A novel credit card scam: exercising a little due diligence, an internal auditor uncovers an attempt by a former employee to defraud the company

Internal Auditor, Feb, 2004 by Scott Langlinais

ABC decided to report Larry to law enforcement. Although $88,000 is not a significant amount of money for a $1 billion company, and the legal fees and other costs might be high, the company wanted to demonstrate to its employees that it would not tolerate fraud and would hold perpetrators accountable. Decisive and timely action such as this is critical to maintaining a sound control environment.

Not everyone is as diligent as Jennifer. The lesson she applied is an important one to teach operations personnel: Take the time to check anything that doesn't seem right. Because she spent a few minutes performing due diligence, Jennifer uncovered an $88,000 fraud.

Several symptoms may have flagged the fraud. If internal auditing had been testing the employee credit card charges, simply identifying the top 25 corporate card users and reviewing their charges would have flagged Larry. Travel reimbursements of $88,000 in one year covers a lot of travel. Testing the accounts of the people with the most posted credits would have similarly flagged Larry. Also, Larry averaged three payments a month on his credit card over the course of a year, an unusual pattern that, if identified, should have been investigated.

Testing the top 25 corporate credit card users and searching for unusual patterns are the staples of any audit program that contains tests designed to uncover fraud.

LESSONS LEARNED

* Employees should take the extra step. If employees are presented with a transaction that they do not completely understand, they should do what was going on so that it became clear to everyone that ABC would not treat fraud lightly. what it takes to understand the transaction. Jennifer was one of the custodians of the organization's cash, so when someone asked for money from the company, even a trusted former boss, it was important for her to understand the nature of the transaction.

* Segregate duties. This is a concept that is drilled into the brains of internal auditors ad nauseam, but it is not necessarily communicated as often to operational management. The organization's head treasurer, to whom Larry reported, was an ex-auditor and ex-controller, and therefore should have been aware of this control concept. However, during the course of business, when times are good and everyone is busy, it is easy to overlook the fundamentals. Larry had too much control, and because accounts payable trusted him, the clerks did not adhere to their own processes and send the check directly to the third party.

* Act quickly and decisively. Larry was a long-time employee of" ABC, and he was well-liked in the organization. It would have been easy for the company to ask Larry to pay the money back and call it even. How ever, management and the board called for a full investigation, led by the internal audit group that included outside consultants, legal counsel, and the district attorney. Management also decided to not keep it quiet; they let the finance and accounting organizations know what was going on so that it became clear to everyone that ABC would not treat fraud lightly.