Category Archives: Payroll Fraud

Bye-Bye Money

Miranda had responsibility for preparing personnel files for new hires, approval of wages, verification of time cards, and distribution of payroll checks. She “hired” fictitious employees, faked their records, and ordered checks through the payroll system. She deposited some checks in several personal bank accounts and cashed others, endorsing all of them with the names of the fictitious employees and her own. Her company’s payroll function created a large paper trail of transactions among which were individual earnings records, W-2 tax forms, payroll deductions for taxes and insurance, and Form 941 payroll tax reports. She mailed all the W-2 forms to the same post office box.

Miranda stole $160,000 by creating some “ghosts,” usually 3 to 5 out of 112 people on the payroll and paying them an average of $650 per week for three years. Sometimes the ghosts quit and were later replaced by others. But she stole “only” about 2 percent of the payroll funds during the period.

A tip from a fellow employee received by the company hotline resulted in the engagement of Tom Hudson, CFE.  Tom’s objective was to obtain evidence of the existence and validity of payroll transactions on the control premise that different people should be responsible for hiring (preparing personnel files), approving wages, and distributing payroll checks. “Thinking like a crook” lead Tom to readily see that Miranda could put people on the payroll and obtain their checks just as the hotline caller alleged. In his test of controls Tom audited for transaction authorization and validity. In this case random sampling was less likely to work because of the small number of alleged ghosts. So, Tom looked for the obvious. He selected several weeks’ check blocks, accounted for numerical sequence (to see whether any checks had been removed), and examined canceled checks for two endorsements.

Tom reasoned that there may be no “balance” to audit for existence/occurrence, other than the accumulated total of payroll transactions, and that the total might not appear out of line with history because the tipster had indicated that the fraud was small in relation to total payroll and had been going on for years.  He decided to conduct a surprise payroll distribution, then followed up by examining prior canceled checks for the missing employees and then scan personnel files for common addresses.

Both the surprise distribution and the scan for common addresses quickly provided the names of 2 or 3 exceptions. Both led to prior canceled checks (which Miranda had not removed and the bank reconciler had not noticed), which carried Miranda’s own name as endorser. Confronted, she confessed.

The major risks in any payroll business cycle are:

•Paying fictitious “employees” (invalid transactions, employees do not exist);

• Overpaying for time or production (inaccurate transactions, improper valuation);

•Incorrect accounting for costs and expenses (incorrect classification, improper or inconsistent presentation and disclosure).

The assessment of payroll system control risk normally takes on added importance because most companies have fairly elaborate and well-controlled personnel and payroll functions. The transactions in this cycle are numerous during the year yet result in lesser amounts in balance sheet accounts at year-end. Therefore, in most routine outside auditor engagements, the review of controls, test of controls and audit of transaction details constitute the major portion of the evidence gathered for these accounts. On most annual audits, the substantive audit procedures devoted to auditing the payroll-related account balances are very limited which enhances fraud risk.

Control procedures for proper segregation of responsibilities should be in place and operating. Proper segregation involves authorization (personnel department hiring and firing, pay rate and deduction authorizations) by persons who do not have payroll preparation, paycheck distribution, or reconciliation duties. Payroll distribution (custody) is in the hands of persons who do not authorize employees’ pay rates or time, nor prepare the payroll checks. Recordkeeping is performed by payroll and cost accounting personnel who do not make authorizations or distribute pay. Combinations of two or more of the duties of authorization, payroll preparation and recordkeeping, and payroll distribution in one person, one office, or one computerized system may open the door for errors and frauds. In addition, the control system should provide for detail control checking activities.  For example: (1) periodic comparison of the payroll register to the personnel department files to check hiring authorizations and for terminated employees not deleted, (2) periodic rechecking of wage rate and deduction authorizations, (3) reconciliation of time and production paid to cost accounting calculations, (4) quarterly reconciliation of YTD earnings records with tax returns, and (5) payroll bank account reconciliation.

Payroll can amount to 40 percent or more of an organization’s total annual expenditures. Payroll taxes, Social Security, Medicare, pensions, and health insurance can add several percentage points in variable costs on top of wages. So, for every payroll dollar saved through forensic identification, bonus savings arise automatically from the on-top costs calculated on base wages. Different industries will exhibit different payroll risk profiles. For example, firms whose culture involves salaried employees who work longer hours may have a lower risk of payroll fraud and may not warrant a full forensic approach. Organizations may present greater opportunity for payroll fraud if their workforce patterns entail night shift work, variable shifts or hours, 24/7 on-call coverage, and employees who are mobile, unsupervised, or work across multiple locations. Payroll-related risks include over-claimed allowances, overused extra pay for weekend or public holiday work, fictitious overtime, vacation and sick leave taken but not deducted from leave balances, continued payment of employees who have left the organization, ghost employees arising from poor segregation of duties, and the vulnerability of data output to the bank for electronic payment, and roster dysfunction. Yet the personnel assigned to administer the complexities of payroll are often qualified by experience than by formal finance, legal, or systems training, thereby creating a competency bias over how payroll is managed. On top of that, payroll is normally shrouded in secrecy because of the inherently private nature of employee and executive pay. Underpayment errors are less probable than overpayment errors because they are more likely to be corrected when the affected employees complain; they are less likely to be discovered when employees are overpaid. These systemic biases further increase the risk of unnoticed payroll error and fraud.

Payroll data analysis can reveal individuals or entire teams who are unusually well-remunerated because team supervisors turn a blind eye to payroll malpractice, as well as low-remunerated personnel who represent excellent value to the organization. For example, it can identify the night shift worker who is paid extra for weekend or holiday work plus overtime while actually working only half the contracted hours, or workers who claim higher duty or tool allowances to which they are not entitled. In addition to providing management with new insights into payroll behaviors, which may in turn become part of ongoing management reporting, the total payroll cost distribution analysis can point forensic accountants toward urgent payroll control improvements.

The detail inside payroll and personnel databases can reveal hidden information to the forensic examiner. Who are the highest earners of overtime pay and why? Which employees gained the most from weekend and public holiday pay? Who consistently starts late? Finishes early? Who has the most sick leave? Although most employees may perform a fair day’s work, the forensic analysis may point to those who work less, sometimes considerably less, than the time for which they are paid. Joined-up query combinations to search payroll and human resources data can generate powerful insights into the organization’s worst and best outliers, which may be overlooked by the data custodians. An example of a query combination would be: employees with high sick leave + high overtime + low performance appraisal scores + negative disciplinary records. Or, reviewers could invert those factors to find the unrecognized exemplary performers.

Where predication suggests fraud concerns about identified employees, CFEs can add value by triangulating time sheet claims against external data sources such as site access biometric data, company cell phone logs, phone number caller identification, GPS data, company email, Internet usage, company motor fleet vehicle tolls, and vehicle refueling data, most of which contain useful date and time-of-day parameters.  The data buried within these databases can reveal employee behavior, including what they were doing, where they were, and who they were interacting with throughout the work day.

Common findings include:

–Employees who leave work wrongfully during their shift;
–Employees who work fewer hours and take sick time during the week to shift the workload to weekends and public holidays to maximize pay;
–Employees who use company property excessively for personal purposes during working hours;
–Employees who visit vacation destinations while on sick leave;
–Employees who take leave but whose managers do not log the paperwork, thereby not deducting leave taken and overstating leave balances;
–Employees who moonlight in businesses on the side during normal working hours, sometimes using the organization’s equipment to do so.

Well-researched and documented forensic accounting fieldwork can support management action against those who may have defrauded the organization or work teams that may be taking inappropriate advantage of the payroll system. Simultaneously, CFEs and forensic accountants, working proactively, can partner with management to recover historic costs, quantify future savings, reduce reputational and political risk, improve the organization’s anti-fraud policies, and boost the productivity and morale of employees who knew of wrongdoing but felt powerless to stop it.

Plum Street Dialogue #8 Bread Crumbs

timesheet[Over the years, I’ve been involved in on-going discussions with any number of practicing certified fraud examiners, many of whom have provided me with excellent insights on every aspect of the profession.   Using the notes I’m constantly taking, I thought it might be fun (and instructive) to cast some of their thoughts on actual practice in the form of a series of fictitious dialogues on everything fraud examination.  This is a discussion between three practitioners, composite fraud examiners, Glenn, Alex and Terrie, on repeat offenders using the case of one such fraudster as an example.

Our three friends are meeting on a cold winter night over beer and cheese in front of an open fire in the living room of Glenn’s house on Plum Street in the Fan District of Richmond, Virginia.]

Glenn – So, Terrie … you have one of your cases you’d like to discuss?

Terrie – And get your reactions … it’s an old one but I think it illustrates some of the points you and Alex were making about what happens when organizations don’t follow through with prosecution of employees who victimize them or when circumstances just allow the fraudster to move on after detection.

Alex – You mean when the fraudster goes on to victimize someone else?

Glenn – Usually multiple someone elses, right?

Terrie – Right … the basic facts in this case are straight forward enough but I think they illustrate the point.   And, since it’s just for discussion I’m not going to use the real names of any of those involved.  I’ll call our serial perpetrator Jonnie Sayre.  Jonnie worked as an administrative assistant for a unit of a large Virginia hospital I’ll call Kay General. His duties consisted mostly of clerical tasks, including the submission of payroll information for the unit where he worked.  A monthly exception report listed some unusual activity on Jonnie’s time sheet. He had posted eight hours that resulted in overtime wages for a pay period that coincided with a time of low occupancy in his unit. During times of low unit occupancy, there was no need for anyone, especially a low-level administrative assistant like Sayre, to work overtime.

Glenn – Red flag!

Terrie – Correct.  When his supervisor confronted him about the eight overtime hours, Jonnie quickly confessed. He said he posted the time due to financial problems and threats of divorce from his wife. He immediately submitted his resignation, a hospital administrator accepted it, and Sayre became a former Kay hospital employee.

Alex – Straight forward enough … but I’m guessing, not the end of the story.

Terrie – Right again. That afternoon, I got a call from the hospital administrator, Bill Cummings.  I’d done some work for one of the practices with admitting privileges at Kay and the practice gave Bill my name.  Bill shared the specifics of the resignation with me and my initial comment to him was that nobody leaves over just eight falsified hours.  There had to be more to the story.  He asked me if I’d be willing to look into the matter and I told him I would.

Glenn – There are always bread crumbs …

Terrie – When I delved into the records, I found exactly what I’d had suspected. Since October of the previous year, Jonnie had been overstating his hours. He recorded hours that he had not actually worked, posted his hours to shifts for which pay was higher, and reported vacation time as time worked. Unfortunately for Sayre, his method of cheating the hospital left a well-marked paper trail. In his administrative role, he collected and submitted the unit’s manually prepared time sheets to his supervisor for approval. She would sign the time sheets, make copies to retain for her records, and return them to Jonnie for delivery to the payroll department. Sayre would then alter his original time sheet before he delivered the approved documents to payroll. Amazingly to me, he was allowed to complete his time sheets in pencil, allowing him simply to erase the old numbers and make any necessary changes.

Alex – Sort of a classic case of the type really.

Terrie – It gets better.  Working with an assistant from the payroll department, I compared the supervisor’s copies of time sheets with those on file in the payroll department. Discrepancies between the two immediately were apparent. The investigation lasted less than a month, and the results revealed that Jonnie defrauded the hospital out of $1,870 over about half a year.  At the completion of the investigation, the hospital filed a claim with the district attorney’s office. Evidence consisted of copies of the approved time sheets, copies of the altered time sheets, and affidavits from Jonnie’s supervisors. Then, an assistant district attorney in charge of the case called the hospital shortly after receiving it. She had uncovered some interesting details about Sayre’s past during a routine background check.

Glenn – Here we go …

Terrie – Seems a computer search revealed he had a criminal history and was currently out on parole. In fact, the assistant district attorney reported, Sayre had previously been sentenced to life in prison for armed robbery. Needless to say, the news that the hospital had unknowingly hired a convicted felon distressed Bill Cummings. He discovered that the hospital’s ability to conduct thorough background checks on prospective employees was restricted by resource limitations and accessibility to records. Kay routinely checked criminal records in the county where it is located and any counties where an applicant reported having a work history. But cost and time prohibited the hospital from checking records in all counties in the state, especially for a low-salaried employee like Jonnie. The complaint against Sayre went to the grand jury quickly. The grand jury issued an indictment, and an arrest warrant was issued for Jonnie’s arrest.

Alex – So where did Jonnie go when he resigned?  I’m sure to another organization.

Terrie – It did take some time to find him.  It seems he had immediately moved on to a non-profit organization that helps low-income families buy houses. In the meantime, a separate party filed a separate, unrelated forgery claim against Sayre with the district attorney’s office. As soon as the nonprofit organization got word of this and about the arrest warrant from Kay, they discharged Jonnie who was arrested and ended up getting five years in prison.  So, what are your reactions?

Alex – First off, the obvious … responsibilities for preparation, authorization, distribution, and reconciliation of time cards should be segregated. Specifically, employees should not have access to time cards following management review and approval. Paper time cards should be taken by the supervisor directly to the payroll department after being approved. In an electronic payroll environment, the system should lock all approved time cards so that employees cannot modify previously approved entries. And what was management thinking of?  Documents completed in pencil!  While pen and printer’s ink can be modified using correction tape or fluid, such changes are usually quite easy to detect. However, as Jonnie knew, if done correctly, pencil can be erased and altered at will.

Glenn – I guess I’d just add that all managers should be informed about ways that payroll records can be manipulated by dishonest employees and trained in what specific observations and comparisons to make to refrain from just rubber-stamping time sheets. We’ve all seen this same problem again and again!  For example, supervisors should maintain a copy of approved time cards or sheets and spot-check them against the time cards on file in the payroll department. Additionally, in a setting where employees work varying shifts, time cards should be reconciled against work schedules.

Terrie – Well, I’m glad to say that my follow-up recommendations to Bill and the other involved managers were along those same lines.

Glenn – Thanks for the case, Terrie … I hope the comments were helpful … they were to me. Until next time …