The Padding That Hurts

BY JOSEPH T. WELLS

avenport, an independent auditor, had a hot potato on his hands. He had just learned from Robert, his client’s internal auditor, that an employee had reported to him possible expense account abuses by one of the company’s managers. Robert said that this employee accompanied Murphy, a senior vice-president, on many business trips. The employee said Murphy had some curious habits: When getting out of a taxi, he would ask for extra blank receipts, and in restaurants, he would often do the same.

Robert had followed up this tip. He pulled Murphy’s travel file and found numerous irregularities: multiple receipts from the same taxi companies for the same days, extremely expensive meals, duplicate meal receipts for the same days and other suspicious charges for several hundred dollars each billed to an innocuous-appearing, but unknown source. Robert estimated he could safely document a minimum of $30,000 worth of phony charges over the last three years.

NUTS AND BOLTS
For companies that choose to adopt a set of ethics guidelines in response to Sarbanes-Oxley—and few will run the risk of not doing so given the negative message it would send to investors, regulators and potential litigants—section 406 of the act says the code should seek to ensure that senior financial executives

Conduct themselves honestly and ethically, particularly in handling actual or apparent conflicts of interest.

Provide full, fair, accurate, timely and understandable disclosure in the periodic reports their employers file with the SEC.

Comply with all applicable government laws, rules and regulations.

When Robert told Davenport what he had found, he said: “The guy makes over half a million a year, and yet he evidently is hitting us for at least $10,000 a year in completely fake expenses.” Davenport added, “And if we know he is defrauding the company for $10,000 a year, then what is he up to that we don’t know about?”

The two men decided they would completely document Murphy’s abuses and notify the CEO. However, as internal auditor, Robert was concerned —and not without reason. “Look,” he said to Davenport, “Murphy outranks me. He and the CEO are very tight. This will look like I am ratting out a valuable company executive, and the CEO won’t be happy with me.” But Davenport explained to Robert that when it came to high-ranking executives, there was no such thing as an “immaterial” fraud. Davenport knew his duty: He had to report Murphy’s conduct to the next highest level in the organization—in this case, the president and CEO and then disclose it to the audit committee.

THE BAD NEWS BEARS
The two auditors met with the CEO, and Robert’s intuition about his reaction was correct. After hearing the presentation, the CEO erupted: “Murphy makes millions for this company, and you people are in here claiming he is hitting us for pocket change. Don’t you have anything better to do?” But, Davenport stuck to his guns. “I really hate that this has happened,” he said, “but my duty as independent auditor is very clear. Murphy is an executive in this organization, and management fraud can have very serious consequences. Managers must set a proper example. If Murphy can cheat on his expenses and get away with it, then other people will try it, too. And if you discipline one employee and not another, the company opens itself to legal liability. Furthermore, a person in Murphy’s position controls millions of dollars in company assets. If he is dishonest about his expenses, what else is he dishonest about?”

But the CEO wouldn’t listen. “I’m telling you,” he said, shaking his finger in the air, “drop this now and leave him alone. I’ve known Murphy for over 10 years. I recommended hiring you as the company’s auditor. I can just as easily recommend that you should be replaced.” It was clear to Davenport the CEO was furious, so he felt it best to end the discussion for the time being.

By the next day, the CEO had relented. He called Davenport and said: “I have thought this over. I even talked to my wife about it last night. Of course you are doing the right thing. I’m sorry I acted the way I did; it’s just that Murphy is such a valuable team member, and this thing is embarrassing for the company and me. I’ll go ahead and talk to the chairman of the audit committee. You can come with me.”

The two men informed the audit committee and the board of directors of Murphy’s “petty” thefts. Most members were chagrined that they had to involve themselves in what they saw as such an insignificant matter. It finally was decided that three audit committee members would speak directly to Murphy.

Murphy’s attitude was cavalier toward the audit committee. He pointed out the many hundreds of nights he had logged away from home on the company’s behalf. He readily admitted submitting inflated and duplicate expense reports, but he said the reason was that he didn’t keep track of all of the cash he spent on behalf of the company, and this was just a way of reimbursing himself. The audit committee backed down from any further confrontation with him.

A WAY OUT To settle the matter, the audit committee chairman offered to strike a compromise with Davenport. Davenport’s firm would be authorized to conduct enough additional audit work to satisfy itself that Murphy’s sins were confined only to the expense account, new internal controls would be implemented over executive travel and the company would send out a memo to all employees informing them of the company’s ethics policies and reminding them of expense account policies.

Source: “Report to the Nation on Occupational Fraud and Abuse,” Association of Certified Fraud Examiners, 1996.

But then came the tough part of the compromise: The audit committee chairman told Davenport that it was in the company’s best interests to keep Murphy and that—notwithstanding Murphy’s indiscretions—he was a valuable company asset. Furthermore, the board decided against punishing Murphy to make an example out of him.

Davenport argued that not disciplining Murphy would send the wrong message. The chairman countered that Murphy’s actions were not widely known and that morale would suffer more if he was disciplined than if the incident was glossed over. And Murphy agreed to go forth and sin no more. In the end, Davenport gave in; after all, his duties were to ensure the accuracy of the financial statements, not to dictate policy to management.

CAUGHT IN A DILEMMA
There are valuable lessons in this case. First, sometimes it is easy to know but hard to do the “right thing.” Decisions in the business world are not always black and white. As a CPA, Davenport knew what ethical course to take and took it. The audit committee chairman and the CEO considered what was in the best interests of the company and made their choice, opting to let Murphy off the hook. Only time will tell whether they made the right decision: Will Murphy mend his ways? Will other employees find out he got away with theft and try it themselves?

Second, there is a double standard in most organizations for employees and for executives. Dismissing a clerical employee for expense account abuse might be done with little thought, but companies naturally are reluctant to get rid of a big revenue-producing executive like Murphy. The result, of course, is that it may send the worst kind of antifraud message: “In this company, crime pays.”

WHAT COMPANIES SHOULD KNOW ABOUT
Expense account schemes. Employees who cheat on their expense accounts usually do so by one of four methods:

Mischaracterized expenses. Employees produce legitimate documentation for nonbusiness-related transactions. Example: taking a friend to dinner and charging it to the company as “business development.”

Overstated expense reports. Employees inflate the amount of actual expenses and keep the difference. Example: altering a taxicab receipt from $10 to $40.

Fictitious expenses. Employees submit phony documentation for reimbursement. Example: producing a fake hotel bill on a home computer.

Multiple reimbursements. Employees copy invoices and resubmit them for payment more than once. Example: copying an airline ticket and claiming the cost again on next month’s expense reimbursement.

Preventing expense account abuse. Beyond using tighter internal controls, auditors can put in place some commonsense controls and policy measures at their own and their clients’ companies to deter expense account abuse. But it should be a reasonable expense reimbursement policy. If your company’s expense account reimbursement policy is too restrictive, employees are more likely to cheat to make up for unreimbursed out-of-pocket costs. A reasonable expense account policy usually gives the benefit of the doubt to the employee. Some companies find it useful to set a fairly liberal per diem rate for employee travel, which should cover all expenses.

Accepting photocopies. There sometimes are legitimate reasons to accept photocopies for small expense items. However, making a copy of an altered document is a common expense account ploy. Pay close attention to the documentation evidence provided in support of the expense claim to see if it appears to contain alterations, particularly if this is the habit of a single employee, as repeat offenders are the rule, not the exception.

Spotting trends. Expense reimbursements, because they are subject to abuse, should be monitored periodically by supervisory personnel or auditors. Look for red flags such as increasing expense reimbursements by employee, variations from budgeted expenses and unreasonable charges.

EXECUTIVES AND FRAUD
When it comes to upper management, there is no such thing as an immaterial fraud; an executive who cheats on his or her expense account may also cheat—big-time—on the company’s financial statements.

According to the new fraud standard, Statement on Auditing Standards no. 99, Consideration of Fraud in a Financial Statement, whenever the auditor determines there is evidence of fraud, he or she should bring the matter to the attention of the proper level of management. This is appropriate even if the amount might be considered inconsequential, such as a minor defalcation by an employee at a low level in the entity’s organization. Fraud involving senior management and fraud (whether caused by senior management or other employees) that causes a material misstatement of the financial statements should be reported directly to the audit committee.

The message to the independent auditor is clear: If the integrity of executives is so low that they would engage in “immaterial” fraud, it is only logical that they would also engage in fraud when something material is at stake. In short, when leaders abuse their organizations for small amounts, we may be seeing only the tip of the iceberg. CPAs should therefore be vigilant in these dangerous waters.

JOSEPH T. WELLS, CPA, CFE, is founder and chairman of the Association of Certified Fraud Examiners in Austin, Texas, and professor of fraud examination at the University of Texas. Mr. Wells’ article “So That’s Why It's Called a Pyramid Scheme” (JofA, Oct.00, page 91), won the Lawler Award for the best JofA article in 2000. His e-mail address is joe@cfenet.com.