6/11/2014
“… And One for Me”
What was the major control weakness in the
Company?
What additional internal controls would you
recommend to this Company?
What recommendation would you make
regarding controls over route deposits and
the overall cash deposits?
How often do you think cases like this can
occur?
1.
Case Study # 1
{ “… And One for Me”
2.
3.
4.
Chapter 3: Cash
Larceny
{
Lecture 3
Cash Larceny


What is the difference
between larceny and
skimming?
Larceny is the least common of the three major
cash misappropriation categories.
What is Cash Larceny?

Intentional taking
Of employer’s cash
 Without employer’s consent

Larceny is not always the least expensive of the
forms of cash misappropriations anymore, with
median losses of:




2008
2010
2012
2014
$ 75,000
$100,000
$ 54,000
$ 32,000
Definition:


“Cash” includes currency and checks
1
6/11/2014
Cash Larceny Schemes


Theft of cash on hand



Cash Larceny Schemes
From cash register or cash box
Posted customer payments
Can occur under any circumstance where
an employee has access to cash
At the point of sale
From incoming receivables
 From the victim organization’s bank deposits

Theft from the deposit

Larceny At The Point of
Sale
It’s where the money is
Most common point of access to
ready cash
Results in an imbalance
between the register tape and
cash drawer

Larceny Schemes

Theft from other registers

“Death by a thousand cuts”





Enforce separation of duties
 Independent checks over the receipting and
recording of incoming cash
 Upon reconciliation of cash and register tape,
cash should go directly to the cashier’s office
 Discrepancies should be checked especially if a
pattern is identified
 Periodically run reports showing discounts,
returns, adjustments, and write-offs by
employee, department, and location to identify
unusual patterns
Using false voids or refunds
Causes the cash register tape to balance to the cash
drawer
Altering cash counts or cash register tapes
Destroying register tapes
Preventing and Detecting Cash
Larceny at the Point of Sale

Stealing in small amounts over an extended period of time
Reversing transactions – (generally considered to be
register disbursements)


Using another cashier’s register or access code
Larceny of Receivables


Theft occurs after the payment has been recorded
Force balancing



Reversing entries


Having total control of the accounting system can overcome
the problem of out-of-balance accounts
Can make unsupported entries in the books to produce a
fictitious balance between receipts and ledgers
Post the payment and then reverse the entry through
“discounts”
Destruction of records

Destroying the records can conceal the identity of the
perpetrator even though the fraud has been discovered
2
6/11/2014
Cash Larceny From The
Deposit
Cash Larceny From The
Deposit
Whoever takes the deposit to the bank has an
opportunity to steal a portion of it.
 Having controls—such as matching the receipted
deposit slip to the originally prepared slip—does
not always prevent theft
 Failure to reconcile the slips can foster an
environment leading to theft
 Lack of security over the deposit before it goes to
the bank can also lead to theft

Preventing and Detecting –
Cash Larceny From The Deposit
Separation of duties is the most important factor
 All incoming revenues should be delivered to a
centralized department
 Compare the authenticated deposit slip with the
company’s copy of the deposit slip, the
remittance list, and the general ledger posting of
the day’s receipts
 Two copies of the bank statement should be
delivered to different persons in the organization
 Require that deposits be made at a night drop at
the bank

19.8%
19.0%
21.1%

Carrying the missing money as a
deposit in transit but it never clears
the bank statement
Perpetrators of Cash Larceny Schemes
Owner/Exec.
13.6%
12.4%
42.7%
Manager
34.0%
57.3%
Employee
0.0%
67.8%
10.0% 20.0% 30.0% 40.0% 50.0% 60.0% 70.0%
Cash Larceny
All Cases
20.0%
Cash Larceny
30.0%
One person prepares/makes deposit,
reconciles bank account
 Failure to reconcile deposits/receipts
 Deposit left unattended before going to bank

56.3%
45.8%
10.0%
Deposits in transit
Perp usually in charge of daily deposit
Steal the currency, deposit the checks
 Poor controls are the key
< 100
0.0%

Day one’s deposit is stolen and is
replaced by day two’s deposit . . . .

17.2%
100-999


8.0%
13.3%
1,000-9,999
Deposit lapping
Cash Larceny from the Deposit
Size of Victim
10,000+

40.0%
50.0%
60.0%
All Cases
3
6/11/2014
Cash Larceny Countermeasures
Concealing Larceny from the
Deposit
Investigate shortages in cash drawers,
deposits, etc.
 Investigate missing or altered sales
records
 Have two people independently verify
deposits on bank statement to postings
in general ledger
 Maintain and review daily cash
availability amounts


Deposit lapping



Steal Day 1 deposits
Cover with subsequent receipts
Deposits in transit

Missing money carried on books as “deposits
in transit”
Cash Larceny Countermeasures
Have deposits delivered to bank under dual
control
 If fraud suspected, verify deposit prior to
dispatch without suspect’s knowledge; then
contact bank to confirm that deposit was
made
 Have deposits made in night drop, verify at
beginning of next day
 Make sure deposits in transit are first items
to clear on next statement

Cash Larceny Controls

Separate the following duties:
Cash receipts
Cash counts
 Bank deposits
 Deposit receipt reconciliation
 Bank reconciliation
 Posting deposits
 Cash disbursements


Cash Larceny Controls
Surprise cash counts
 Review check and cash composition of
daily bank deposit
 Review timeliness of deposits from
locations to central treasurer function
 Observe cash receipting operations at
all points of entry

{ Chapter 4
Billing Schemes
4
6/11/2014
Frequency of Fraudulent
Disbursements
Billing
23.0%
22.6%
22.9%
18.2%
18.5%
20.3%
17.0%
14.5%
12.9%
Expenses
Check Tamp
Payroll
4.7%
5.6%
4.6%
Register Disb.
0.0%
Median Loss – Fraudulent
Disbursements
37.2%
38.8%
39.4%
$100,000
$100,000
Billing
Expenses
$120,000
$131,000
$131,000
Check Tamp
$50,000
$48,000
Payroll
10.0%
20.0%
2014
2012
30.0%
40.0%
50.0%
2010















2010
Certificate of incorporation or assumed-name
certificate set up
Shell company may be formed in someone else’s
name
Best way is set up company under a fictitious name
Set up entity’s address – home address, post office
box, or friend/relative’s address


Two or more employees conspire to steal
More difficult to detect
Circumvents controls implemented to prevent fraud
Purchases of services rather than goods

Don’t check the documentation
Approve whatever is submitted
Reliance on false documents
 Without approval authority, fraudster submits false
documents – purchase order, invoice, and receiving
reports
$80,000 $100,000 $120,000 $140,000
Collusion

“Rubber stamp” supervisors


Most fraudsters are in a position to approve payment
Approvals may be forged
2012
Shell Company
Self-approval of fraudulent invoices


Invoice is manufactured using a professional printer,
personal computer, or a typewriter
$60,000
2014
Fictitious entities created for the sole
purpose of committing fraud
 Bank account is usually set up in the
company’s name
 Forming a shell company
Shell company schemes
Non-accomplice vendor schemes
Personal purchases schemes
Submitting false invoices
$40,000

Shell Company

$20,000
Shell Company Schemes
Billing Schemes
The perpetrator uses false
documentation to cause a payment to
be issued for a fraudulent purpose
 Fraudulent disbursement is issued in
same manner as a legitimate
disbursement
 Schemes
$72,000
$20,000
$25,000
$23,000
Register Disb
$-

$128,000
$30,000
$26,000
$33,000
Purchases of service are preferable over purchases of
goods
Services are intangible and fraud is more difficult to
detect
Pass-through schemes

Goods or services are purchased by the employee and
resold to the victim company at an inflated price
5
6/11/2014
Preventing and Detecting
Shell Company Schemes
Maintain and regularly update an approved
vendor list
 Independently verify all vendors before payment
 Identifying shell company invoices






Preventing and Detecting
Shell Company Schemes

Testing for shell company schemes
Investigate budget overruns and
departments that regularly exceed their
budget
 Conduct horizontal analysis of expenses
 Investigate unexplained increases in “soft”
accounts
 Investigate unexplained increases in quantity
of items purchased

Lack of detail on the fraudulent invoice
Invoice that lacks detailed descriptions of the items
billed
Mailing address may be an indicator of fraud
Consecutively numbered invoices over a period of time
Reviewing payables and sorting payments by vendor
and invoice number
Preventing and Detecting
Shell Company Schemes

Testing for shell company schemes
Monitor trends in average unit price
 Investigate goods and services that would
not normally be purchased
 Compare vendor addresses to employee
addresses
 Run reports of average turnaround time for
invoices to look for unusual payment patterns
Preventing and Detecting
Shell Company Schemes

Verifying whether a shell company exists

Billing Schemes –
Non-Accomplice Vendors


Vendor is not a part of the scheme
Pay-and-return schemes






Payments owed to legitimate vendors intentionally
mishandled
Double pay an invoice
Pay the wrong the vendor
Overpay the invoice amount
Purchase excess merchandise
Overbilling with a non-accomplice vendor’s invoices


Fake invoice is created for a vendor that regularly does
business with victim organization
Rerun an invoice already paid




Use the phone book to verify the vendor
Contact others in the industry
Conduct a site visit of the vendor
Identifying the employee behind a shell company




Conduct a public records search of the company’s registration
Be alert for related names, addresses, phone numbers, Social
Security numbers, and other identities
Match vendor checks with payroll checks
Conduct surveillance of mail drops to see who picks up the
checks
Personal Purchases on Credit Cards
or Other Company Accounts
Employees make purchases using their company
credit cards or have running accounts with
vendors
 Company cards may be stolen or “borrowed” from
authorized users
 Charge accounts



Employees order items using an existing account with
the vendor
Returning merchandise for cash/credit

Employee purchases a good or service, receives
reimbursement, and then returns the item for a credit
6
6/11/2014
Preventing and Detecting
Personal Purchases




Conduct a thorough review of each credit card
statement independent of the signature authority
Only original support for the reimbursement should be
allowed
Credit card issuer should send two copies of the
statement to two different individuals within the
organization
Credit card statements should be compared with
employee expense vouchers for duplications, and
monitored for unexplained increases in purchasing
levels
Shell Company Schemes

Case Study – 1985
Victim – Real Estate Developer with projects
throughout the U.S.
 Perp – Property Manager at a remote location
 Property Manager approved invoices for carpet
cleaning at the property – a 50-story office
building
 No carpets had actually been cleaned
 Total loss for 1985 was >$50,000

Shell Company Schemes

Invoice for carpet cleaning had





Shell Company Schemes

Case Study – 2005
Victim – Owners of an oil & gas working
interest
 Perpetrator – the President/CEO of the
operator of the working interest

No physical address – only a Post Office Box
No telephone number
No Federal Tax ID number
Invoice was for cleaning carpets on a vacant floor
(floor did not even have carpeting installed)
What procedures could help to prevent this
type of occurrence?

The two owners of a 90% working interest
in an oil and gas well requested that I look
at the costs that had been incurred

Shell Company Schemes

I started looking at invoices
All were in files, by vendor
 Everything was normal until I got to the
vendor “Tri-County Consulting Services”
 There were 9 monthly invoices, and they
were numbered:

1001, 1002, 1003, 1004, 1005, 1006, 1007,
1008 and 1009
 Each was for monthly consulting services and
each was for $6,000

They did have right to audit the operator
Shell Company Schemes
The address of “Tri-County Consulting
Services” was only a post office box in a
small town near Corpus Christi, in an area
where three counties come together
 I called the County Clerk’s office in the
county where the post office box was
located, and found that “Tri-County
Consulting Services” was an assumed name
registered there

7
6/11/2014
Shell Company Schemes

I asked the County Clerk’s office the name
holding the assumed name certificate
Shell Company Schemes

Since it was a small town, after I finished
eating, I asked my waitress if she knew
David Markham
 She said that yes she did know him because
he came in frequently to eat there
 I asked what kind of work he did
 She told me that he worked in the body
shop of the local Chevrolet dealer

The name was David Markham
 The President/CEO of the operator was
Mark Markham


I had lunch at a local diner
I decided to go to the town where the post
office box was located
Shell Company Schemes

I came back at about 4:30 PM to have a
cup of coffee
Shell Company Schemes

The deputy followed me, and parked just out
of direct sight
I knocked on the door and introduced myself to
David Markham (just my name)
 I told him that I knew he owned “Tri-County
Consulting Services” and I was wondering what
type of consulting services he provided because I
was looking to hire a consultant in the area
 David Markham told me that he only set it up at the
direction of his brother and billed $6,000 per
month at his brother’s direction – his brother got
the money and paid him $1,000 per month
There were two Sheriff deputies there
 I asked if one of them would be willing to
follow me to David Markham’s house when
I went to ask him a question
 I told them what I knew, and one of them
said that they would be glad to help me in
that way


Shell Company Schemes
I told him “thank you” and left, telling the sheriff
that I did not need him after all
 I told my client about what I found, and they
turned it over to the District Attorney’s office
 The DA sent an investigator to talk to David
Markham, and David told him the same thing he
had told me


Only, the investigator had a digital recorder and
recorded the conversation
Shell Company Schemes
The DA chose not to prosecute David Markham
because he had only followed his brother’s
directions
 The DA charged Mark Markham with felony fraud
and theft charges

Was convicted and sentenced to 60 months in state
prison
 Spent 15 months in prison and was paroled
 Was charged in a civil complaint and was convicted
and ordered to pay approximately $250,000 in
restitution

8
6/11/2014
Shell Company Schemes

Mark Markham did not have the money to pay the
restitution, and the court “sold” his oil and gas
drilling company to settle the debt

My clients ended up buying the drilling company and
have been operating it ever since
9