Sales Skimming

The most basic skimming scheme occurs when an employee makes a sale of goods or services to a customer, collects the customer’s payment at the point of sale, but makes no record of the transaction. The employee pockets the money received from the customer, instead of turning it over to his employer.

In order to discuss sales skimming schemes more completely, let us consider one of the simplest and most common sales transactions, a sale of goods at the cash register.

In a normal sale transaction, a customer purchases an item—such as a pair of shoes—and an employee enters the sale into the cash register. The register tape reflects that the sale has been made and shows that a certain amount of cash (the purchase price of the item) should have been placed in the register. By comparing the register tape to the amount of money on hand, differences in the amounts may indicate thefts. For instance, if $500 in sales is recorded on a particular register, but only $400 cash related to those sales is counted in the register, reasons for the discrepancy of $100 must be provided (this example assumes a zero beginning cash balance).

When an employee skims money by making off-book sales of merchandise, however, the theft cannot be detected by comparing the register tape to the cash drawer because the sale was never recorded on the register. Return to the example in the preceding paragraph.

Assume a fraudster wants to steal $100, and there are $500 of sales at that employee’s cash register throughout the course of the day. Also assume one sale involves a $100 pair of shoes. When the $100 sale is made, the employee does not record the transaction on his register. The customer pays $100 and takes the shoes home, but instead of placing $100 in the cash drawer, the employee pockets it. Because the employee did not record the sale, at the end of the day, the register tape reflects only $400 in sales. There will be $400 in the register ($500 in total sales minus the $100 that the employee stole), so the register tape and cash on hand amounts match. By not recording the sale, the employee was able to steal money without the missing funds raising any red flags.

A typical control is for retailers to require that customers must receive a receipt. A sign behind the counter of a fast food restaurant informed customers that they would receive a free meal if they alerted the manager that they did not receive a sales receipt. This was more than the company’s attempt to offer good service, it was also an antifraud tool to prevent cash skimming.

Understated Sales

The prior cases dealt with purely off-book sales. Understated sales work differently, in that the transaction is posted to the books, but for a lower amount than the perpetrator collected from the customer (see Figure 4-2). For example, an employee wrote receipts to customers for their purchases, but she removed the carbon-paper backing on the receipts so that they did not produce a company copy. The employee then used a pencil to prepare company copies that showed lower purchase prices. For example, if the customer had paid $100, the company copy might reflect a payment of $80. The employee skimmed the difference between the actual amount of revenue and the amount reflected on the fraudulent receipt. This can also be accomplished at the register when the fraudster underrings a sale, by entering a sale total that is lower than the amount actually paid by the customer. The employee skims the difference between the actual purchase price of the item and the sales figure recorded on the register. In some cases, rather than reduce the price of an item, an employee might record the sale of fewer items. If 100 units are sold, a fraudster might only record the sale of 50 units and skim the excess cash. The successful concealment of this type of fraud necessitates that the customer would not be given a receipt.

Theft in the Mailroom—Incoming Checks

Another common form of skimming occurs in the mailroom, where employees charged with opening the daily mail simply take incoming checks instead of processing them. The stolen payments are not posted to the customer accounts, and, from the victim organization’s perspective, it is as if the check had never arrived (see Figure 4-3). When the task of receiving and recording incoming payments is left to a single person, it is all too easy for that employee to slip an occasional check into his or her pocket.

An example of a check theft scheme is where a mailroom employee stole over $2 million in government checks arriving through the mail. This employee simply identified and removed envelopes delivered from a government agency that was known to send checks to the company. Using a group of accomplices, acting under the names of fictitious persons and companies, this individual was able to launder the checks and divide the proceeds with his cronies.

Lapping

Lapping customer payments is one of the most common methods of concealing receivables skimming. Lapping is the crediting of one account through the abstraction of money from another account. It is the fraudster’s version of “robbing Peter to pay Paul.” Suppose a company has three customers, A, B, and C. When A’s payment is received, the fraudster takes it for himself instead of posting it to A’s account. Customer A expects that his account will be credited with the payment he has made, but this payment has actually been stolen. When A’s next statement arrives, he sees that his check was not applied to his account, and he complains. To avoid this, some action must be taken to make it appear that the payment was posted.

When B’s check arrives, the fraudster takes this money and posts it to A’s account. Payments now appear to be up-to-date on A’s account, but B’s account is short. When C’s payment is received, the perpetrator applies it to B’s account. This process continues indefinitely until one of three things happens: (1) someone discovers the scheme, (2) restitution is made to the accounts, or (3) some concealing entry is made to adjust the accounts receivable balances.

It should be noted that, although more commonly used to conceal skimmed receivables, lapping could also be used to disguise the skimming of sales. In one actual situation, a store manager stole daily receipts and replaced them with the following day’s incoming cash. She progressively delayed making the company’s bank deposits, as more and more money was taken. Each time a day’s receipts were stolen, it took an extra day of collections to cover the missing money. Eventually, the banking irregularities became so great that an investigation was commenced. It was discovered that the manager had stolen nearly $30,000 and concealed the theft by lapping her store’s sales.

A Ponzi scheme, such as the one Bernard Madoff perpetrated, contains the essential elements of lapping in that money from new investors was used to pay off what was “owed” to earlier investors.

Because lapping schemes can become very intricate, fraudsters sometimes keep a second set of books on hand, detailing the true nature of the payments received. In many skimming cases, a search of the fraudster’s work area reveals a set of records tracking the actual payments made and how they have been misapplied to conceal the theft. It may seem odd for someone to keep on hand records of his or her illegal activity, but many lapping schemes become complicated, as more and more payments are misapplied. The second set of records helps the perpetrator keep track of what funds he or she has stolen and what accounts need to be credited to conceal the fraud. Uncovering these records, if they exist, greatly aids the investigation of a lapping scheme.

Force Balancing

Among the most dangerous receivables skimming schemes are those where the perpetrator is in charge of collecting and posting payments. If a fraudster has a hand in both ends of the receipting process, he or she can falsify records to conceal the theft of receivables payments. For example, the fraudster might post an incoming payment to a customer’s receivables account, even though the payment is never deposited. This keeps the receivable from aging, but it creates an imbalance in the cash account. The perpetrator hides the imbalance by forcing the total on the cash account, overstating it to match the total postings to accounts receivable.

Stolen Statements

Another method used by employees to conceal the misapplication of customer payments is the theft or alteration of account statements. If a customer’s payments are stolen and not posted, his or her account becomes delinquent. When this happens, the customer should receive late notices or statements showing that the account is past due. The purpose of altering customers’ statements is to keep them from complaining about the misapplication of their payments.

To keep customers unaware about the true status of their accounts, some fraudsters intercept their account statements or late notices. This might be accomplished, for instance, by changing the customer’s address in the billing system. The statements are sent directly to the employee’s home or to an address where he or she can retrieve them. In other cases, the address is changed so that the statement is undeliverable, which causes the statements to be returned to the fraudster’s desk. In either situation, once the employee has access to the statements, he or she can do one of two things. The first option is to throw the statements away. This is not particularly effective, especially if customers ever request information on their accounts after not having received a statement.

Therefore, the fraudster may instead choose to alter the statements or to produce counterfeit statements to make it appear that the customers’ payments have been properly posted. The fraudster then sends these fake statements to the customers. The false statements lead the customers to believe that their accounts are up-to-date and thus keep them from complaining about stolen payments.

Fraudulent Write-Offs or Discounts

Intercepting the customers’ statements keeps them in the dark as to the status of their accounts, but the problem still remains that as long as the customers’ payments are being skimmed, their accounts are slipping further and further past due. The fraudster must find some way to bring the accounts back up-to-date in order to conceal his or her crime. As we have discussed, lapping is one way to keep accounts current as the employee skims from them. Another way is to write off the customers’ accounts fraudulently. For example, an employee skimmed cash collections and wrote off the related receivables as “bad debts.” Similarly, in another case, a billing manager was authorized to write off certain patient balances as hardship allowances. This employee accepted payments from patients and then instructed billing personnel to write off the balance in question. The payments were never posted, because the billing manager intercepted them. She covered approximately $30,000 in stolen funds by using her authority to write off patients’ account balances.

Instead of writing off accounts as bad debts, some employees cover their skimming by posting entries to contra revenue accounts, such as “discounts and allowances.” If, for instance, an employee intercepts a $1,000 payment, he or she might create a $1,000 “discount” on the account to compensate for the missing money. Providing customers with false discounts is a common technique to conceal a fraudulent skimming scheme.

Debiting the Wrong Account

Fraudsters also debit existing or fictitious accounts receivable in order to conceal skimmed cash. As an example, an office manager in a health-care facility took payments from patients for herself. To conceal her activity, the office manager added the amounts taken to the accounts of other patients that she knew would soon be written off as uncollectable. The employees who use this method generally add the skimmed balances to accounts that are either very large or are aging and about to be written off. Increases in the balances of these accounts are not as noticeable as in other accounts. In this case, once the old accounts were written off, the stolen funds were written off along with them.

Rather than existing accounts, some fraudsters set up completely fictitious accounts and debit them for the cost of skimmed receivables. The employees then simply wait for the fictitious receivables to age and be written off, knowing that they are uncollectible. In the meantime, they carry the cost of a skimming scheme where it is not detected.

Destroying or Altering Records of the Transaction

Finally, when all else fails, a perpetrator may simply destroy an organization’s accounting records in order to cover his or her tracks. For instance, we have already discussed the need for a salesperson to destroy the store’s copy of a receipt in order for the sale to go undetected. Similarly, cash register tapes may be destroyed to hide an off-book sale. In one situation, two management-level employees skimmed approximately $250,000 from their company over a four-year period. These employees tampered with cash register tapes that reflected transactions in which sales revenues had been skimmed. The perpetrators either destroyed entire register tapes or cut off large portions where the fraudulent transactions were recorded. In some circumstances, the employees then fabricated new tapes to match the cash on hand and make their registers appear to balance.

Discarding transaction records is often a last-ditch method for a fraudster to escape detection; the fact that records have been destroyed may itself signal that fraud has occurred. Nevertheless, without the records, it can be very difficult to reconstruct the missing transactions and prove that someone actually skimmed money. Furthermore, it may be difficult to prove who was involved in the scheme.

Preventing and Detecting Receivables Skimming

Receivables skimming schemes typically succeed when there is a breakdown in an organization’s controls, particularly when one individual has too much control over the process of receiving and recording customer payments, posting cash receipts, or issuing customer credits. If the accounting duties associated with accounts receivable are properly separated, so that there are independent checks of all transactions, skimming of these payments is very difficult to commit and very easy to detect. For example, when force balancing is used to conceal skimming of receivables, it causes a shortage in the organization’s cash account, because incoming payments are not deposited. By simply reconciling its bank statement regularly and thoroughly, an organization ought to be able to catch this type of fraud. Similarly, when an individual skims receivables but continues to post the payments to customer accounts, postings to accounts receivable exceeds what is reflected in the daily deposit. If an organization assigns an employee to verify independently that deposits match accounts receivable postings, this type of scheme ought to be quickly detected, or, more likely, it is not attempted at all. It is also a good idea to have that employee spot-check deposits to accounts receivable, to ensure that payments are being applied to the proper accounts. If a check was received by customer A, but the payment was posted to customer B’s account, this indicates a lapping scheme.

As discussed earlier, lapping schemes can become very complicated, and they may require the perpetrator to spend long hours at work, trying to shift funds around in order to conceal the crime. Ironically, it is actually very common in these cases for the perpetrator to develop a reputation as a model employee, because of all the overtime that he or she puts in at the office. After the frauds come to light, the employers frequently express shock—not only because they were defrauded, but also because they had considered the perpetrator to be one of their best employees. The point is that a lapping scheme can only succeed through the constant vigilance of the perpetrator. Because of this fact, many organizations mandate that their employees take a vacation every year or regularly rotate job duties among employees. Both of these tactics can be successful in uncovering lapping schemes, because they effectively take control of the books out of the perpetrator’s hands for a period of time, and, when this happens, the lapping scheme quickly becomes apparent.

It is also important to mandate supervisory approval for write-offs or discounts to accounts receivable. As we have seen, fraudulent write-offs and discounts are a common means by which the skimming of receivables is concealed; they enable the fraudster to wipe the stolen funds off the books. However, if the person who receives and records customer payments has no authority to make these adjustments, the perceived opportunity to commit the crime is severely diminished. Consistent with this concern, all journal entries should be scrutinized for proper supporting documentation, reviews, and approvals.

Although strong internal controls are a valuable preventative tool, the fact remains that fraud can and does continue to occur, regardless of the existence of controls designed to prevent it. Organizations must also be able to detect fraud once it has occurred. Some detection methods are very simple. For example, fraudsters sometimes conceal the theft of receivables by making alterations or corrections to books and records. Physical alterations to financial records, such as erasures or cross-outs, are often a sign of fraud, as are irregular entries to miscellaneous accounts. Audit staff should be trained to investigate these red flags.

It is also important for organizations to search out proactively the accounting clues that point to fraud. This can be tedious, time-consuming work, but computerized audit tools allow organizations to automate many of these tests and greatly aid in the process of searching out fraudulent conduct.

The key to using automated tests successfully is in designing them to highlight the red flags that are typically associated with a particular scheme. For example, we have seen that fraudsters often conceal the skimming of receivables by writing off the amount of funds they have stolen from the targeted account. To detect this kind of activity, organizations can run reports summarizing the number of discounts, adjustments, returns, write-offs, and so on that have been generated by location, department, or employee. Unusually high levels may be associated with skimming schemes and could warrant further investigation. Because some fraudsters conceal their skimming by debiting accounts that are aging or that typically have very little activity, it may also be helpful to run reports looking for unusual activity in otherwise dormant accounts.

Trend analysis on aging of customer accounts can likewise be used to highlight a skimming scheme. A significant rise in the number or size of overdue accounts could be a result of an employee who has stolen customer payments without ever posting them, thereby causing the accounts to run past due. If skimming is suspected, an employee who is independent of the accounts receivable function should confirm overdue balances with customers.

There are several big data/data analytic audit tests that can be used to help detect various forms of occupational fraud. In each chapter of this book where fraud schemes are examined, we provide a set of proactive data analytic audit tests that are tailored to that particular category of fraud. These tests were developed and accumulated by Richard Lanza, working through the Institute of Internal Auditors Research Foundation.

Big Data and Data Analytic Techniques for Detecting Skimming

Larceny at the Point of Sale

A large percentage of the cash larceny schemes occur at the point of sale, and for good reason—that’s where the money is. The cash register (or similar cash collection points, such as cash drawers, church collection baskets, or cash boxes) is usually the most common point of access to ready cash for employees, so it is understandable that larceny schemes frequently occur there. Furthermore, there is often a great deal of activity at the point of sale—particularly in retail organizations—with multiple transactions requiring the handling of cash by employees. This activity can serve as a cover for the theft of cash. In a flurry of activity, with cash being passed back and forth between customer and employee, a fraudster is more likely to be able to slip currency out of the cash drawer and into his or her pocket without getting caught.

This is the most straightforward scheme: the fraudster opens up the register and removes currency (see Figure 4-4). It might be done as a sale is being conducted to make the theft appear to be part of the transaction, or perhaps when no one is around to notice the perpetrator digging into the cash drawer. For instance, a teller simply signed onto a cash register, rang a “no sale,” and took currency from the drawer. Over a period of time, the teller took approximately $6,000 through this simple method.

Recall that the benefit of a skimming scheme is that the transaction is unrecorded, and the stolen funds are never entered on company books. Employees who are skimming either underring the register transaction so that a portion of the sale is unrecorded or they completely omit the sale by failing to enter it at all on their register. This makes the skimming scheme difficult to detect, because the register tape does not reflect the presence of the funds that have been taken. In a larceny scheme, on the other hand, the funds that the perpetrator steals are already reflected on the register tape. As a result, an imbalance results between the register tape and the cash drawer. This imbalance should be a signal that alerts a victim organization to the theft.

The actual method for taking money at the point of sale—opening a cash drawer and removing currency—rarely varies. But the methods used by fraudsters to avoid getting caught are what distinguish larceny schemes. Oddly, in many cases, the perpetrator has no concealment plan for avoiding detection. A large part of fraud is rationalizing; fraudsters convince themselves that they are somehow entitled to what they are taking or that what they are doing is not actually a crime. Cash larceny schemes frequently begin when perpetrators convince themselves that they are only “borrowing” the funds to cover a temporary monetary need. These people might carry the missing cash in their registers for several days, deluding themselves in the belief that they will one day repay the funds and hoping that their employers will not perform a surprise cash count until the missing money is replaced.

Employees who do nothing to camouflage their crimes are easily caught (if someone is paying attention); more dangerous are those who take active steps to hide their misdeeds. In the cash larceny schemes reviewed, there were several methods used to conceal larceny that occurred at the point of sale:

• Thefts from other registers
• Death by a thousand cuts
• Reversing transactions
• Altering cash counts or register tapes
• Destroying register tapes

Larceny of Receivables

Not all cash larceny schemes occur at the point of sale. As discussed earlier, employees frequently steal incoming customer payments on accounts receivable. Generally, these schemes involve skimming—the perpetrator steals the payment but never records it. In some cases, however, the theft occurs after the payment has been recorded, which means it is classified as cash larceny. For example, an employee posted all records of customer payments to date but stole the money received. In a four-month period, this employee took over $200,000 in incoming payments. Consequently, the cash account was significantly out of balance, which led to discovery of the fraud. This case illustrates the central weakness of cash larceny schemes—the resulting imbalances in company accounts. In order for an employee to succeed at a cash larceny scheme, he or she must be able to hide the imbalances caused by the fraud. Larceny of receivables is generally concealed through one of the following three methods:

1. Force balancing
2. Reversing entries
3. Destruction of records

Cash Larceny from the Deposit

At some point in every revenue-generating business, someone must physically take the company’s currency and checks to the bank. This person or persons, literally holding the bag, has an opportunity to take a portion of the money prior to depositing it into the company’s accounts.

Typically, when a company receives cash, someone is assigned to tabulate the receipts, list the form of payment (currency or check), and prepare a deposit slip for the bank. Then another employee, preferably one who was not involved in the preparation of the deposit slip, takes the cash and deposits it in the bank. The person who made out the deposit generally retains one copy of the slip. This copy is matched to a receipted copy of the slip stamped by the bank when the deposit is made.

This procedure is designed to prevent theft of funds from the deposit, but thefts still occur, often because the process is not adhered to (see Figure 4-5). For instance, an employee in a small company was responsible for preparing and making the deposits, recording the deposits in the company’s books, and reconciling the bank statements. This employee took several thousand dollars from the company deposits and concealed it by making false entries in the books that corresponded to falsely prepared deposit slips.

Similarly, in a retail store where cash registers were not used, sales were recorded on prenumbered invoices. The controller of this organization was responsible for collecting cash receipts and making the bank deposits. This controller was also the only person who reconciled the totals on the prenumbered receipts to the bank deposit. Therefore, he was able to steal a portion of the deposit with the knowledge that the discrepancy between the deposit and the day’s receipts would not be detected.

Another oversight in procedure is failure to reconcile the bank copy of the deposit slip with the office copy. When persons making the deposit know that their company does not reconcile the two deposit slips, they can steal cash from the deposit on the way to the bank and alter the deposit slip so that it reflects a lesser amount. In some cases, sales records are also altered to match the diminished deposit.

When cash is stolen from the deposit, the receipted deposit slip is, of course, out of balance with the company’s copy of the deposit slip (unless the perpetrator also prepared the deposit). To correct this problem, some fraudsters alter the bank copy of the deposit slip after it has been validated. This brings the two copies back into balance. For example, an employee altered twenty-four deposit slips and validated bank receipts in the course of a year to conceal the theft of over $15,000. These documents were altered, with correction fluid or ballpoint pen, to match the company’s cash reports. Of course, cash having been stolen, the company’s book balance does not match its actual bank balance. If another employee regularly balances the checking account, this type of theft should be easily detected.

Another mistake that can be made in the deposit function, one that is a departure from common sense, is entrusting the deposit to the wrong person. For instance, a bookkeeper who had been employed for only one month was put in charge of making the deposit. She promptly diverted the funds to her own use. This is not to say that all new employees are untrustworthy, but it is advisable to have some sense of a person’s character before handing that person a bag full of money.

Still another common sense issue is the handling of the deposit on the way to the bank. Once prepared, the deposit should be immediately put in a safe place until it is taken to the bank. In a few of the cases we studied, the deposit was carelessly left unattended. In another fraud, for example, a part-time employee learned that it was the bookkeeper’s habit to leave the bank bag in her desk overnight before taking it to the bank the following morning. For approximately six months, this employee pilfered checks from the deposit and got away with it. He was able to endorse the checks at a local establishment, without using his own signature, in the name of the victim company. The owner of the check-cashing institution did not question the fact that this individual was cashing company checks; as a pastor of a sizable church in the community, the fraudster’s integrity was thought to be above reproach.

As with other cash larceny schemes, stealing from the company deposit can be rather difficult to conceal. In most cases, these schemes are successful for a long term only when the person who counts the cash also makes the deposit. In any other circumstance, the success of the scheme depends primarily on the inattentiveness of those charged with preparing and reconciling the deposit.

Big Data and Data Analytic Techniques for Detecting Cash Larceny

Misuse of Noncash Assets

To this point in the chapter, our discussion of asset misappropriations has focused on cash receipts schemes. Although the vast majority of asset misappropriation schemes involve cash, other assets can be stolen as well. Schemes involving the misappropriation of inventory and other assets are not as common as cash schemes, but they are nevertheless potentially disastrous. The remainder of this chapter will discuss the ways in which employees misappropriate inventory, supplies, equipment, and other noncash assets.

Noncash assets, such as inventory and equipment, are misappropriated by employees in a number of ways. These schemes can range from taking a box of pens home from work to the theft of millions of dollars’ worth of company property. In general, noncash misappropriations fall into one of the following categories:

• Misuse
• Unconcealed larceny
• Asset requisitions and transfers
• Purchasing and receiving schemes
• Fraudulent shipments

There are essentially two ways a person can misappropriate a company asset: the asset can be misused (or “borrowed”), or it can be stolen. Simple misuse is obviously the less egregious of the two. Assets that are misused but not stolen typically include company vehicles, company supplies, computers, and other office equipment. For example, an employee made personal use of a company vehicle while on an out-of-town assignment. The employee provided false information, both written and verbal, regarding the nature of his use of the vehicle. The vehicle was returned unharmed, and the cost to the perpetrator’s company was only a few hundred dollars. Nevertheless, such unauthorized use of a company asset amounts to fraud when a false statement accompanies the use.

Computers, supplies, and other office equipment are also used by some employees to do personal work on company time. For instance, employees might use their computers at work to write letters, print invoices, or do other work connected with a business that they run on the side. In many instances, these side businesses are of the same nature as the employer’s business, so the employees are essentially competing with their employer and using the employer’s equipment to do it. An example of how employees misuse company assets to compete with their employers involved a group of employees who not only stole company supplies but also used the stolen supplies and their employer’s equipment to manufacture their own product. The fraudsters then removed the completed product from their work location and sold it in competition with their employer. In a similar scheme, the perpetrator used his employer’s machinery to run his own snow removal and excavation business for approximately nine months. He generally did his own work on weekends and after hours, falsifying the logs that recorded mileage and usage on the equipment. The employee had formerly owned all the equipment himself, but then he had sold it in order to avoid bankruptcy. As a term of the sale, he had agreed to go to work for the new owner who was operating the equipment, but, in truth, he never stopped running his old business.

The preceding cases offer a good illustration of how a single scheme can encompass more than one type of fraud. Even though the perpetrators in these schemes were misusing company materials and equipment—a case of asset misappropriation—they were also competing with their employers for business—a conflict of interest. The categories ACFE researchers have developed for classifying fraud are helpful in that they allow us to track certain types of schemes, noting common elements, victims, methods, and so on; but those involved in fraud prevention should remember that every crime does not fall neatly into one category. Frauds often increase as opportunity and need allow, and a scheme that begins as something small may grow into a massive crime that can cripple a business.

Unconcealed Larceny Schemes

Although the misuse of company property might be a problem, the theft of company property is obviously of greater concern. As we have seen, losses resulting from larceny of company assets can run into the millions of dollars. The means employed to steal noncash assets range from simple larceny—just walking off with company property—to more complicated schemes involving the falsification of company documents and ledgers.

The textbook definition of larceny is too broad for our purposes, because it would encompass every kind of theft. In order to gain a more specific understanding of the methods used to steal noncash assets, we have narrowed the definition of larceny. For our purposes, larceny is the most basic type of theft, the schemes in which an employee simply takes property from the company premises without attempting to conceal it in the books and records (see Figure 4-6). In other fraud schemes, employees may create false documentation to justify the shipment of merchandise or tamper with inventory records to conceal missing assets. Larceny schemes are more brazen. The culprits in these crimes take company assets without trying to “justify” their absence.

Most noncash larceny schemes are not very complicated. They are typically committed by employees (such as warehouse personnel, inventory clerks, and shipping clerks) with access to inventory and other assets. A typical example of this type of scheme was committed by a warehouse clerk who simply removed inventory from outgoing shipments and left it in plain sight on the warehouse floor as he went about his duties. If someone noticed that a shipment was short, the fact that the merchandise was sitting out in the open made it appear that the omission had been an oversight rather than an intentional removal. In most cases, however, no one noticed that shipments were short, and the excess inventory was available for the perpetrator to take. If customers complained about receiving short shipments, the company sent the missing items without performing any follow-up to determine where the missing inventory had gone. The culprit was eventually caught when someone noticed that he was involved in the preparation of an inordinate number of short shipments.

When we speak of inventory theft, we tend to conjure up images of late-night rendezvous at the warehouse or merchandise stuffed hastily under clothing as a nervous employee beats a path to his or her car. Sometimes this is how employees go about stealing inventory and other assets, but, in many instances, fraudsters do not have to go to these extremes. In several of the cases in our study, employees took items openly, during business hours, in plain view of their coworkers. How does this happen? The truth is that people tend to assume that their friends and acquaintances are acting honestly. When they see a trusted coworker taking something out of the office, people are likely to assume that the culprit has a legitimate reason for removing the asset. In most cases, people just don’t assume that fraud is going on around them. Such was the situation in another fraud, where a university faculty member was leaving his offices to take a position at a new school. This person was permitted to take a small number of items to his new job, but he certainly exceeded the intentions of the school when he loaded two trucks full of university lab equipment and computers worth several hundred thousand dollars. The perpetrator simply packed up these stolen assets along with his personal items and drove away.

Even though it is true that employees sometimes misappropriate assets in front of coworkers who do not suspect fraud, it is also true that employees may be fully aware that one of their coworkers is stealing, yet they refrain from reporting the crime. There are several reasons that employees might ignore illegal conduct, such as a sense of duty to their friends, a “management versus labor” mentality, intimidation of honest employees by the thief, or poor channels of communication—or the coworkers may be assisting in the theft. When high-ranking personnel are stealing from their companies, employees often overlook the crime because they fear they will lose their jobs if they report it. For example, a school superintendent was not only pilfering school accounts but also stealing school assets. A search of his residence revealed a cellar filled with school property. A number of school employees knew or suspected the superintendent was involved in illegal dealings, but he was very powerful, and employees were afraid to report him for fear of retaliation. As a result, he was able to steal from the school for several years. Similarly, in another fraud, a city manager ordered subordinates to install air conditioners—known to be city property—in the homes of several influential citizens, including his own. Although there was no question that this violated the city’s code of ethics, no one reported the manager because of a lack of a proper whistleblowing procedure in the department.

Ironically, employees who steal company property are often highly trusted within their organizations. This trust can provide employees with access to restricted areas, safes, supply rooms, or even keys to the business. Such access, in turn, makes it easy for employees to misappropriate company assets. One embezzlement scheme, in particular, provides an example of how an employee abused his position of trust to misappropriate noncash assets. In this case, a long-term employee of a contractor was given keys to the company parts room. It was his job to deliver parts to job sites. This individual used his access to steal high-value items that he then sold to another contractor. The scheme itself was uncomplicated, but, because the employee had a long history of service to the company and because he was highly trusted, inventory counts were allowed to lapse, and his performance went largely unsupervised. As a result, the scheme continued for over two years and cost the company over $200,000.

Employees with keys to company buildings are able to misappropriate assets during nonbusiness hours, when they can avoid the prying eyes of their fellow employees, as well as management and security personnel. Several schemes involved employees who entered their places of business to steal assets during weekends, as well as before or after normal working hours. In one scheme, two employees in management positions at a manufacturing plant set finished items aside at the end of the day and then returned the next day an hour before the morning shift and removed the merchandise before other employees arrived. These perpetrators had keys to the plant’s security gate, which allowed them to enter the plant before normal hours. Over the course of several years, these two fraudsters removed and sold approximately $300,000 worth of inventory from their company.

It can be unwise for fraudsters to carry inventory and other assets physically off the company’s premises. This practice carries with it the inherent risk and potential embarrassment of being caught red-handed with stolen goods on one’s person. Some fraudsters avoid this problem by mailing company assets to a location where they can pick them up without having to worry about security, management, or other potential observers. For instance, a spare-parts custodian took several thousand dollars’ worth of computer chips and mailed them to a company that had no business dealings with the custodian’s employer. He then reclaimed the merchandise as his own. By taking the step of mailing the stolen inventory, the fraudster allowed the postal service to do his dirty work for him unwittingly.

Asset Requisitions and Transfers

Asset requisitions or other documentation that enables noncash assets to be moved from one location in a company to another can be used to facilitate the misappropriation of those assets. Fraudsters use these internal documents to gain access to merchandise that they otherwise might not be able to handle without raising suspicion. Transfer documents do not account for missing merchandise the way false sales do, but they allow fraudsters to move assets from one location to another. In the process of this movement, fraudsters take the merchandise for themselves (see Figure 4-6).

The most basic scheme occurs when an employee requisitions materials to complete a work-related project and then steals the materials. In some cases, fraudsters simply overstate the amount of supplies or equipment needed to complete their work and pilfer the excess. In more extreme cases, fraudsters might completely fabricate a project that necessitates the use of certain assets that they intend to steal. For instance, an employee of a telecommunications company used false project documents to request approximately $100,000 worth of computer chips, allegedly to upgrade company computers. Knowing that this type of requisition required verbal authorization from another source, the employee set up an elaborate phone scheme to get the “project” approved. The fraudster used his knowledge of the company’s phone system to forward calls from four different lines to his own desk. When the confirmation call was made, it was the perpetrator who answered the phone and authorized the project.

Dishonest employees sometimes falsify property transfer forms so that they can remove inventory or other assets from a warehouse or stockroom. Once the merchandise is in their possession, the fraudsters simply take it home with them. For example, a manager requested merchandise from the company warehouse to be displayed on a showroom floor. The pieces he requested never made it to the showroom, because he had loaded them into a pickup truck and taken them home. In some instances, he actually took the items in broad daylight, with the help of another employee. The obvious problem with this type of scheme is that the person who orders the merchandise is usually the primary suspect when it turns up missing. In many cases, fraudsters simply rely on poor communication between different departments in their company and hope that no one pieces the crime together. The individual in this case, however, thought that he was immune from detection because the merchandise was requested via computer, using a management-level security code. The code was not specific to any one manager, so there would be no way of knowing which manager had ordered the merchandise. Unfortunately for the thief, the company was able to record the computer terminal from which the request originated. The manager had used his own computer to make the request, which led to his undoing.

Where inventory is stored in multiple locations, the transfer of assets from one building to another can create opportunities for employees to pilfer.

Purchasing and Receiving Schemes

The purchasing and receiving functions of a company can also be manipulated by dishonest employees to facilitate the theft of noncash assets (see Figure 4-6). It might at first seem that any purchasing scheme falls under the heading of false billings. There is, however, a distinction between the purchasing schemes that are classified as false billings and those that are classified as noncash misappropriations. If employees cause their company to purchase merchandise that the company does not need, this is a false billing scheme. The harm to the company comes in paying for assets for which it has no use. For instance, a carpenter was allowed control over the ordering of materials for a small construction project. No one bothered to measure the amount of materials ordered against the size of the carpenter’s project. The carpenter was therefore able to order excess, unneeded lumber, which was then delivered to his home in order to build a fence for his own residence. The essence of the fraud in this case was the purchase of unneeded materials.

On the other hand, if the assets are intentionally purchased by the company but simply misappropriated by the fraudster, this is classified as a noncash scheme. In the preceding example, assume that the victim company wanted to keep a certain amount of lumber on hand for odd jobs. If the carpenter took this lumber home, the crime is a theft of lumber. The difference is that, in the second example, the company is deprived not only of the cash it paid for the lumber but also of the lumber itself. It then has to purchase more lumber to replace what is missing. In the first example, the company’s only loss was the cash paid in the fraudulent purchase of the unneeded materials.

False Shipments of Inventory and Other Assets

To conceal thefts of inventory, fraudsters sometimes create false shipping documents and false sales documents to make it appear that missing inventory was not actually stolen but was instead sold (see Figure 4-7). The document that tells the shipping department to release inventory for delivery is usually the packing slip. By creating a false packing slip, corrupt employees can cause inventory to be delivered to themselves or an accomplice fraudulently. The “sales” reflected in the packing slips are typically made to a fictitious person, a fictitious company, or an accomplice of the perpetrator. For instance, an inventory control employee used his position to create fraudulent paperwork that authorized the shipment of over $30,000 worth of inventory to his accomplices. The fraudsters were then able to sell the inventory for their own profit.

One benefit of using false shipping documents to misappropriate inventory or other assets is that someone other than the fraudsters can remove the product from the warehouse or storeroom. The perpetrators of the scheme do not have to risk being caught stealing company inventory. Instead, the victim company unknowingly delivers the targeted assets to them.

Packing slips allow inventory to be shipped from the victim company to the perpetrator, but alone they do not conceal the fact that inventory has been misappropriated. In order to hide the theft, fraudsters may create a false sale, so it appears that the missing inventory was shipped to a customer. In this way, the inventory is accounted for. Depending on how the victim organization operates, the fraudster may have to create a false purchase order from the “buyer,” a false sales order, and a false invoice along with the packing slip to create the illusion of a sale.

The result is that a fake receivable account goes into the books for the price of the misappropriated inventory. Obviously, the “buyer” of the merchandise never pays for it. How do fraudsters deal with these fake receivables? In some cases, fraudsters simply let the receivable age on their company’s books until it is eventually written off as uncollectable. In other instances, the employee may take steps to remove the sale—and the delinquent receivable that results—from the books. For instance, in Case 1683, the perpetrator generated false invoices and delivered them to the company warehouse for shipping. The invoices were then marked “delivered” and sent to the sales office. The perpetrator removed all copies of the invoices from the files before they were billed to the fictitious customer. In other scenarios, the perpetrator might write the receivables off, as did a corrupt manager in another case. In that five-year scheme, the perpetrator took company assets and covered up the loss by setting up a fake sale. A few weeks after the fake sale went into the books, the perpetrator wrote off the receivable to an account for “lost and stolen assets.” More commonly, the fake sale is written off to discounts or allowances or to a bad debts expense account.

Instead of completely fabricated sales, some employees understate legitimate sales so that an accomplice is billed for less than delivered. The result is that a portion of the merchandise is sold at no cost. In one instance, a salesman filled out shipping tickets, which he forwarded to the warehouse. After the merchandise was delivered, he instructed the warehouse employees to return the shipping tickets to him for “extra work” before they went to the invoicing department. The extra work that the salesman did was to alter the shipping tickets, reducing the quantity of merchandise on the ticket so that the buyer (an accomplice of the salesman) was billed for less than he received.

Other Schemes

Because employees tailor their thefts to the security systems, record-keeping systems, building layout, and other day-to-day operations of their companies, the methods used to steal inventory and other assets vary. The preceding categories comprised the majority of schemes in our study, but there were a couple of other schemes that did not fit any established category, yet which merit discussion.

Write-offs are often used to conceal the theft of assets after they have been stolen. In some cases, however, assets are written off in order to make them available for theft. For example, a warehouse foreman abused his authority to declare inventory obsolete. He wrote off perfectly good inventory and then “gave” it to a dummy corporation that he secretly owned. This fraudster took over $200,000 worth of merchandise from his employer. Once assets are designated as “scrap,” it may be easier to conceal their misappropriation. Fraudsters may be allowed to take the “useless” assets for themselves, buy or sell them to an accomplice at a greatly reduced price, or simply give the assets away.

One final unique example was presented in a scheme where a low-level manager convinced his supervisor to approve the purchase of new office equipment to replace existing equipment, which was to be retired. When the new equipment was purchased, the perpetrator took it home and left the existing equipment in place. His boss assumed that the equipment in the office was new, even though it was actually the same equipment that had always been there. If nothing else, this case illustrates that sometimes a little bit of attentiveness by management is all it takes to halt fraud.

Altered Inventory Records

One of the simplest methods for concealing shrinkage is to change the perpetual inventory record so that it matches the physical inventory count. This is also known as a forced reconciliation of the account. Basically, the perpetrator just changes the numbers in the perpetual inventory to make them match the amount of inventory on hand. As an illustration, a supervisor involved in the theft of inventory credited the perpetual inventory and debited the cost of sales account to bring the perpetual inventory numbers into line with the actual inventory count. Once these adjusting entries were made, a review of inventory would not reveal any shrinkage. Rather than use correcting entries to adjust perpetual inventory, some employees simply alter the numbers by deleting or covering up the correct totals and entering new numbers.

There are two sides to the inventory equation: the perpetual inventory and the physical inventory. Instead of altering the perpetual inventory, fraudsters who have access to the records from a physical inventory count can change those records to match the total of the perpetual inventory. Going back to the computer store example, assume the company counts its inventory every month and matches it to the perpetual inventory. The physical count should come to 990 computers, because that is what is actually on hand. If the perpetrator is someone charged with counting inventory, he or she can simply write down that there are 1,000 units on hand.

Fictitious Sales and Accounts Receivable

We have already discussed how fraudsters create fake sales to mask the theft of assets. When the perpetrator made an adjusting entry to the perpetual inventory and cost of sales accounts in the prior case, the problem was that there was no sales transaction on the books that corresponded to these entries. Had the perpetrator wished to fix this problem, he would have entered a debit to accounts receivable and a corresponding credit to the sales account to make it appear that the missing goods had been sold.

Of course, the problem of payment then arises, because no one is going to pay for the goods that were “sold” in this transaction. There are two routes that a fraudster might take in this circumstance. The first is to charge the sale to an existing account. In some cases, fraudsters charge fake sales to existing receivables accounts that are so large that the addition of the assets they have stolen is not noticed. Other corrupt employees charge the “sales” to accounts that are already aging and will soon be written off. When these accounts are removed from the books, the fraudster’s stolen inventory effectively disappears.

The other adjustment that is typically made is a write-off to discounts and allowances or bad debt expense. To illustrate, an employee with blanket authority to write off up to $5,000 in uncollectable sales per occurrence used this authority to conceal false sales of inventory to nonexistent companies. The fraudster bilked his company out of nearly $180,000 using this method.

Write-Off Inventory and Other Assets

We have already discussed the case where a corrupt employee wrote off inventory as obsolete and then “gave” the inventory to a shell company that he controlled. Writing off inventory and other assets is a relatively common way for fraudsters to remove assets from the books before or after they are stolen. Again, this is beneficial to the fraudster because it eliminates the problem of shrinkage that inherently exists in every case of noncash asset misappropriation. Examples of this method include a manager who wrote supplies off as lost or destroyed and then sold the supplies through his own company; in another case, a director of maintenance disposed of fixed assets by reporting them as broken and then took the assets for himself.

Physical Padding

Most methods of concealment deal with altering inventory records, either changing the perpetual inventory or miscounting during the physical inventory. Alternatively, some fraudsters try to make it appear that there are more assets present in the warehouse or stockroom than there actually are. Empty boxes, for example, may be stacked on shelves to create the illusion of extra inventory. For example, employees stole liquor from their stockroom and restacked the containers for the missing merchandise. This made it appear that the missing inventory was present when, in fact, there were really empty boxes on the stockroom shelves. In a period of approximately eighteen months, this concealment method allowed employees to steal over $200,000 worth of liquor.

The most egregious case of inventory padding in our study occurred when the fraudsters constructed a facade of finished product in a remote location of a warehouse and cordoned off the area to restrict access. Although there should have been a million dollars’ worth of product on hand, there was actually nothing of finished product behind the wall, which was constructed solely to create the appearance of additional inventory.

Big Data and Data Analytic Techniques for Detecting Noncash Misappropriations

We have eight types of assignments for instructors to choose from:

1. Critical Thinking
2. Review Questions
3. Multiple Choice Questions
4. Fraud Casebook
5. Brief Cases
6. Major Case Investigation (MCI)
7. IDEA Exercises
8. Tableau Exercises

Short Answer Questions

1. What event sparked the drop in the value of Tyco stock in 2002?
2. Who was the Tyco Chief Executive Officer at the time of the investigation?
3. How many shares of stock did Kozlowski and Swartz sell without proper disclosure?
4. What corporate governance body was criticized for failing to set appropriate standards of ethics, integrity, accounting, and corporate governance?
5. For how much did Tyco settle their shareholder lawsuits?
6. In what prison system were the Tyco executives prosecuted?

Discussion Questions

1. What kind of noncash asset misappropriation scheme was perpetrated by Mr. Kozlowski?
2. Why does the venue for the criminal prosecution matter? Given that Mr. Kozlowski was prosecuted in state court, how does he likely benefit and how is he likely to suffer in contrast to being prosecuted in the Federal system?
3. Mr. Kozlowski forgave relocation loans given to 51 employees and paid their corresponding income taxes at a cost to Tyco shareholders of $96 million. How would you hypothesize that this act impacted the fraud, if at all, and why?

Assignment:

Continuing to focus on evidence associated with the act, concealment, and conversion, use the evidentiary material to continue the investigation. Your primary assignment is to examine the operational environment to consider the questions of what (scheme), how would the act be perpetrated, and who (a list of suspects).