Satyam Fraud: A Failure in Corporate Governance

In January 2009, nearly a decade after a wave of financial reporting frauds in the United States, Ramalingam Raju, the chairman of an Indian IT outsourcing company, Satyam Computer Services (SAY), with more than 50,000 employees, sent a letter to the Company’s Board of Directors and the Securities & Exchange Board of India. In this letter, Raju addressed the following:

• He acknowledged his culpability in hiding information that he had inflated the amount of Satyam’s cash on the balance sheet by nearly $1 billion
• Satyam incurred a liability of $253 million on funds arranged by him personally
• Satyam’s September 2008 quarterly revenues were overstated by 76% and profits by 97%
• He apologized for his inability to close what began as a “marginal gap between operating profits and the one reflected in the books of accounts” but it grew unmanageable.

In the text of Raju’s letter, he asked, “When riding a tiger, how does one get off without getting eaten?” According to SCRIBD.com, Satyam was a “failure of corporate governance.” As a result, the Indian government replaced all of the Satyam Board members.

The Fraud Risk Universe

According to Jonathan Marks, CPA, CFE, CFF, in addition to establishing an ethical environment, corporate governance players, including board members and management must take the lead in establishing, implementing, and maintaining a formal fraud risk management program.

In his Blog, BoardandFraud.com, Marks identifies the fraud risk universe in Figure 8-1:

In the following section, the authors examine the critical role of the corporate governance stakeholders.

Management’s Responsibility

Management’s primary responsibility is to ensure that the organization meets its strategic, operational, and performance objectives. To accomplish this, the leadership must develop and implement strategies and procedures to manage the company’s long-term economic stewardship rather than acting simply as agents of the owners—the shareholders—and responsible merely to maximize shareholder wealth.

Inherently, such responsibilities require that management establish some methodology for measuring performance and communicating the results of their efforts. Furthermore, management must protect the organization’s assets, the various resources controlled by the organization to meets its objectives. Statement on Auditing Standards (SAS) No. 1 states, “Management is responsible for adopting sound accounting policies and for establishing and maintaining internal control that will, among other things, initiate, authorize, record, process, and report transactions (as well as events and conditions) consistent with management’s assertions embodied in the financial statements.”² More specifically, these latter obligations require management to design and implement a system of internal controls, processes, and procedures necessary to safeguard the resources of the entity and ensure relevant and reliable financial reporting. In many cases, the company falls under the purview of various regulatory and taxing authorities that also require compliance with their informational and reporting needs.

Overall, management must design, implement, and maintain internal controls and financial reporting processes to produce timely financial and nonfinancial information that reflects the underlying economics of the business. Accounting information and reporting must comply with generally accepted accounting principles as well as other necessary regulatory requirements. Because management is responsible for the fair presentation of the financial statements and to safeguard the assets of the business, they must also mitigate fraud within the organization by preventing, deterring, and detecting asset misappropriation, corruption, and fraudulent financial statements. Consistent with those objectives, management should design, maintain, and monitor a system of internal controls over assets, financial information, and the financial reporting process. Management is also responsible for providing information to the independent auditors so that they may complete the work necessary to render an opinion on the financial statements.

The Role of the External Auditor

The perception of the public—particularly with regard to asset misappropriation, corruption, and misstated financial statements—is that independent auditors are responsible for fraud detection. However, an auditor’s responsibility, according to generally accepted auditing standards (GAAS), is to provide reasonable assurance that the financial statements are free from material misstatement whether caused by error or fraud. Auditors do not examine 100% of the recorded transactions; instead, they rely on a sample portion to determine the probability that the transactions were recorded properly. Further, auditors also rely on high-level analytical procedures, as well as interviews, inquiries, external confirmations, inspections, physical inventories, and other audit procedures, to determine whether the financial statements are free from material misstatement. The difference between the public’s perception of the role of the auditor and the role that audit professionals actually serve has led to an “expectations gap.”

Management is responsible for the financial reporting process and its output: financial statements, disclosures, and related notes. Consequently, many might question what role the auditor plays. The auditor’s role is to attest to the fairness of management’s presentation of the financial information as well as the assertions inherent in the financial statements. When auditors have completed their work, they report their findings in an audit report. Auditors have several choices concerning the types of opinions that they may render. First, auditors may conclude that the financial statements present fairly, in all material respects, the financial position—balance sheet (assets, liabilities, and stockholders equity), results of operations/income statement (income and expenses), and cash flows. This opinion is referred to as an unqualified opinion. The auditor may also publish a modified, unqualified opinion. This report is referred to as the “unqualified opinion with explanatory paragraph or modified wording.” This type of opinion is issued when auditors feel that it is necessary to provide additional information that they believe needs to be understood by the financial statement users. Some examples of when an auditor may provide explanatory information include when substantial doubt exists about an entity’s ability to continue as a going concern and when generally accepted accounting principles have not been consistently applied. Other opinions that an auditor may issue include a qualified opinion, when the auditor believes that some material aspects of the financial information are not presented fairly; a disclaimer, when they cannot issue an opinion because of limitations on the scope of their work or when there is a lack of audit evidence that would provide a reasonable basis on which the auditors may draw conclusions; and an adverse opinion, when the auditor has concluded that the financial statements are essentially misleading.

Boards of Directors and Audit Committees

The board of directors and/or an audit committee, if one exists, has a primary responsibility to oversee management and direct the internal audit and the external auditor with regard to the organization’s internal controls over financial reporting and the company’s internal control processes. One of the central duties of the audit committee with regard to fraud and fraudulent financial reporting is to carefully assure—with the assistance of the organization’s internal audit structure—that management has adequately assessed the risk of internal control override or collusion among top-level managers and executives that may lead to asset misappropriation, corruption, or fraudulent financial statements.

The audit committee is an integral internal control mechanism with regard to management override and high-level management collusion. It is only by carrying out their responsibilities in concert with the internal and external auditors that management override and collusion can be detected and deterrence levels set high enough so that management’s likelihood of attempting either override or collusion is sufficiently reduced. Audit committees can signal their interest is this area by paying particular attention to the “tone at the top,” “mood in the middle,” “buzz at the bottom,” antifraud programs, and ethics training, as well as by instituting a zero-tolerance policy toward fraud.

Diligence by the audit committee with regard to their fraud-related duties serves as a significant deterrent to senior-level management fraud. An open line of communication between the audit committee, internal auditors, external auditors, C-suite management, and other levels of management sends a powerful signal about their interest and diligence in fulfilling their responsibilities concerning fraud. Audit committees also need to take steps to proactively investigate whistleblower tips and protect whistleblowers from retaliation by members of management.

Most audit committees have the authority to investigate any matters within the scope of their responsibility, including internal control deficiencies, concerns about the financial reporting process, suspected corruption, and alleged illegal acts. Audit committees generally have the right to retain legal counsel, investigators, forensic accountants, nonauditor accountants, and other professional advisors, as necessary, to carry out their duties. Fraud awareness and fraud risk assessment training are critical elements at the audit committee and board levels that aid audit committees in carrying out their antifraud responsibilities.

Internal Auditors

Properly organized, structured, and supervised, the internal audit group is in a unique position to detect and deter fraud. Their primary deterrent effect is related to the increased perception that fraud perpetrators will be detected. The main deterrent for fraud continues to be the fear of getting caught and the consequences that go along with it. An effective and empowered internal audit group can serve as a significant deterrent.

Whether internal audit can be effective with regard to financial statement fraud is somewhat determined by the role internal auditors play in an organization and to whom they report. Traditionally, internal auditors have supported both operations and the financial-reporting processes. Related to operations, internal auditors evaluate segment, product line, and division profitability, look for ways to improve internal productivity, and seek solutions to a myriad of other operational problems. In such roles, auditors often report directly to senior management with authority over a particular operation. Such reporting authority allows the internal auditor to be a mechanism for operational change.

On the other hand, in the financial reporting process, including the evaluation of internal controls, such a reporting structure reduces the ability of the internal auditors to offer criticism or make recommendations due to the established reporting lines. Thus, for internal auditors to be objective and unbiased in assessing the financial reporting process and evaluating the design and implementation of internal controls, they need to have a direct reporting line to the organization’s audit committee. In fact, internal auditors are no longer allowed to complete any work for the external auditor unless their reporting structure is such that they report to the audit committee. In such circumstances, internal audit has the authority and independence necessary to carry out their assigned duties. The NYSE requires that all listed companies have an audit committee, and that the internal audit function report directly to them. NASDAQ also has a similar requirement.

The Institute of Internal Auditors (IIA) has few standards on fraud and those are vague concerning the specific responsibilities that internal auditors may have. Statement on Internal Auditing Standards (SIAS) No. 3 indicates that internal auditors have responsibility for fraud deterrence and should examine and evaluate the adequacy and effectiveness of the system of internal controls, commensurate with the extent of potential exposure or risk in the various segments of the organization’s operations. During the detection phase of their work, internal auditors should identify conditions, red flags, and other symptoms that may be indicative of fraud. In addition, internal auditors need to be cognizant of the opportunities to perpetrate fraud, such as a lack of internal controls or the failure to observe them.

Upon discovering fraud, internal auditors have an obligation to notify management or the board of directors when the incidence of significant fraud has been established to a reasonable degree of certainty. If the results of a fraud investigation indicate that previously undiscovered fraud materially and adversely affected previous financial statements for one or more periods, the internal auditor should inform management and the audit committee of the board of directors. A written report should include all findings, conclusions, recommendations, and corrective actions taken. Finally, a draft of the written report should be submitted to legal counsel for review, especially where the internal auditor chooses to invoke client privilege. On November 12, 2007, the IIA in conjunction with the AICPA and the ACFE issued an exposure draft titled “Managing the Business Risk of Fraud: A Practical Guide.” The guide recommends ways in which organizational stakeholders—boards, managers, internal auditors—can fight fraud within their entities.

Social Media as a Tool for Fraud Detection

Matti et al.¹⁵ suggest that detecting financial fraud is a daunting challenge for banks and credit card companies due to massive amount of transaction data and a wide diversity of user behaviors. In their research note, the authors explore the benefits of social media crowdsourcing, in particular, the tweets, retweets and comments from the Twitter online social network for effectively detecting financial fraud events. The goal of their work is to develop a real-time system to explore social media crowdsourcing to detect financial fraud events. The system has four modules:

1. Data collection from tweets that use predetermined keywords such as fraud and bankruptcy.
2. Using data mining from unstructured texts—the module extracts name, residence location, and age.
3. The system then correlates the text data to a database of financial transaction databases of a large credit card company.
4. In the final stage, a report is generated that summarizes the findings and suggests actions, such as recommended additional validation steps—i.e., closing the credit card account to prevent further losses and manual investigations.

While the article ends by indicating that the authors are working to validate and improve the accuracy of financial fraud detection of their system, the author’s findings suggest that big data analysis using text sources, such as social media, shows promise for improving fraud detection efforts.¹⁶

Fraud detection is challenging to say the least. At a minimum, the perpetrator has attempted to conceal the activity (the act) from those around him or her. Further, financial statement fraud is often perpetrated through management override and collusion, which makes it even harder to detect. In most cases, asset misappropriation, corruption, and financial statement fraud last about twenty-four months from inception to conclusion. At some level, this observation reflects the nature of the average fraud and the average fraudster. Fraud perpetrators tend to be people who rarely ever stop.

In short, it may be difficult to be dishonest the first time; but once the fraudster crosses that line, he or she may never stop until caught. In addition, fraud perpetrators almost never save their stolen goods. This creates a necessity to continue perpetrating the fraud. Furthermore, fraudsters tend to get greedier and sloppier over time. Often, it is the sheer size of the fraud that ultimately takes the fraudster’s proverbial “house of cards” down.

By the very title of this topic, “fraud detection,” a fraud has already been perpetrated and is possibly ongoing. Thus, the internal control environment has either been ineffective or circumvented, possibly through collusion or management override. The important issue to note is that no matter how a fraud is perpetrated, the internal control fabric of the organization has been compromised, either because a necessary control does not exist, or a properly designed control has not been implemented effectively. Effective fraud detection is an attempt to identify the fraud as early as possible, in contrast to the optimal situation in which the fraud is prevented or deterred.

The key to detecting fraud is to know where to look and how to proceed. A targeted approach is necessary to improve the probability of discovering that a fraud has occurred or is occurring at the earliest possible moment. This makes sense since the average audit generates a large number of red flags, where the vast majority are explainable and not of concern. Anomalies are part of the day-to-day operations of most organizations and are often observed by auditors. As such, anomalous transactions and activities generate red flags in the underlying financial records and possibly the financial statements if the amount rises to the level of materiality. Sorting through the pool of red flags efficiently and effectively is the key to fraud detection.

The starting point for the antifraud professional or forensic accountant is an attitude of professional skepticism. Although outlined in auditing standards related to the traditional audit, such an approach applies to fraud and forensic accounting engagements as well. SAS Nos. 99 and 113 suggest that auditors approach audit engagements with an enhanced sense of professional skepticism.

Generally, enhanced skepticism has three defining elements. First, it includes recognition that fraud may be present. Second, professional skepticism is exemplified by a professionals’ attitude, an attitude that includes a questioning mind and a critical assessment of evidence. Thus, auditors need to be alert for red flags and other symptoms of fraud and “pull on all loose threads” to see if fraud may, in fact, be ongoing within an organization. Third, professional skepticism asks professionals to make a commitment to persuasive evidence to determine whether or not fraud is present. Professionals are expected to “go that extra mile” using evidence-based decision-making.

In addition, fraud detection techniques require that fraud and forensic accounting professionals pay particular attention to the possibility of concealment because concealment suggests deception. Concealment could entail: falsified, counterfeit, or altered documents; inappropriate general ledger activity; unauthorized journal entries (possibly without documentation and backup) or reconciling items that do not have backup and supporting documentation or the backup and support is fraudulent; or tax returns that do not reconcile to the GAAP-based books and records.

Notwithstanding the above, there are two major approaches to fraud detection. The first is to detect fraud through the identification of red flags, anomalies that ultimately point to problems underlying the foundations upon which transactions have been recorded or a financial statement has been based. The second is to detect fraud through a targeted risk assessment. Both of these approaches are interrelated and both rely on a thorough understanding of the types of schemes (fraud schemes and financial crimes) that might be perpetrated.

In fact, throughout the major scheme-based chapters of this text, not only are the schemes outlined, but also the red flags are presented. Further, the steps necessary to prevent and detect the schemes are also identified. All of this information is necessary to give antifraud professionals and forensic accountants the knowledge, skills, and abilities necessary to successfully detect fraud early in the process. Because red flags are so prevalent, and many times represent “false positives,” it is only a targeted approach that considers the risk of fraud, likely fraud schemes, and the expected symptoms that will prove to be successful for antifraud professionals.

Fraud detection is the first sign or symptom that a fraud has occurred. It is the process of discovering the presence or existence of fraud. Fraud detection can be accomplished through the use of well-designed internal controls, supervision, and monitoring, as well as the active search for evidence of potential fraud (fraud auditing and related follow-through). However, the results of fraud detection are only symptoms and are not conclusive proof of fraud. Furthermore, the first signs of fraud often do not meet the threshold necessary for predication (the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred or is occurring).

Thus, more work needs to be done to ensure that other explanations—non-nefarious explanations, such as human error—are not at the root of this particular symptom. With fraud detection, we continue to examine until the antifraud professional believes that the predication threshold has been met or that no fraud has occurred. Fraud detection may include proactive fraud auditing, results of data interrogation based on predetermined parameters, or it may be a reaction to an anomaly found by the internal control system that requires additional explanation. In short, initial fraud detection steps are the first of several steps toward concluding that predication has been met but are far from providing the evidence that will be needed to convince a jury that an actual fraud has occurred. That said, it is important to use a targeted approach when attempting to detect fraud to minimize the effort associated with false (fraud detection) positives.

Understanding the Business

The first step to detecting fraud is to build an understanding of the organization and the environment in which it operates. As a starting point, the performance of the overall economy and its effect on the industry and organization should be undertaken. Is the economy growing, stagnant, or shrinking, and what effect, if any, does the economy have on the particular industry and organization? For example, during the recession of the early 1980s, the overall economy had little noticeable effect on the fast-growing technology industry because the productivity gains being realized outweighed any problems in the underlying economy. In fact, those productivity gains necessitated faster investment in technology to avoid being left behind in a difficult economic climate.

With this in mind, an assessment of the industry should be completed. The overall performance of the industry can be a key indicator of expectations of the organization. If the organization under study is not following the trends posted in the industry, an explanation of why this is occurring needs to be developed. Within any economy and in any industry, there are always high-flyers and overachievers and there are also the laggards and underachievers. Some organization has to be first, and another has to be last. At the same time, there must be good business reasons for exemplary or inferior performance in an industry. Developing an understanding of the industry and how the organization under study compares is part of the fraud risk assessment that serves as a necessary basis for detecting fraud.

Similar to the overall industry, most organizations have one or two key competitors, similar organizations that compete in the same markets, for the same customers with comparable products and services. A comparison of those competitors to the organization under study serves as a basis for looking for environments where fraud may be occurring. This analysis considers geographic and other demographics. For example, the first decade in the 2000s was particularly difficult for Midwestern states such as Ohio and Michigan. Such a difficult climate may serve as the basis for a company to cook its books. At the same time, it may also serve as the backdrop for an employee or group of employees to commit fraud to maintain their lifestyles.

Finally, an evaluation of trends within an organization is required. Trends over time and across several different metrics including revenues, gross profits, and operating expenses, as well as assets, liabilities, and stockholders’ equity are important points. The analysis of these trends needs to be both horizontal across time and vertical within a particular year.

Each of these techniques may be applied to an organization as a whole, and also to specific units, divisions, and product lines within the organization. In fact, if an antifraud professional suspects an employee payroll scheme in a particular warehouse, the symptoms and the actual fraud scheme may only come to light through comparison of this warehouse’s operations to that of others in the same organization.

The purpose of this preliminary work is to develop a backdrop for evaluating the possibility of fraud. For example, consider the case in which a company claimed to be “put out of business by the actions of another.” The actions of the other company had supposedly started in July, two years prior, and carried on for approximately eighteen months.

This claim suggested at least two expectations: (1) the performance of the failed company should have deteriorated over the eighteen-month period and (2) the failed company should have appeared reasonably healthy prior to July of two years prior. The first expectation held—the company’s performance, in fact, deteriorated over the eighteen-month period, starting in July. The second expectation did not—the failed company was in terrible financial condition at the beginning of the eighteen-month period. This necessitated additional work to understand how the company came to be in such a poor financial condition eighteen months prior to the alleged act, and how this precarious starting point may have contributed to the failure.

The Internal Control Environment

To develop an effective approach to fraud detection, the second step is to develop an understanding of the control environment—the environment as opposed to the controls themselves. The control environment consists of the policies, procedures, actions, and other activities that reflect the overall attitudes and actions of the board of directors, the audit committee, and senior management concerning internal controls. Some of the attributes that should be considered include¹⁷:

1. Commitment to integrity, ethics, and core values
2. Commitment to competence
3. An independent board of directors and audit committee that participates in the internal control process and oversees the process
4. Management’s attitudes, philosophy, and operating style concerning important internal controls and operational issues (“tone at the top”)
5. Organizational structure, including lines of responsibility and authority, particularly as it relates to the control environment and operational expectations
6. Communications about the importance of control-related matters, ethics, antifraud awareness and commitment, organizational and operating plans, employee job descriptions, and related policies
7. Human resource policies and practices

The antifraud professional or forensic accountant is hoping to see a clear and unwavering commitment to a culture of honesty, openness, and assistance. Optimally, the company is

• hiring honest employees
• training them in all aspects of their duties and responsibilities
• delivering fraud awareness in organization orientation and ongoing communications
• providing fraud risk assessment methodology to appropriate personnel.

The company should also create a positive work environment with open door policies and a commitment to employee success. The company should have an up-to-date code of ethics or code of conduct that employees review and sign regularly to clarify expectations concerning honesty and other important attributes for employee and organization success.

To deal with perceived pressure, employee assistance programs offer personnel a place to go during difficult times. The company should not only expect its employees to be aware of its commitment to honest and ethical behavior, but it should also communicate its expectations to vendors, suppliers, customers, contractors, and others who do business with the organization. These communications, along with tip hotlines, create an environment in which whistleblowers feel free to call concerning matters of questionable behavior.

While the control environment is about openness and expectations, it also assumes that employees will be monitored, and fraud perpetrators will be caught and suffer appropriate consequences. Those consequences should be meted out regardless of the pressure or rationale behind such behavior. The primary goal of a good internal control environment is to minimize the opportunity to commit fraud, given sensible cost-benefit constraints.

While the above discussion suggests that the key to successful fraud prevention, deterrence, and detection is a solid control environment, missing or inadequate elements in an internal control system may increase the risk for fraud to occur. While it is impossible to prevent all frauds, a good control environment can mitigate the opportunities for fraud.

The Use of Red Flags to Detect Fraud

Red flags—symptoms of fraud—often go unnoticed or are not vigorously pursued. As noted in the Preecher and Hobson research discussed earlier in the chapter, even trained auditors benefit from a prompt to raise their awareness of the possibility of fraud. This is not surprising given the number of red flags observed and the fact that most are not indicators of fraud but are a function of the dynamic environment in which organizations operate. Nevertheless, red flags need examination until the evidence suggests that the anomaly is innocuous.

The red flags that can lead to a formal fraud investigation come from many sources and include tips and complaints, behavioral red flags, analytical anomalies, accounting anomalies, and internal control irregularities and weaknesses. Each of these, when observed, needs to be evaluated with additional evidence to make a determination concerning fraud. Some of the questions that need to be answered include:

• Does the anomaly have supporting documentation?
• Does the documentation appear to be falsified, altered, or fictitious?
• Does the transaction and its reflection in the financial statements make sense?
• Does the transaction make sense in light of the company’s operations, goals, and objectives?
• Does the totality of this and similar transactions make sense analytically when evaluated in comparison to the economy, the industry, key competitors, and other related accounting numbers within the organization?
• Does the transaction have proper approval and the proper authority levels?
• Does anything else about the transaction or its nature make it appear suspicious?

Asking follow-up questions and resolving those questions with backup evidence is one of the keys to professional skepticism and a key to successfully uncovering fraudulent activity, whether asset misappropriation, corruption, or financial statement fraud.

Tips and Complaints

The 2016 ACFE Report to the Nations survey results suggested that while “tips” are the most common detection methods, the fraud discovery method varied substantially between small organizations (i.e., those with fewer than 100 employees) and larger organizations. The starkest variation occurred with tips; small and larger organizations detected fraud via tip in 29.6% and 43.5% of cases, respectively. A flip observation occurred with regard to internal audit where the detection method was 12% for cases at small organizations, but 18.6% at larger organizations. Over time, when combined, tips and accidental discovery typically account for greater than 50% of all frauds detected. This supports the contention that organizations have an opportunity to improve efforts to actively seek out fraud acts and perpetrators. It also suggests that, like-it-or-not, employees, managers, co-workers, and colleagues outside the company—those closest to the day-to-day operations—are in the best position to detect and report fraud.

This also reinforces why the control environment is so critical to fraud detection. Without an obvious commitment to fraud detection, prevention, deterrence, and remediation, some frauds are likely to go unreported and undetected. These frauds would be far more costly than if they were discovered and resolved earlier in the process.

These findings are logical. If fraud occurs, and the control environment and specific prevention controls fail, employees, co-workers, managers, and others who interact with the fraudster daily, weekly, or monthly, are more likely to observe suspicious behavior. If they don’t report it, we are left with other fraud detection methods that are more time-consuming, often less timely, and sometimes more invasive, to discover the fraud. It should be noted that many times tips and complaints are false. At least one highly recognizable organization was noted as closing down their fraud hotline because most calls were bogus and the tips were often made for purely vindictive reasons—to try to get an innocent person in trouble.

Another concern is that employees, who suspect someone of doing something wrong or observe suspicious activity, may not report it for fear of getting someone in trouble. Knowing for certain is almost an impossible standard, and in some cases, the suspicious employee is fearful of being labeled a tattletale. The person may even be afraid of retaliation by the suspected perpetrator. For these reasons, some employees, who know of wrongdoing, do not come forward. The main lesson for companies is to make reporting suspected fraud easy and anonymous.

The whistleblower needs to be able to feel safe and secure while providing the organization with the needed information. One alternative is to leave a tip on a fraud hotline. This approach is much more likely to be successful if an employee feels that the overall environment is one in which a report of fraud and unethical behavior will be acted upon. The employee should always feel that going to a supervisor or manager is an option, but sometimes hotlines are a better alternative. The key to successful tip hotlines is to ensure that the tipster provides sufficient detail so that the situation can be examined. In this regard, some hotlines are often managed by third parties who have the expertise to collect enough facts to initiate an examination. This helps employees feel secure in their anonymity and allows the third party, through an interview-style inquiry, to ensure that all the necessary details have been gathered.

Behavioral Red Flags

Behavioral anomalies are exhibited in lifestyles and unusual behaviors. As suggested by the fraud triangle, many people who commit fraud do so, initially, as a result of pressure. Beyond pressure, they then evaluate the perceived opportunity for success, followed by a necessity to rationalize their actions. For many, pressure comes in the form of money or greed. They live a lifestyle beyond what their resources could obtain or achieve through legal methods, or have found themselves in a precarious financial condition due to previously living beyond their means.

Lifestyle symptoms can be observed as expensive cars, homes, boats, jewelry, clothing, and other material possessions an employee could not, or should not, be able to afford. As noted above, few perpetrators save what they steal; most spend their ill-gotten gains almost immediately. This psychological observation makes sense: those who can delay the gratification associated with their purchases need not steal because they can wait. Assuming that managers, employees, and coworkers pay attention, lifestyle red flags are relatively easy to spot. Just as easily, fraudsters often have a quick explanation: a recent inheritance, winning the lottery, a promotion by a spouse, and so forth. Once identified, these explanations are easily examined for accuracy, veracity, and completeness.

A second nonaccounting red flag revolves around unusual behaviors. Fear of getting caught and the ramifications associated with that fear cause anxiety and the person tends to act differently. The underlying cause may be guilt or fear, but either way, stress is created. That stress then causes changes in the person’s behavior. Such changes may include insomnia, alcohol abuse, drug abuse, irritability, paranoia, inability to relax, inability to look people in the eye, signs of embarrassment, defensiveness, argumentativeness, belligerence, confession to a trusted confidant, attributing failure to others (scapegoats), excessive smoking or starting smoking, and other anxiety-based symptoms.¹⁸ These symptoms are similar to those associated with when a person or loved one suffers from a health or job-related crisis. Unless the person is willing to talk, it can be difficult to discover a fraud from these clues alone. Still, when combined with other financially based red flags, this can be one more piece of evidence to track down what is going on and who might be associated with the fraudulent activity.

Analytical Anomalies

Analytical anomalies are transaction or financial statement relationships that do not make sense. For example, one may notice transactions that are too small or too large when compared to normal activity; it’s often about patterns and breaks in patterns. Some analytical anomalies include:

• Unusual items
• Missing items
• Larger or smaller than usual items
• No pattern when you would expect one
• A break in a pattern that is unexpected
• Round, even transaction amounts
• Cash transactions instead of transactions by check
• Large consistent transactions
• Unusual timing of transactions
• Unexpected transaction recipients or beneficiaries
• Unexplained cash shortages
• Unexplained inventory shortages
• Deviations from specifications
• Increased scrap
• Excessive purchases
• Too many debit or credit memos
• Significant unexpected changes in account balances
• Excessive late charges
• Unreasonable expenses
• Unusual expense reimbursements

Anomalies may also include strange relationships. Some examples include

Analytical anomalies are common in many organizations, including those in which fraud is not present. Nevertheless, these preliminary symptoms of fraud should not be ignored and should be diligently pursued until fraud is discovered or a conclusion of no fraud is warranted based on the totality of the evidence.

Accounting Anomalies

Accounting anomalies are unusual activities that seem to violate normal expectations for the accounting system. For example, a fraud examiner may notice transactions being recorded in odd ways or at odd times during the day or month. In some cases, a transaction may be recorded by a person not expected to record such a transaction. For instance, the Chief Financial Officer may be logged as posting routine journal entries to Property, Plant, and Equipment accounts on a Sunday evening when these transactions are normally recorded by a clerical employee during regular business hours.

In some cases, irregularities in documentation may be observed. Some of these include:

• Missing documents
• Old items being carried on bank and other account reconciliations from one period to the next period
• Excessive voids or credit memos
• Common names, addresses, or phone numbers of payees or customers
• Names, addresses, or phone numbers that are the same as those of employees
• Increases in past due accounts receivables
• Excessive write-offs of accounts receivables
• Increases in the number and amount of reconciling items
• Alterations on documents
• Duplicate payments
• Second endorsements on checks
• Breaks in check, invoice, purchase order, and other document number sequences
• Questionable handwriting
• Photocopied documents²⁰

Irregular or undocumented journal entries are another accounting anomaly that may be observed. Also, unusual entries that reduce a liability while simultaneously increasing a revenue account are red flags that should be investigated. Journal entries may be a method fraudsters use to effect management override; unusual or problematic journal entries should be closely scrutinized. This includes journal entries with little, incomplete, or missing backup. Journal entries of concern are those created by members of senior management, journal entries recorded by a person who does not have the required authority, or entries for which requisite approvals are missing. The following are some basic journal entry techniques for “cooking the books.”

• Journal Entry Example 1— Consider the following set of journal entries to record fraudulent revenues:

  Fixed Asset	$350,000
  Cash		$350,000

  This journal entry, although completely bogus, appears to be a normal acquisition of property, plant, and equipment.

  Accounts Receivable	$350,000
  Sales		$350,000

  The second journal entry, also bogus, looks like a normal sales transaction on credit.

  Cash	$350,000
  Accounts Receivable		$350,000

  This third bogus journal entry looks like a normal cash collection of accounts receivable.

  Because all three journal entries are completely fictitious, let’s see what’s left:

  $$\begin{array}{l}\text{Fixed Asset}\$350,000\hfill \\ \sout{\text{Cash}\$350,000}\hfill \\ \sout{\text{Accounts Receivable}\$350,000}\hfill \\ \text{Sales}\$350,000\hfill \\ \sout{\text{Cash}\$350,000}\hfill \\ \sout{\text{Accounts Receivable}\$350,000}\hfill \end{array}$$

  The bottom line here is that through a series of seemingly reasonable, yet bogus, journal entries, fictitious sales have been recorded through the fictitious acquisition of property, plant, and equipment. The problem is that sales are not normally recorded through journal entry, unless it is a typical month-end accrual entry. Further, none of the journal entries would have proper documentation or backup or would require fictitious support. In addition, the bogus journal entries are likely to be recorded by someone who normally does not post journal entries to the general ledger.

• Journal Entry Example 2— Consider the following timing difference:Year 1—A contract is awarded

  Cash	$500,000
  Sales		$500,000

  In year 1, a company is paid $500,000 for work completed on a contract near year end. The journal entry to record the sale is consistent with generally accepted accounting principles; however, also in year 1, the company incurred expenses of $350,000 to fulfill the contract. Those expenses were paid in cash (via check) in year 2, and no accrual was recorded in year 1.

  Year 2—Recognize expenses related to Year 1 contract
  Operating Expense	$350,000
  Cash		$350,000

  Year 2—Awarded new contract
  Cash	$750,000
  Sales		$750,000

  In year 2, the year 1 expenses are recorded. In addition, the company obtains and completes a new contract in year 2 but does not accrue any of the $450,000 of related expenses. The overall result of these three transactions is that year 1 income has been overstated by $350,000 and year 2 income has been understated by the same amount. Further, year 2 income has been overstated by the failure to accrue year 2 expenses of $450,000. Thus, the net effect on year 2 is an overstatement of income in the amount of $100,000. In this case, all of the transactions have proper documentation, but the expense transactions have been recorded in the wrong period, resulting in overstated income in years 1 and 2.

• Journal Entry Example 3— Consider the following concealed liabilities and operating expenses:

  Year 1—The proper accounting is to accrue normal period-end expenses
  Operating Expense	$500,000
  Accounts Payable		$500,000
  Year 1—However, no journal entry was made to accrue year 1 expenses

  The net effect here is an overstatement of year 1 income of $500,000 and an understatement of income in year 2 by the same amount.

• Journal Entry Example 4— Finally, consider the following attempt to treat operating expenses as capitalized property, plant, and equipment:

  Year 1—The proper accounting is to accrue period-end expenses
  Operating Expense	$500,000
  Accounts Payable		$500,000

  Year 1—Instead of accruing the amount to expense, the amount was capitalized as a fixed asset
  Fixed Assets	$500,000
  Accounts Payable		$500,000

  The net effect in Example 4 is an overstatement of year 1 income of $500,000, and an understatement of income in future years as the fixed asset is depreciated.

In years gone by, it was possible for the general ledger not to balance, meaning that debits did not equal credits, and assets did not equal liabilities plus stockholders equity. In this day and age, most computerized accounting packages prevent one-sided and unbalanced journal entries from being recorded; however, professional skepticism requires the fraud examiner to test this assumption for veracity. Further, unbalanced entries are a real possibility in manual accounting systems and those maintained in spreadsheet software, such as Excel. In electronic accounting software packages, it is far more likely that the general ledger subsidiary ledgers and other supporting documentation do not agree with, or reconcile to, the total reflected on the general ledger (and in the financial statements).

This is because many assume that most of a company’s information systems (e.g., distribution, store operations, purchasing, inventory management, marketing, etc.) feed directly into the general ledger and other aspects of the accounting system, but that is often not the case. It is common that payroll systems, marketing systems, inventory records, and accounts receivable details are independent of the main accounting system. As such, it is important to examine the underlying supporting details to ensure that the amounts agree with, or reconcile to, the general ledger totals. In addition, tests of the details need to be performed. This may include observation of physical inventory counts; confirmations with banks, customers, suppliers, and vendors; and other methods to verify that the supporting detailed records are accurate and supported. Third-party independent verification is the best evidence unless persons in the third-party company are colluding with individuals in the organization under review.

Internal Control Irregularities and Weaknesses

The internal controls necessary to safeguard assets and maintain the integrity of the financial reporting processes are beyond the scope of this text. Most companies of reasonable size often have several accounting information modules (possibly, independent systems), including the following:

• Sales and accounts receivable collections
• Personnel and payroll
• Procurement (acquisition), accounts payable, and disbursements
• Inventory, warehousing, and distribution
• Capital acquisition, maintenance, retention (including depreciation), and disposition
• Cash accounting and control

Additional controls are also required for prepaid assets; intellectual property; the acquisition, maintenance, and payment of short-term and long-term debt obligations; as well as others. Each of these processes, from the inception of any transaction through transaction completion, and its proper reflection in the audited financial statements, has many steps. Each step has controls in place to ensure that the transaction (underlying activity) exists, is complete (detailed supporting documentation), accurate (properly valued), classified properly, recorded in the proper period, and posted and summarized properly in the financial statements (these are otherwise known as management’s assertions concerning the attributes of amounts presented in the financial statements).

These controls not only safeguard the assets and facilitate accurate financial reporting but are also integral to running an effective and efficient operation. They ensure that (1) customers receive high-quality goods and services and (2) vendors, suppliers, and employees are paid accurately and on time. The Sarbanes-Oxley Act of 2002, particularly section 404, puts considerable emphasis on the system of internal controls. Management is responsible for the system of internal controls, including their design, implementation, and maintenance. Auditors must test management’s assertions concerning the existence and operational effectiveness of that system of internal controls.

The normal internal control environment is expected to have several control activities, including:

1. Adequate separation of duties
2. Proper authorization of transactions and activities
3. Adequate documents and records
4. Physical control over assets and records
5. Independent checks on performance

While these characteristics are commonly presented in auditing texts and the auditing literature, from a fraud perspective, internal controls have at least three different objectives. The first line of defense related to internal controls is to prevent fraud. Fraud prevention refers to creating and maintaining an environment in which fraudulent activities are improbable or reduced to an acceptable level of risk of fraud and/or illegal activity.

Along a similar vein, fraud deterrence involves creating an environment in which fraud is less likely to occur (e.g., by encouraging whistle blowing through hotlines). Fraud deterrence creates an environment in which organizational stakeholders are discouraged from committing fraud. This is usually accomplished through a variety of efforts associated with internal controls and ethics programs that create a workplace of integrity, as well as by encouraging employees to report potential wrongdoing and promoting any actions that increase the perceived likelihood that an act of fraud will be detected and reported. Fraud deterrence can also be achieved through the use of continuous monitoring and auditing software tools. It is enhanced when potential perpetrators recognize that they will be punished when caught.

Fraud detection is the process of discovering the presence or existence of fraud. Most often, this can be accomplished through the use of well-designed internal controls, supervision, monitoring, and the active search for evidence of potential fraud (e.g., fraud auditing).

Some internal controls are meant to prevent fraud, and this aspect is often the main focus that accountants place on internal controls. Nevertheless, the second goal of internal controls—fraud deterrence—creates the perception of detection, whether real or perceived, and is critical, given that the number of controls required to prevent every type of fraud would cost far more than the potential benefits achieved.

Finally, internal controls also need to be focused on fraud detection. This is the central goal of internal control area five—independent checks on performance. These independent checks, even if on a periodic or somewhat random basis, are designed, not to prevent fraud, but to deter and detect fraud. Therefore, the fraud audit professional needs to consider and document those controls related to the prevention of fraud, and also those controls that increase the “perception of detection” and thus act as deterrents. Because independent checks are often periodic or random, it is precisely those checks that may not be operational, even though they have been designed and documented.

Let’s consider the example of the fraudster who cooked the accounts receivables, not to steal the money for himself, but to keep his job. Because this individual wanted to keep his job within the organization, he “adjusted” the accounts receivables using credit memos in advance of meetings with the CEO, sales manager, and controller to enhance the perception of his effectiveness in the collection of those receivables. After the meeting, he restored the accounts receivable amounts by reversing the credit memos with debit memos. Eventually, he hoped to find the time to make collection calls and get the customers to pay their accounts. The pattern of his fraud was clear and distinct in the credit and debit memo records.

The shortcoming in the company’s internal control structure was not in the design—all accounts receivable debit and credit memos required supervisory approval—but rather in the implementation. Case evidence showed that legitimate credit memos had been written up for management approval and had the appropriate sign-offs; however, the weekly credit meeting “adjustments” were not approved or signed-off. The internal control procedure that was intended to act as an independent check was properly designed. The controller or CFO was supposed to review the accounts receivable system to ensure that all debit and credit memos were approved. Although this was part of the internal controls design for 3 1/2 years, the procedure had not been operationalized. This lack of independent check cost the company approximately $1 million in accounts receivable write-offs. The moral of the story: Fraud examiners need to pay as much attention to the implementation of internal controls that act as independent checks as they do to the design of those controls to prevent fraud.

Fraud examiners must document the system of internal controls to the level of detail necessary to complete their work. Assuming that the fraud examiner is using a targeted, red flag, scheme-oriented approach or a targeted, risk assessment, scheme-oriented approach, the documentation of the system of internal controls in and around the area of investigation is an integral step in fraud detection. The fraud examiner is looking for weaknesses in the design, or deficiencies in the implementation, of the internal control system. Further, the antifraud professional will also need to be aware of the possibilities of management override and/or collusion. Internal controls cannot prevent management override or collusion, but a properly designed system of internal controls with independent checks includes detection controls that alert the proper individuals when anomalous situations occur.

Some typical internal control weaknesses include:

• Lack of segregation of duties
• Lack of physical safeguards
• Lack of independent checks
• Lack of proper authorization
• Lack of proper documentation and other records
• Override of existing internal controls by an individual, management, or through collusion
• Inadequate accounting system
• Inadequate employee education (expectations)
• Reactive fraud detection approach
• Inadequate surprise audits
• Inadequate whistleblower opportunities and protection²¹

The Power of Nonfinancial Numbers

Fraud examiners need to use not only data generated from the financial accounting systems but also data from surrounding operational systems. The Internal Revenue Service’s Fuels Excise Specialists will tell you that they spend as much time auditing the inventory, chemical processing, and distribution data as they do investigating the data generated from the subject organization’s accounting system because fuels involve precise chemistry.

Thus, the managers working with the fuels cannot afford to have their nonaccounting systems corrupted with fraudulent data because of the effect on the quality of the product and the impact on end users (i.e., customers). The power of using nonfinancial data to corroborate financial information cannot be understated. Nonfinancial numerical performance data (numbers) may also prove valuable and include:

• Laundromat electricity usage
• Laundromat cycle time
• Gas produced
• Tons of minerals mined (raw and processed)
• Beer purchase quantities
• Employee time records
• Delivery records
• Attorney hours charged
• Travel (number of trips and average cost per trip)

The foundation behind the use of nonfinancial numerical information is that the world revolves around quantities and prices. By breaking down the sum totals for a series of accounting transactions into prices and quantities, a fraud examiner now has two additional pieces of data to evaluate. First, he or she can analyze the quantity. Does the total quantity make sense? How does it compare to other periods, divisions, nonfinancial system’s data, and so forth? How does it compare to prior periods? How does it compare to budgets or other data that serve as reasonable expectations? How does it compare to total capacity for the company under study? Similarly, the price per unit can be examined for reasonableness. Does the average price per unit make sense? How does the price compare to the average market price for the period and to other companies in the industry? How does the price compare to prior periods? How does the average price compare to published price lists for the company under study?

The nonaccounting systems information and nonfinancial numerical data are then used to correlate with, or reconcile to, the numbers represented in financial statements, and tax returns. Generally, any data generated outside of the financial accounting system will serve as a starting point for analysis and reconciliation. This does not mean that nonaccounting and nonfinancial numerical data are never tainted, but if it is also impacted by the fraud, then the number of perpetrators involved expands to include persons beyond accounting. The theory is that, in general, the nonaccounting and nonfinancial data are generally not corrupted because companies always want to maximize operational performance. As such, operational managers need accurate and timely data to manage their portion of the business. If nonaccounting and nonfinancial numerical data cannot be reconciled to the related data in the financial systems, or the data are not correlated, additional examination is warranted.

Using Red Flags as a Basis for Further Investigation

It is impossible to provide a complete list of all the red flags that may be observed when trying to detect fraud. Each fraud will have some unique attributes, and thus the related red flags will also be somewhat unique. Therefore, when considering red flags, it is important to think about the red flag in the context of the circumstances.

• Why does the transaction or transactions seem important?
• What causes this transaction or series of transactions to seem unusual or irregular?
• How does this red flag track into the company’s control environment?
• Does the red flag fit a known fraud scheme, given the organization, its industry, its competition, and the current business environment?

It is critical to use evidence-based decision making to draw a conclusion that fraud is likely, or that this anomaly has another reasonable explanation. It is important to use evidence to see if you can develop other reasons for the suspicious activity.

In relation to observed red flags, the fraud examiner should consider possible motivations of specific individuals who might be involved. Each of the following should be documented:

Prevention and Deterrence in a Digital Environment

In an electronic environment that captures a huge amount of transactions annually, many transactions and data relationship anomalies appear to be a potential fraud or error. To utilize the computer environment effectively, the targeted fraud risk assessment process must be completed. This process will yield the highest probability of frauds that might manifest themselves and have a large enough magnitude to make a significant impact. Red flags and anomalous relationships require evidence to determine whether a fraud is ongoing, has occurred, or is not, and never happened. It is only by using a laser or rifle-shot approach that digital tools and techniques can be effective in preventing, deterring, and detecting fraud.

Early in the millennium, an acronym related to fraud and forensic accounting in a digital environment was created—CAATTs, computer-aided auditing tools and techniques. CAATTs are used for data extraction and analysis. Recently, the terminology has morphed to use terms such as big data and data analytics. No matter the moniker, auditors, and other antifraud and forensic professionals often make use of these massive datasets for testing the information systems control environment, as well as performing detail tests of transactions, totals and subtotals. Information systems and related technology, including the financial accounting system, are integral to an organization’s success; they provide timely and essential information to facilitate achieving strategic objectives. These systems provide the information necessary to execute strategy and to achieve operational goals and objectives.

Because information is a key to the successful operation and execution of strategy for any organization, information systems technology is central to many organizational transactions, beginning at a transaction’s inception. If we use an electronic purchase order for inventory, as an example, this transaction flows through the information system to digitally capture the receipt of the merchandise at a warehouse facility, payment via the cash disbursement system, and tracking through the inventory and merchandising systems. Some of these systems are part of, or modules within, the accounting information systems, while others are periphery or separate and distinct information systems outside the normal accounting systems. In either case, this information is integral to producing fairly stated financial statements and strong systems of internal control.

Digital Evidence

A major challenge for the fraudster is to conceal their nefarious activities, given that so much information is captured electronically and is available to monitor their activities during and after the perpetration of a fraud act. Electronic storage is relatively inexpensive, and information systems store and manage this data. This means that the fraudster risks detection during the fraud act and as long as the data are stored. Stored data can be used to trace transactions, document approvals, and exceptions, as well as provide evidence of system override. This stored data can also be used with data mining software such as Access, ACL, or IDEA, SAS, and other statistical and analytical packages, which allow a large amount of data to be evaluated quickly for symptoms of fraud, and provide evidence of the fraud act or concealment of the fraud.

Detection and Investigation in a Digital Environment

The importance of information systems as a mechanism for fraud prevention, deterrence, and detection cannot be overstated. The value of these information systems to generate red flags for further investigation, to reconstruct actual data flow, and to provide a strong evidence trail is also of considerable value to the fraud and forensic specialist. That said, the most challenging issue regarding fraud detection is the potential for an overwhelming number of fraud symptoms (i.e., red flags). Once preliminary symptoms are observed and documented and the predication threshold has been met, the information systems serve as an important tool in the examination process.

Additional discussion of fraud and forensic tools and techniques in a digital environment is presented in a separate chapter. The key to successful fraud detection and investigation using digital tools and techniques requires a targeted approach. The fraud examiner or investigator must have a sense of what could go wrong, what did go wrong, and how it might manifest itself in the information systems. This requires an understanding of the schemes, the industry, the organization, its IT control environments, its history of fraud, and other items outlined in the previously listed steps to develop a targeted risk assessment. With this foundation, the antifraud professional has a place to begin the fraud examination or financial forensic engagement.

We have eight types of assignments for instructors to choose from:

1. Critical Thinking
2. Review Questions
3. Multiple Choice Questions
4. Fraud Casebook
5. Brief Cases
6. Major Case Investigation (MCI)
7. IDEA Exercises
8. Tableau Exercises

1. CT-1 The magical elevator. There is a man who lives on the top floor of a very tall building. Every day he gets the elevator down to the ground floor to leave the building to go to work. Upon returning from work though, he can only travel half way up in the elevator and has to walk the rest of the way unless it is raining! Why?
2. CT-2 How would you prefer to die? CT-2How would you prefer to die? A murderer is condemned to death. He has to choose between three rooms. The first is full of raging fires, the second is full of assassins with loaded guns, and the third is full of lions that haven’t eaten in 3 years. Which room is safest for him?

Short Answer Questions

Discussion Questions

1 Red Flags. Assume that Aardvark and Zebra compete in the same four-digit SIC code industry and offer comparable products and services. The following table contains their reported financial performance and condition for the last two years, calculated ratios and key nonfinancial metrics. Assume that industry ratios were derived from a reputable source. Further, assume that nonfinancial metrics were derived from reliable public and internal sources. Identification of Red Flags

1. Use the Aardvark and Zebra data provided to complete the following assignments: