FRAUD

DETECTION
GUIDE
By SALIH AHMED ISLAM
1
 Table of Contents
FRAUD DETECTION GUIDE: SAMPLE 1 .................................................................................................................3
FRAUD DETECTION GUIDE: SAMPLE 2 .................................................................................................................8
FRAUD DETECTION GUIDE: SAMPLE 3 .............................................................................................................. 16

2
 FRAUD DETECTION GUIDE: SAMPLE 1

HOW CAN FRAUD BE DETECTED?

Detecting fraud is a matter of acknowledging that:

• Fraud exists.
• Any organization can become either a victim of fraud or a perpetrator of fraud.
• Certain weaknesses in internal controls and human character can be conducive to fraud.
• Certain tests of internal controls and tests of the organization's motivational environment can provide some
insight into the possibility of fraud in that environment.

An effective fraud auditor should be able to do the following competently:

• Conduct a review of internal controls.
• Assess the strengths and weaknesses of those controls.
• Design scenarios of potential fraud losses based on identified weaknesses in internal control scenarios.
• Identify questionable and exceptional situations in account balances.
• Identify questionable and exceptional transactions (too high, too low, too often, too rare, too much, too little,
odd times, odd places, odd people, etc.).
• Distinguish between simple human errors and omissions in entries and fraudulent entries (intentional error,
such as recurring small errors vs. unintentional random error and ignorance).
• Follow the flow of documents that support transactions.
• Follow the flow of funds into and out of an organization's account.
• Search for underlying support documents for questionable transactions.
• Review such documents for peculiarities such as raised amounts; forgery; counterfeiting; fake billings;
invoicing of claims; destruction of data; improper account classification; irregularities in serial sequences,
quantity, pricing, extensions and footings; and substitution of copies for original documents.
• Monitor variances, exceptions and oddities in accounting transactions and account balances – debit balances
in payables, credit balances in receivables, out-of-cycle and out-of-pattern transactions, and so on.
• Be aware of management; administrative; and organizational policies, procedures and practices.

The questions the fraud auditor has in mind are:

• Where are the weakest links in this system's chain of controls?
• What deviations from conventional good accounting practices are possible in the system?
• How are offline transactions handled, and who can authorize such transactions?
• What would be the simplest way to compromise this system?
• What control features in this system can be bypassed by higher authorities?
• What is the nature of the work environment?

Auditing for fraud is more of an intuitive process than a formal, analytic methodology. Skill depends on the right
mindset (thinking like a thief, probing for weaknesses) and practice. One seeks relevant information, organizes it
in some meaningful way, and then sees the pattern it creates. Every fraud has its unique aspects. All thieves do

3
not think alike. They tend to be opportunists. Given a set of circumstances that allow them to steal, they take the
easiest way.

Detecting fraud is possible:

• Through the traditional control concepts of separation of duties and audit trails
• Through periodic financial and operational audits
• By gathering intelligence on the lifestyles and personal habits of employees
• Through allegations and complaints of fellow employees
• By logging exceptions to prescribed controls and procedures
• By reviewing variances in operating performance expectations (standards, goals, objectives, budgets and
plans)
• Through the intuition of the embezzler's superiors
• Through generalized suspicion (neurotic paranoia)

In time, all frauds are revealed by auditing techniques such as counting, confirmation, inspection, observation,
comparison, inquiries, ratio analysis, account analysis and internal control testing.

USING COMPUTER AUDIT RETRIEVAL FOR FRAUD DETECTION

If auditors know specific symptoms of fraud, which would be reflected in data files, computer audit retrieval
TESTING
techniques can beTHE FILE
used to searchSEQUENCE
for symptomsFOR OUT
in huge OF ORDER
quantities ITEMS
of data. Once identified, these symptoms can
be researched and resolved. The process of identifying symptoms, which could reflect fraud, researching them,
IDENTIFY DUPLICATES
and following through to a satisfactory conclusion will result in a better understanding of what is going on in the
system in addition to
IDENTIFY potentially detecting fraud.
GAPS
LISTofMISSING
Examples ITEMS
using computer audit retrieval for detection of fraud include:
• Search for duplicate
PERFORM payments.
AGING OF DATA FOR OUT OF PERIOD ITEMS
• Analyze voids and refunds by employees, using passwords or employee identification numbers.
• Match the vendor address to the employee address.
• Search for duplicate addresses within files.
• − IDENTIFY
Payroll
TRANSACTIONS THAT ARE ODD AS TO:
− Vendor
- − TIME
Accounts
(OF receivable write-offsMONTH, YEAR, OR SEASON)
DAY, WEEK,
− Pension
- FREQUENCY (TOO MANY, TOO FEW)
− Annuity
- − PLACES
Welfare (TOO FAR, TOO NEAR, AND TOO "FAR OUT")
•- Match
AMOUNT (TOO
employee HIGH,
addresses withTOO LOW,ofTOO
addresses CONSISTENT,
past due accounts. TOO ALIKE, TOO
DIFFERENT)
• Match addresses of city or state employees with addresses of welfare recipients.
• Match active payroll files with disability, pension or workers’ compensation claim files.
•• Analyze
USE the
ACL,use ACCESS, OR OTHER AUDIT SOFTWARE TO GENERATE THE
of override transactions.
FOLLOWING TYPES OF FRAUDaccounts.
• Analyze file maintenance on employee DETECTION REPORTS:
• List large payments to individuals.
• - ListDORMANT ACTIVITY
loans in excess ANALYSIS
of collateral or loan value.-- HIGHLIGHTS IMPROPER TRANSACTION
ACTIVITY ON DORMANT ACCOUNTS

- DORMANT RECALCULATION -- HIGHLIGHTS ACCOUNTS THAT SHOULD BE

4 CLASSIFIED AS DORMANT AND ARE NOT PROPERLY CLASSIFIED.
MISCLASSIFYING ACCOUNTS ALLOWS IMPROPER ACTIVITY TO TAKE PLACE
• List vehicles with high maintenance costs.
• Identify scrapped inventory, followed by reorders.
• Foot general ledger and files such as accounts receivable, bank account demand deposits, overdraft accounts,
etc.
• Identify employee accounts with large numbers of transactions or large dollar volume.
• Analyze employee overtime.
• Match the current payment listing to the vendor master list.
• Search for large payments to grantees, followed by no further payments.
• Analyze sales returns after the end of an accounting period.
• Match current table files used in financial programs to previous table files.
• Search for credit balances in inventory.
• Search for types of transactions known to be high exposure:
− Large health claim payments to individuals
− Large signature loans
− Write-offs to employee accounts
− Early life insurance claims
− Cash payments by governmental or commercial customers granted special rates
• Match land records with producing property records maintained by the states.
• Match accounts payable with past-due accounts receivable.
• Match the date of use of computer passwords with employee time off.
• Search for patterns:
− Individual customer accounts written off or adjusted down every month repeatedly
− Groups of customers (by branch or salesman) that changed their paying habits
− Sales returns or cancellations after a sales contest
− P.O. boxes used as shipping addresses
• Search for invalid social security numbers.

USING DATA ANALYSIS FOR FRAUD DETECTION

• Use ACL audit software to perform the following fraud detection tests of data files:
− Test the file sequence for out-of-order items.
− Identify duplicates.
− Identify gaps.
− List missing items.
− Perform aging of data for out-of-period items.
• Identify transactions that are odd as to:
− Time (day, week, month, year or season)
− Frequency (too many or too few)
− Places (too far, too near and too "far out")
− Amount (too high, too low, too consistent, too alike, too different, etc.)

5
• Use ACL, Access or other audit software to generate the following types of fraud detection reports:
− Dormant Activity Analysis: This analysis highlights improper transaction activity on dormant accounts.
− Dormant Recalculation: This calculation highlights accounts that should be classified as dormant and is
not properly classified. Misclassifying accounts allow improper activity to take place without an audit trail.
− Negative Balances Report: This report examines all dollar account balances on customer account records
for evidence of negative values, for example, unapplied insurance, partial payments, withholdings, etc.
− Internal Transfers Analysis: This analysis examines the movement of money between two or more
customer account records for evidence of skimming or removal of funds from dormant or inactive customer
account balances. This routine highlights movement to unrelated accounts and groups recipients by
common keys, such as similar addresses.
− Suspect Duplicate Addresses Analysis: This report analyzes similar addresses and related addresses
that have been changed in a minor way so that they will not be detected as duplicates through normal sort
operations. For example, regardless of how post-office box numbers are represented, this routine will relate
to them. Second and third address lines are flip-flopped, minor differences in street names are ignored,
temporary and secondary addresses are matched, and so on.
− Transaction Monitors: This task highlights out-of-pattern and unusual financial transaction activity,
including irregular supervisory overrides, activity against accounts on "hold" and unusual error corrections.

PREPARE A TREND ANALYSIS

Chart operating data for prior periods’ years to evaluate the reasonableness of current income or expenses. Here
are some examples:
• An auditor charted sales and freight costs for seven years. Sales had increased by 130%, but outbound freight
– which had a direct relationship to sales – was up 300%. The auditor checked freight bills for several months
and found that they did not add up to the inflated amount. Investigation found that amounts purportedly for
freight had been stolen.
• An auditor charted sales to customers and sales to employees. The first was increasing dramatically, mirroring
the company's excellent growth. The sales to employees were decreasing. Investigation disclosed no control
over sales to employees. The office manager had been pocketing a good deal of cash received from
employees.

PREPARE A PROPORTIONAL ANALYSIS

Proportional analysis is a method that appraises certain income and expenses by relating them to other income
and expenses. For example, the cost of shipping cartons should bear a proportional relationship to the number of
units sold and shipped.

One auditor, within a few hours after he arrived at a brewery, discovered that the number of hops charged to
costs was twice the amount necessary to produce the annual output of beer. Investigation disclosed that the thief
was the treasurer. He was paying for hops delivered to another brewery in which he had an interest.

Some proportional comparisons are based on ratios from other organizations or on industry averages. Trade
associations often compile average costs for the information of their members. Often personal experience
provides indicators of what is reasonable or unreasonable.

Internal auditors must be cautious when using these analyses. Variables may enter into the calculations – such as
a great deal of overtime pay in one period and none in others. Moreover, most of these ratios are limited to
relating only two variables to each other. Used cautiously, such analyses may provide useful indicators, with this
additional caveat: trend and proportional analyses do not produce substantive evidence. They do show where to
investigate further.

6
 REVIEW OF OPERATIONAL AND PERFORMANCE REPORTS

Review operational and performance reports for out-of-norm situations:

• Review standards, budgetary and statistical, and investigate all material deviations.
• Use quantitative and analytical techniques (time series analyses, regression and correlation analyses, and
random sampling) to highlight aberrant behavior. Develop indicators such as space used, the time required,
weight limitations imposed, usage and output compared.
• Compare performance with industry norms as well as with the performance of comparable profit centers within
the organization.
• Identify critical process indicators: melt loss in smelting, death loss in feedlots, rework in manufacturing and
assembly, and gross profit tests in buy-sell or retail operations.
• Carefully analyze performance that looks too good as well as performance that does not meet standards.

7
 FRAUD DETECTION GUIDE: SAMPLE 2

OPPORTUNITY RED FLAGS

FRAUD CONDUCTED BY EMPLOYEES AGAINST THE COMPANY

• Familiarity with operations (including cover-up capabilities and in a position of trust)
• Close association with suppliers and other key people
• A firm that does not inform employees about the rules or the action taken to combat fraud
• Rapid turnover of key employees either by quitting or firing
• No mandatory vacations, periodic rotations or transfers of key employees
• Inadequate personnel-screening policies when hiring new employees to fill positions of trust
• An absence of explicit and uniform personnel policies
• No maintenance of accurate personnel records of dishonest acts or disciplinary actions
• Executive disclosures and examinations not required
• Dishonest or overly dominant management
• Operating on a crisis basis
• Attention not paid to details
• Unrealistic productivity measurements
• Poor compensation practices
• A lack of internal security
• Inadequate training programs

FRAUD CONDUCTED BY INDIVIDUALS ON BEHALF OF THE COMPANY

• Related party transactions
• A complex business structure
• No effective internal auditing staff
• A highly computerized firm
• A firm in atypical or "hot" industries
• A firm that uses several different auditing firms or changes auditors often
• A firm that is reluctant to give auditors needed data
• A firm that uses several different legal firms or changes legal counsels often
• A firm that uses an unusually large number of different banks, none of which can see the entire picture
• Continuous problems with various regulatory agencies
• Large year-end and/or unusual transactions
• An inadequate internal control system or no enforcement of the existing internal controls
• Unduly liberal accounting practices
• Poor accounting records and inadequate staffing in the accounting department

8
• A firm that inadequately discloses questionable or unusual accounting practices

Some circumstances that might contribute to fraud include:

WEAK INTERNAL CONTROL ENVIRONMENT

• Management does not emphasize the role of strong internal controls.
• Management does not prosecute or punish identified embezzlers.
• Management does not have a clear position about conflicts of interest.
• Highly placed executives are less than prudent or restrained on expenditures for travel and entertainment,
furnishings of offices, gifts to visitors and directors, etc.
• Internal auditing does not have the authority to investigate certain executive activities involving heavy
“personal” expenditures.
• Accounting policies and procedures are on the lax or loose side.

PERSONAL CHARACTERISTIC RED FLAG CONTROLS

- MANAGEMENT DOES NOT PROSECUTE OR PUNISH IDENTIFIED EMBEZZLERS
WARNING SIGNALS SHOULD GO OFF WHEN EMPLOYEES EVIDENCE THE FOLLOWING
- MANAGEMENT DOES NOT HAVE A CLEAR POSITION ABOUT CONFLICTS OF
CHARACTERISTICS
INTEREST
• Rationalization of contradictory behavior
- HIGHLY PLACED EXECUTIVES ARE LESS THAN PRUDENT OR RESTRAINED ON
• Lack of a strong code of personal ethics
EXPENDITURES FOR TRAVEL AND ENTERTAINMENT, FURNISHINGS OF OFFICES,
• GIFTS
A wheeler-dealer
TO VISITORSpersonality
AND DIRECTORS, ETC.
• Lack of stability
- INTERNAL AUDITING DOES NOT HAVE AUTHORITY TO INVESTIGATE CERTAIN
• EXECUTIVE
A strong desireACTIVITIES INVOLVING HEAVY “PERSONAL” EXPENDITURES
to beat the system
• - A criminal or questionable
ACCOUNTING background
POLICIES AND PROCEDURES ARE ON THE LAX OR LOOSE SIDE
• A poor credit rating and financial status

SITUATIONAL PRESSURE RED FLAGS

FRAUD COMMITTED BY EMPLOYEES AGAINST THE COMPANY

• Significant observed changes from past behavior patterns
• High personal debts or financial losses
• Inadequate income for lifestyle
• Extensive stock market or other speculation behavior
• Excessive gambling
• Undue family, company or community expectations
• Excessive use of alcohol or drugs
• Perceived inequities in the organization
• Resentment of superiors and frustration with the job
• Peer group pressures
• Undue desire for self-enrichment and personal gain

9
• Emotional trauma in home life or work life

FRAUD COMMITTED BY MANAGEMENT ON BEHALF OF THE COMPANY

• Unfavorable economic conditions within the industry
• Insufficient working capital
• Dependence on one or two products, customers or transactions
• Severe obsolescence
• High debt
• Extremely rapid expansion through new business or product lines
• Reduced ability to acquire credit or restrictive loan agreements
• Profit squeeze: costs and expenses rising higher and faster than sales and revenues
• Difficulty in collecting receivables
• Progressive deterioration in quality of earnings
• Significant tax adjustments
• Urgent need for favorable earnings to support high price of stock or to meet earnings forecast
• Need to gloss over a temporarily bad situation in order to maintain management position and prestige
• Significant litigation, especially between stockholders and management
• Unmarketable collateral
• Significant reduction in sales backlogs (indicates future sales have declined)
• Possibility of license being revoked or imperiled, especially if it is necessary for the continuation of business
• Suspension or desisting from a stock exchange
• Pressure to merge
• Sizable inventories increase without comparable sales increases
• Consistently late reports
• Managers who regularly assume subordinates’ duties
• Noncompliance with corporate directives and procedures
• Managers dealing in matters outside their profit center’s scope
• Payments to trade creditors supported by copies instead of originals
• Negative debit memos
• Commissions not in line with increased sales.

TELLTALE SIGNS OF MANAGEMENT AND CORPORATE FRAUD

In every case of management and corporate fraud, telltale signs of the fraud exist for some time before a third
party detects or discloses it. These signs may be:
• Significant observed changes from the defrauder’s past behavior patterns
• Knowledge that the defrauder has undergoing emotional trauma in his home life or work life
• Knowledge that the defrauder was betting heavily, drinking heavily, had a very expensive social life or was
sexually promiscuous
• Knowledge that the defrauder was heavily in debt

10
• Audit findings deemed as errors and irregularities that were considered immaterial at the time
• Knowledge that the company was having financial difficulties such as frequent cash flow shortages, declining
sales and/or profits, and loss of market share
• Knowledge that management was showing increasing signs of incompetence (e.g., poor planning, organization
communications controls, motivation and delegation), management indecision and confusion about corporate
mission goals and strategies, and management ignorance of conditions in the industry and the general
economy
• Substantial growth beyond the industry norm versus regulated industries

CHARACTERISTICS OF TOP-MANAGEMENT FRAUD

TOP MANAGEMENT DEFRAUDERS

• Have highly material personal values
• Success to them means financial success, not professional recognition
• Treat people as objects, not individuals, and often as objects for exploitation
• Highly self-centered
• Often eccentric in the way they display their wealth or spend their money
• Conspicuous consumers and often boast of the things they have acquired, the friends they have in high office,
and all the fine places they have visited
• Speak about their cunning achievements and winnings more than their losses
• Appear to be reckless or careless with facts and often enlarge on them
• Appear to be hard working, almost compulsive, but most of their time at work is spent scheming and designing
shortcuts to get ahead or beat the competition
• May gamble or drink a great deal
• Buy expensive gifts for their families usually to compensate for spending so little time with them
• Hostile to people who oppose their views
• They feel exempt from accountability and controls because of their station or position.
• Create a great deal of turnover among their subordinates and often set off one subordinate against the other.
• Play favorites among subordinates, but the relationship can cool very quickly because a subordinate often falls
some grace after one mistake even an insignificant one.
• Manage by the crisis more often than by objectives.
• Tend to drift with the times and have no long-range plans, tend to override internal controls with impunity and
argue forcefully for less formality in controls.
• Demand absolute loyalty from subordinates, but they are loyal only to their self-interests.
• Have few real friends within their industry or company.
• Their competitors and colleagues often dislike them.

INDICATORS OF POSSIBLE FRAUDULENT ACTIVITIES

• Transactions that are odd as to time (day, week, month, year or season), frequency (too many or too few),
places (too near and too far), amount (too high, too low, too consistent, too alike or too different), parties or

11
 personalities (related parties, oddball personalities, strange and estranged relationships between parties,
management performing clinical functions).
• Internal controls that are unenforced or too often compromised by higher authorities
• Employee motivation, morale and job satisfaction levels that are chronically low
• A corporate culture and reward system that supports unethical behavior toward employees, customers,
competitors, lenders and shareholders

Examples of fraud risk indicators that might be noted during fieldwork are:

DISCREPANCIES IN ACCOUNTING RECORDS

• Account balances that are significantly over or understated
• Transactions not recorded in a complete or timely manner or improperly recorded as to amount, accounting
period, classification or company policy
• Unsupported or unauthorized records, balances or transactions
• Last-minute client adjustments that significantly affect financial results (particularly those increasing income
presented after submission of the proposed audit adjustments)

CONFLICT OR MISSING EVIDENTIAL MATTER

• Missing documents
• Unexplained items on reconciliations
• Unavailability of other than photocopied documents
• Inconsistent, vague, or implausible responses arising from inquiries or analytical procedures
• Unusual discrepancies between the client’s records and confirmation replies
• Missing inventory or physical assets
• Excessive voids or credits
• Common names or addresses of payees or customers
• Alterations on documents (e.g., backdating)
• Duplications (e.g., duplicate payments)
• Questionable handwriting on documents

UNUSUAL RELATIONSHIPS WITH THE CLIENT

• Records or facilities are denied access to.
• Certain employees, customers, vendors or others from whom audit evidence might be sought are denied
access.
• Undue time pressures are imposed by management to resolve complex or contentious issues.
• Unusual delays occur when providing requested information.
• Tips or complaints about fraud occur.

OTHER CONCERNS
• Significant internal control weaknesses or prior-year internal control weaknesses are not corrected.
• Transactions (e.g., for activities outside the normal line of business) are unusual.
• Changes occur in accounting principles or the methods of applying them that enhances reported income.

12
• Key financial or operating personnel leave.
• Specific instances of management’s conduct that raise serious concerns as to their integrity occur.

UNDERSTANDING SYMPTOMS/RED FLAGS OF FRAUD

Understanding the symptoms of fraud is the key to detecting fraud. A symptom of fraud may be defined as a
condition that is directly attributable to dishonest or fraudulent activity. It may result from the fraud itself or from
the attempt to conceal the fraud.

The following are representative examples of symptoms or “red flags” of fraud:

ACCOUNTS PAYABLE PROCESS

• Recurring identical amounts from the same vendor
• Unusual even-dollar or high-cash disbursement amounts for routine odd-dollar or low-value purchases
• Multiple remittance addresses for the same vendor
• Vendor addresses do not agree with vendor approval application
• Sequential invoice numbers from the same vendor or invoice numbers with an alpha suffix
• Dramatically increased payments to vendors for no apparent reason
• Lack of segregation of duties between the following:
− Processing of accounts payable invoice and updates to vendor master files
− Check preparation and posting to the vendor account
− Check preparation and mailing of signed checks
• No proper documentation of additions, changes or deletions to the vendor master file
• Excessive credit adjustments to a particular vendor and/or credit issued by unauthorized department (credits
involving quantities and price)
• Systematic patterns of adjustments to accounts payable for goods returned
• No reconciliation performed of accounts payable subledger to general ledger control account
• Insufficient supervisory review of accounts payable activity
• Lack of documentation for payment of invoices
• Cash disbursements for unrecorded liabilities and routine expenses (e.g., rent) when all expenditures must be
vouchered prior to payment
• Excessive miscoding to same expense account
• Payments made on copies of invoices, not originals
• Paid invoices not properly canceled, allowing for reprocessing
• High volume of manually prepared disbursement checks
• Unrestricted access to blank checks, signature plates and check-signing equipment
• Missing or easy access to blank checks, facsimile and manual check preparation machines
• Vendor invoices are received by a department other than accounts payable (purchasing)
• Vendor complaints noted by credit rating services regarding slow or no payments not justified by disbursement
schedule

13
PURCHASING PROCESS
• Turnover among buyers within the purchasing department significantly exceeds attrition rates throughout the
organization.
• Purchase order proficiency rates fluctuate significantly among buyers within comparable workload levels.
• Dramatic increase in purchase volume per certain vendor(s) is not justified by competitive bidding or changes
in production specifications.
• Purchase order numbers are unaccounted for and purchase orders are physically lost.
• The cost of routine purchases rises beyond the inflation rate.
• Unusual purchases occur that are not consistent with the categories identified by prior trends or operating
budget.

PAYROLL PROCESS
• Dramatic increase in labor force or overtime is not justified by production or sales volume.
• Turnover within the payroll department significantly exceeds attrition rates throughout the organization.
• Access to blank checks, facsimile and manual check preparation machines is easy or missing.
• Tax deposits are substantially less than those required by current payroll expenses.
• Manually prepared payroll checks experience high volume.

CASH RECEIPTS PROCESS

• Improper safeguarding of cash under lock and key.
• No segregation of duties between the following:
− Receiving cash and posting to customer accounts
− Issuing receipts and deposit preparation
• Infrequent bank deposits, allowing cash to accumulate
• Consistent shortages in cash on hand
• Consistent fluctuations in bank account balances
• “Closing out” cash drawer before end of shift
• An excessive number of voided transactions regularly without proper explanation
• Missing copies of prenumbered receipts
• Not balancing cash to accounts receivable subledger
• Insufficient supervisory review of cashier’s daily activity

ACCOUNTS RECEIVABLE PROCESS

• Accountability is lacking for invoice numbers issued.
• Segregation of duties is lacking between the following:
− Processing of accounts receivable invoices and posting to subledger
− Posting to accounts receivable subledger and cash receipts
• Policies and procedures regarding write-offs to satisfy industry standards are lacking.
• Undocumented and/or unapproved adjustments, credits and write-offs to the accounts receivable subledger
are frequent.
• Turnover or the collection cycle for accounts receivable is low.

14
• Allowance dramatically increases for doubtful accounts in view of positive economic events and stringent credit
policies.
• Reconciliation of the accounts receivable subledger to the general ledger control account does not occur.
• Review of accounts receivable activity as well as the customer account aging schedule is inefficient.
• Access to subledgers and the general ledger is unrestricted.

INVENTORY/PRODUCTION PROCESS
• Credit balances in inventory accounts
• Consistent fluctuations in inventory accounts between months (e.g., debit balance one month, credit balance
the next)
• Excessive inventory write-offs without documentation or approvals
• Unusual volume of adjustments; write-offs; and disposal of material, inventory or fixed assets
• Unrestricted access to inventory storage areas by nonresponsible employees and/or vendors.
• Significant weaknesses in inventory cutoff procedures
• No policy regarding identification, sale, and disposal of obsolete and surplus materials
• Finished goods inventory turnover rate does not correlate with operating cycle
• No segregation of duties between:
− Receipt of inventory and issuing of materials
− Recording of inventory accounts and ordering materials
− Identification of obsolete and surplus materials and sale and disposal of such materials
• No policy regarding inventory levels to be maintained (e.g., minimums, maximums, reorder points)
• Systematic pattern of improperly labeled inventory and raw materials
• Poor review of inventory accounts, write-offs and physical access to storage areas
• Lack of regular physical inventories carried out by independent personnel
• Consistent production overruns beyond sales demand and backlog orders
• Excessive production waste, spoilage or other loss of raw materials
• Physical replacement of finished goods within production area beyond a reasonable period
• Abnormal expenditures for external maintenance services beyond normal repairs and capability of internal
repair service personnel
• Extended delay of goods marked “for shipment” maintained within a shipping area

FINANCE PROCESS
• Significant adjustments to accrued liabilities, accounts receivable, contingencies and other accounts prior to
acquisition of new financing
• Dramatic change in key leverage, operating and profitability ratios prior to obtaining financing
• Adopting a change in accounting principle or revising an accounting estimate prior to obtaining financing
• Increase in short-term cash and a decrease in receivables while sales are increasing prior to seeking new
financing
• A change in external activities, legal counsel or treasury department head prior to obtaining new financing
• A delay in issuance of monthly, quarterly or annual financial reports prior to seeking new financing

15
 FRAUD DETECTION GUIDE: SAMPLE 3

The following sections provide examples and signals of fraud in six areas:
• Cash and Cash Sales
• Accounts Receivable/Sales
• Inventory/Cost of Sales
• Accounts Payable
• Payroll
• Other Fraud Areas

PETTY CASH AND CASH SALES

PETTY CASH
• Often overlooked because it is not material, petty cash can be the locus of fraud. If this fraud is not detected
and corrected it can lead to larger amounts being taken.
• One company in the southeast was defrauded of nearly $100,000 in petty cash funds.

Test: Look for a pattern of frequent reimbursements and/or expenditures for services and/or expendable items,
that is, no assets that can be substantiated.

CASH SALES
• Cash sales provide an opportunity for theft of cash.
• Cash sales can be unreported.

Test: Watch inventory turnover and inventory writeoffs. Prenumbered sales tickets should be used. All purchases
of inventory should be identified by invoice and purchase order.

KITING
• Kiting is based on the fact that there is a two-day to two-week delay in clearing deposits and withdrawals.
• It is the use or withdrawal of nonexistent funds from a checking account.
• Funds are withdrawn before they clear and then are covered with new deposits.
• In complex cases, double counting of funds is possible as funds are counted as present in one account and as
a deposit waiting to clear in another account.

Test: Look for delayed payments on accounts.

ACCOUNTS RECEIVABLE/SALES

DESTRUCTION OF LEDGERS
• An accounts receivable clerk was able to intercept customer receipts. He then removed and destroyed the
customer's ledger card to hide the fraud. The out-of-balance condition was relatively small, so the auditor
made an adjusting entry each month to make the subsidiary ledger agree with the general ledger.

16
• Over two years, this pilferage amounted to a significant shortage.

Test: Analysis of the steadily declining gross profit percentage. Upon investigation, the small adjustments were
seen to be in total quite significant, and the pilferage was discovered.

LAPPING
Payments made by customers are partly or entirely intercepted by employees and future payments are used to
cover older deficits before the customers discover the error in their accounts. The scheme usually grows to the
point where it is difficult to disguise. The employee then inserts a personal check to cover the deficit and is
detected by this action, by customer complaints, or by an analysis of account aging.
• A manager of a local branch intercepted customer payments and lapped them with later payments to divert
attention from the theft.
• The auditors' confirmation letters included some of these accounts. The manager called the customers to
explain that the auditor had made an error and to tell them how to respond to the confirmation.
• At one point the lapping became difficult to cover and the manager inserted a personal check to collections to
help bring things back into balance.

Test: Look for a decrease in accounts receivables or an increase in the aging of receivables.

INTERCEPTING RECEIPTS AND DESTROYING INVOICES

• Person A was a cashier for a company. The company prepared invoices in three forms, one for the customer,
one for accounting and one for the accounts receivable clerk.
• Person A functioned as both accounting and cash receipts clerk because the company trusted her and
because it did not emphasize controls.
• To pay for a variety of personal needs, Person A would intercept customer payments or replace them with
cash from the cash drawer and destroy the two copies of the invoice.
• Prenumbered forms were not reconciled, so eventually, her thefts amounted to about $50,000

Test: Note how a poor control environment makes analytical review less effective. Unless amounts are large or
some employee tips management off, this type of theft is difficult to detect.

DIVERTING RECEIPTS AND MANIPULATING WRITEOFFS

The computer personnel of a hospital was able to divert customer payments of more than $60,000. The computer
records were manipulated to show that these accounts had been written off as uncollectible.

Test: Watch the trend of receivables written off. There should be a predictable relationship between sales and
total receivables, over time and in comparison, to the average for the industry.

SELLING A COMPANY
• A new company was starting to experience a good bit of success; a related company offered to purchase the
new company.
• During the purchase negotiations, the owner of the small new company beefed up the sales and profit picture
of the company by making purchases on his account.
• The eventual sales figure for the new company was determined by the net assets figure of the new company
plus a figure for goodwill as a percent of net assets, so the owner was able to capitalize on these phony sales.

Test: Inventory turnover analysis might show the problem if the owner was not showing a shipment or credit to
inventory for the sales. Also, analysis of customer mix of cash sales as a portion of total sales or comparison to
production capacity might uncover the problem.

17
SALES ON CONSIGNMENT
• Companies can boost reported sales by showing shipments of goods on consignment or a trial basis as valid
sales. A company, maker of modular homes, followed this practice in (Insert Year). The modular homes were
shipped to customers without a binding purchase contract.
• The company can keep attention away from such a situation by adding periodic credits and new charges so
that the account appears active, even though no sale has occurred.

Test: Watch inventory turnover, meaning there should be a decline in turnover to reflect the slow-moving,
obsolete items. An aging of receivables, if not prepared or manipulated, might show up the problem. If the fraud is
carried out on a small scale, it might be difficult to detect.

INTERCOMPANY RECEIVABLES
• XX Company had a subsidiary, a brewery that was losing money badly. The brewery was transferred to a new
entity called the investment company, another subsidiary of XX Company.
• Then XX made loans to the investment company and carried them as accounts receivable. The investment
company used the money to pay off the debts of the brewery. By shifting the debt around, the standard was
able to obscure the fact of its failing ventures.

Test: Careful analysis should be done of all intercompany transactions, receivables turnover and large
receivables balances.

INVENTORY/COST OF SALES

EXCESSIVE WRITE-DOWNS
Excessive write-downs in one year can make it easier to steal sales in the following year. The relatively low
amount for beginning inventory in the following year will make it easy to steal sales and still show a normal gross
margin percentage.

SHEET METAL CASE

• Management had falsified the inventory tags and added the falsified tags to the box of tags the auditors had
tested. The tags were added at night, and the auditor did not detect the fraud initially. Later, the auditor did an
analytical review of inventory and discovered a significant decline in turnover.
• To examine further, the auditor determined the space that would be needed to store the inventory claimed and
determined that it substantially exceeded the warehouse space.
• Looking back at the tags, the auditor noticed that some of the tags listed sheet metal weighing about 50,000
pounds, which was more than the yard equipment could carry.
• Faced with discrepancies, management admitted the attempt to overstate inventory and profit and agreed
upon an adjustment.

Test: Perform a reasonableness test of inventory quantity.

INTERNAL COMPETITOR
• A salesman for a branch office opened a business that would compete with his employer's.
• Goods and services were then taken from the employer's inventory and other employees.

Test: Check inventory turnover, analysis of sales, gross margin, and profit performance, all of which must suffer if
significant sales are stolen.

18
SUPPLIES
• The cost of packing and related supplies for a branch location has been rising steadily. The purchases are
from local suppliers and local cash working funds.
• There was no inventory account for these purchases. The invoices were signed as approved by various
employees, and receiving reports were signed. A handwriting expert indicated the signatures could not have
been done by a person using his or her ordinary style of writing.
• Upon investigation, the auditors found no inventory of the supplies.
• The purchases were phony, and four employees were discharged.

Test: Steeply rising supplies expense.

OIL CORPORATION
Computer personnel at a New Jersey site manipulated the records of oil transfers to cover the theft of $20 million
of fuel over seven years.

Test: This kind of fraud is very difficult to detect. It involves the computer and collusion. Only when it is on such a
large scale that analytical tests will sense it, or when someone tells the story, will it be uncovered.

REPAIR PARTS
A stock receiving clerk in the repair department of an appliance dealer, in collusion with a supplier, had the
supplier deliver appliances to his home and bill the company for repair parts. Because the clerk received parts, he
was able to falsify the receiving reports.

Test: Conduct a detailed analysis of inventory by category.

THE BRANCH X CASE

• A local branch of a large company had been experiencing a steady trend of losses. The internal audit staff
investigated to determine the cause. Initially, no cause could be determined.
• After constant probing of top management, the local manager said he had found the cause. A stockroom clerk
had been stealing and had been fired, but the losses continued.
• The local manager indicated that another clerk, a friend of the first, also had been involved and also had been
fired.
• This sequence was repeated for a third and fourth stockroom clerk, but the losses continued.
• A second investigation by the internal audit department covered improper disbursements. The local manager
had approved payments to friends for goods and services not received by the company. Several employees in
the local branch had known of the problem but were afraid to say anything until it got too serious.

Test: Perform a detailed analysis of expenses and trends for each category, and do not rely on management's
explanations.

RAILROAD COMPANY
• Railroad Company merged with Central Railroad in 1972. Then Railroad Company began a $200 million
investment campaign, mostly in real estate, which demanded large amounts of cash.
• The working capital problem was solved temporarily by borrowing eurodollars at high interest rates and large
amounts of commercial paper. The cash position was worsened by the interest cost, high executive salaries,
large dividends and difficulties in collecting receivables.
• Railroad Company failed to write off junk boxcars that had essentially no value. Other boxcars were rerouted,
so they could not be found. They then were repainted and sold to other railroads.

19
Test: Check receivable turnover, inventory turnover, aging of receivables, fixed asset productivity analysis and
analysis of fixed charge coverage.

PHONE THEFT
• A major telephone company was defrauded many years ago by a college student. The student recognized
through examining computer listings thrown out in the trash that the telephone company had installed an
automatic ordering system for installers.
• Understanding the codes, the student was able to telephone the company's computer over a touch-tone
telephone and order parts to be delivered at authorized sites.
• After delivery, the student picked up the orders and sold them on the black market.
• When the student was turned into the police by a fellow student, the telephone company was asked to
determine how much the student had defrauded. The telephone company was unable to determine the size of
the fraud or even the fact that a fraud had occurred.
• The system relied on authorized installers at predetermined construction sites to order parts. The company did
not consider the fact that unauthorized people might request these parts.
• Therefore, if an order was received from an authorized installer, for delivery of parts at an authorized site, the
delivery was made.
• Because the evidence produced by that transaction was electronic, and it contained all valid codes, there was
no way to differentiate a fraudulent transaction from a valid transaction.
• In this case, the student entered into a plea bargaining and was able to escape with a six-month jail term. After
90 days, the student was out of jail and was hired by the telephone company as a consultant to prevent that
type of computer crime from recurring.

Test: Perform periodic analysis of quantities ordered by location.

PROCUREMENT SCHEMES
Procurement schemes are purchasing transactions that involve bribes, kickbacks or conflict-of-interest situations.
• Specifications are tailored. The specifications for the purchase order are tailored so that the order will have to
go to a certain firm, usually signaled by unusually tight specifications.
• Collusion occurs. Predetermined arrangements designate one of a group of bidders to receive the award.
Perhaps several of the bidders are closely related.
• Kickbacks occur. The purchasing agent receives a kickback on the amount of the award.

Test: Perform periodic analysis of purchased quantity by the vendor.

FALSE BILLS OF LADING

False bills of lading are fraudulent misstatements of the weight or the volume of goods shipped, with the over
shipment being stolen.

ACCOUNTS PAYABLE

UNRECORDED LIABILITIES
• A company was nearly insolvent, but the executives did not want to see it fail because their outside financial
interests were at stake.
• To continue basic maintenance of plant and equipment, the executives loaned the company money using
legitimate documents but failed to disclose the loan in financial reports.

20
• Payments on the loan were charged to maintenance expense.

Test: Analyze the relationship between recorded expenses and the physical aspects of the firm's office, plant and
equipment. Evidence that expenses might be understated is also an indication of possible unrecorded liability.
False accounts payable are used to withdraw cash fraudulently from a company under the guise of a legitimate
business expense. Often it happens between related companies or to phony companies. Disbursements not for a
business purpose occur if management diverts cash from the company for personal uses by having personal
items purchased through the company. Double billing is the submission of multiple invoices for the same products
or services. If it is detected, the defense is usually that it was a "simple error." Watch for a pattern of such errors.

PAYROLL

EMPLOYMENT AGENCY EXPENSE

• The personnel manager, in collusion with an employment agency, arranged to have many of the new direct
hires and transfers charged as having been acquired through the employment agency.
• The manager and the agent split the amount of the phony fees.

Test: This fraud was detected by an analysis of employment expenses, which showed a significant increase in
this expense. Also, the fraud could have been detected by comparing these expenses to the figures for other
companies in the industry.

COMPUTER FRAUD
A programmer and computer operator in collusion were able to increase their pay fraudulently.

Test: This fraud is hard to detect unless significant in amount or someone tells. In one case, the fraud was
detected by manual analysis of payroll amounts, which disclosed that these employees had somewhat higher
than the average pay for their classification.

BUSINESS EXPENSE ACCOUNT

• One executive was very tardy in repaying advances to his expense account, due to delays in reporting
expenses and by other means.
• An analysis of his account showed this pattern over many years.
• The executive was investigated, and it was determined that he was using the expense advance as an interest-
free loan.

Test: For each expense account, analyze the relationship between average advances outstanding and average
advance relative to average expense reported.

DOUBLE DIPPING
• A university professor has positions simultaneously at two local universities.
• The fraud is detected when one of the universities asks about the number of supplies, which seems too large
for the size of the classes he is teaching.

Test: Check the use of supplies, company car and so on. Compare reported financial data to reported operating
data for discrepancies.

21
PHONY EMPLOYEES
• A payroll clerk in a weak control environment was responsible for all phases of payroll accounting, including
running the checks through the check-signing machine.
• The clerk created phony employees and collected the payment for himself through petty cash and phony bank
accounts. Some of the phony employees were those who had been fired.
• To divert attention, the clerk periodically fired the phony employees and hired new ones.

Test: Analyze the relationship between operating and payroll data. Are they consistent? How do they compare to
similar companies in the industry? Example: $2 million of a $15 million-dollar payroll on a federal grant project.

OTHER

CLAIMS DEPARTMENT OF INSURANCE COMPANY

• A claims department manager sets up his own company to investigate claims and pays himself from company
funds for the investigation.

Test: Examine the proportion of claims that are investigated. Analyze the total investigation costs over time and
per claim and compare them to industry figures. Any change over time in the percentage of claims should be
resolved and explained.

SHIPPING EXPENSES
• A traffic manager creates his own transportation company and pays it for fictitious services.
• In another case, a shipping manager had a budget for rental trucks to facilitate the orderly flow of shipments at
peak times. The payments to rental truck agencies were fictitious and went into his pocket.

Test: Compare total shipping costs to those of prior years and the industry average. Estimate the shipping cost
per item or pound and compare it with other shippers' costs.

ADVERTISING EXPENSES
In collusion with an advertising agent, a retail store manager agreed to purchase 16 one-minute local TV ads, with
the idea that the agent would purchase eight of these ads and have the home office billed for all 16. The agent
then would split a portion of the excess fee with the store manager.

Test: Compare trends to prior years and industry averages. This one could be difficult to detect if not substantial
and no one tips off the auditor unless there is a detailed regular investigation.

PAYMENTS TO CONTRACTORS
Frequently errors and frauds can occur in payments to contractors.

Test: Is the contract lump-sum or cost-plus? Things to watch out for:

• Changes in contract
• Solvency of the contractor
• Ownership of plans and materials
• Escalation clauses they will make a lump-sum contract into a cost-plus contract
• The contractor's controls for inventory and personnel (What are the chances we are paying for his employees'
fraud against him? Watch out if the contract is not specific on the following matters: overhead and field office

22
 expenses; small tools, repairs and maintenance; EDP charges; transportation; sales and other taxes;
insurance coverage costs; freight; overtime and other wage premiums.

U.S. INC.
• U.S. Inc. showed bogus sales of real properties and other assets at substantial profit to the company.
• The company wanted to bolster its stock price because one of the directors had a substantial amount of stock,
and the stock was pledged as collateral on loans. The stock price had a significant effect on the director's
borrowing power.

Test: Test management pressures and management integrity. Review all nonoperating transactions for validity.
Take note of management interests in stock price and their perceptions of how profit relates to stock price.

ARSON FOR PROFIT

Fires may be set deliberately, or property may be destroyed to collect insurance. The business press has reported
that 20% to 30% of all fires are the result of arson.

Test: The auditor should be alert to both under and over insurance coverage.

23