In the direct method the assets can be traced through the point of payment or the point of receipt. Once an item has been identified to be suspicious, the CPA will then review all the surrounding documents and circumstances to confirm the suspicion.
The "asset hider" might want to hide funds through his/her business. The scheme used can be either an on-book scheme or an off-book scheme depending on whether the activity runs the books of the business or not.
On-Book Schemes
Fictitious Payable Schemes
Fictitious Employees and Payroll Kickback Schemes
Over-billing Schemes
Tracing Suspected Illegal Payments
Obtain Documentation
Determine Categories of Payments
Examination of Suspect Payments
Compare Records with Back-up Documentation
Look for Errors of Omission or Commission
On-Book Schemes
On-book schemes are illicit funds drawn from the payer's regular, known bank accounts and recorded on its books and records in a disguised manner such as some sort of legitimate trade payable, usually as a consulting or brokerage fee or commission. Payments can also be made to fictitious employees.
Payments are generally made by regular business checks. Cash payments in relatively small amounts might be generated by fictitious charges to travel, entertainment, or miscellaneous accounts. Three common schemes are
· Fictitious payable schemes.
· Fictitious employees and payroll kickbacks.
· Over-billing schemes.
Back to top
Fictitious Payable Schemes
In a fictitious payable scheme a payable is created for a debt that is not owed. Through the establishment of fictitious vendors, payments can be made to entities or persons that do not exist thus making it an excellent method of hiding assets. To look for fictitious payable schemes, a good starting point for the CPA is to analyze cash receipt and disbursement journals as well as ledger accounts for unusual activity. Similarly, purchase orders, invoices, and receiving tickets should also be reviewed. Finally, the bank account should be examined closely, looking at monthly statements, canceled checks, and deposits.
Other steps the practitioner should perform to uncover fictitious payable schemes are the following:
· Follow-up any payments on accounts identified to be suspicious based on financial analysis of the above.
· Review "soft accounts," that is, accounts for which there are no tangible products attached to the payable. Accounts such as consulting fees, sales commissions, and advertising are good places to start.
· Review all accounts that are unusual for the business.
|
Example 5-1
· A manager sets up a shell company in the name of an outside accomplice, and the two individuals submitted false billings to the manager's company. The victim company discovered irregularities in the amounts paid for certain expenses and also found invoices that could not be traced to any particular shipment. One supplier was unknown to most of the victim organization's employees and seemed to have no other customers.
· An investigation into the business background of this supplier indicated that it was owned by a close associate of one of the victim's managers. The bulk of that manager's transactions involved the suspect vendor. Freight bills, customer orders, checks, and freight invoices were collected for transactions involving the shell company; and the manager was confronted with the documentation during an interview. He confessed to the fraud and was terminated [Case 98-343 from the Association of Certified Fraud Examiners' 1998 Survey on the Effects of Occupational Fraud and Abuse].
|
Back to top
Fictitious Employees and Payroll Kickback Schemes
Fictitious employee schemes can be used to disguise income by having salary payments go to nonexistent or former employees. Another variation of this scheme is the payroll kickback scheme in which extra payments are made to current employees that can be either returned to the payer or passed on to someone else. These schemes can be difficult to detect since the payout looks legitimate to the unsuspecting eye.
To search for payroll schemes, the following records should be obtained from the suspect company:
· Payroll lists of attendance
· Printouts of current and former employees which list start and termination dates as well as Social Security numbers
· Personnel files, employment applications, tax withholding forms, and authorized deductions
· Payroll checks (front and back)
To identify payroll fraud schemes designed to hide assets, perform the following steps:
· Compare the list of all current and former employees from the personnel office to the current payroll list. Identify any employees who have not filled out tax withholding forms or have not elected any health benefits or other optional withdrawals, such as enforced savings plans. Follow-up on any discrepancies. The absence of usual deductions is often an indicator that the employee does not exist.
· Compare any suspect employee's claimed Social Security Number against a list of valid numbers that have been issued. A fictitious employee might have been given a Social Security number that does not exist.
· Once a suspicious paycheck has been identified, determine whether the check was cashed or deposited; note the endorsements (be sure to make note of any second endorsements), and the bank and account where the check was deposited.
· If the company has direct deposit of paychecks, compare account numbers for duplicates.
|
Example 5-2
· A high-ranking official of a midsized corporation added several ghosts to his company's payroll. This individual used fictitious social security numbers and the names of deceased individuals to create his ghost employees. Over a five-year period the perpetrator created more than 30 fictitious employees and embezzled more than $1 million.
· The perpetrator created the internal paperwork necessary to place the ghosts on the payroll and prepared the timekeeping information needed to generate paychecks. This individual had sole control over payroll checks once they were issued. He would remove the fraudulent paychecks prior to general distribution, then have outside accomplices cash the fraudulent checks.
· The fraud was discovered when an accounting clerk noticed that a social security number was missing from one employee's file. This employee asked the perpetrator to verify the social security number, but the perpetrator stalled. After several unsuccessful attempts to get the number, the clerk brought the discrepancy to the attention of others in the organization, and an investigation commenced. The fraudster was terminated and signed a restitution agreement [Case 98-125 from the Association of Certified Fraud Examiners' 1998 Survey on the Effects of Occupational Fraud and Abuse].
|
Back to top
Over-billing Schemes
Over-billing schemes are on-book schemes that require the assistance of a third-party contractor or supplier. In an over-billing scheme the payer adds an illegal payment to a legitimate business expense or trade payable. The cooperative third party then forwards the excess payment either directly to the intended recipient or returns it, usually in cash, to the payer for distribution.
In similar fashion rebate payments or kickbacks can be demanded from contractors, suppliers or even employees, and used by the principal to fund illegal payments, create a slush fund, or generate tax-free income.
To uncover over-billing schemes the CPA should look for the following:
· Notations on invoices or other billing documents for "extra" or "special" charges, particularly those that require no delivery of goods for payment.
· Discrepancies between the purchase order or invoice amount and the actual amount of payment. Take particular note of invoices that appear to have been altered or photocopied.
· Unusually large bills, or bills that break a consistent pattern of amounts, schedule, or purpose.
Remember that the over-billing entity will usually add its own fee for providing these services, so the disbursements coming from its account might not be in the same amount as the additional payments made to it. To complicate things, disbursements from the intermediary may be disguised as phony payables, cash withdrawals, or disbursements charged to miscellaneous accounts.
|
Example 5-3
· A purchasing employee bolstered her income by conspiring with a supplier to fraudulently increase the cost of certain raw materials. The supplier sold materials to the victim organization at an inflated price, and the purchasing employee vouched for the prices. The supplier kicked back half the excess funds to the employee/fraudster.
· The scheme was discovered when the perpetrator confided in another employee that she was making extra money through a billing scheme. The second employee reported the matter to management. The perpetrator's ex-husband was able to provide a canceled check, payable to the perpetrator, from the supplier. In addition the ex-husband produced tax returns where the fraudster had listed her illicit income. The perpetrator confessed to the scheme and resigned [Case 98-170 from the Association of Certified Fraud Examiners' 1998 Survey on the Effects of Occupational Fraud and Abuse].
|
Back to top
Tracing Suspected Illegal Payments
To trace suspected illegal payments, the following steps should be taken:
· Obtain documentation
· Determine categories of payments
· Examine suspect payments
· Compare records with back-up documentation
· Look for errors of omission or commission
Back to to top
Obtain Documentation
Obtain the following records from the entity suspected of making illegal payments:
· Bank account information
o All records of payments, including canceled checks, wire transfer receipts, receipts for the purchase of cashier's checks and money orders, withdrawal slips
o Check registers
o Account statements
· Sales documentation
o Purchase orders
o Invoices
o Documents showing receipt of goods ordered
Back to top
Determine Categories of Payments
Begin with a preliminary examination by dividing the gathered checks, the check register, and/or cash disbursement journal for payments into the following categories:
· Payables and expenses charged to the account that is suspected of containing illicit payments. Look at payables and expenses contained in an account that might have been used to make illicit payments.
· Payments for services, such as sales commissions or consulting fees, which do not require the delivery of goods and need relatively little documentation to obtain payment.
· Anomalous charges, such as the payment for design fees by a company engaged in a business that would not normally require such services.
Back to top
Examination of Suspect Payments
After the preliminary examination, focus on the most suspect payments, noting in particular:
· The endorsement on the check. The endorsement can be by signature, but will more commonly be by a stamp in the name of the business payee. Note the identity of the endorser. Corrupt recipients have been known to endorse such checks with their own name.
· The location where the check was negotiated. If not obvious in the endorsement, identify the bank at which the deposit was made. The depository bank's stamp will appear on the back of the check. The location of the depository bank is an important lead connecting the check to the suspected recipient. The depository bank can supply the fraud examiner with information concerning the recipient's bank account.
· Checks with a second endorsement. A strong indication of a phony payable is a check made payable to a business that is endorsed by that business and then endorsed personally, permitting the check to be cashed or deposited in a personal account. A check payable to a third party that is endorsed over to the issuer of the check is another suspect transaction.
· Checks payable to a business that were cashed and not deposited. Cashing, rather than depositing business checks, often indicates foul play. In general a "For Deposit Only" stamp appears on the back of checks that are deposited. Most banks have a code stamp that indicates a check was cashed rather than deposited. These codes, which vary from bank to bank, can be obtained from the institution where the check was negotiated.
· Checks that fall into an unexplained pattern. Look for unusual patterns in check writing. For instance checks drawn once a month in an amount equal to some percentage of the sales against which they are charged, and which are not otherwise explained, can indicate a kickback.
Back to top
Compare Records with Back-up Documentation
If an examination of the checks does not yield any clear leads, compare the payment records with the company's backup documentation. Note particularly the following circumstances:
· The absence of back-up documentation. There should always be a back-up document to support a particular payment, such as an invoice in the files for a payment to a supplier or contractor, a receipt to indicate that materials paid for were actually delivered, or a consultant's report to substantiate consulting fees paid. Take note if no back-up documents exist to confirm a particular payment.
· Discrepancies. Look for discrepancies between the payment information and the backup documentation. These include a check payable to a supplier in an amount different from the invoice, or a check payable to a person or entity different than that identified on the invoice.
· Anomalies. Look for anomalies in the backup documentation, such as invoices from several suppliers with different names but which all have the same business address, or which are signed by the same person, or which return to a post office box number.
· Unnumbered or sequentially numbered invoices. Look for sequentially numbered invoices that are dated 30 days apart. A legitimate business would be issuing other invoices in the 30-day period.
· Alterations. Be on the lookout for alterations on, or photocopies of, the backup papers. Photocopies might be made in order to conceal alterations made on the originals.
Back to top
Look for Errors of Omission or Commission
If the above steps do not yield any suspect payments, search the check registers and cash disbursement journals for errors of omission or commission.
Back to top