Corydon Corporation was a large international conglomerate with many business segments, each of which produced its own revenue stream. Because of the size and complexity of the company, management created a customized accounting system. Each segment had its own credit department with a line-management system in place for internal direction and communication.

The credit department to which Trina was assigned was managed by Jesse Clark, and the primary metric of success used in the department was the Receivables Aging Report that communicated the number of days receivables were outstanding. The clients Trina was responsible for varied in size. Some were large international companies and others were small and locally based.

As a credit manager, Trina had great authority with clients. If she e-mailed her contact at a company and said that Corydon would like to receive some of their aged or outstanding receivables through an Internet-banking transfer, why would a client question it? Most of Trina's clients paid by check but they were not averse to paying with an online transfer if an invoice was past due. So Trina requested just that — and jumped on her opportunity to generate funds to impress the woman she had grown fond of and didn't want to lose. Trina's plan was to build a house of worship so Rhonda could preach full time.

Because she knew that some of her clients might not be familiar with Internet banking and the process for making online transfers, Trina sent e-mails to the accounts payable representatives at the targeted companies with the instructions for transferring funds online; there were 11 of them in total. Not so coincidentally, Corydon Corporation's new Internet banking account was the same as Trina Johnson's personal account. In the beginning Trina forwarded the new banking instructions only to clients who went into bankruptcy. These payments would be easy to cover up because Corydon wasn't expecting to receive the funds and she could write them off without suspicion. But it didn't take long for Trina to become brave enough to e-mail fraudulent bank instructions to her other clients.

Part of the function of the credit department was to review collection efforts made on major clients' accounts. Traditionally this happened quarterly, but with the dramatic increase in business in the past few years, it had unfortunately become an annual event. It was during one of these reviews that Jesse Clark, Trina's manager, asked about one of the receivables for Powell, a major client. Trina responded that the check must have gotten lost in the interoffice mail because she had sent it to the lockbox a few weeks earlier. Jesse's suspicion was raised because he knew Powell had to reissue another check recently, again because it was lost on Corydon's end.

Jesse was also unhappy with Trina's performance in recent months. He couldn't put his finger on it but something wasn't quite right, so he decided to move her to a different segment with new accounts to manage. Doug Brown was slated to take over Trina's accounts. While this transition was occurring, Jesse was thinking about how to reduce the department head-count because business had started to slow down. Only a handful of people were being considered for the layoffs, and Rhonda's low seniority put her near the top of the list.

During the handover of accounts, Trina told Doug and Jesse that two of her clients had multiple problems and that she would like to resolve them herself. Jesse was skeptical but agreed to let Trina finalize the issues with Powell and Axis.

Doug had a tough time at the office after the handover. Employees in other departments were uncooperative. After many meetings with operations, Doug learned that Trina had been aggressive with the operational staff to the point that no one wanted to work with the credit department.

Shortly after the handover, Jesse asked Doug and Trina for an update on the Powell and Axis accounts. Trina was panicking. She had received the payments as Internet transfers — one from each company — to her personal bank account many months earlier. How was she going to write off the amounts without attracting suspicion? She had already lied about the lost checks to Jesse and couldn't risk the truth surfacing. Then there was Rhonda's church to consider. Construction had started at the site and the Web site was being designed; Trina had to pay many contractors to keep her plan in motion. Jesse insisted that both Doug and Trina go to Powell to pick up a replacement check for the lost payment and, while there, Trina was to introduce Doug to the Powell accounts payable supervisor, Vivian York. Jesse wanted to know what was going on and he knew that he would not get answers until Trina was completely out of the picture. The meeting was arranged for later in the week; Trina knew she was on borrowed time.

On the same day the Powell meeting was arranged, Doug was surprised to receive an e-mail from Corydon's treasury department stating that the missing Axis payment of $129,747.24 had been received. Treasury had scanned a copy of the details as an attachment. Doug looked through the supporting documents and was puzzled by the calculator tape (with handwritten notes) that accompanied the check. He also thought it was strange that Axis paid with a cashier's check. Doug forwarded the documents to Jesse and then called him to discuss the calculator tape. The handwritten words next to the amounts said "Axis, Powell and Strickland." While there were various calculations and notations, the amount of $129,747.24 appeared next to "Axis," $118,770.32 appeared next to "Powell," and $78,412 appeared next to "Strickland." Jesse and Doug both agreed that the calculator tape was strange, but neither of them understood the comments and decided not to pursue it.

The day of Trina and Doug's meeting at Powell's offices was beautiful and sunny with almost no humidity — a rare day for the millions of people who live close to the Gulf of Mexico. Doug was supposed to meet Trina at Powell's Houston office at 1:00 PM and he was right on time. He parked in the visitors' parking area and went into Powell's main reception area. Doug checked in with the receptionist, who informed him that Trina had already been there but returned to her car for a moment and would be back shortly. Doug took a seat and waited.

Trina came off the elevator a few minutes later and apologized to Doug, saying she had forgotten something in her car. Trina also told Doug that she had already received the check from Vivian right before the meeting and that they could leave after introductions were made. Trina signaled her readiness to the receptionist, who called Vivian York to announce her visitors. Vivian came out moments later and took them back to her office.

Doug first apologized for the trouble of Corydon losing the two previous checks. Vivian was sympathetic and said, "That's okay; it happens sometimes." There was some small talk but, for the most part, Vivian was in a hurry because she had another meeting to get to. The three exchanged good-byes. On the way to the elevator, Doug asked Trina to see Powell's check. Trina looked through her briefcase and day planner but couldn't find it. She said, "I must have left it in my car when I went down earlier." That seemed extremely unlikely to Doug, but he followed her to the main parking lot. Trina led Doug to her car (a BMW 7 Series that she claimed she bought after winning a lawsuit), and picked up a plain envelope that was lying on the back seat. She handed the envelope to Doug; he looked inside and immediately had a sinking feeling. It was a cashier's check that looked very similar to the Axis check. Doug made no comment except to thank Trina for arranging the introductions. He took the replacement check and assured Trina he would put it in the lockbox.

Doug went back to his office and quickly faxed a copy of the Powell check to Jesse. Both the Powell and Axis cashier's checks were from the same bank — sequentially numbered — and the Powell check amount matched the figure next to Powell's name on the calculator tape submitted with the Axis check. Jesse reviewed Trina's customer account records and another recent receivable jumped off the page — a payment with a cashier's check on the Strickland account. Jesse thanked Doug for the information and said that he would take it from there. Jesse met with various levels of management and the consensus was to terminate Trina at once and figure out the damages later.

When I was brought into the Corydon case as an investigative auditor, Trina was no longer an employee, which meant I was not able to interview her. I was told that Trina had been fired several weeks ago and we needed to determine the extent of her criminal actions.

The investigation team was composed of me and my colleague Adrian. We were given the facts that had already been gathered. At the start, we only knew "who" and even then we could not rule out the possibility of accomplices. We divided the investigation into four parts.

Adrian started reviewing the credit and collection process and asked Jesse for an overview of Trina's job responsibilities, while I focused on her computer. I was hoping to recover any evidence that might have still existed. This was the first forensic review that had ever been performed at Corydon Corporation — history was in the making. I was also aware that the district attorney's (DA) office had been contacted and Trina's bank records were being subpoenaed, so I hoped to have more information to work with soon.

Adrian's review of the credit department's processes revealed multiple internal control breaches:

I began my forensic review with the deposits that blew Trina's cover in the first place. With photocopies of the two cashier's checks in front of me, I started searching. The main questions going through my mind were: "Why would clients wire transfer funds to a personal bank account?" and "How did Trina convince them to do it?" What I discovered shocked me because of its simplicity. I found the wiring instructions Trina had e-mailed to the companies associated with the two cashier's checks. It became obvious why the clients changed their banking instructions — Trina told them to. She was, after all, a credit manager at Corydon Corporation so, why wouldn't they believe her? The targeted clients must have assumed that the online communication, sent from her Corydon e-mail account, represented the business decisions and processes of Corydon.

The e-mails she sent were short and to the point. Both Powell and Axis had normally remitted their funds via physical check; however, because she had established relationships with their accounts payable supervisors, Trina had no trouble getting them to switch to wire transfers temporarily. She just asked: "Any chance of getting a wire transfer on the old invoices?"

When the client said yes, Trina followed up with: "You are wonderful and to show my appreciation, I would like to take you for lunch whenever your schedule permits. Due to the delay in payment, the only two invoices I would like sent by wire transfer are the oldest from January and February. Attached are the wire instructions that I need these funds sent to."

The wire transfer form that Trina had attached was a simple Word document with only basic information:

While the bank account number was her own personal account, by giving both her name and the company name, she made it less obvious. So why did the bank allow a business wire transfer into a personal bank account? The DA's office asked just that and it turned out, much to our surprise, most banks at the time did not review the names on wire transfers because they were automated transactions. As long as the account and routing numbers existed and people did not complain, bank personnel would generally only review transactions if system errors occurred.

Once I had the bank account number and wire instruction details, I searched through Trina's computer for other electronic instructions. I identified more targeted clients and two other bank accounts in Trina's name. I cross-referenced her payroll files and learned that she had changed her direct deposit information three times during her employment history. This information was given to the DA's office to subpoena the other bank statements and we hit the jackpot; Trina had received wire transfers in the other two accounts.

We discovered e-mails between Trina and Rhonda that solidified Trina's motive to commit the fraud. Countless e-mails from Trina to Rhonda had the same tone. Trina was clearly submissive to Rhonda and sought her love and approval. Trina commonly referred to Rhonda as "Pastor Davis" or "Overseer" and often thanked her for allowing Trina into her life.

The best piece of evidence, known as "Exhibit 33," was also found in Trina's e-mail server. It was a detailed, four-page e-mail to a pastor in a nearby city. The relationship between Trina and this pastor was not determined, but the letter outlined how Trina's life had recently been blessed by a "woman of God" and that Trina was so excited because "God had spoken" to her and given her a plan to follow. The e-mail was written in chronological order, and each time God spoke to Trina, money miraculously appeared in her personal bank accounts. God's plan included many perks for Rhonda. A new Lexus, a wardrobe and fully paid back taxes were just the beginning; the most extravagant item demanded of Trina by the Lord was a house of worship for Rhonda. Trina sought the advice of this pastor after explaining that her relationship with Rhonda had become estranged. She did not understand why Rhonda pushed her away after Trina had bestowed gifts to her, as commanded by God.

The question on my mind after finding this document was, where was Rhonda? I knew we needed to go through her computer, but much to my disappointment, Rhonda had been laid off due to headcount reductions three months before Trina was fired. Rhonda's computer had been wiped and reissued to another employee and her backup account on the server had been purged after 90 days of inactivity.

Intrigued by the mention of a new church in Trina's e-mail to the other pastor, I performed additional searches on Trina's computer and scored again. Temporary Internet files led me to the church's new Web site. Multiple pages detailed the construction timeline of the new church and the organizational chart of the people involved in the ministry. Rhonda was at the top with a beautiful picture that linked to her biography; Trina's title was "Audio & Tape Ministry" with other responsibilities in overseeing the Web site's design. I also found e-mails to and from the Web designer in Trina's computer with detailed instructions, as communicated to her by Rhonda. We couldn't wait to get the bank records from the DA.

After we received Trina's bank records, we cross-referenced the deposits with her customer sales. We also reviewed two of Trina's other personal bank accounts and discovered hundreds of thousands of dollars of redirected client payments.

Corydon worked closely with the DA's office to build a solid case against Trina. Through information-sharing we learned that the bank account that received the majority of misdirected receivables was in the names of both Trina Johnson and Rhonda Davis. Signature cards were required for shared accounts and we already had other reasons to believe that Rhonda was involved in the fraud — primarily because of the material benefits she received from Trina. I searched through the bank documents and, sure enough, found a signature card with both Trina's and Rhonda's signatures. I matched their signatures on documents in their respective personnel files. After communicating this to the DA's office, Rhonda's personal bank accounts were subpoenaed — she had three accounts and had received $103,000 from Trina.

While tracing the funds that Trina electronically sent from her various bank accounts, we also discovered the new church's accounts. There were a total of four, and more than $500,000 had been transferred to them online from Trina. Besides payments to a number of contractors working on the church, other expenditures included furniture and a home-theater system for Trina's new house as well as ongoing payments for her leased BMW. There were even donations to other ministries in Texas.

Thirty-seven of the identified misappropriations were wire transfers. By the end of the investigation we determined that Trina had targeted 14 clients and stolen more than $2.5 million over the course of three years. She opened three different bank accounts during the period, as outlined here:

The first and second accounts overlapped for a few months, as did the second and third. During the last 14 months of the fraud, Trina repaid invoices — totaling $925,927 using cashier's checks — mainly because of the many questions she received during credit meetings when Doug took over her accounts. She could not keep telling her manager that checks were getting lost in the mail. Too many wire transfers had hit her personal bank accounts, and Trina could not keep up with hiding them. She felt that she had to give some of the money back or risk being discovered. We reviewed the repayments she made to ensure no other victim clients were missed. The remaining funds in Trina's bank accounts were frozen and Corydon got back $360,000 from them.

The DA's office interviewed Rhonda. Her story was that Trina had told her she owned several oil rigs (handed down from her family) and that Trina wanted to help Rhonda build a house of worship. Rhonda thought it was a "dream come true." She confirmed that the church was being built but there was no more money left in the church's bank accounts. After the DA informed Rhonda that the money had in fact been taken from Corydon, she transferred ownership of her Lexus to the company. Rhonda was not prosecuted due to a lack of direct evidence connecting her to the fraud, and she had left Corydon before the scheme was discovered. The DA offered Trina a reduced sentence to disclose Rhonda's involvement but she stuck to her story that Rhonda had nothing to do with the fraud. However, we believed that Rhonda had to know about the fraud because:

Before Trina spoke in front of a judge to be sentenced, several character witnesses testified on her behalf. One was a former supervisor under whom Trina worked at a different company. After he finished extolling Trina's virtues, the prosecuting attorney asked a basic question. "If you had a chance to hire her back, would you?" The supervisor looked around the courtroom as if to stall for time and then said, "Don't think I could do that."

When Trina took the stand she didn't offer a defense or an apology. She was arrogant, obstinate and disrespectful. She showed no remorse, offered no explanations and talked in circles. Trina's stance was that it was other people's fault. The judge was frustrated with Trina's cavalier attitude in the courtroom and sentenced her to 30 years in state prison. Restitution was set at $1.2 million.

Kasondra N.D. Fehr, CFE, CGA, CFI, is a compliance audit manager at Schlumberger Limited. She joined the company in 1997 as the Controller over Canadian Seismic operations and was transferred to the Internal Audit department based in Sugar Land, Texas, in 2001 where she began her career in financial fraud investigation. Ms. Fehr has traveled the world to investigate financial crimes. She has investigated many types of internal crimes and has worked closely with law enforcement agencies in several countries. In 2006, she moved to the Compliance Department of Schlumberger.