The patient embezzler: nonexistent segregation of duties and unlimited access to cash entice a long-time employee to raid the company's coffers

Internal Auditor, Oct, 2006 by Ika A. Kurniwanti, Hendry Y. Setiabudi

NINA, A CASHIER AT AN INDONESIAN automotive dealership, handled the cash management system at one of the dealership's branch offices. The system recognized and differentiated between two types of cash flows--bank transactions and cash transactions--and was set up to receive credit card payments that were recorded as bank transactions. When a customer paid with a credit card, the bank charged the company a merchant fee for the transaction. This fee averaged about 3 percent of the total payment and was deducted directly from the amount of the payment deposited; thus, only the net amount of the deposit appeared on the bank statement.

Nina received the bank statement printout daily, so she was aware of every credit card payment transferred into the branch's bank account. A few days after each transaction, when the payment had cleared the bank, she would record the net payment received in the system by crediting accounts receivable and debiting the bank account, leaving the balance in accounts receivable equal to the amount of the bank charge. To zero out the residual amount, Nina would periodically record a bank transaction labeled as "credit card charge" for the amount of the total credit card charge.

Nina was also responsible for the monthly cash bank reconciliation. She prepared the reconciliation under the branch finance manager's supervision, with additional oversight from the accounting officer at the company's head office. Because Nina recorded the transactions based on the daily bank printouts, reconciling the books at month-end was relatively straightforward. Usually, only the bank charges and interest needed to be updated in the branch's record system.

Nina's job performance was flawless. But, unfortunately, during her nine years at the company, Nina acquired considerable knowledge about the system's weaknesses. Although she was unfamiliar with the concept of segregation of duties, she was quite aware that she held most of the cash processing duties in her office. This knowledge, coupled with her nearly unlimited access to incoming cash, enabled Nina to execute an embezzlement scheme that continued for two years before it was finally detected. During this time, she managed to glean IDR 150 million (approximately US $16,600) of the company's funds.

Nina's plot was simple. She chose one of the most common methods for covering her cash theft--the false debit. She marked up the bank merchant charge expense account with fake amounts and then pilfered the money afterward. She chose this specific expense account to help conceal her theft because nobody paid much attention to the bank charges. Because the fees were deducted by the bank, it was assumed that they would be free from individual interference.

Access to the branch's bank accounts was restricted to the branch manager and the branch finance manager, so Nina had to devise a way to retrieve her illicit gain. Wisely, she looked for customers who paid in cash, collected the cash, recorded the transaction as bank revenue instead of cash revenue, and took the money afterward. For example, Nina received a credit card payment for IDR 100,000 (approximately US $11). She obtained a bank printout showing a deposit of IDR 97,000 (approximately US $10.67)--the net payment after the 3 percent merchant charge--and recorded the bank receipt transaction on the books with an incorrect value of IDR 95,000 (approximately US $10.45). The receivable retained an outstanding balance of IDR 5,000 (about US 55 cents), and the bank account contained an extra IDR 2,000 (about US 22 cents)--the difference between the actual deposit and the recorded deposit. She then sought a customer's cash payment of IDR 2,000, slipped the money into her pocket, and recorded the cash transaction on the books as a bank payment, bringing the total recorded credit card receipts to the actual amount of IDR 97,000. This chain of events ensured that the cash balance on record would tally with the bank statement. At the end of the month, as usual, Nina made an entry to zero out the residual accounts receivable balance to the bank charge account. All accounts involved remained in balance, with the bank charge account overstated by the amount of the theft.

Nina was also responsible for reconciling the cash account to the bank's records; she could easily manipulate the reconciliation report that was provided to her boss and the accounting department. Unfortunately, her boss relied solely on Nina's work, and the accounting officer trusted her boss. Consequently, both her boss and the accounting officer simply glanced at the reconciliation report to check the conformity of the ending book and bank balances, without ever scrutinizing the details. If they had examined the reconciliations carefully, they would have noticed an obvious inconsistency: The net amount of credit card payments received from payer banks never tallied with the net amount of credit card payments recorded on the company's books.

Ironically, Sam, a new junior auditor in the company, uncovered the problem. After completing a couple of field assignments, he was concerned that the audit team never reviewed the bank charge account during their regular audits. Although he was told that the bank accounts were always presumed to be correct and therefore did not need to be checked, when Sam was assigned to audit Nina's branch office he decided to review the bank accounts anyway. His analysis included examining all bank charges recorded on the branch's books during the year. Surprisingly, he found that the merchant fees had been increasing consistently, from 5 percent up to 10 percent in the last four months. He noted that this was much higher than 3 percent, the common rate for such fees.