Monday, October 19, 2015

Expense Reimbursement Schemes

Expense reimbursements. In our world, we call it "low hanging fruit." In other words, if we are asked to look into allegations of fraud, we always ask for the suspect's expense reimbursements, too. It is not unusual to find additional fraud in plain sight on employee expense reimbursement forms.

I have seen several million-dollar expense reimbursement schemes (yes, you read that correctly) involving high level executives. These individuals had W-2 forms that would be the envy of most, yet they expensed everything from their daily Egg McMuffins, to their Thanksgiving dinner at the country club, to their personal trips to Hawaii. I have seen priests expense personal items through a church's coffers, and I have seen low-level employees alter receipts. Expense reimbursements are easily perpetrated by all members of an organization.

All for the purpose of securing additional cash.

Recently, a client of mine found that their second in command (and likely next CEO) had forged the CEO's signature on his expense reimbursements. They thought it was an error in judgment, for the purpose of getting his reimbursement through the system more quickly.

They thought wrong.

Within a few hours, using the employee's reimbursement forms, his calendar, and conducting a key interview, we discovered a fraud scheme that resulted in losses of $1,450,000 to our client. That executive traded in his extraordinary and comfortable lifestyle for a jumpsuit and a prisoner number in a federal penitentiary in Washington.

Expense reimbursements come in varying forms, including:
  • Fictitious Reimbursements: Employee remits reimbursement for expenses that never occurred.
  • Mischaracterized Reimbursements: Employee remits reimbursement for personal expenses as if they are a business expense (e.g. a receipt for a pink toy remitted as a meal expense).
  • Altered Reimbursements: Employee alters a receipt for a legitimate business expense (e.g. writing in a larger tip amount on a meal expense or altering a cab fare).
  • Duplicate Reimbursements: Employee remits a receipt for the same expenditure more than once or returns the item for cash after already reimbursed for the expense.
Expense reimbursements (including P-Card purchases) should be considered as necessary for higher-level scrutiny in all organizations. This includes at least one additional review and approval before the expenses are paid, spot checking "audits" of employee expense reimbursement forms, and a robust and enforced policy that includes the remittance of timely and original receipts and copies of credit card statements.

Proper oversight of expense reimbursements is as critical as internal controls over incoming cash and outgoing disbursements. And remember, when employees know that significant scrutiny is applied to their reimbursements, they will be less likely to manipulate them.

EXPENSE REIMBURSEMENT BEST PRACTICES:
  • Require original receipts be presented for all expenses.
  • Require original signatures on all reimbursement forms.
  • Ensure meal expenses include names of participants and business purpose of meal.
  • Compare an employee's calendar with purported business travel.
  • Use simple online searches to verify prices match remitted receipts.
  • Use analytics to monitor employee reimbursements (e.g. total paid to employees over time, budget to actual reports, etc.)
  • Request copies of credit card statements be remitted along with receipts. 

Friday, March 6, 2015

Good Guys vs. Bad Guys

This article was originally published in Fraud Magazine - March/April 2015 issue.

“I love getting bad guys — I think that would be so fun to do with you!said the prospective job applicant sitting across from me. I’d just asked her why she would want to come to work for my firm.
I considered my next move carefully. “Tell me how you would feel about working for one of those bad guys,” I said. The furrowed brow and crook of her neck indicated that she was perplexed. I obliged her. “Well, in this office we work for white-collar criminals, tax evaders and people sometimes perceived as the ‘bad guys.’ So how would you feel about that?” I asked. I then sat back to observe what her verbal and nonverbal cues would be (I practice my interviewing skills any chance I get, don’t you?). She was suddenly parched, swallowed multiple times and took a deep breath before answering, “I didn’t think you would ever do such a thing. I mean, I guess, well … I always thought of you as someone who worked for the good guys.”
I didn’t hire the applicant.
I had a similar conversation with a fraud examiner over lunch during a recent speaking engagement. She clearly was frustrated by her clients who chose not to prosecute their alleged fraudsters. She told the group at our table about a couple of prosecutions that had resulted in the alleged fraudster “only having to do community service and a small amount of restitution.” She was physically and emotionally upset about these outcomes. My curiosity got the better of me and I asked, “Why does this bother you so much?” She explained that she had put so much work into these cases and it wasn’t “fair” or “right” that these people avoided more formal or significant punishment for their alleged crimes.
I gently reminded her that it wasn’t our job to exact punishment. Most importantly, our own ACFE Code of Professional Ethics expressly prohibits us from opining on a person’s guilt or innocence. She acknowledged this, but I pressed further. How many defense cases have you worked? The reaction from her was similar to my job applicant. “None!” she said. “I don’t see how I could ever defend someone who had committed a fraud!”
Encounters such as these aren’t uncommon. Admittedly, they’re delicate conversations — often ones that those of us in private practice discuss in private.
ACFE training is unlike any other. If you want to be a fraud examiner, there’s no better place to get your education, training and credential (and I don’t say this just because I’m an ACFE faculty member and member of the Board of Regents). However, the training applies to both sides. In my own private practice, there’s plenty of room and good reason to work defense cases. In fact, the work is similar no matter what side you’re working on.
If you’re considering how or whether to take on defense cases, read on.

Consider your ability to be impartial
Discovering “why” you’re doing your job is important (it certainly makes going to work every day easier). A predisposition to “get” a bad guy can be a detriment in a case and can place blinders on a fraud examiner who might see questionable documentation as a crime — when in fact it’s only red flags of fraud. Zealotry could lead to unnecessary work, false accusations, inaccurate employment-related decisions and potential liability, which can then harm the client or others.    
Consider a recent case of mine. A woman (I’ll call her Betty) had worked 30 years as the office manager for my client’s medical practice. A new physician-partner in the group was trying to get up to speed, so he asked Betty for bank records, financial statements and other standard documents. She refused. An office-sized firestorm ensued. Doctors took sides, and accusations flew among staff members even though they didn’t yet have any real information.
I walked into the perfect climate for possible fraud: A long-term trusted office manager who never took vacations and who was now refusing to provide simple financial documents.
My interviews discovered that Betty was the sole person responsible for billing insurance companies and patients, collecting funds and taking them to the bank, writing checks, reconciling the bank account, processing payroll and managing the financials. Sounds familiar? Surely I would find fraud, right?
We scoured the bank statements, canceled checks and payroll records. We didn’t find any fraudulent disbursement schemes. We searched the billing system and analyzed customer credits. Betty had supported them with appropriate documentation. We traced funds to the bank with no exceptions. After all that, we still didn’t find fraud.
We recommended stopping the investigation, but the medical practice asked us to keep going back further. More records, more expense but still no fraud.
When I finally talked to Betty, she said she had “hurt feelings” when the new physician began asking questions. Why wouldn’t he trust her when she’d worked there for so long and gave all of herself to her job? However, I gently reminded Betty that her sole custody of these funds meant that she was unsafe in her job, and any missing money would point to her. Betty’s demeanor changed immediately, and she was suddenly ready to start offloading some of her responsibilities.
We didn’t take this job as a true defense engagement, but our work resulted in effectively clearing someone who was “on the defense” against potential criminal allegations.

Fraud examiner’s role
As fraud examiners, our roles are the same in plaintiffs’ or defendants’ cases: We’re fact finders. We conduct interviews, examine documents, identify evidence, prepare reports, and, yes, even work on obtaining confessions.
I’ll never forget the first time a defense attorney called me. My firm was new and I, too, thought my role was to go after “the bad guys.” A call from a new attorney, Steve, changed all of that. His client was accused of taking nearly $10 million from a publicly traded company. She was looking at significant jail time. I wrongly assumed he was calling to ask me to “defend her” (i.e. find some angle or story to get the charges dropped). I couldn’t have been more wrong.
“Ms. Couch, I need help here. The government is telling me she’s taken millions. My client is telling me she didn’t, and it can all be explained. I don’t know who to believe.”
Admittedly, the government’s case was terrible. The feds’ work-up of the case was cumbersome and confusing. The CPA firm that’d originally handled the case hadn’t prepared a written report. I accepted the case, and Steve’s client became my client.
I traced millions of dollars of the public company’s funds into our client’s account. I told Steve the facts — what had happened and how. I had no plausible explanation for these funds being in this account. Amazingly, I worked with our client (the defendant) to confess and admit to her wrongdoing. Steve then could negotiate a plea deal with the government. Our client went to prison for many years. And since then, the attorney has brought or referred countless cases to us .

Communicate your role
Some attorneys will want to pay you to testify to certain positions early in cases. Run away. Fast. Not only do I disengage from these matters, I refuse future calls from these people. Clients pay us for our expertise and our time. They don’t pay us for our opinions or for “prescribed” testimony.
Testimony is based on facts and work performed. You don’t need to worry if cases are for “plaintiffs” or “defendants” when you’re clear in your role and responsibilities and you’re able to communicate that role via your engagement letters and in meetings with your clients. You only need to be concerned that you have the resources to perform the work well.

Bias
For those of us in private practice, we also have a business reason to take on cases from “both sides.” Opposing counsel is going to immediately question your credentials and experience to see if you’re working for “our side” or the “other.” He’s going to try to infer a perception of bias. But he can’t do that if you have had a healthy balance of clients who are plaintiffs and defendants.
Working for the defense can help you construct better plaintiffs’ cases. You’ll better understand your work, the necessity for simpler and easily comprehended reports, and that all findings need to be documented with evidence.

The ‘why’ of my job
In the decade I’ve had the privilege of calling myself a Certified Fraud Examiner, I’ve discovered my “why”: I work hard for my clients — whether plaintiffs or defendants — who trust me to assist them through what can be the most difficult times in their lives and who thank me for support and expertise.
When we’re able to take complex and confusing information and turn it into clear and concise deliverables, then our clients are able to make educated decisions. When a client thanks you for doing that, you can’t receive a better compliment.



Thursday, August 28, 2014

Taking the leap to start your business

Have you ever wondered what it would be like to start your own fraud examination practice? To be your own boss? To be free to take the reins on a case? Perhaps you’re already a self-employed fraud examiner, and you’re looking for ideas on how to find balance in your life.  Or perhaps you’re looking for ideas on how to find clients. If so, I hope my experience and advice will help you on your journey.

In 2007, with a promising career at a well-known firm ahead of me, I thought I was set. Visions of partnership and my own (corner) office danced in my head! What I couldn’t foresee were the changes taking place that forced me to stand up for my ethics and change my definition of success.  I had plenty of employment offers — many from other prestigious accounting firms — but I found myself at a crossroads. Building a practice for another firm seemed daunting, at best.

I discussed it with my spouse, who said, “If you don’t start your own business now, you may never get another chance.” “Who, me? A business owner?! The one who plays it safe, who has a plan? Who isn’t, by nature, a big risk taker? Yeah, right!” The idea was as farfetched as my flying to the international space station.

But, nearly seven years after that conversation, that’s exactly who I am. A business owner operating a thriving forensic accounting (fraud investigation and litigation support) practice.

While the practice has grown exponentially over the last several years, it hasn’t been easy. I’ve learned several important lessons along the way, which I will share here.

Take time to plan
A quote by an unknown author says it all: “If you fail to plan, you plan to fail.” Planning your business takes time and energy. And planning is not a one-time effort culminating in a static document.

At a minimum, plan your budget. Consider costs such as business insurance, professional liability insurance, taxes and licensure. If you intend to immediately secure office space, be certain to factor in the cost of rent, leasehold improvements and utilities of the new space.

Research professional fee rates in your area, and price yourself in a median range. Take your minimum budget requirements, divide it by your set hourly rate and you’ll have the minimum number of hours you’ll need to bill clients and generate revenue.

But don’t stop there. You’ll need to factor in at least 30 percent more time for running your business. Marketing, billing and other administrative tasks will devour more time than you can imagine. This is work that doesn’t generate revenue but is crucial to running a successful business.

Regularly take time to evaluate your plan and measure it up to your reality. Rework as necessary.

Don’t navigate waters alone
If you’re a fraud examiner you need the skills of an accountant, a psychologist, an attorney and a technical writer (to name just a few). Realistically, most of us don’t come to the table with all of these skills. For example, I’m a CPA. Before I was exposed to fraud and litigation work at a big firm, I could tell you about preparing tax returns and performing financial statement audits but nothing about writing a fraud examination report.

Perhaps you have a background in law enforcement with excellent investigative and interviewing skills, but you’re unsure of the accounting-related facets of an engagement. Whatever the case, don’t attempt to offer services or skills that you don’t possess. You don’t have to be everything to everyone. (Remember the third point in the ACFE Code of Professional Ethics: “A Certified Fraud Examiner … will accept only assignments for which there is reasonable expectation that the assignment will be completed with professional competence.”

Much of my success has come from putting together teams of professionals who offer complementary skills. It’s not uncommon for me to be engaged on a matter and subsequently contract with a computer forensic specialist, a business valuation expert or a private investigator with more interrogation skills.

Stick to what you know and do it well. Team up with other professionals in your area. You will find that they, in turn, will remember you next time they need your specific skills.

Communication is key
Client communication at our firm starts with a robust engagement letter. This letter communicates the type of service to be performed, document retention, fee schedules, billing and payment agreements and dispute resolution. We don’t perform any work until the client (and its attorney, if applicable) executes this engagement letter.

Communicating and understanding expectations is key to any successful engagement. Not all clients (or their attorneys) are the same. Some attorneys loathe email communication as it relates to their client’s matter; others use it as the only means of communication. One client might want a full written report of investigation when you’ve completed your assignment; others may only want an oral report. It’s imperative to understand your client’s wants and needs up front to ensure you understand what the end goal looks like.

Communicating about fees can be difficult for some, but it’s imperative for cash flow. A common fee issue is when an estimated budget clearly isn’t going to be sufficient for the amount of work necessary to do a job well. You’ll know this is the case when you’ve spent one-half of the client’s money, but you’re not nearly halfway through the work. When this happens, stop working. We call a timeout and contact our client. We explain the nature of the issue (perhaps it’s a lack of documents, or we’re finding more than we first expected) and ensure there’s an agreement for further funds. Or, we give the client options for a different scope of service. Communicating with your client at all times during the engagement helps to ensure that you’re meeting their expectations and they’re honoring their obligations.

Pick your head up
Unlike a traditional tax or accounting practice, a fraud examiner doesn’t have the luxury of annuity work. It can easily be feast or famine. Just when I’m convinced that no work will ever come through the door again, numerous potential clients will call me or dormant cases will fire up again.

So, when there’s work to be done and we’re being paid by the hour, we often put our heads down, pencils up and charge forward. However, losing yourself in your work can ultimately damage your practice. You have to find time in your day to do some sort of marketing. Take a local attorney to lunch, write a newsletter or schedule yourself to speak at a professional networking function. Consistent, frequent and targeted marketing (even when you’re busy with client work) helps to ensure your pipeline will always be full.

Cash is king
You’d think a CPA would have cash flow down to a science, but it can be an ongoing struggle, especially with a feast-or-famine practice. But losing the cash-flow worries can be as simple as working on retainer.

Admittedly, it’s not easy to ask someone to pay you money before you’ve even met them or started work. The first time I asked for a retainer, a whopping $1,000, I prepared myself for the refusal, or worse — the potential client walking away from the engagement. So, I was surprised when he pulled out his checkbook and wrote a check immediately! We hold client retainers in a separate account until we’ve earned the money. We then transfer the funds to our operating account for paying bills immediately. Another way to manage cash flow is to bill clients weekly, semimonthly or immediately when we complete an engagement.

We’ve made it a practice to stop working if retainers haven’t been replenished, or if monthly invoices aren’t paid by the tenth day of the month. We communicate this clearly in our engagement letters, and sometimes we’ll stop work on a case. It’s funny how the money arrives in the mailbox when you cease working. Don’t waste your time or talent on clients unwilling to pay you.

It’s a marathon, not a sprint
Building a client base does not happen overnight. We’ve cultivated a successful practice by making clients happy — one at a time. Happy clients tell others about you. Cultivate your own satisfied clients by knowing your strengths, planning for your future and communicating clearly and often. Success may not look like the dream of the corner office you once had in your head. However, perhaps, like me, you’ll find that the reality of entrepreneurship is better than any dream you could imagine.
Published in Fraud Magazine, September/October 2014 Issue

Friday, July 25, 2014

Don't let your business become a victim of bank fraud

Your bank or credit union is the lifeblood of your business and critical spoke in the wheel of daily commerce. To their credit, financial institutions are working hard to make doing business more convenient for us.
Recent interactions with clients, however, has led me to the conclusion that some of these conveniences, used improperly or without oversight, can increase a company’s risk of fraud.
This doesn’t have to be the case! Understanding these products – what they can and can’t do – and your role in proper oversight over your banking transactions increases the likelihood that these products can work in your favor and decreases the chances that a fraud scheme goes unnoticed.
Positive pay
Simply put, positive pay ensures that the bank only pays on checks presented to them that match the amount and check number you have provided in advance. Checks presented to the bank that do not match the positive pay file, commonly called “exceptions,” must be cleared prior to being paid. I highly recommend that companies ensure that exceptions are cleared only by someone other than the person who initiates the positive pay file or who has access to the company’s check writing system.
Online bill pay or funds transfer access
I once investigated a fraud where an unscrupulous controller directed $5 million of my client’s funds to his own account using online bill pay. The bank statements indicated that expenditures were legitimate. It was only when the set up file was reviewed that it was discovered the funds were being misdirected to the controller’s personal account. Any online transfers of funds from your company to an outside source should be set up by one person and authorized by another. Many online banking systems can be set up with these dual controls, requiring the actual funds transfer be approved by a user different than who set up the initial transaction.
Remote deposit
“We only go to the bank once a week because we only receive checks, we don’t take cash.” Checks written to your business are as easily converted for someone’s personal benefit as cash. It is highly recommended that cash and checks be taken to the bank daily, this eliminates the risk of theft or loss (and increases your cash flow!). Many banking institutions provide remote deposit machines that allow you to deposit checks as you receive them. While there are transaction fees associated with this convenience, it can be a convenient way to increase your cash flow and decrease your risk of fraud from a skimming scheme.
Online banking
Access to banking transactions online is one of the most delightfully convenient products banks provide. Too often, however, my clients are choosing not to receive paper statements and/or choosing not to receive images of their cancelled checks. As such, the most critical oversight function in a business, the review of the bank statements and cancelled checks, is foregone. Take it from me, it is excruciating to wait for cancelled check images to load and most business owners don’t have that kind of time! Fraudulent disbursements (i.e. someone writing checks to themselves or their vendors for their personal benefit) are the number one fraud scheme, and the review of statements and cancelled checks is the number one way such a scheme is uncovered. Ask your bank to send you paper statements with the cancelled check images and perform that simple review function before your bookkeeper or accountant reconciles the account.
Work with your banker to identify what conveniences make sense to streamline banking functions and add additional security. And as with any of life’s conveniences, don’t lull yourself into a false sense of security. Your active participation in oversight and monitoring is the best internal control you can implement.
Published in the Vancouver Business Journal July 25, 2014