained the word ‘‘dinner’’ or ‘‘banquet’’ with a strange writing that I did not recognize. I turned to Peter and said, ‘‘Could you do me a favor and scrutinize

Wells4689_c32_1

300

05/31/2007

300

chapter 32

patriotic game

all these vouchers and compile a schedule showing the receipt number, date, amount, and whether we have any detail about what was ordered?’’
I then reviewed the other information Peter had gathered. I immediately spotted two words, ‘‘Galapagos Island,’’ in the travel expense list. Peter wrote that it was approved by
Chin, and the business purpose listed was to build a relationship with the CEO of a local mobile phone operator and his senior management team. The amount of $12,000 was claimed by James. I dug out the respective voucher, which was attached to an invoice. The invoice was in Spanish and from a local travel agent. No details were given except for a brief sentence in Spanish and the total amount. I looked the sentence up in my Spanish dictionary. It translated to ‘‘luxury package tour for seven foreigners, including child.’’ It seemed odd that all of the management for a local phone company would be referred to as
‘‘foreigners’’ and that they had brought along a child for this so-called business promotion tour. I wondered if I could get more details. Browsing through the travel expenses of
Francisco and James again, I found two more items relating to the Galapagos Island—one for $6,000 claimed by James and the other for $8,000 claimed by Francisco.
I asked Myriam Ramirez, one of the accountants in the Quito office, if there were any foreigners who operated mobile phone businesses in this area. She said there weren’t any that she was aware of. I also asked her about the Galapagos Island trips. I told her that I had noticed certain submissions for travel expenses that only had the invoices from the travel agents attached. ‘‘Do we normally request the travel agents to give us details on the invoices they send?’’ I inquired.
Myriam replied, ‘‘Yes, usually the travel agents mail the invoices, including the itinerary and copies of air tickets. You said you’ve noticed some without details given. Can I have a look at these?’’
After a brief review, she said ‘‘Oh! These are expense vouchers submitted by the managers for their cash advances. Under our normal procedures, when the receptionist receives the request, she looks at them and passes it on to the responsible staff to confirm the services received. The claimants later forward all the paperwork detailing what they spent and returning the remaining cash, if any. So I’m surprised to see that the invoices are not attached.’’
‘‘Is it possible to find out where the details are? If not, can we get them from the travel agents?’’ I asked. Myriam agreed to see if she could locate any more documentation in our files. The next morning as I walked in, Peter came running up to me and said, ‘‘You’d better have a look at these.’’ In his hand were three invoices from a Chinese restaurant, for approximately $15,000. Two had only the word ‘‘dinner,’’ but the other did have at least a partial description. As I looked through the documents, I noticed Peter grinning at me. I was about to ask him what I was looking for, but then I caught sight of the three invoice numbers.
‘‘My goodness! All of the invoice numbers are the same,’’ I exclaimed. Peter laughed and said,
‘‘You see it now.’’ As I examined the schedule of restaurant invoices that Peter had created, he told me that he had contacted the restaurant and confirmed that it had not prepared these. It certainly seemed as if Francisco had been using fake invoices to claim expenses.
Later that day, Myriam called and said she’d received the records from both travel agents.
Chin had traveled with his wife, son, Francisco, and two other Chinese men. Eventually

Wells4689_c32_1

05/31/2007

301

a second chance

301

we identified them as some sales people in the regional headquarters. The travelers on the second trip were Chin, his wife, and three other senior management personnel from other regional offices. The third trip was taken by Chin, his secretary, and his administrative assistant. However, all these were claimed by Francisco or James. Company procedures did not allow anyone to claim expenses on behalf of others.
We were just about to finish the whole operational review as well as the financial audit.
Chin was in violation of company policy for asking his subordinates to claim expenses on his behalf. Additionally, it appeared that the purposes of at least some of these trips were questionable and that the company paid for Chin’s family’s vacation.
Francisco had defrauded the company by using fake invoices. He and James had claimed doubtful items as gifts and other entertainment expenses. The total amount for these questionable transactions was over $90,000.

A Second Chance
I called Ms. Jing, the CFO, to inform her of what I had found so far. She said, ‘‘I think you have solid evidence. Have you interviewed them?’’
‘‘Not yet,’’ I replied, ‘‘I intend to interview Francisco and James first. As you know,
Chin is in China. So I’ll interview him later.’’
‘‘Ask them to explain these transactions. At the same time, convey the message to them that the whole case can be handled leniently if they disclose and explain the facts fully to us. Please keep me informed of their responses. Also, we will use your recommendations to strengthen the internal controls in order to avoid such schemes from happening again,’’ she said.
Peter and I decided to interview Francisco first. He looked worried when he came into the room. I began by asking him about the travel expenses he had submitted. He stared at me coldly. ‘‘I think it was explained on the voucher.’’
‘‘I just am trying to understand the exact details and the people involved. For example, what about this trip?’’ I asked, showing him the expense report for one of the Galapagos
Island trips.
‘‘Well, that was for the senior management of the local telecom company,’’ Francisco said, slightly nonplussed.
‘‘What does this word mean?’’ I asked, pointing to the word ‘‘foreigners’’ in Spanish.
Francisco hesitated and just said, ‘‘It refers to the people that went on the trip. Even if I told you their names, you wouldn’t know who they were.’’
‘‘No worries,’’ I said. ‘‘Just give me the names of these ‘foreigners’ as indicated on the invoice.’’ Francisco was desperate and so anxious to defend himself that he just stared at me.
There was a long silence. I did not speak. We all stared at Francisco.
‘‘I can’t remember their names,’’ he said feebly, then stopped. Peter broke the silence nicely and said gently, ‘‘Look, Francisco, we all know who they are. Just tell the truth.’’
Francisco distanced himself and said, ‘‘The voucher was passed on by Chin. How could
I say no to my boss?’’

Wells4689_c32_1

302

05/31/2007

302

chapter 32

patriotic game

I replied, ‘‘Oh! I see. What about this? I showed him another travel expense voucher.
His only reply was ‘‘It was the same.’’
I made a signal to Peter. He said, ‘‘What about these three invoices? Francisco. . .’’
I said calmly, ‘‘You are such a capable sales manager that Red Sun would like to give you a second chance. I think you have heard the speech by our CEO, Mr. Sue, that he hates those employees who do not admit their mistakes. Ms. Jing told me before my audit that if we found anything wrong, the most important thing was to find out the control weaknesses and prevent them from recurring. Lenient treatment will be given to anyone who is truthful and honest.’’
Francisco stared at the floor. Finally he raised his head and said, ‘‘I’ll tell you everything I know.’’ He went on to admit that he had submitted fake invoices and falsified the expense reports. At the end of the interview, he croaked in a weak voice, ‘‘What about my career? They won’t send me back to China, will they? I just followed my boss’s instructions.’’ Peter and I averted his eyes. We did not like being present at the end of a colleague’s career.
‘‘That decision will rest with management’’ was all I could reply.
Next, we interviewed James. We repeated the same technique. In fact, I was leery of him, as he looked calmer and more experienced than Francisco. When presented with the evidence, however, he admitted the falsification. He claimed that Chin made him do it and that the two of them had several bitter quarrels over the matter. He agreed to cooperate and stressed the fact that he had been forced to do this by Chin. At this point, the only person left to interview was Chin. I had gathered all of the information I needed in Ecuador, and this time, I was looking forward to the long plane ride back to
China.
It was good to be home. As soon as I was back in the office, I called Chin to set up an interview. He did not seem surprised to be receiving my call. When he walked in the room, I did not know what to expect. I wondered if he would be combative and argumentative, or just keep silent and deny everything. Somewhat surprisingly, Chin was extremely cooperative and admitted to the fraud. He assured us he would be fully responsible for what he had done. He conceded he did pass the vouchers and invoices on to
James and Francisco to claim the false expenses. His candid demeanor and admission certainly made my job easier; however, I wondered if his cooperation was the result of a tip-off from Francisco. Regardless, with the interviews completed, I finished my investigation report and sent it to Mr. Sue.
The next day, I received a copy of a short memorandum written by Mr. Sue to the senior vice president of Global Overseas Sales and the human resource director. Attached to the memorandum was the executive summary of my report. The memo outlined how Mr. Sue had decided to handle the case:
1. The perpetrators would be required to reimburse the company for twice the amount of money taken. If they were unable to pay immediately, they could choose that these sums to be deducted from their bonuses and share options.

Wells4689_c32_1

05/31/2007

303

recommendations to prevent future occurrences

303

2. These individuals would receive no promotions or salary increases for two years. 3. Chin would be demoted from his senior management grade, and his salary would be adjusted accordingly.
4. If any of them committed a future act of fraud, they would be fired immediately and would not receive their retirement funds, share options, or outstanding bonuses.
Red Sun further reserved the right to report the case to the police.
Later, Ms. Jing phoned me to explain the rationale behind the decision. Basically, Red
Sun did not have a policy of firing its employees for any wrongdoing. Mr. Sue wished to present an image of treasuring the efforts and accomplishments of every staff member in the company. However, he would not let fraud go unpunished. Instead of firing them, he gave them a chance to correct their mistakes.

Lessons Learned
The whole event was written about in the company’s monthly management newsletter, including what steps would be taken to prevent future occurrences. While this presumably served as a lesson, it also stressed to employees that the company was taking a more active role in fraud prevention and detection.
An internal control presentation on the red flags of fraud was prepared and distributed to all financial departments, along with the mandate to implement antifraud programs in their business units. Additionally, we were asked to conduct various workshops for senior management to help them strengthen internal controls and enhance their fraud awareness.
Two months later, my proposal for setting up an antifraud team in our internal audit department was approved. It seemed that Red Sun had learned the lesson that frauds should be prevented proactively.
The company also learned that it must be more diligent about supervising its operations around the globe. It instituted a system of strict oversight for all of its local offices. It also changed the reporting lines for its financial personnel. Previously, the chief accountant at the local level reported to the local manager. Now he or she reports directly to the regional chief financial officer. Red Sun also established a policy whereby local and regional managers are graded annually on their internal control programs and fraud prevention measures as part of their annual performance review.

Recommendations to Prevent
Future Occurrences
After these events, Red Sun agreed that the growth of the company must be handled in a more balanced way; that is, it would still be committed to increasing sales and efficiency, but not by sacrificing internal controls. We offered a number of specific

Wells4689_c32_1

304

05/31/2007

304

chapter 32

patriotic game

recommendations, which the company agreed to adopt. The most important ones included these five:
1. The gift policy would be completely revised and include the following:
a. All gifts over $1,000 must be approved by both the local chief executive and the chief financial officer. Those decisions were subject to review by the regional chief executive and regional financial director.
b. Segregation of duties should be implemented regarding gift approval, purchases, and delivery.
c. If possible, all gifts should bear the company’s logo.
2. Entertainment expenses must not exceed preset spending limits. These schedules detail the maximum amounts allowed for different entertainment events. For example, dinner cannot exceed $30 per person unless prior approval is obtained. All staff members would be trained each year to ensure they understand this policy.
3. All employees will receive a new code of conduct that emphasizes their responsibility for fraud prevention. Training and related workshops on the new code will also be provided.
4. Employees who claim expenses for their supervisors will be subject to discipline.
Previously, only the supervisor could be disciplined.
5. An extensive fraud reporting program will be implemented to encourage employees and vendors to reveal fraud or other questionable acts without fear of retribution.

James Lee, CFE, CIA, ACA, is a chartered accountant in Alcatel-Lucent’s internal audit department. Previously he was a deputy internal audit director of a multinational telecommunication company. Mr. Lee holds an MBA from Melbourne University as well as master of law (commercial). He has over 20 years of experience in financial, auditing, and managing information systems.

Wells4689_c33_1

05/31/2007

305

chapter

33

&
Would You Like the Special Poutine,
If You Know What I Mean?
RICHARD ELLIOTT

anadian Multi-Cinemas Inc. (CMC) opened their latest movie house in Toronto,
Ontario, in May. Upon opening, Century 16 Cinemas became the hundredth theater owned and operated by CMC, one of the largest film exhibitors in Canada. This marked the completion of an aggressive expansion plan, adding 30 state-of-the-art theaters to the chain in just over five years. They all had multiple cinemas, stadium-style seating, large screens, birthday party rooms, games arcades, and a variety of food items at the main concession stand, as well as specialty food outlet areas.
With this challenging expansion, the company’s resources were spread thin, both operationally and administratively. Support staff at the head office, including senior corporate officers, looked forward to the end of the growth phase of the company so they could concentrate on the day-to-day operations of the organization and build stronger theater management teams and theater operational systems.
May was the start of the busy season—Spider-Man and the latest Star Wars movie were hyped as the blockbusters of the summer. Not unlike any other theater complex, Century
16 Cinemas relied heavily on young, part-time help to staff the box office and the concession areas. For most part-time theater employees, it was their first job, and for many, a summer job only. Once school started in the fall, business dropped, and the theater did not need the level of staff necessary for summer operation until the next blockbuster season: Christmas.
The theater had a great opening and a great summer season. In November, in anticipation of the coming Christmas holidays and the accompanying release of holiday blockbusters, the management team at Century 16 Cinemas recruited 20 new part-time employees. One of the new employees was 16-year-old Jeremy Hamel. Jeremy was trained along with the other new recruits, and he learned quickly. He soon became a versatile employee who could work all food service positions at the main concession and at the specialty food service areas located in the theater lobby. Jeremy learned how to operate the point-ofsale devices and how to make, prepare, and serve all drink and food items available at the theater, including popcorn, fries, pretzels, pizza, hamburgers, and specialty coffees.

C

305

Wells4689_c33_1

306

05/31/2007

306

chapter 33

would you like the special poutine

Because of Jeremy’s versatility, when the Christmas rush ended, theater management decided to keep him on as a part-time employee. Management had to reduce his hours, but once business picked up during the coming busy summer season, Jeremy would be working close to full time. That suited him. He could first concentrate on school while making a bit of pocket money, and then have a fun summer job with more hours, more money, and free movies.
Jeremy turned 17 in January. One day in early spring, he came to work very excited. All he could talk about was a used car that he had just purchased: a seven-year-old Honda
Civic. The car was in poor shape, but throughout the coming weeks Jeremy had decided that he was going to fix it up and turn it into his ‘‘dream car.’’ What Jeremy failed to realize was the cost involved in such a project, not to mention the day-to-day prices of insurance and fuel.
Jeremy desperately wanted to have the car fully reconditioned for the summer, but even with his job at Century 16 Cinemas, he could not find enough cash to achieve his goal. It seemed that everything he needed to do to his car cost more than he first estimated.
Regardless, the transformation of the Honda became his obsession, and he decided he would do whatever it took to make this vehicle into something special.

Poutine with Your Fries?
One Friday evening Jeremy was assigned to the fry outlet, as he often was. Some of his friends came by and started joking with him about ‘‘hooking them up’’ with some poutine
(fries, with cheese and gravy). Jeremy knew about the company’s strict zero tolerance policy regarding employee theft; in fact, he had signed a theater fraud and theft policy document when he was hired. Jeremy also knew that there were cameras aimed at the various serving stations about the theater. But his friends were relentless, and Jeremy gave in to the pressure. He prepared the poutine and handed the order out to his friends.
Later that night, on the way home, Jeremy realized that he had taken a huge risk, but he had heard that other food service attendants were giving out food for free, so he felt that his actions were justified. ‘‘Who cares?’’ he thought. ‘‘It’s just a few fries. They owe it to me anyway, given the amount of work I do and the low pay that I get.’’
That weekend the muffler on Jeremy’s car went. He still hadn’t done any of the bodywork or painting, he needed four new tires, and it was already the middle of May. He only had a few weeks left before summer. And there was this girl he met in December who was coming to work at Century 16 Cinemas for the busy summer season. He needed to make his car ‘‘road-worthy,’’ and he needed to do it fast.
Jeremy came up with a plan. Instead of just giving product out to his friends, he would use his friends to help him steal money. On camera, it would look like a legitimate transaction. Jeremy would give his friends free fries. His friends would give Jeremy money as if pretending to pay, but Jeremy would give them back their money, plus more. Later his friends would give Jeremy the extra money that he had handed them during the so-called sales. Wells4689_c33_1

05/31/2007

307

not a pretty picture

307

The plan worked. In less than one week, and over three shifts, Jeremy was able to steal
$150 from the fry outlet. But he was running out of friends—or at least friends who could be trusted to help him steal in return for free product. Realizing the potential of this scam, the amount of money at stake, and his ‘‘deadline’’ rapidly approaching, Jeremy began to steal money from sales other than the ‘‘fake’’sales he was doing with the help of his friends.
When Jeremy wanted to steal, he used his body to block his actions from the camera. He usually crumpled up bills with his right hand and put his right hand inside his apron. He then walked away from his serving station to the food preparation area so that he could pocket the money off camera. Sometimes he slipped bills into the waste basket and later pocketed the money when he made the trip to the trash compactor with the garbage. One
Friday night, Jeremy stole $80, and one busy Saturday night, over $200. At this rate, he would easily have enough money to finish the repairs and beautification of his car.

Not a Pretty Picture
Alison Collins was puzzled and concerned. Just transferred to the position of general manager for Century 16 Cinemas, Toronto, she could not gain control of her cash over/ shorts, which recently were becoming more ‘‘short’’than ‘‘over.’’ In addition, the operator report showing summary data of sales and tender type (cash, credit, debit, coupon, gift certificate) by food service attendant (operator) was so convoluted that she could not make sense of what was going on in the theater at the operator/treasurer level. Nothing was coherent, and Alison felt she was rapidly losing control over the handling and balancing of cash at Century 16 Cinemas. Was theft occurring in her building, or was she looking at the results of sloppy cash accounting procedures? Perhaps her food service attendants were just not capable of returning the proper change.
In an effort to grasp the situation, Alison viewed the report to see if, for every operator who was short cash and noncash tender at the end of the shift, there was a corresponding operator who was over by the same amount. For most days there were not enough overages to cover off the shortages, and although it was clear that the treasurers were not doing their job of properly attributing their cash pickups to the correct operator, it was not clear if the overall shortages were due to theft.
Alison also printed some concession audit trail reports that showed all entries made on the point-of-sale devices by operator and by time. She looked at the reports for unusual voids. There were some suspicious voids, but when she checked these against the CCTV images, nothing jumped out as fraudulent. The voids seem to occur when the operator made a legitimate mistake or the customer changed his or her mind. It appeared to Alison that, if there was theft, those guilty were not leaving evidence of the theft on the audit trail reports by entering phony voids on their tills to cancel legitimate sales they made.
Operators can void product prior to the completion of a sale. This allows for the correction of errors or changing an order if the customer changes his or her mind during the sale.
Once the sale is totaled, it cannot be voided. If a customer changes his or her mind once the sale is totaled, a refund must be processed, and only managers can process refunds.

Wells4689_c33_1

308

05/31/2007

308

chapter 33

would you like the special poutine

Alison persistently pored over the operator reports. For one day, she noticed what she thought was an unusually high cash shortage at the fry outlet. She investigated further by reviewing the CCTV images for the shift in question. Alison did not see any theft or product giveaways, but she did notice that the food service attendant on duty at the fry outlet was acting suspiciously. To Alison, it appeared that the attendant was hiding some of his actions by blocking the CCTV camera with his body. The attendant on duty was
Jeremy Hamel.

Guilty Moves
Alison scheduled Jeremy to work at the fry outlet for his next shift, and she had her most trusted treasurer do the cash pickups and deposits for the outlet for the young man’s entire shift. In addition, Alison watched Jeremy’s behavior live on the computer CCTV monitor.
Again, his body language was suspicious, and, at the end of his shift, his cash was significantly short when compared to his recorded sales. Alison contacted the Loss Prevention
Department at CMC head office.
Alison spoke with the director of Loss Prevention, Paul Drake, about her suspicions.
Paul was confused. ‘‘Let me get this straight,’’ he said. ‘‘You mean you suspect that an operator is stealing because he is coming up short cash at the end of the night, and there is no indication on the audit trail report that he is manipulating sales through voiding?’’
‘‘Yes,’’ Alison replied.
Paul continued, ‘‘So you think he is taking money and making no attempt to hide his theft—not even trying to balance by not entering the sales he steals money from, or by entering and then voiding the sales he steals money from?’’
‘‘That’s correct,’’ Alison replied.
Paul thought that this was odd. Usually food service attendants who are stealing cash try to balance their recorded sales to the cash in their drawer, to avoid any suspicion.
They do this by first entering the sale, then voiding it, or they simply do not enter the sale at all. By voiding or not entering the sales from which they steal money, their cash will always balance to their recorded sales and they can hide their theft. Although the cash drawer will not open if the product is voided, the food service attendant can get around this by entering a low-dollar item as the sale. This will open the cash drawer and allow the attendant to give change to the customer. If the customer pays with exact change, the attendant does not have to open the cash drawer at all, since change is not required—for exact change sales, the attendant does not have to void anything on the point-of-sale device to try to balance.
When cash is just outright short due to theft, it is most often a treasurer or manager who is taking the money. Treasurers and managers do periodic cash and noncash tender pickups from the tills. They flag these pickups by operator and device, make up deposits, and enter the pickups and deposits into the sales reporting and cash accounting systems accordingly.
‘‘What about your inventory of fry containers?’’ Paul asked.
‘‘They balance,’’ Alison replied.

Wells4689_c33_1

05/31/2007

309

guilty moves

309

Alison understood that most retail businesses have three measures of sales: (1) recorded sales, that is, sales entered on the point-of-sale device by the operator; (2) physical cash and noncash tender received from customers for sales; and (3) sales based on the difference between opening and closing inventories, in this case determined by counting the supply of containers used for fries before and after a sales period. Alison had no discrepancies in the difference between her opening and closing counts of fry containers when compared to the number recorded by the operator as sold; both of these measures of sales balanced to each other. The discrepancy was between the two measures of sales and the cash and noncash tender for these measures of sales. Alison had more recorded sales than cash and noncash tender, and she had more sales based on inventory changes than she had cash and noncash tender.
Alison insisted that the evidence pointed toward Jeremy. She described Jeremy’s body language; how he sometimes apparently used his body to block the camera. Paul agreed with Alison’s suspicions, and they decided to install a covert camera at the fry outlet to augment the camera coverage of the suspected area of criminal activity.
Paul contacted Daryl Anderson at SecurTech Video Solutions, a Toronto CCTV company. He explained the area that needed coverage and suggested that Daryl install a pinhole camera in the acoustic ceiling tiles above the point of sale. Daryl had done previous work for CMC and knew the basic requirements, but Paul reminded Daryl that the camera should cover the customer being served, the counter, the point-of-sale device, the product going out to the customer, the cash drawer, and the server. Also, Paul told Daryl that if he had to locate the camera either to the left or right side of the server, he should locate it to the server’s right. One morning in June, Daryl met Alison at the theater and, under Alison’s supervision, installed a covert camera and VCR to videotape activities at the french fry outlet. Daryl was able to install the VCR in a locked cupboard in Alison’s office, which allowed her to change tapes in private and have the VCR secured in a locked cupboard and office that no one else could access.
The theater’s existing overt CCTV system was a multiplexed digital system, consisting of 2 Digital Video Recorders (DVRs) with 16 cameras per DVR, for a total of 32 cameras.
The images were captured on the DVRs, but the frame rate capabilities of the system were not high enough to provide the detail needed for this investigation. Besides, the suspect was hiding his activities from the overt camera, making the covert camera necessary to determine exactly what was happening at this point of sale.
To ensure the continuity of evidence and the chain of custody, Paul instructed Alison on how to label and change the videotapes and where and how to send the tapes to Loss
Prevention for analysis. Alison had to label each videotape with the date and time that she inserted the tape into the machine and the date and time that she removed it. Beside each entry on the videotape label, he instructed her to sign her name to identify her as the person changing and labeling the videotapes. Paul also instructed Alison to remove the record tab of each videotape as she removed it from the VCR.
Alison followed Paul’s instructions. When she removed each videotape, she sealed it in a package and sent it by courier to the Loss Prevention department at CMC’s head office.

Wells4689_c33_1

310

05/31/2007

310

chapter 33

would you like the special poutine

The manager of the department, Sara Williams, analyzed the videotapes. For each of
Jeremy’s shifts on camera, Sara used the theater’s audit trail report and matched what was recorded as sold on the report with the videotape images. Sara’s analysis of the images revealed that Jeremy Hamel entered everything that he prepared and served to customers as sold on the point-of-sale device. However, the images showed that Jeremy was repeatedly stealing money from the cash drawer at the fry outlet. Sometimes he would discreetly take the money from the cash drawer or from the counter, walk away from his serving station, and pocket the money. Other times he would take the money from the cash drawer and give it to his friends, faking a sale: Jeremy would give his friends the product, his friends would pay, he would enter the sale, and then give them back their money, plus $40 or $60 more. Sara noticed on the videotape that every time Jeremy’s friends approached him for the fake sales, they would ‘‘high-five’’ or tap knuckles with Jeremy before and/or after the fraudulent sale. Sara documented her findings for June 20, 21, and 27. The total amount stolen was $510 over the three days that Sara examined. Paul Drake verified Sara’s findings and, on June 30, Paul contacted the police.

Caught on Tape
On July 4, Sara, Paul, and Alison met with Constable Daigle and Constable McLellan of
Toronto Police Services, 52 Division, to present their case, which included full documentation of the investigation: table of contents and contact sheet; Jeremy’s loss summary amounts; audit trail reports; video analysis report; operator shift report; record of employment and swiped hours; statements from Alison, Sara, and Paul; and the invoice from the CCTV installer. Sara kept all original documents and prepared the evidence file in triplicate: one copy for the police, one copy for the crown, and one copy for Jeremy’s legal counsel. Sara also included copies of the videotape of Jeremy’s shifts in triplicate. At the meeting with Constables Daigle and McLellan, Sara showed the videotape of the cash thefts to the officers. The officers agreed that there were sufficient grounds to arrest
Jeremy, and both commented on the quality of the evidence and the documentation:
‘‘Sara, the work you have done and the documentation you have prepared for this case would put many police officers to shame,’’ Constable McLellan remarked.
‘‘Well done,’’ Constable Daigle added.
On the evening of July 4, Constables Daigle and McLellan approached Jeremy while he was working at the fry outlet, arrested him, and charged him with theft under $5,000.
Jeremy was devastated. He didn’t want his parents to find out, but he was a young offender, under the age of 18. The police had to release Jeremy to the custody of his parents with a promise to appear in court on a set date. Jeremy’s parents assured Alison that Jeremy would pay back every cent that he stole. Alison banned Jeremy and his friends from all
CMC theaters for a period of three years.
During the investigation, Alison found out that other operators were stealing money.
Jeremy indicated that he knew other operators were giving away product. When arrested

Wells4689_c33_1

05/31/2007

311

lessons learned

311

by the police, Jeremy revealed that he used at least one employee to pass money to, and this was discovered by Sara on the videotape. After Jeremy’s arrest, the employee was questioned by Alison, and admitted that he received money from Jeremy and that they split the cash. The employee returned the money and was dismissed by Alison. A third employee was also named by Jeremy. This employee was alleged to be stealing money at the pizza outlet. She was questioned by Alison, admitted to giving pizza out to friends, and was dismissed with cause for giving out free product.

Lessons Learned
After Jeremy’s arrest, the Audit and Loss Prevention Department for CMC scheduled a meeting with the management team at Century 16 Cinemas to discuss how this theft occurred and what could be done to prevent it in the future. During the meeting, the group discussed the case from all angles—from Jeremy’s perspective and from the theater’s perspective—to determine the root cause for the theft and to determine what corrective measures could be taken to prevent or deter employee concession theft. A description of the points of discussion follows.
Jeremy was driven by the desire to create an image for himself within a deadline. He wanted to be the cool guy with the cool wheels to impress a girl, and he had only a few weeks to create this image. This desire was much stronger than the fear of cameras, or not balancing his cash to his sales, or getting caught. In addition, when Jeremy gave the poutine to his friends, he created justification for this first act of dishonesty. Jeremy applied the same justification logic to his more serious crime of stealing cash.
During the meeting, the group agreed that the act of giving out free product is usually one short step away from stealing money and often the two go hand in hand. In Jeremy’s mind, he was stealing from a company that would not miss the money. He believed that he worked hard and was underpaid, so he deserved what he stole, and he rationalized that other food service attendants were doing the same or similar things, so there was no reason why he shouldn’t partake in the theft.
The theater had several preventive measures in place to detect or deter theft:


Cameras



Audit trail reports



Surprise cash audits, where an operator is cashed out and balanced to recorded sales in the middle of his or her shift



Cash balancing procedures, including log-ins and log-outs by employee, and cash pickups by treasurers or managers by till



Cash drawers that will not open unless the total sale key is pressed



Till product display windows for customers to follow their transactions



Company policies regarding the consequences for employee theft



Management/supervisory floor presence

Wells4689_c33_1

312


05/31/2007

312

chapter 33

would you like the special poutine

Performance dialogue with employees (communicating balancing performance as part of the training and ongoing process)

But there were also factors that contributed to theft:


No consequences for operators short cash, due to poor implementation of cash balancing procedures



Peer pressure: operators’ friends demanding free product



Cameras that didn’t cover every angle of the serving area



Limitations of the existing digital video recorders



Difficulty in attributing sales and cash for sales to the individual who transacted the sales 

Sloppy money handling by treasurers, resulting in errors that hide theft indicators



Lack of management focus on operator balancing performance

During the meeting, Paul and Sara discussed with the management team the importance of proper cash balancing. Paul explained, ‘‘In a perfect world of exact balancing, cash handling, transactional processing, and hardware/software operation, a cash shortage would indicate that there was theft and show you who was responsible. In the real world, what you are trying to do is eliminate as many other reasons for shortages and overages as you can so these cash variances will be indicators that theft is a strong possibility and must be investigated. That is why the cash balancing system must be kept as ‘clean’ as possible.
‘‘Just because an operator is short cash, you can’t assume theft. If an operator innocently gives back the wrong change, he or she will be short (or over). If an operator accidentally enters more product than he or she sells, he or she will be short. A treasurer doing the cash pickups and deposits may improperly count money or assign cash to the wrong person.
This could cause cash shortages.
‘‘If an operator balances his or her cash to recorded sales, you can’t assume that there is no theft. ‘Off the till’transactions allow operators to balance their cash to recorded sales and still steal money.
‘‘If there is theft due to cash shortages, don’t assume that cash shortages always indicate treasurer or manager theft, and not operator theft.
‘‘If there is theft indicated by shortages, you can’t assume that the operator assigned to the till that is short is the guilty operator. Maybe this operator was relieved and the relief operator was not set up with a separate till and float, and stole cash from the till.
Maybe a dishonest treasurer or manager took money from a cash pickup at the operator’s till. Even the employee setting up the floats at the beginning of the day could skim money.
‘‘Don’t assume that an overage means ‘everything is okay.’ ‘We’re over’ probably is just someone forgetting to enter sales, or not giving back enough change. An overage could mean that the operator responsible made numerous off-the-till transactions, but only took some of the money from these transactions, either to avoid suspicion by being over, or

Wells4689_c33_1

05/31/2007

313

recommendations to prevent future occurrences

313

because the operator couldn’t properly keep track of the amount he or she could steal to balance. ‘‘Don’t take a shortage and apply it to an overage, assuming that the treasurers made an error. The shortage could be the result of one operator theft, and the overage could be the result of another operator theft.’’
The group agreed that Alison completed all of the necessary steps to try to come up with a suspect, and her investigation produced results. She examined the operator reports. She looked at audit trail reports and video images. She was somewhat lucky in that Jeremy was not trying to cover up his theft by balancing his reported sales to his cash. Eventually his shortages would stand out, but someone had to be looking and questioning these shortages, as Alison eventually did. She also knew the limitations of the overt CCTV system; if theft was occurring, the perpetrator would try to conceal his or her actions from the camera. Therefore, the theft of cash would not jump right out of the video. Alison knew to look for odd body language; the suspect was likely not going to steal money right in front of the camera.
The treasurers’ sloppy work and lack of attention to detail cost Alison huge amounts of time during her investigation. The treasurers assigned cash to the wrong operators. They also failed to keep track of pickups and attempted to fix everything up in the office to make it appear that they were doing their job. The treasurers were partly responsible for these thefts going undetected.

Recommendations to Prevent
Future Occurrences
Monitor Financial Transactions Closely; Do Not Ignore Mistakes
To improve the cash accounting system, Alison realized that she must enforce the requirement that anyone who transacts sales is accountable for the cash attributed to the sales that he or she processes. All agreed that floats must be set up for each operator that transacts sales and that treasurers must properly attribute cash pickups to the operator responsible for the sales that resulted in the cash picked up. When this is achieved, the operator report becomes a meaningful document that can be used more effectively as an investigative tool.
Alison commented that she would have to make sure that her treasurers or managers do not merely ‘‘move things around’’ after the fact to make the report look the way it is supposed to.
The operator report should reflect exactly what happened by operator.
Hold Employees Accountable for Financial Transaction Mistakes
Going forward, Alison agreed to set up a routine to investigate the cause of operator shortages and overages on the operator report. As part of the routine, if the shortages or overages are the result of error, management must find out who is responsible and make them accountable. If an operator is the cause of the shortages or overages, management

Wells4689_c33_1

314

05/31/2007

314

chapter 33

would you like the special poutine

must make that operator accountable. If the operator continues to be out of balance, management must retrain, reassign, or dismiss if necessary.
Analyze Audit Trail Reports
Alison also agreed to set up a routine to analyze the audit trail reports for unusual transactions, especially voids, and to investigate these transactions with the corresponding video images. This routine includes documenting findings, and if there is sufficient evidence of theft, dismissing the perpetrator, and/or contacting the police.
Surprise Cash Audits
Alison stressed the importance of surprise cash audits on tills. Sara and Paul agreed, and indicated that operators who are stealing and aware that their tills can be audited at any time are under pressure to keep their tills balanced. This means they have to pocket money as they steal it—they don’t want to be caught with an overage in their cash drawer. And the more times an operator pockets money, the more likely he or she will be caught.
Surveillance with Many Vantage Points
Management pointed out the importance of watching operators as they process sales, preferably from a vantage point where the operators are not aware that they are being watched. Paul commented that management should look for red flags and make a note of anything they see that appears unusual. Later management can check the audit trail report and video images to confirm what they have seen. There are several things that management might see that they should investigate further. For example:


Unnecessary or suspicious handling of money



Items, even coins or bills, placed in a certain way that operators are using as counters to keep track of amounts they are about to steal from the cash drawer



Operators transacting sales with customers who appear to be friends



Operators serving other staff



Handshaking, ‘‘high-fives,’’ laughing, or any other familiar gestures that occur between operators and customers before or after a sale



Operators with till display windows fully or partially obstructed



An operator serving customers at a serving area other than at that operator’s assigned till

Other Measures
When the meeting concluded, the management team thanked the Audit and Loss
Prevention Department for their support. Paul summed up the overall recommendations requiring implementation to deter the specific type of theft perpetrated by Jeremy Hamel.

Wells4689_c33_1

05/31/2007

315

the outcome of the investigation

315

‘‘To instill in operators responsibility for the money that they are entrusted with, and to ensure that operators take true ownership of the responsibility for balancing their cash, and for transacting sales correctly, managers and treasurers will:


Assign every operator his or her own float;



Confirm all floats in the presence of the operator given the float;



Count all cash pickups in front of the operator at the time of pickup; and



Fill out a sign-off agreement with the operator as to the amount picked up.

‘‘These procedures provide accountability at the operator level for balancing recorded sales with the cash for these sales, and hold operators responsible for shortages and overages.’’ The Outcome of the Investigation
After this investigation, Alison had a huge challenge in trying to improve the performance of her treasurers. Unfortunately, she had to dismiss most of them over the next few months because they could not or would not carry out the responsibilities of their job. Alison implemented new training procedures for her treasurers, but she still finds it difficult to fill this position with competent staff.
A few months after Audit and Loss Prevention personnel met with the theater management team, Jeremy’s court date came up, and he pled guilty. He had no previous record or occurrences, so the judge gave him a conditional discharge, consisting of one year’s probation, during which he had to perform 200 hours of community service, maintain an 11 o’clock curfew, stay in school, keep the peace, and be on good behavior.
The judge took into account during sentencing that he had paid back the money he took from Century 16 Cinemas.
Jeremy was able to do so by selling his car.

Richard Elliott, CFE, is director, loss prevention, for a chain of movie theaters and entertainment complexes in Canada. He is a graduate of York University and has worked in the movie and entertainment business for over 30 years, primarily in the prevention, detection, and investigation of employee theft and fraud.

Wells4689_c34_1

05/31/2007

316

chapter

34

&
´
Three-Ring Circus: An Expose of a
Corporate Commission Embezzlement
DAVID A. SCHNEIDER

lthough fraudsters Alex Bedford, Van Nguyen, and Parviz Shah may have collectively acquired five college degrees at the baccalaureate level or higher, these 20-somethings were not clever enough to elude the experienced Special
Investigative Unit (SIU) at Centerstone Health Systems, a leading health care insurer in the United States. This trio, in varying roles, was involved in a scheme to embezzle funds from the company. While both Alex and Van were Centerstone Health employees,
Parviz’s involvement was different because he acted as an external co-conspirator. All three were close friends and they enjoyed playing basketball, experiencing the nightlife, and discussing their aspirations of owning big homes and expensive cars in a ritzy suburb just north of Los Angeles.
Alex, the ringleader, took pleasure in flaunting his muscular build and natural intelligence. He had a jovial personality and was admired by many of his peers. Yet he did not hesitate to let others know that he was the one in charge. He was the father of a young daughter. Even though he was no longer with his child’s mother, the two proud parents jointly paid for her private school. Alex was an eight-year Centerstone Health employee who earned his bachelor’s degree in business administration during the day while working the swing shift at night. Soon after completing his degree, he began working toward an MBA with a concentration in finance at a pricy private university. Alex was in the same department all eight years of his employment with Centerstone Health, and he reached the distinction of unit lead, responsible for customer service, processing member enrollments, and various supervisory functions. Alex was known to be very technically savvy, and he knew all the ins and outs of his business unit’s operations. He began to get bored with his job so he decided to obtain his Life & Health sales license in hopes of transferring to Centerstone Health’s in-house sales department. Once he became licensed, he applied for the job. However, Alex was unsuccessful in securing a position so he remained in his existing role.
In appearance and demeanor, Van was Alex’s polar opposite. Van was of very slight stature, and he was more of a follower than a leader. Nevertheless, he had no intellectual

A

316

Wells4689_c34_1

05/31/2007

317

three-ring circus

317

shortcomings. He received his undergraduate degree in history from one of the top universities in the University of California system and considered going to law school. Van was from a very close-knit family. Growing up, he saw how hard his immigrant parents worked to make a living in the United States. His father, who unquestionably was his hero, was a manufacturing manager always worried about the possibility of losing his job. Van’s parents knew how important owning real estate was, and, over the years, they were able to acquire three single-family homes, one of which Van was renting.
Parviz was quite arrogant. He was athletically built, sported hoop earrings in both ears, had bleached blond hair, and wore expensive clothes and a heavy dose of cologne. He also was from an immigrant family, but unlike Van, whom he had met and befriended in high school, his family lived a much more lavish lifestyle. His mother was an extremely successful real estate agent and his father was an engineer who owned several small businesses in town. In his high school days, Parviz learned quite a bit about computer programming. Instead of attending college immediately after graduation, he began to work for his father as a software engineer. During this time, he also started his own
Internet-based car poster business. He was known to be an avid fan of the science fiction trilogy The Matrix, starring Keanu Reeves and Laurence Fishburne. He even had a black
Infinity G35 coupe with the personalized license plate ‘‘MATRIX.’’ Parviz decided to attend college about two years after graduating high school. He attended one of the nation’s most elite technical universities and graduated with double majors in economics and computer science. At the time of the investigation, Parviz was finishing his master’s degree in mathematics at the same university.
Centerstone Health is a commercial health benefits company. It offers medical insurance to large and small employers, individuals and families. It has over 40,000 employees and major operations in many states. The company’s products are marketed by a network of independent insurance agents and an in-house sales team. When an individual seeks medical insurance, he or she can apply for coverage in one of three general ways: by contacting an independent licensed agent, by calling the company’s internal sales department, or by completing an application online or submitting a paper-based enrollment application.
The SIU is led by a former federal prosecutor. Each of the company’s four geographic regions is managed by a director of investigations, two of whom are retired from the
Federal Bureau of Investigations (FBI). At the time of his retirement, my manager, Jim
Greer, was the supervising agent in charge of one of the local FBI offices. Each director of investigations has one investigative analyst and several investigators. I am the investigative analyst for the western region and have been employed by Centerstone Health for nearly
10 years, of which the last 3 have been in the SIU. One of my primary roles is leading largescale data-mining studies and performing statistical analyses on medical claim payments, but I am always excited when I’m assigned the occasional investigation. The SIU is responsible for all internal and external white-collar crimes perpetrated against
Centerstone Health. This largely includes physician and hospital fraud, but also consists of broker, vendor, and employee frauds.

Wells4689_c34_1

318

05/31/2007

318

chapter 34

three-ring circus

Secret Agent
On an unusually crisp September morning, I received a call from a manager, Gracie
Leonard, within one of my organization’s membership departments. She stated that her business unit had recently received information from several upset insurance agents and one new policy holder complaining that the agent of record on file with the company was someone they had never heard of. The agents were angered because they wanted their commissions. The new policy holder, Mr. Donald Strickland, was concerned because he felt someone had inappropriately obtained his personal information. Gracie knew something was not right. She told me the common denominator was an agent named
Parviz Shah. Parviz’s name appeared as the agent on these particular enrollment applications, and he had skyrocketing commissions in the five months since becoming appointed to sell insurance with Centerstone Health.
Mr. Strickland had sent a long letter to Gracie detailing how he signed up for his insurance with a close family friend who had been his agent for a long time. Parviz Shah,
Mr. Strickland proclaimed, was someone he had never heard of, and he demanded to know how that person was listed as the agent of record on the enrollment application. Mr.
Strickland provided a copy of the documents he completed with his agent when he applied for his insurance policy. Just as he stated, the agent whose signature was on his version of the application was not Parviz’s. Mr. Strickland, along with his agent, took it upon himself to phone Parviz to confront him about the matter. As a result Parviz sent Centerstone Health a letter releasing himself as the broker of record on Mr. Strickland’s insurance policy.
According to Mr. Strickland, Parviz claimed that there must have been some sort of mixup and agreed to give the commissions to the original agent. Nobody was told how this socalled mix-up occurred, but Mr. Strickland was more or less satisfied when the matter was resolved. In insurance sales, it is almost unheard of for an agent to surrender his or her commissions. That struck Gracie as rather odd because commissions are the lifeblood of all insurance salespeople. She advised me that the management team had spent two weeks examining the situation. She had no idea how Parviz, a nonemployee independent sales agent, would be able to obtain copies of enrollment applications. Although foul play was suspected, the management team had no success in determining how, if, and by whom a fraud was perpetrated. Gracie needed my help and she needed it quickly.

Mail Room Mystery
I suspected that this was an inside job. The timing was ideal because I was training the newest addition to the SIU. It was Gary Pultzer’s second week with the company, and, as it turned out, this was the perfect case to acquaint him with occupational fraud. I told
Gary that my immediate impression was that Parviz must have had an accomplice who worked for Centerstone Health. How else would he be able to become the official agent of record on these insurance policies, especially when the policy holders had never heard of him?

Wells4689_c34_1

05/31/2007

319

mail room mystery

319

Online, Gary and I and looked up Parviz’s licensing information with the California
Department of Insurance. He was a newly licensed Life & Health agent. The Department of Insurance database also showed that Parviz was authorized to transact on behalf of
BN&S Insurance Agency, LLC. I then had Gary go to the California Business Portal webpage to do a search on BN&S. His research showed that Parviz was the company’s registered agent and both a post office box and a physical address were listed on the documentation. I then ran a business search on the physical location. The address was residential and occupied by Alex Bedford.
Who was Alex Bedford? Was he our culprit? A search of Centerstone Health’s employee directory revealed that Alex was not only an employee, but that he also worked in the Membership Department within the same business unit as Gracie, the manager who had called me earlier that morning. The California Department of
Insurance Web site also showed that Alex, like Parviz, was a licensed Life & Health agent. Further, Alex had been appointed to sell insurance with two of Centerstone
Health’s competitors. Because of the obvious conflict, that fact alone could be grounds for termination. I wondered if he had disclosed this information on his annual employee conflict-of-interest form. I then theorized that BN&S stood for the initials of
Alex Bedford, Parviz Shah, and an unknown third party whose last name began with the letter ‘‘N.’’ At this point, Gary and I high-fived and began to document the information we had gathered so far.
We were off to a fast start in cracking the case. Although we felt confident that Alex and Parviz were in cahoots to embezzle commission payments from Centerstone
Health, we needed to complete the puzzle. What that meant was establishing their precise modus operandi. I called Gracie back and scheduled a time to meet with her the following day. She and Alex worked in a Centerstone Health building 20 miles northwest of my office. Gracie was not Alex’s boss, but she was able to provide a detailed description of the business unit’s operations and Alex’s job responsibilities. She explained that her department used an imaging system to scan and process enrollment applications. That meant that when an individual or family applied for insurance, their paper-based enrollment application was scanned into a software program; this made all internal operations paperless. Once the enrollment application was scanned, it was electronically forwarded to a queue to be reviewed for completeness. If the enrollment application was missing information, such as a signature or a question that was left unanswered, it was electronically sent to a holding queue until the missing or incomplete information was obtained. Enrollment applications that were not missing information were placed in a production queue to be processed.
Now that I was knowledgeable of the unit’s operations, it became apparent to me that
Alex must have been intercepting enrollment applications before they were imaged. That way he would be able to affix Parviz’s name and license number on them and place the applications back into the mail. Like all others working in his business unit, Alex was not authorized to possess paper-based enrollment applications. Only mail room employees were allowed to handle the paper versions that were received in the mail every morning

Wells4689_c34_1

320

05/31/2007

320

chapter 34

three-ring circus

and then processed into the imaging system. The papers were scanned daily up until
3:30 p.m. when the mail room shift ended. Those not scanned then were handled the following morning. Gary and I learned that the door was always left unlocked after the mail room employees left for the day. We already knew that Alex worked the swing shift. His regular hours were between 4:00 p.m. and 12:30 a.m. I surmised that Alex was sneaking into the basement where the mail room was located and then either inserting Parviz’s agent information on the paper enrollment applications or taking the applications home with him and doing the same.
Prior to leaving Alex’s work site, I called Centerstone Health’s Human resources
(HR) Department. I sought to obtain copies of his employment record, including his yearly performance evaluations and conflict-of-interest disclosures. Human resources told me they could have the information ready for me to pick up in two hours. Gary and I decided to eat sushi for lunch at a nearby Japanese restaurant before heading to the
HR office, which was located in a different Centerstone Health office seven miles north of Alex’s building. Upon arrival, we perused the documents. Alex, for the most part, received glowing yearly reviews and above-average salary increases. However, his evaluations contained some noteworthy entries. For example, his supervisor mentioned that he was a ‘‘whiz kid’’; he learned and mastered new responsibilities so quickly that he became bored shortly thereafter. He also had to be warned about his excessive chatting with friends in other departments on several occasions. Overall, the content of Alex’s evaluations would lead most people to believe he was nothing less than a stellar employee. More important, the review of Alex’s conflict-of-interest form showed that he did not disclose that he received his Life & Health insurance agent’s license just over a year earlier and that he was authorized to do business with two of
Centerstone Health’s competitors. I was almost certain that Alex’s omission of this fact would be all Centerstone Health needed to terminate his employment, but I considered this a side note for the time being because I needed to complete the investigation at hand.
Gary and I left the HR office and traveled several more miles to Alex’s residence, which also was BN&S Insurance Agency’s business address, to take pictures. It is standard practice to document an investigation as thoroughly as possible. Therefore, when pictures are included in the final investigative report, it helps to give credence to the amount of detail and effort undertaken in putting the case together. Afterward, Gary and I decided to call it a day and we hopped on the highway for a long drive back to our office. As I dropped him off at his car, he expressed how eager he was to get started tomorrow to continue the investigation. I felt the same way, but also was personally thrilled to be a part of the rookie’s excitement. The next day came and I spent a good portion of the morning on the telephone with the Centerstone Health Information Technology (IT) department. After several hours, I was granted access to the systems Alex used, including his e-mail account. I pored through the contents in hopes of finding incriminating evidence. One such communication stuck out, which was sent to Alex by another worker asking why

Wells4689_c34_1

05/31/2007

321

mail room mystery

321

some of the employees in his unit had been electronically forwarding applications from the production queue back to the holding queue when, in fact, they were not missing any information. Alex received and viewed the e-mail two days earlier, but he had not yet responded. I decided to take a look at the imaging system for myself.
As I was logging in, I noted that the password given to me by IT was the same as my normal network logon ID and there was no way to change it. I gave IT another call and was informed that all imaging system users’ passwords were set to match their network IDs. That meant that any employee could log on to the imaging system as another employee. Therefore, the system’s audit log would not accurately reflect who was handling the application. In my mind, this was a serious internal control issue.
I ran a search for all applications that were transferred from the production queue back to the holding queue. There was one thing in common: The majority were those in which the insurance applicant did not use an agent. These are called nonbrokered applications. For Centerstone Health, this is highly valued business because the company does not have to pay a commission. Further, of the thousands of insurance applicants applying for individual or family coverage every month, about 15% or so do not use an agent. I was on to something! If Alex was smart, and we knew he was, he would affix Parviz’s name and license number to only those applications. Otherwise, the true agents would complain when their commissions were not received. Why then did Parviz’s name appear on Mr. Strickland’s insurance policy? To help me determine why, I called the Centerstone Health sales manager and obtained Parviz’s complete book of business (an agent’s list of his or her clientele information, such as each subscriber’s name, policy ID number, commissions paid, etc.). Parviz had only been licensed to sell insurance for Centerstone Health for five months, but he had an astounding 250 policies from which he was receiving commissions. The total amount paid to Parviz in these five months was $13,072. Over the course of the next day and a half, Gary and I called a sample of 50 of Parviz’s ‘‘clients.’’ Each and every one of them indicated that they had never heard of Parviz and that they applied for their health insurance policies without an agent. My best guess to why Alex affixed Parviz’s name and license number on Mr. Strickland’s insurance application was that he made a mistake—a costly one. Up to this point I believed that Alex was sneaking into the mail room to obtain physical copies of nonbrokered enrollment applications to add Parviz’s name before they were scanned. Now I had to consider the additional possibility that he too was logging on to the imaging system with other users’ IDs. I figured that it would be easier for Alex to search for them there, as opposed to the mail room, because these applications were rather rare. How then would Alex insert Parviz’s name and license number on those that had already been scanned? I later learned that, within the imaging system, Alex had found a way to cancel the original application. He then had a copy rescanned, but with Parviz’s name and license number inserted. Alex had enough know-how to circumvent this vulnerability. It was now time to take the investigation to the next level.

Wells4689_c34_1

322

05/31/2007

322

chapter 34

three-ring circus

Case Dismissed
To conclude our work, I sought to interview Alex’s former manager, Paula Lee, who had recently started a new position within a different division of the company. Next we’d interview Alex. Before that could be done, I needed to obtain the blessing from
HR, Legal, and Ethics & Compliance. I arranged a conference call between these parties. The HR manager, Neil Honna, said that he was apprehensive about Paula’s integrity as a result of previous, unrelated dealings with her. Neil was concerned with the possibility that she would relay information back to Alex before he was interviewed. So I suggested that we arrange simultaneous questioning of both of them at their two respective work sites. The plan was for me and Randy, a colleague
SIU investigator, to interview Paula while Jim and Gary interviewed Alex. The attorney from the Legal Department felt comfortable with this arrangement. However, he recommended that Neil also should be present during Alex’s interview. Finally, the ethics & compliance department wanted to be notified immediately about the outcomes, and I agreed to keep them posted.
Randy and I met with Paula at precisely 4:00 p.m. It was a surprise interview. Much to my astonishment, she was entirely cooperative and extremely helpful. She told us that Alex was a ‘‘big part of the team’’ and that he was used as a ‘‘floater’’ to cover other job functions when the unit was understaffed. He was described as extraordinarily knowledgeable of all of the business unit’s processes and procedures. When Paula was apprised of the allegations against Alex, she stated that if any of her former employees were intercepting enrollment applications, she would suspect him. He exuded such an aura of confidence that she would not be surprised if he thought he could get away with it. She explained that he had been involved in the initial testing and subsequent implementation of the imaging system just several years earlier. In fact, she described
Alex as the ‘‘king of the imaging system.’’
I then asked Paula if she knew if our suspect had any friends in the company whose last name began with the letter ‘‘N.’’ Without hesitation, Paula named Van Nguyen.
She explained that Van began working for Centerstone Health in the Membership
Department three years earlier. He then received his Life & Health agent’s license and transferred to Centerstone Health’s in-house sales department in July of the following year. Paula recounted that both Van and Alex applied for sales positions, but only Van received the transfer. He terminated his employment with Centerstone Health in April of the next year to care for his father, who had suffered a heart attack. Van’s departure from Centerstone Health came among a great deal of speculation from fellow sales employees concerning his incredible sales performance. Paula explained that Van was rumored to have been receiving ‘‘inappropriate sales referrals’’ from friends in his former department. This was one of those ‘‘aha!’’ moments; one additional and previously unknown piece of the puzzle was about to be put into place. During the time Van worked as an in-house sales agent, Alex was intercepting nonbrokered enrollment applications and sending them to Van—much like what was taking place at

Wells4689_c34_1

05/31/2007

323

case dismissed

323

present between Alex and Parviz. I began to draw a mental timeline and noted that Parviz’s first commission check was paid the month after Van terminated his employment. Paula told us that to her knowledge the rumors surrounding Van were never established to be true. Last, but certainly not least, Paula revealed that just three weeks earlier, Van was rehired by the original membership department where he worked prior to his transfer to in-house sales. This was the same department that Alex worked in. Randy and I wrapped up the interview and rushed to Alex’s work site to share what we learned with Jim and Gary.
When we arrived 15 minutes later, Alex was still being interviewed. I took out my cell phone and sent Jim a text message indicating that I had important information about the previously unknown third player whose last name began with an ‘‘N.’’ A few minutes later, Jim emerged from the interview room, and I briefed him on everything
Randy and I learned from the interview with Paula. The information came at the right time because Jim stated that Alex was being a ‘‘punk’’ and that, so far, he had not admitted to any wrongdoing or even knowledge of who Parviz was. Jim, with his
30 years of FBI experience, then went back into the interview room. A few minutes later, Neil scurried out. He told me that when Jim mentioned Van, Alex said that he quit working for Centerstone Health five months prior. He omitted the fact that Van had just been rehired three weeks earlier and that they were both working in the same unit. I followed Neil while he looked up Van’s employee file and confirmed that he was recently rehired. Neil then went to Van’s cubicle and asked him to come to Neil’s office and wait.
In the meantime, Neil headed back to the unit where Alex and Van worked and gathered their personal belongings. He returned to the interview room with Alex’s briefcase and asked him if it contained any Centerstone Health documents. Alex confirmed that it did contain enrollment applications and premium checks from applicants, but said that he was allowed to take work home with him. This, however, was not the case. He should not have had possession of any of these documents. When Neil confiscated the papers, Alex stated that he might need an attorney. Neil told Alex that he was free to leave at any time, but advised him that as a Centerstone Health employee, it would be a good idea to finish the interview. That is when Alex admitted he knew Parviz and that he was introduced to him by Van. For the rest of the interview, Alex remained mostly tight-lipped, but he did state—still not admitting any wrongdoing—that he was a
‘‘venture capitalist’’ and that he gave Parviz $3,000 to start BN&S Insurance Agency. Neil immediately placed Alex on administrative leave, and he was escorted from the building by
Centerstone Health security personnel.
Jim, Neil, and I then interviewed Van. The look on his face was of utter fright. He knew the real reason he was being questioned. After Jim and I introduced ourselves as
SIU fraud investigators, Van asked if he could use the rest room, and Neil was kind enough to escort him there. When they returned, Jim and I cut to the chase.
Ultimately, while Van admitted that he had been friends with Parviz since high school, he refused to admit to any past or current misconduct in relation to embezzlement of

Wells4689_c34_1

324

05/31/2007

324

chapter 34

three-ring circus

commission payments. Neil placed Van on administrative leave pending further investigation. I was not surprised to learn that Alex and Van resigned the following day, prior to what would have been their official dismissal. I worked with the sales manager to develop a letter notifying Parviz of his termination as a Centerstone Health sales agent.
In the letter, we also demanded the repayment of all commissions to date. In the meantime, Gary scheduled a meeting with the California Department of Insurance to report the trio and pursue revocation of their licensure. When they decided to dismiss the case as ‘‘too difficult to prove,’’ Jim contacted the local district attorney’s office, which also declined the case because it had bigger fish to fry. Last, I entered a summary of the case into an online intelligence-sharing system developed by LexisNexis in partnership with the National Health Care Anti-Fraud Association (NHCAA). This electronic database allows corporate members of the NHCAA, such as Centerstone
Health, as well as a variety of law enforcement agencies, to search for fraud schemes, trends, and perpetrators.

Lessons Learned
When I logged in to my computer the following Monday morning, I came across something quite ironic. Just days before Alex resigned, the general manager of his business unit awarded him with the prestigious honor of employee of the quarter. His picture was posted on the Centerstone Health intranet homepage, and there was an article about how crucial he was to the company’s success. For this honor, Alex was given a $1,000 bonus.
Gary and I joked that we needed to create an SIU Wall of Shame in our office and post
Alex’s picture, along with photos of Van, Parviz, and fraudsters from previous investigations. We were shocked that Alex was so highly regarded among his peers and management. It must have been even more shocking to the general manager who, after he learned of the embezzlement, had to send notification letters to the 250 individuals and families whose personal information was compromised in the process.
In yet another ironic event, I received a call from the Membership Department director the month following Alex’s resignation and learned that he had been hired by one of Centerstone Health’s competitors. SIU investigators regularly share information with those at competing companies. I advised one of my investigative contacts at
Alex’s new company to read my entry in the online intelligence-sharing system. Alex had been hired as a manager for another company and was earning a significantly higher salary than he had been at Centerstone Health. In addition, Alex had hired his friend and fellow fraudster, Van. My investigative contact opened a case on Alex and
Van, but she ultimately was unable to have them terminated because they were not dishonest on their job applications. Alex and Van were smart enough to terminate their employment with Centerstone Health before they were officially fired. That way, when asked by a potential new employer whether they had ever been fired, they could honestly answer no.

Wells4689_c34_1

05/31/2007

325

recommendations to prevent future occurrences

325

The most important lesson I learned is that I have little control over the decisions as far as prosecution is concerned. My investigation may have been professionally executed, but there is no guarantee law enforcement will be interested in taking the case. It was not easy to swallow the fact that Alex had moved on to greener pastures with a new company. It also was upsetting that Parviz never responded to our demand letter for repayment of the
$13,072. However, I have a personal sense of satisfaction that I was able to stop this commission embezzlement relatively early. If it were not for Mr. Strickland, an astute new policy holder, the fraud could have continued for a very long time. This fact demonstrates the importance of the consumer in detecting fraud. Using a statistical technique called simple linear regression, I projected that Parviz would have received $204,342 over the next 12 months had the scheme gone on.

Recommendations to Prevent
Future Occurrences
Physical Safeguards
The fact that the mail room was left unlocked after business hours was a major concern.
This policy needed to be changed. Enrollment applications contain Protected Health
Information (PHI) under the Health Insurance Portability and Accountability Act
(HIPAA). Specific HIPAA provisions require health care insurers to control physical access of PHI against inappropriate acquisition.
Technical Safeguards
There was a serious internal control issue with the imaging system used by Alex’s department. The password was set to be the same as the user ID, so any employee had the ability to log on to the imaging system of another. If anyone did this, the system’s audit log would not accurately reflect who was processing enrollment applications. The obvious recommendation is to require legitimate passwords.
Processing of Nonbrokered Applications
Nonbrokered enrollment applications are good business for Centerstone Health because no commissions are paid. I recommended that nonbrokered applications be assigned a dummy broker number, such as 99999, before the application is scanned into the imaging system. That way, it will be clear that the insurance applicant did not use an agent.
Segregation of Duties
Alex was a jack of all trades. He was cross-trained in every facet of his department’s operations, and this enabled him to perpetrate this scheme. For example, the reason he

Wells4689_c34_1

326

05/31/2007

326

chapter 34

three-ring circus

knew the imaging system’s vulnerabilities was because he was the membership department liaison with IT. As the unit lead, Alex also was the person to contact whenever there was an operations problem that needed to be resolved. His responsibilities were simply too vast.

David A. Schneider, CFE, is an investigative analyst in the SIU of a leading health care insurer. He is responsible for fraud detection and investigation through data mining and statistical analysis. Mr. Schneider has uncovered massive fraud schemes, including those perpetrated by organized crime rings. He enjoys spending time with his beautiful wife and newborn daughter.

Wells4689_c35_1

05/31/2007

327

chapter

35

&
One Bad Turn Deserves Another
FORREST BOWMAN JR. AND CHARLES F. G. KUYK III

obert Anthony Walker was striking in appearance and demeanor. At six feet seven inches tall, he was athletic, highly intelligent, and possessed a charming personality.
He attended a small liberal arts college in mid-America on a basketball scholarship and graduated with honors. The most significant facet of his personality was not so readily apparent, nor did he specifically disclose it: He was a sociopath.
As an undergraduate, he served a paid internship as an aide to a member of the state legislature. Robert went on to attend the state law school, from which he graduated in the top third of his class. He and his wife, a CPA with a major accounting firm, had one child.
They had just moved from a neighboring state when he applied for a position as the chief
´
´ benefits officer of the Public Employees Pension Fund. On his resume, he stated that that he was previously employed as counsel and manager of the Corporate Benefits
Department of a highly regarded medical devices manufacturer.
The Public Employees Pension Fund was created by the legislature to administer investments and pay benefits to employees of the state and its political subdivisions after specified years of service. The fund is managed by a five-member board of trustees appointed to staggered terms by the governor. The statute sets the qualifications of the five members, no more than three of whom may be of the same political party. The board, with the approval of the governor, appoints an executive director, who is in charge of the dayto-day administration. The board and the executive director also administer several other retirement and death benefits for public employees. The primary fund consists of contributions from governmental employers, as well as an annuity savings account paid for by member contributions.
When Robert applied for employment as the chief benefits officer, the fund had 150,000 active accounts, over 50,000 benefit recipients, and managed assets in excess of $9 billion.
As is often the case with quasi-governmental agencies with tight operating budgets, the fund had a long history of significant understaffing and underfunding. It had just recently added an internal audit function, staffed with one employee. To keep operations running and to minimize expenses, the fund made extensive use of temporary employees for whom no background checks were required. The fund’s business processes had been repeatedly criticized in audits by reputable public accounting firms and by the state audit agency.

R

327

Wells4689_c35_1

328

05/31/2007

328

chapter 35

one bad turn deserves another

Governor, We Have a Problem
The hometown newspaper in the capital city ran an article in which it listed the names, positions, and annual salaries of a number of state employees, including the recently hired
Robert Walker. The next day the statehouse reporter received an anonymous call suggesting she explore the records of the federal court in a large city in an adjoining state.
After following that lead, the reporter called the governor’s press liaison to ask if he was aware that Robert had been convicted of federal bank fraud involving the use of stolen identification. That same evening, I (one of the coauthors of this study) received a call from counsel at the governor’s office asking if he could come in the next morning to discuss an urgent matter. As an attorney with more than 40 years of criminal defense and civil litigation experience, I knew it was serious.
The governor ordered an investigation to explore how the fund went about hiring
Robert. He also asked that it include the organization and supervision of an investigative audit to determine what vulnerabilities existed at the fund and to what extent any members’ identities had been exploited. Within hours of the disclosure of Robert’s record, a criminal investigation was opened by the U.S. Attorney. The agencies involved included the United States Secret Service, the Special Investigations Division of the State
Police, and the Criminal Investigation Division of the Internal Revenue Service, all working as a team. I also retained the services of a seasoned forensic accounting practice of a large firm. This engagement was led by the other coauthor of this study, a forensic accountant (with certified fraud examiner and certified public accountant credentials) with extensive investigative experience.