It can happen to you

Employee fraud is occurring more frequently, and small businesses are particularly vulnerable

by Kenneth Boyd

"John," a roof system installer, was filled with excitement. He had decided to start his own roofing company. He had a loose business plan, a few jobs lined up and best of all, he had persuaded his co-worker "Michelle" to work with him. He would handle completing the jobs, and she would handle managing the office duties. John even offered to pay Michelle's vehicle expenses to compensate for the long commute to his new office. John believed he did not need to train Michelle or oversee her work. After all, she was experienced!

Ten months later, John sat down with me at the Denver District Attorney's office and listened in dismay as I explained he might never see a dime of the more than $40,000 Michelle had embezzled from his new company. By the time John ended up in my office, it was simply too late.

If this happens to you, local law enforcement agencies will not perform an audit for your business; they will not recreate your books; and restitution will be limited if you recover any of your lost funds.

Much of the following information comes directly from the 2016 Association of Certified Fraud Examiners [ACFE] Report to the Nations on Occupational Fraud and Abuse. In the report, ACFE has put statistics and definitions to what I have seen anecdotally in cases I have handled during my time as an economic crimes prosecutor in the Denver District Attorney's office.

Fraud facts

Occupational fraud is a significant threat to U.S. businesses. ACFE estimates a typical business loses 5 percent of its revenue to employee fraud each year. In addition, ACFE estimates the median loss from occupational fraud has grown during the past 10 years from $93,000 to $150,000. And if that isn't bad enough, in the employee fraud incidents that involved losses of more than $1 million, a majority of those funds were never recovered.

The 10-10-80 is a good rule of thumb for a business owner to remember. Ten percent of your employees will never steal from your company; 10 percent always will steal from you; and 80 percent may steal from you depending on the circumstances.

According to ACFE's 2016 report, small businesses (those with fewer than 100 employees) are victimized more frequently than their larger counterparts and suffer a larger median loss relative to their size. Why are small businesses the most vulnerable to employee theft? What we see in our office is small businesses differ widely in organizational structure, have limited resources to hire enough employees for comprehensive cross-checks and tend to have unsophisticated anti-fraud controls in place.

To combat occupational fraud, business owners need to have an idea of the many ways in which employees can walk away with their money. ACFE recognizes three primary categories of fraud: corruption, financial statement and asset misappropriation. I will focus on asset misappropriation because it is the most common type of employee fraud business owners encounter.

Asset misappropriation

Simply put, asset misappropriation involves schemes where an employee steals or misuses an organization's resources. Within this broad definition, ACFE recognizes nine categories of fraud:

Skimming. This involves schemes in which an organization's cash is stolen before it is recorded on the business's books. Think about an employee who performs roof system repairs. This individual might be tasked with estimating the repair, performing the work and collecting payment. He does all this, but perhaps he tells you the customer thought the price was too high and chose not to have the work done. The repair person then pockets the cash from the repair.
Cash larceny. This is different from skimming because it involves cash being stolen after an organization has recorded it on its books. This commonly occurs in companies where the same person is charged with not only processing company deposits but also recording payment to company books. An employee in this scenario is able to steal payments made to the company before they can be deposited in the company's account. These funds then can be "written off" as a bad debt or disappear through some other accounting adjustment.
Billing. These schemes are common in small businesses, and our office is seeing an increasing number of employees committing this type of fraud. ACFE defines a billing scheme as one in which a person causes his or her employer to issue payments on invoices for fictitious goods or services, invoices that have been presented with highly inflated prices or invoices submitted for an employee's personal expenses. Our office prosecuted a defendant who created several shell companies with names similar to vendors with whom the company commonly did business. The defendant submitted invoices from these shell companies, and they were paid along with all the other invoices received from legitimate businesses. In this instance, no one in the company was paying attention to the vendor list and controls were not in place to add or delete new vendors. The problem was not discovered until the defendant left that job and went to work for another company. By then, she had bilked the company of more than $240,000.
Expense reimbursement. This fraudulent scheme simply involves an employee submitting fictitious or highly inflated business expenses for reimbursement. Too often, these charges are never verified by anyone in the company.
Check tampering. In this situation, employees steal the employer's funds by intercepting, forging or altering a check drawn on one of the business's bank accounts. The most common way this occurs is when an employee simply steals a check from his or her employer and makes it out to himself or herself or an accomplice. Employees might also steal outgoing checks to vendors and deposit them into their own bank accounts.
Payroll fraud. This involves employees who submit false claims for compensation. In these situations, this could be anything from an employee claiming overtime for hours not worked to more sophisticated schemes where an employee is able to add a ghost employee to the payroll whose paycheck is then directly deposited into the embezzler's bank account.
Cash register disbursements. This type of fraud involves employees who make false entries on a cash register to conceal the removal of cash. For example, an employee might void a valid sale on the register and pocket the cash received in the transaction.
Misappropriation of cash on hand. In this scheme, an employee will steal or misappropriate cash kept on hand at the business.
Non-cash misappropriation. This fraud involves an employee stealing any non-cash asset of the victim organization. This could include everything from inventory theft to stealing or misusing the company's confidential customer financial information.

Of the many ways in which an employee can defraud an employer, according to the 2016 ACFE report, the most common schemes in the construction industry were skimming, billing, expense reimbursements, check tampering, payroll fraud and non-cash misappropriations. For small-business owners, billing schemes are the most common fraud, and check tampering is three times more common in smaller organizations than in larger businesses.

Remedies

So what is a business owner to do? The problem with employee fraud is it commonly takes a long time to detect, allowing precious revenue to slip out the door until someone in the organization finally realizes what is happening or the loss of funds takes the company down completely. Payroll, check tampering, billing and expense reimbursement schemes usually take the longest time to detect with a median average of 24 months. The other schemes averaged from 12 to 18 months. Loose oversight and the sophisticated methods of concealment employees use can combine to make things worse. The most common concealment methods used by perpetrators are creating false documents, altering documents, altering transactions in the accounting system, creating fraudulent transactions in the accounting system or destroying physical documents.

How can you detect fraud? By far the most common way is through tips from other employees. But for employees to come forward, they must believe there is a person in the organization who will listen to their concerns, investigate their allegations and keep their identities confidential. Other ways in which businesses are detecting fraud are through internal audits, management reviews, through bank account reconciliation or by accident.

The statistics are telling. When a business owner identifies an employee who is stealing from the company, surprisingly, a vast majority of these people previously have never stolen from an employer. In fact, 88 percent are first-time offenders, according to the 2016 ACFE report. Think back to the rule of thumb: 80 percent of employees will steal from their employers depending on what is happening in their work or personal lives. Perhaps they are facing gambling debts they cannot cover. Or maybe someone in their family is ill and needs specific medical attention they cannot afford. Or the employee might feel underappreciated, overworked or underpaid. And sometimes, it's just good old-fashioned greed.

Almost half of offenders are between 36 and 45 years old, and 55 percent are male. Just less than half have a college degree, and, interestingly, 38 percent of offenders will have some sort of nonfraud-related misconduct that's been reported during their tenure, such as bullying other employees or using intimidation tactics within the victim organization.

It is common for victims in the cases I have prosecuted to see at least one red flag from an employee who was stealing from their business. In many cases, there were multiple red flags waving around the employee; however, the business owner simply did not see the warning signs or refused to believe the employee would steal from the business.

The most common red flag noted in the 2016 ACFE report was employees who were living beyond their means. This might be an employee who is buying a new car he or she obviously cannot afford. Other signs are employees who are experiencing financial difficulties, have unusually close associations with vendors or customers, or display excessive control issues over their work products.

For instance, you should pay close attention to a "perfect" employee who is looking to take on more responsibility, never misses a day of work even for a vacation or is eager to handle your personal finances. If you find yourself in love with the fact that you can focus on roofing while the "perfect" employee opens the mail, answers the phone, pays the bills, deposits the money, reconciles the bank accounts and collaborates with the accountants, you are setting yourself up for a major disaster.

Think of employee fraud as a triangle composed of three independent but necessary sides. On one side is motive, usually driven by financial hardship or simple greed. On another side is opportunity, usually driven by lack of controls within the victim organization. The third side is rationalization, which can take many forms. Oftentimes, employees view theft from their employers as a loan they will pay back. It is up to you as a business owner to recognize the triangle in your company and install a thorough, robust set of internal controls, including:

Creating a code of ethics that communicates to all employees a commitment to ethical conduct in the business and holding everyone (including ownership) accountable. If employees see other employees exhibit unethical behavior, it won't be long before they begin to rationalize their own unethical behavior.
Creating a training program that instructs employees about the proper procedures for reporting fraud. Review hiring procedures, and background checks should be a part of the hiring decision, especially with employees who are assigned to accounting or banking tasks. Make sure to follow all federal and local laws surrounding background checks.
Performing employee evaluations that include evaluating each employee's compliance with the code of ethics established by the business and any anti-fraud measures in place.
Creating a safe way for employees to report fraud. Remember, employees are the first line of defense when it comes to discovering employee fraud. Reporting employees must feel safe, protected and heard. Train your employees regarding how to spot warning signs that employee fraud may be occurring.
Conducting surprise audits of company books. Clearly state to employees that parts of their jobs may be subject to audits.
Dividing responsibilities and tasks. The same employee should not be opening the mail, making bank deposits and posting the receipts to the company books. Separate cash handling and bookkeeping duties if possible.
Opening your mail randomly. The idea that a company owner might open the mail and discover a fraudulent invoice or billing may be enough to deter an employee from stealing.
Reconciling bank statements and monitoring tax filings and insurance renewals. I had a victim organization whose office manager was intercepting the insurance premiums for malpractice insurance. When the owners finally detected the fraud, they were horrified to learn they had been practicing medicine for more than six months without any malpractice insurance. The policy had been cancelled for nonpayment of the premium, and the letters warning them the policy was being cancelled had been intercepted by the office manager.
Requiring two signatures on checks over a certain amount.
Instituting a purchase order system that prevents employees from purchasing items on behalf of a business without the owner's signature.
Protecting the business's check stock in a locked location and reviewing and signing checks sent to vendors. When reviewing checks, look for missing check numbers.
Requiring that only a supervisor or owner can add new vendors to the company's accounting program or new employees to the payroll system.
Approving employee time sheets (before payroll is prepared) should be performed by the owner or supervisor and, if possible, paychecks should be distributed by someone other than the person preparing them.
Avoiding the allowance of standard accounting or banking procedures put in place to be overridden by trusted employees. Everyone, including business owners, must be accountable to the procedures that have been established.
Installing security cameras or other devices in the office and around the warehouse and randomly reviewing security tapes.
If possible, requiring approval from two employees in the business for all ACH (automated clearing house) transactions.
Requiring all employees to take vacations.
Understanding and interpreting financial statements to recognize unusual variances in the statements.
Purchasing employee fidelity bond insurance to protect your company in case of employee fraud.
Limiting the amount of petty cash on hand.
Establishing a policy for employee use of credit cards. This policy should outline the appropriate uses for the card, dollar limits for transactions and clearly delineate what constitutes personal use of the card.
Looking for additional discrepancies in your company's books even when you find one. Never ignore your suspicions or those of your employees. The adage "where there's smoke, there's fire" applies here.

Don't ignore signs

In the roofing industry, the pressure to perform a job well and at a profit is increasingly difficult. In the ideal world, every roofing contractor would employ all the internal controls listed previously, but that's not always possible. At the very least, take time to identify the threats that exist in your organization. Then, put policies and procedures in place that are appropriate to protect against employee fraud based on the size of your organization. If you ignore the vulnerabilities that exist, there is a good chance you will end up sitting in a prosecutor's office just like John.

Kenneth Boyd is a senior deputy district attorney for the Denver District Attorney's Office.