David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, forensic accounting, and marital dissolution services in Philadelphia and the Delaware Valley.

Many of the frauds investigated by forensic accounting expert David Anderson of David Anderson & Associates, a Certified Fraud Examiner in Philadelphia, share a common element: The fraudster was able to perpetrate and hide the fraud for an extended period due to the lack of separation of duties.

Separation of duties requires more than one person be involved in the processing and reporting of financial transactions to eliminate the possibility of that person alone committing a fraud. If a fraud were to occur in a situation in which there was adequate separation of duties, it would have to be due to the collusion of two or more people involved in the processing or reporting.

For example, Anderson said, if you look at a sales transaction from start – entry of the customer purchase order/request – to finish – receipt, deposit and recording of the customer’s payment for the sold item(s) or services – you could expect to see the following steps:

• Receipt and entry into the business system of the customer’s purchase order/request
• Fulfillment of the customer purchase order via product shipment/delivery, manufacture and shipment/delivery, or provision of services
• Creation, entry, and sending of customer invoice
• Receipt and entry of payment
• Application of credits, if any – usually for returns or errors in the customer invoice
• Deposit of customer payment
• Periodic reconciliation of an operating bank account into which the deposit is made.

Proper separation of duties would prevent a single person from processing the customer invoice; receiving, entering, and depositing the payment; applying credits; and performing the bank reconciliation.  If those duties are not separated, the person could potentially divert the payment received to a bank account under control of that person or, if the payment is made in cash, to that person’s own pockets, while hiding the diversion by:

• Not recording the sale or customer invoice in the accounting system to hide diversion of the customer’s payment; or
• Recording in the accounting system the receipt of the payment and hiding the failure to deposit the customer payment when performing the bank reconciliation; or
• Applying credits against the customer’s account so that the balance in the bank equals the balance on the books, as adjusted through the bank reconciliation process.

Similarly, if you were to look at a purchase transaction from start – setup of the vendor and entry of purchase order/request – to finish – preparation and recording of vendor check for goods or services purchased – you could expect to see the following steps:

• Receipt and entry into the business system of internal purchase order/request
• Setup of the vendor, if not already in the system)
• Fulfillment by the vendor of the purchase order via product shipment/delivery, manufacture and shipment/delivery, or provision of services
• Receipt and entry of vendor invoice
• Preparation and recording of vendor check
• Sending of vendor check
• Periodic reconciliation of an operating bank account from which the check was written
• Interfacing with the vendor regarding amounts due to the vendor.

Proper separation of duties would prevent a single person from setting up the vendor in the business system, making changes to the vendor information, entry of the internal purchase order/request, receiving and entering the vendor invoice, preparing and recording the vendor check, and sending the vendor check and performing the bank reconciliation.  If those duties are not separated, the person could potentially:

• Divert the vendor’s check to an account under control of that person, in which case the person would tell the vendor that there were problems with processing their payment or would refuse to pay the vendor; or
• Create a phony vendor, or change the mailing address of an existing inactive vendor, and cause payment to be made for non-existent products – typically office supplies and other items that are expensed rather than being recorded as inventory – or services; and
• Hide the diversion when reconciling the operating bank account.

Note that failure to adequately separate duties for payroll could be similarly exploited for payments to either a terminated employee or a non-existent employee.

Based on the description above, it is easy to see the need to properly separate duties as part of a fraud prevention program. However, many businesses and other organizations – including governmental and non-profit entities – do not possess a staff large enough to facilitate adequate separation of duties.  So, what are some alternative steps that can be employed?

In such circumstances, some alternatives these businesses and organizations should consider are:

• Engaging an outside party such as a forensic accountant to provide periodic oversight and review of financial transactions and bank reconciliations;
• Arranging for all bank statements to be sent directly to the owner or a designated executive, at an address outside the business, so the bank statements and cancelled checks can be briefly reviewed for unusual or missing items prior to being given to the person performing the bank reconciliation;
• For deposits, requesting that the bank provides a separate machine-printed deposit receipt matching the in-house prepared deposit slip;
• For checks, requiring two separate approvals and signatures for all checks above a designated amount, or requiring a separate management approval for all checks, i.e. someone separate from the check signer;
• For payroll prepared by a third-party company, arranging for a periodic list of active employees be sent directly to the owner or a designated executive, at an address outside the business, so the list may be scrutinized for unknown employees or terminated employees still receiving pay.

The costs of these alternatives, either financial – for the outside review – or time – for internal review – are low relative to the potential cost of undiscovered fraud.

If you want to learn how a Certified Fraud Examiner from an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley can help safeguard your company, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at david@davidandersonassociates.com.

About David Anderson & Associates

David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley.  The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services.  Company principal David Anderson is a forensic accounting expert who has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.

David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, forensic accounting, and marital dissolution services in Philadelphia and the Delaware Valley.

You have them, your competitors have them, every company large or small has them. “Them” are your trusted employees, women and men on your team who have worked with you forever and have, time after time, proven their loyalty to you and your organization.

Despite a spotless track record, though, can you really trust your “trusted” employees?

Certified Fraud Examiner David Anderson of the Philadelphia forensic account services firm of David Anderson & Associates, says you never should forget that these “trusted” employees can pose a significant fraud threat to businesses and organization.

“They may be family members, employees who have worked their way up the management ladder over the years, employees who are hardworking and who put in long hours, and/or employees who have contributed to the past success of the business,” he said.

Because of this “trusted” status, Anderson said, business owners and senior managers tend to exert less oversight over these employees than they do over the typical employee.

Most “trusted” employees are worthy of the trust they have earned.  However, other “trusted” employees have used the trust and lack oversight to commit fraud.  Over the past several years, investigations of “trusted” employees conducted by David Anderson & Associates have identified the following frauds perpetrated on their employers:

• Use of employers’ business credit cards to charge personal expenses
• Use of expense reimbursements to have the business pay for personal expenses or non-existent expenses
• Manipulation of payroll to take improper salaries and bonuses
• Use of more vacation, personal, and sick days than earned
• Running purchases for their own personal business through the purchase accounts of their employer, and having the employer pay for these purchases
• Diverting customer cash payments to themselves, and covering up the diversion by manipulating the employer’s accounting system
• Removing inventory from the employer’s warehouse, and covering up the diversion by manipulating the employers accounting system
• Diverting customers and sales from the employer’s business to their own personal or a friend’s business
• Selling the employer’s fully depreciated assets to a third-party and pocketing the proceeds.

In each case, Anderson said, the employer had no fraud deterrence program in place.  These companies could have significantly reduced the likelihood of fraud occurring if management had instituted such procedures as:

• Regular top management or third-party consultant review of credit card statements and expense reimbursement requests
• Regular top management or third-party consultant review of payroll journals
• Regular top management or third-party consultant review of monthly bank statements and monthly financial statements
• Regular periodic review of operations by top management or a third-party consultant
• Instituting an anti-fraud policy, disseminating it to all managers and other employees, and holding periodic training sessions on spotting and report fraud
• Letting all employees know that top management does not condone fraud, and that supervisors are actively watching out for it.

“Trusted” employees continue to be a problem for employers who provide reduced oversight to them.  However, Anderson said, by instituting relatively simple and relatively inexpensive fraud deterrence procedures, management can significantly reduce the risk of such “trusted” employees becoming untrustworthy.

If you require the services of a Certified Fraud Examiner or any other forensic accounting services in Philadelphia and the Delaware Valley, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at david@davidandersonassociates.com.

About David Anderson & Associates

David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley.  The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services.  Company principal David Anderson is a forensic accounting expert who has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.

David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, forensic accounting, and marital dissolution services in Philadelphia and the Delaware Valley.

In this blog, the second of a two-part series, forensic accounting expert David Anderson of David Anderson & Associates, a Certified Fraud Examiner in Philadelphia, concludes his look at examples of security failures he has observed in his work.

As he noted last week, many businesses implement a wide range of policies and procedures to protect their property, assets, and data. However, even the best of policies and procedures are ineffective if employees don’t adhere to them. Here are several more such “tales:”

The unsecure data center: Anderson was engaged to evaluate the IT security controls at a medium-sized company based in North Carolina.  Their “secure” data center was an unlocked coat closet just off the lobby.  Besides having no air flow, which could have caused the servers to overheat, visitors could have easily entered the closet, and even walked off with the equipment.

Common user IDs and passwords: At the same company as above, each member of the accounting department accessed the company’s accounting system by entering “Accounting” as the user ID and “Accounting” as the password.  Although the company had experienced departmental turnover, including one individual who had embezzled funds, the company had never changed the common user ID and password.

Not changing locks and system access: At a medium-sized Philadelphia-area company, Anderson’s investigation of the IT and facility security controls noted that the firm issued employees an office key when they started their jobs, but never asked for the key back when the employee left.  Additionally, the company never deleted the user ID and password for these employees.

Although Anderson said he was able to persuade the company to remove system access for terminated employees, management did not want to incur the cost of changing locks and issuing new keys.  This problem was resolved several months later after a former employee, who had retained his key, entered the premises one weekend and stole computers and inventory.

Non-secret passwords: This is perhaps the most common “insecurity” Anderson said he has encountered. At many companies, he has seen passwords taped to the monitor, or tacked to a corkboard next to the computer, or taped to the desk underneath the user’s keyboard.  In several of the companies, the company itself was the cause of the “insecurity” because many employees accessed multiple systems which each required a new password every 60 days, and passwords could not be common across systems.

Executives who violate access rules: This is another “insecurity” Anderson said he has seen in multiple companies.  A busy executive provides his/her user ID and password to his/her administrative assistant/executive secretary to facilitate access to his/her e-mail and personal files.  Assuming the administrative assistant/executive secretary is a trusted employee, many companies do not consider this situation to be a problem, even though, as Anderson points out, it usually violates company IT security control procedures.

This situation becomes a problem when that trusted employee is out and must temporarily be replaced. For example, Anderson said he has seen such employees out on vacation, maternity leave, family medical leave, etc. This means one or more new employees – or even temporary employees – are granted access to the executive’s e-mail and personal files.  Now, because the executive does not want to change user IDs and passwords, no such change is made.  This means other employees or temporary employees could continue to access the executive’s e-mails and personal files.

In each of the above cases, the employee’s failure to adhere to the established policies and procedures resulted in security lapses. To avoid the “insecurity” failures Anderson detailed both last week and this week, he makes the following recommendations:

• Engage an outside expert to review your company’s security/control policies and procedures to identify potential failure points and provide solutions. For example, changing multiple passwords across multiple systems every 60 days is likely excessive. The expert can suggest alternatives, such as using the same password across multiple systems; increasing the number of days between password changes to 120 or 180 or even annually; or providing a password management tool.
• Ensure all employees are provided with, and acknowledge receipt of, company security/control policies and procedures.
• Conduct training on a regular basis, at least once a year, to remind to remind employees of the policies and procedures, and why they need to be followed.
• Encourage employees to follow the guideline “if you see something, say something” with regards to unauthorized visitors and employees who violate company policies and procedures.

If you want to learn how a Certified Fraud Examiner from an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley can help you steer clear of such security issues, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at david@davidandersonassociates.com.

About David Anderson & Associates

David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley.  The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services.  Company principal David Anderson is a forensic accounting expert who has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.

David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, forensic accounting, and marital dissolution services in Philadelphia and the Delaware Valley.

Many businesses implement a wide range of policies and procedures to protect their property, assets, and data.  However, according to forensic accounting expert David Anderson of David Anderson & Associates, a Certified Fraud Examiner in Philadelphia, even the best of policies and procedures are ineffective if employees don’t adhere to them.  The following is Part 1 of a two-part series featuring examples of security failures Anderson has observed in his work:

When Security Badges Aren’t Effective:

Many businesses require employees to wear a security badge and “swipe” it to gain access to facilities.  In one case, a just-fired employee returned to the company that had fired him and waited by the security access door. Other employees who had seen him around (and didn’t know he had been fired), held the door open for him (not noticing he didn’t have a security badge).  He then entered the building, proceeded to pull out a hammer, and vandalized several desktop computers until he was stopped by security officers.

In another case, Anderson said he was visiting the IT department of a large Philadelphia business to conduct an evaluation of its IT controls.  He was standing outside the secure data center when an employee with a large cart full of equipment swiped his security badge to enter the data center.  The employee was struggling to hold the door open for his cart and, seeing Anderson, asked him if he would hold the door (neither Anderson nor the employee had seen each other before, and Anderson was wearing a visitor badge).  Anderson helped and continued to hold the door open until the employee entered the data center and out of view. Anderson, now in center himself, went over to one of the terminals, and, if he had been malicious or interested in stealing data, he said he easily could have entered the necessary commands to do so.

When Terminals or Desktop Computers Aren’t “Secure:”

When conducting an IT security evaluation, Anderson wandered into the accounting department of another large Philadelphia business.  He observed an employee tell another he was going to lunch, and then watched him get on the elevator and leave.  Anderson walked over to the now-empty cubicle and noticed the just-departed employee had not logged out of the company’s accounting system.  Anderson said he sat down at the vacant desk and proceeded to access the accounts payable and general ledger applications.  No one challenged him, he said, or even appeared to notice he was there.  Again, had he wanted to, Anderson said he could have caused major damage to the company’s accounting system.

When Confidential Records Aren’t Secure:

When Anderson was a junior auditor (before the days of electronic medical records), his first assignment was on the audit of a large hospital.   One of his assignments was to make sure that selected patient records had been properly entered into the hospital’s accounting system (to facilitate billing).  He said he was unable to locate one patient’s file, and after investigation, learned it was because the patient was still in the hospital (and the records were at the nurse’s station on one of the patient floors).  He said he went up to that floor, and requested the patient’s chart (He said he was not wearing a badge and didn’t identify himself, but was dressed in a business suit).  The nurse handed the requested documents to Anderson, saying, “Here’s the chart, doctor.”

Taking Secured Data Files Home to an Unsecured Computer:

At one medium-sized company, Anderson was called in to investigate when their system became infected with a rather nasty virus.  It turned out the Controller had taken certain budget files home (on a thumb drive) to work on over a holiday weekend.  Unbeknownst to him, his high school son had been using the same family computer, and had unknowingly downloaded a virus.  When the Controller used the computer, the virus was transferred to his thumb drive and then to the company’s system.  What made this worse was that the Controller was responsible for updating the virus protection for the company’s system, but had failed to download three years of updates.

Becoming Victimized by E-Mail Spoofs:

Hackers had obtained confidential names, addresses, social security numbers and other salary information of the employees of a small subsidiary of a larger Philadelphia company.  Anderson said his investigation determined the company’s systems had not been penetrated, but instead, the Accounting Manager of the subsidiary had been victimized by an e-mail spoof.  She had received an e-mail, purportedly from the parent company’s Controller, informing her there was a problem with the subsidiary’s W-2 forms, and requesting she prepare and send to him an Excel spreadsheet of the subsidiary’s W-2 information, allegedly so the home office “can correct the problem.” The local Controller failed to notice the requesting e-mail came from an e-mail address that was similar to but not the same as the corporate Controller’s actual e-mail address.  She prepared the requested spreadsheet and attached the spreadsheet as she replied to the original “spoofed” e-mail.

In each of the above cases, employee failure to adhere to the established policies and procedures resulted in security lapses.  Next week, Anderson will continue with more examples of such failures, and offer some tips for avoiding them.

If you want to learn how a Certified Fraud Examiner from an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley can help you steer clear of such security issues, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at david@davidandersonassociates.com.

About David Anderson & Associates

David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley.  The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services.  Company principal David Anderson is a forensic accounting expert who has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.

David Anderson is principal of David Anderson & Associates, a Philadelphia forensic accounting firm that provides a full range of fraud investigation, forensic accounting, and marital dissolution services in Philadelphia and the Delaware Valley.

In Parts 1 and 2 of this three-part series, forensic accounting expert David Anderson of David Anderson & Associates, a Certified Fraud Examiner in Philadelphia, discussed frauds committed by trusted accounting employees, and how these frauds could have been prevented.  This week, he closes the series with a look at frauds by trusted members of management which he has investigated.

Fraud #1: The President (and 1/3 owner) of a family-owned retail business was a gambler.  He could be found at one or more Atlantic City casinos four or more days a week.  However, he ran short of money to support his gambling habit.  He knew the family business generated a lot of cash sales, so he schemed to use the company’s cash to finance his gambling.  He made sure all cash sales were manually recorded on numbered receipt pads.  He then made sure the pads were used in mixed sequence (of the six pads in use at any one time, no two pads were in sequence), so the receipt numbers could not easily be tracked.

Next, he fired the long-time bookkeeper and installed his new girlfriend as the bookkeeper.  She had no accounting background at all, and therefore depended on him to teach her bookkeeping and how to use the accounting system.   Finally, he made himself responsible for reconciling cash received to the receipts.  Then, each day, he took a handful of receipts and threw them in a desk drawer while simultaneously pocketing the cash amount of those receipts.  He gave the remaining receipts and cash to the bookkeeper for entry into the accounting system and deposit in the bank.

Over time, the business began to experience cash-flow problems (due to his fraud).  He hid this by slowing or even stopping payments to vendors, and then blamed the 2008 recession as the cause of their refusal to ship product to the business.  His scheme was discovered when he was out sick one day.  His brother, another 1/3 owner of the business, was looking for a document and, in searching for the document in the President’s desk, discovered the drawer with the hidden receipts.  By then, the President had taken over $750,000 from the business.

Since senior management can override internal controls, the primary way to prevent such a fraud is to bring in outside oversight.  Also in this case, the other two business owners should have been suspicious of the President firing the long-time bookkeeper.  They should have insisted the company retain an outside accounting or forensic accounting firm to establish internal control procedures, train the bookkeeper, and produce monthly operating reports.  If this had been done, the President would not have been able to perpetrate his fraud scheme.

Fraud #2: The Vice President /General Manager of a family-owned business was the heir-apparent to run the business as the primary owner began to cut back on his involvement in the business.  However, he had only a minor ownership interest, and was supposed to share the profits of the business with other family members.  Instead, he schemed to keep most, if not all, of the profits for himself.  He began by charging significant amounts of personal expenses on his company credit card.  Since he approved credit card purchases, he was able to have these charged as business expenses of the company.

Next, he began to purchase inventory through this company, but for the benefit of his wife’s retail business.  He alone took control of how much the wife’s business was to reimburse the family-owned business for these purchases.  Over the course of several years, he had the wife’s business reimburse only a fraction of the inventory she used, but which was paid for by the family-owned business.  Next, he closed one of the company stores and installed his wife’s business in the store.  Although he stated his wife’s business would reimburse the family-owned business for the rent, he again only had her business reimburse a fraction of the total rent.

Finally, he set up another business to compete with the family-owned business, and began diverting sales to his new business.  His fraud was discovered after the company began to experience significant cashflow problems.  His attempts to cover-up his fraud caused him to have major disagreements with the primary owner.  Due to these disagreements, the primary owner fired the Vice President /General Manager.  After the primary owner stepped back into the business, he discovered the fraud.

As with the previous fraud, since senior management can override internal controls, the primary way to prevent such a fraud is to bring in outside oversight. The primary business owner should have insisted the company retain an outside accounting or forensic accounting firm to establish internal control procedures and produce monthly operating reports.  If this had been done, the Vice President/General Manager would not have been able to perpetrate his fraud scheme.

Fraud #3: The General Manager of an automobile dealership owned only 15 percent of the business, but schemed to keep a greater share of the profits.  He purchased two small nearby businesses – a car wash and a used car lot.  Previously, the automobile dealership had sent each customer car it serviced and each used car it purchased to an auto detailer.  Now, the General Manager started to send each such car to his car wash.  He merely washed each car, but charged the automobile dealership for a full detail.

Next, he schemed to have the automobile dealership sell to his used car lot good quality used cars at large discounts, and to purchase from his used car lot poorer quality used cars at large markups.  His scheme was discovered when an employee overheard the General Manager discussing the huge profits that his car wash and used car lot were making at the expense of the automobile dealership.  The employee reported this to the dealership’s primary owner, and the General Manager was fired.

As with the previous frauds, since senior management can override internal controls, the primary way to prevent such a fraud is to bring in outside oversight.   The primary business owner should have insisted the company retain an outside accounting or forensic accounting firm to establish internal control procedures and produce monthly operating reports.  If this had been done, the General Manager would not have been able to perpetrate his fraud scheme.

As can be seen from the frauds discussed above, when a business owner cedes active oversight to internal senior management, it is critical to employ an outside accounting or forensic accounting firm to provide a measure of oversight and independent reporting to the business owner.

If you want to learn how a Certified Fraud Examiner from an experienced firm that provides forensic accounting services in Philadelphia and the Delaware Valley can help safeguard your company against such fraud schemes, please contact the Philadelphia forensic accounting firm of David Anderson & Associates by calling David Anderson at 267-207-3597 or emailing him at david@davidandersonassociates.com.

About David Anderson & Associates

David Anderson & Associates is a Philadelphia forensic accounting firm that provides a full range of forensic accounting services in Philadelphia and the Delaware Valley.  The experienced professionals at David Anderson & Associates provide forensic accounting, business valuation, fraud investigation, fraud deterrence, litigation support, economic damage analysis, business consulting and outsourced CFO services.  Company principal David Anderson is a forensic accounting expert who has more than 30 years of experience in financial and operational leadership positions and is a Certified Public Accountant, a Certified Fraud Examiner and a Certified Valuation Analyst.

(NOTE: David Anderson’s forensic accounting blog will be on hiatus for the holiday season and will return on Monday, January 8.)