Guarding Against Internal Frauds Committed by Employees

You can reduce employee fraud by controlling tempting environments and implementing internal control processes to deter wrongdoing.

Internal fraud threats are the most common type of fraud that small businesses must contend with. To complicate matters, these threats can come from employees of all ranks--even owners. Employees generally commit occupational frauds when a permissive environment or misplaced trust exists.

If no internal controls exist, or if they exist but are not enforced, temptation beckons employees. Or, your bookkeeper for more years than either of you care to remember, is so trusted that no one would ever suspect him of dipping into the till, opportunities abound for him to go astray!

Factors leading to fraud. Most employees perpetrate so-called "white collar" frauds when a combination of four factors exists:

Motive: The employee has some pressing financial need such as a family illness, excessive debt, or a gambling problem.
Means. The employee has skills that qualify him or her for a job working with cash or other employer assets.
Opportunity. The employer's lack of internal controls or enforcement thereof, or just misplaced trust, create an environment conducive to fraud.
Rationalization. The employee is convinced that the employer owes her or him something such as higher pay or more appreciation, thus justifying committing the fraud. Or, "I'm really only borrowing it; I'll replace it later."

Types of occupational fraud. Occupational frauds committed by employees generally come in two flavors:

Misappropriation of Cash by Employees. Misappropriation of cash (or its equivalents) is the most common of all the employee frauds.
Misappropriation of Non-Cash Assets by Employees. Misappropriation of non-cash assets commonly consists of inventory theft, false purchases and false sales.

This article discusses the first type: misappropriation of cash by employees.

Financial statement fraud is another type of occupational fraud (a la Enron, WorldCom, Tyco, etc.), but this type of deception is usually found in large, public companies. Still, you should be aware that it exists.

Employee Misappropriation of Cash Is Most Common Fraud

The most common employee occupational frauds of misappropriations of cash include:

check tampering,
revenue skimming
fraudulent disbursements by fake invoicing,
payroll schemes, and
billing scams.

These frauds can be grouped into general categories, including larceny and embezzlement, skimming, and phony disbursements.

Preventing Employee Larceny and Embezzlement

Employee dishonesty can turn a thriving cash transaction business into a leaky bucket at warp speed. Internal controls designed to discourage this kind of behavior are essential and hands on management on a day-to-day basis can stem this tide if the commitment is there.

The Fraud. Larceny and embezzlement are cash theft schemes perpetrated after the cash has been recorded in the company's books.

The difference between these similar criminal actions is that larceny is a "trespassory" taking of another's property with intent to steal, while embezzlement is also a taking of another's property with intent to steal . . . but by a person in a position of trust with legal access to the property. In other words, embezzlement is the fraudulent appropriation of money or property lawfully in one's possession.

Common examples of larceny and/or embezzlement can be the stealing of cash from a cash register or the company's daily bank deposit, or the stealing of customer checks received to pay accounts receivable balances.

A cashier takes in cash from a restaurant patron, rings it up on the register and hands the change to the customer. She then removes cash from the register and hits the "void" key to cancel the transaction on the tape and writes "void" on the restaurant check/tab.

She has just negated the record of the sale of that meal without approval. Say she does this to the tune of only $10 a day. . . that's a $50 a week untaxed raise she's given herself at the company's expense.

Voiding a transaction makes her cash drawer balance with the register tape at the end of the day, and no one's the wiser . . . as long as she doesn't get greedy, that is.

The Flaw: Employees, for example, cashiers should not have sole authority over "voids." A manager's key must be required to process legitimate voids as well as rebates. Absent that control, there is a fertile field for embezzlement fraud.

The Fix: Segregation and/or rotation of duties, along with frequent surprise audits of cash on hand, independent reconciliation of register contents and tapes, and voucher accounting are the prime modes of embezzlement prevention. One individual must not have the sole responsibility for receiving cash, counting it and reconciling registers, preparing and making bank deposits, doing the voucher accounting, and posting payments to open receivable accounts.

In our restaurant example:

Each customer should receive a receipt. One way to assure this is to put a sign on the register saying the meal will be free if the cashier fails to give a receipt. The manager must, of course, adjust for the free meal which could be charged to the cashier, if that is the policy.
Giving a receipt to a customer assures that the transaction goes through the register and is recorded on the tape. If it is later voided in a theft attempt, the cashier's tape report for that shift will not reconcile with the cash drawer. A manager must authorize the voided check and key the register to adjust the tape if the transaction is truly void.
Every numbered document must be accounted for . . . including voids. In the case of the restaurant, each check (voucher) is pre-numbered and all must be accounted for in sequence. Strong internal controls like voucher accounting and separation/rotation of duties are essential methods of larceny and embezzlement prevention.
There is no substitute for close personal observation of the suspected fraudster if stealing is thought to be occurring. Video can be an effective deterrent to cashiers as well as mail room employees, but be sure to consult your lawyer before you institute this sort of program.

Employee Skimming of Sales Proceeds Is Also Common

The next step up on the internal fraud ladder is known as skimming. Skimming is basically a more complex way to steal, often involving cohorts.

Skimming is not always employee against employer. For example, in the good old days the Vegas casinos were legendary for skimming revenue off the top until the government taxing authorities stepped in with controls and a perpetual physical presence.

The Fraud: Stealing unrecorded sales receipts is dubbed skimming and is usually committed by cashiers, accounting personnel. To a lesser degree, it is committed by customer service people and management.

The following are typical incidences of skimming:

A skimming problem arises when a cashier, for example, rings up a "no sale" without management approval. This allows access to the cash drawer with no corresponding entry on the tape. If the customer is in collusion with the cashier, they can split the stolen cash and no one's the wiser. "No sale" keys should be disabled or keyed only by a manager.
Skimming can also involve selling a product to a customer and not recording it at all. The perpetrator keeps the cash, the customer (accomplice or not) keeps the goods, and the inventory, of course, shrinks.
Accounts receivable frauds represent some of the most expensive skimming schemes. (But skimming sales is a lot easier to pull off than skimming receivables.)
Phony receivables can be created representing phony sales (which may eventually be written off) . . . effectively masking inventory thefts. Intercepting statements perfects this scheme for awhile.
Receivables can be re-dated to appear current, thereby masking unrecorded payments . . . deposited perhaps to the crooked employee's bank account by use of an altered payee scheme.
To cover up any discrepancies, the fraudster resorts to lapping. Lapping is a complicated ongoing fraud usually perpetrated by an employee who has custody of cash and check payments plus responsibility for accounts receivable recordkeeping. The fraudster receives a payment to a legitimate customer's account receivable and pockets it for himself. To cover this up, the stolen amount is replaced at a later date by receipts from another customer. This is repeated over and over and over again.
Inventory padding is often used to mask skimming schemes.
While most skimming is done via unrecorded sales, it can also be done via under-recorded sales. The skimmer sells 10 widgets at $100 each, but records 8 at $100 each and pockets the $200. Or he could record 10 sold, but at $80 each, and achieve the same result.

The Flaw: The failure to separate duties is the root of many large skimming frauds. Even small examples of skimming stem from a lack of consistent supervision and sometimes poor inventory controls. Misplaced trust is also a common problem.

The Fix: Segregation and rotation of duties cannot be over-emphasized as the single most effective method of controlling fraud in any business.

Cash control systems are essential in preventing this all-too-tempting target of employee fraud. The same person should not write checks, sign them, reconcile the bank statements, apply payments to receivables, and so forth. It can't be repeated often enough that a division of these tasks is critical.

One simple way for a small business owner to ensure his cash is controlled is to open all incoming mail personally. Most of the mail you'll receive will be routine in nature, and this task could easily be assigned to an employee. But that one piece in a thousand is the one you can't afford to miss seeing first. You will be amazed at the things you can learn from personally attending to this seemingly low-level task.

If your bookkeeper is embezzling funds and using the cash float to cover up the ensuing overdrafts -- and you always hand the unopened and unread bank statement to your bookkeeper because, after all, bookkeepers reconcile bank statements don't they -- there's no way you will learn of this problem until it's too late. Returned check notices come in the mail, but if you don't open the mail you'll never know.

Prevention of skimming can be as simple for some businesses as numbering receipts sequentially and tracking down any missing numbers. This tedious but effective auditing chore is often called "voucher accounting."

Computers excel at these chores, but you must take the time to review their output and act upon any exceptions noted. Every numbered document must be accounted for . . . including voids. Strong internal controls like voucher accounting and separation/rotation of duties are essential methods of prevention.