Grounds for dismissal: a controls breakdown enables a coffee company's IT manager to perpetrate a lucrative fraud

Internal Auditor, Feb, 2005 by Maryanne Atkinson, Margie Biliske

MARY DOE BEGAN WORKING AT The Coffee Co. in November 1999 as an application manager in the Information Technology (IT) department. Her job responsibilities included managing and implementing IT projects. She supervised approximately a dozen employees.

Within a few weeks of her hiring, Doe, on behalf of The Coffee Co., signed a consulting services agreement with Fictitious Consulting Company (FCC). To begin doing business with a vendor such as FCC, Doe was required to obtain written approval of the contract from a supervisor. Instead, Doe forged her supervisor's signature.

The first of more than 100 FCC invoices submitted to The Coffee Co. was for $4,000. Between Dec. 20, 1999, and Aug. 29, 2000, The Coffee Co. paid more than $3.7 million to FCC. Every FCC invoice bore an approval stamp, with the approval note bearing Doe's initials. In addition, many of the invoices bear notations requesting special processing (e.g., "as soon as possible") or handling instructions requesting that Doe personally pick up the checks for delivery to FCC.

According to The Coffee Co. policy, Doe did not have authority to approve invoices greater than $5,000. However, she approved FCC invoices for more than $40,000, never seeking her supervisor's authorization.

When asked by her supervisor to be introduced to FCC in early 2000, Doe was evasive. Her supervisor directed her to terminate the relationship with the consultant by July 2000 because he could not justify the value for the expense.

Ultimately, Doe lied to her supervisor, telling him that she had terminated the relationship with FCC, when in truth she simply moved the charges to capital accounts not monitored by him. The scheme began to unravel when the charges were noticed by the employees in charge of the capital projects. Charges were even made to two dormant accounts.

Doe and her husband were on vacation when The Coffee Co. began to wake up and smell the coffee. The company quickly stopped payment on a $246,000 check issued to FCC on Sept. 8, 2000, and blocked Doe's card key access to the building. On the evening of Sept. 9, Doe and her husband attempted to gain access to The Coffee Co. offices, as was recorded on videotape and on the access system computer hard drive.

In March 2001, both Doe and her husband were named in the civil judgment received from a King County Superior Court Judge for a settlement of nearly $2.4 million. It was the largest fraud case in the history of King County, Wash. The settlement also required a list of the possessions the Does had acquired. The 19-page list contained 489 items. Several cars and pianos and other possessions were sold at an auction in May 2001 and netted The Coffee Co. about $1.8 million.

In September 2002, Doe pleaded guilty to criminal charges. According to Doe, she had an anxiety disorder that drove her to commit the fraud. She was a compulsive shopper, and by the time the fraud was uncovered, her home was filled with items she had purchased. The police reported there was only a small path through the rooms, with boxes stacked to the ceiling. Doe and her husband had filed for bankruptcy two years before she obtained the position at The Coffee Co.

Doe began serving a four-year prison sentence in December 2002. Her husband's certified public accountant license is under review by the Board of Accountancy in the State of Washington.

KEY CLUES

Doe's behavior rose many red flags for her supervisor and co-workers, including:

* Doe's supervisor indicated in the court statements that he had repeatedly asked Doe to tell him more about the consulting charges, including what work was being performed, the identity of the company, and other information. He noted that she was evasive and never satisfactorily answered his questions.

* Her supervisor repeatedly asked to meet with FCC representatives; however, he was told that they were working away from the office or that they had left the building and that he had just missed them. Doe even once prefaced her answer to his request by stating, "They really do exist."

* FCC was not registered in the State of Washington, or listed in any of the usual telephone directories. The phone number for FCC was a cell phone registered to Doe and a business owned by her husband. Doe was an authorized signatory on the checking account.

* FCC's mailing address was listed as a post office box, and the physical address listed on the account was Doe's residence.

* Doe asked that some of the checks be sent using special handling instructions. This included Doe personally picking up a check for the consulting company in the amount of $246,000. Several Coffee Co. staff members knew that Doe regularly picked up checks for FCC.

Once The Coffee Co. became aware of problems, Doe's access to her computer accounts was cut off, and all of the documents related to FCC were gathered and analyzed.

CONTROL WEAKNESSES

Several failures in controls allowed Doe to get away with her fraud for as long as she did. For example:

* Doe forged the initial contract starting the consulting relationship with FCC. If the form had been returned to the vice president, who usually signs such documents after processing, the forgery would have been detected immediately.