Unsecured credit

Internal Auditor, Dec, 1997 by Peter J. Belloli

Most auditors take the low-risk nature of employee charge cards for granted. The common assumption is that if a company receives monthly billing statements and implements basic controls, any losses will be minimal, even insignificant. Unfortunately, the reality may be otherwise.

Jiffy Corporation, a regional building-service company, recently purchased one of its competitors and became a national presence, tripling its workforce. As a result of the acquisition, the number of vehicles leased by Jiffy reached approximately 400. As part of its service to customers, the fleet management company provided Jiffy with detailed fleet operating information and fuel usage invoices. The activity reports and invoices were piling up, unopened, at Jiffy, and the CFO summoned the internal auditor to review the reports for any problems.

BIG BILLS

While the internal auditor's review revealed numerous minute errors, one glaring problem was also uncovered. The fuel bills for one particular van had increased from $1,667 to $14,603 over a four-month period. When the auditor asked the manager in charge of the vehicle to explain the extraordinary increase, he could offer no explanation. The van was not used frequently enough to justify the increase, said the manager.

The auditor asked the manager to physically verify the security of the fuel charge cards for the five vehicles under his supervision. After a thorough search, the manager reported that the charge card for the van was missing. In addition, he had terminated the primary driver of the vehicle four months earlier. The auditor, realizing that the ex-employee's termination date coincided perfectly with the date the charges began to increase, surmised that the ex-employee had been charging several thousand dollars per month to the missing fuel card.

The auditor promptly notified the CFO and the Loss Prevention Manager. They launched an investigation to verify the identity of the suspect and requested that the auditor immediately ensure that no additional charges could be made to the card. The auditor knew that the verification of charge card transactions required a card number and a personal identification number (PIN). However, the vehicle manager had assigned a common PIN to all of his fuel cards. Both he and management agreed that canceling the common PIN would be too inconvenient for the other drivers who needed their fuel cards for legitimate purchases during the current busy season. Besides, the auditor believed that canceling the charge card number only would be enough to stop the fraudulent charges.

MORE BILLS

Soon after the number was canceled, the fleet management company called with disturbing news. The fraudulent purchases had not ceased; they simply had been charged to a different card. The suspect had continued to make purchases by using the common PIN and the next number in sequence from his original charge card. By telling gas station attendants that the fuel card's magnetic strip was too scratched, the suspect had probably convinced them to enter the card number manually. He then entered the common PIN, and the charges were accepted.

This time, the auditor canceled both the newly compromised charge card number and the common PIN. He also issued new, individual PINs to the company's legitimate drivers.

The auditor had finally ended the fraud, but the suspect's identity still needed to be confirmed. Jiffy hired a private investigator to interview managers of the gas stations where the highest volume of purchases were made and to study the copies of the purchaser's charge slips. Eventually, station managers confirmed that the suspect was the terminated employee. He had fueled several large construction vehicles and filled 55-gallon drums with gasoline using the charge cards in question. In total, Jiffy's disgruntled ex-employee managed to steal more than $55,000 worth of gasoline during a three- to four-month period.

CASE CLOSED

Because they wanted to avoid a default responsibility ruling, which would require them to pay for the stolen gasoline, Jiffy management proceeded cautiously with criminal prosecution. Fortunately, one of the gas station owners filed fraudulent charges against the suspect, which led to his arrest and conviction.

Throughout the fraud investigation, the auditor kept management well-informed of the progress via interim reports. When internal auditing's role was complete, the auditor issued a final report that listed recommendations and control procedures to help prevent similar situations. Several of the recommendations have been enacted.

LESSONS LEARNED

1 Management was deficient in monitoring the detail reports supplied by the fleet management company. A procedure was enacted to ensure prompt review of future reports.

2 Management was late in paying the fleet management company's invoices. Had the bills been properly reviewed and paid, management might have caught the problem earlier. Jiffy restructured its fleet payment system and ensured that accountability was well communicated.