Trust is not an internal control.
Read time: 15 minutes.
This article was planned & written by Serena Shoup, CPA without the assistance of AI. Thanks for taking the time to read something developed by a human!
90% of employees are capable of committing fraud.
Buckle up, friends, this one is a case study and a warning to small businesses everywhere. I’ve already written about external fraud here, but what we’re talking about today is internal fraud & the potential for it happening to you. This can happen to anyone, no matter how much you trust your employees.
Trust is not a control
The following is a true story, that happened to one of my clients.
But before we get into that:
I was trained in my profession to be skeptical. The Accounting & Audit world calls this professional skepticism. It is engrained in us from day one of our degree program. This isn’t something all bookkeepers have. In fact, if you are a bookkeeper or accountant reading this, and you aren't part of the 10% who would NEVER commit fraud, I will tell you what my fraud professor told my class: please leave the profession. You don't belong here. If you aren't sure if you would, ask yourself this: If I find someone's wallet full of cash in the street, would I find the owner and return it with everything in it?
Essentially, "Do I do the right thing even when no one would know otherwise?"
So with that, I question things more so than business owners who trust their employees. But once you understand the factors that contribute to fraud, hopefully you will look at implementing controls a little diffferently.
My Quickbooks reporting sucks.
It all started with what I thought would be a quick migration for a new client over to Xero. She’d been a part of a business group who recommended she get on Xero for better reporting. So I took on a new client, and started digging into the migration, making sure everything was clean enough to move over. It was actually pretty clean, aside for some missed payroll tax deposits from Intuit Payroll, and some sort of messy accounting, but not terrible: there were two businesses commingled into one file—which I don’t recommend, especially in the case of this client: her two companies were absolutely 2 different EINs and corporate structures. They needed to be separate. Thankfully, though, the previous accountant was at least using classes to track everything separately. This made the migration to Xero pretty straight forward.
I want to pause here and remind you, I wasn’t initially hired for any sort of analysis or consulting—purely the migration from QBO to Xero. So that’s what I did.
Xero to the rescue. Sort of.
After the migration, I showed the client how to run reports, and during that conversation learned that she no longer had a bookkeeper on staff (had to lay off during the pandemic) and had let go of the accounting firm she’d been using, due to some things falling through the cracks. So she actually needed help going forward.
A background on medical billing
This wasn’t a tiny business, by any means, and was in the Healthcare sector, where there is quite a bit of compliance involved. But they did at least have someone on staff handling billing. In case you aren’t familiar with the medical industry, billing should always be handled in a 3rd party software and maybe even a 3rd party billing company. So none of the patient information & bills are inside of the general accounting software (accounting software usually isn’t HIPAA Compliant). To record revenue, it requires getting reports from another system.
This is where I started digging into getting the reports and trying to figure out how the previous accounting firm had been recognizing revenue. The process looked right, but something was off, because each month we were continuing to adjust A/R down, which then was a hit to revenue.
That part was not right. So I started asking questions.
In the medical industry, healthcare providers are either in-network or out of network with insurance payers like Aetna, Blue Cross, United Healthcare, and so on. This particular business was in network which means they had contracts with the insurance with agreed upon and decided amounts they would be paying. This is called the allowed amount.
If you already know the amount you’re going to get paid, the best process is to just recognize that amount as revenue. Pretty logical.
๐ฉExcept due to the write offs that were occurring, that indicated that they weren’t actually being paid the full allowed amount (on the reports I was looking at).
So the first step was for the client to start comparing a sample of bills that were going out with the contracted allowed amounts from the actual payer contracts.
The results: finding that the amounts being entered in the billing system as allowed did not match the contracts. They were higher. This would explain why we are writing off as cash comes in, because we were never going to be paid the amount we recognized as revenue, since it was inflated.
My next question was: who has the authority to adjust the allowed amounts in the billing system?
The answer: someone from the client’s company has to call the billing software and approve the change. This person was the Sales Operations Director.
๐ฉ A huge conflict of interest. His and his team’s compensation was directly related to that allowed number via commissions. The higher that allowed amount sold/billed, the higher commissions would be.
When the client started digging around and asking questions,
๐ฉ 2 people from the sales team left the company at this point and went to a competitor.
This was about a year after I initially brought the client on.
More time went by, and the client lifted the pressure on the team, because of personal life things… so the problem continued.
I continued to highlight the writeoffs each month that were happening, so the client decided to move to another billing software/billing company to get a better handle on billing and cashflow.
๐ฉThe remaining involved employee displayed anger & frustration, even temper tantrums during the training sessions for the new software… because he was going to lose access to manipulating the numbers.
The ending of this story isn’t good.
That Director of Sales Operations was given a 2 weeks’ notice of being let go (which I recommended against—anytime you are letting someone go, you do so immediately and cutoff all access). That unfortunately gave him time to steal the customer list and vendor information. He left the company and took his big clients with him.
The owner found that after he left, he had also been overbuying inventory because he’d been getting kickbacks (incentives) from vendors as well.
The Owner of the company (my client) was left scrambling to save contracts, repair vendor relationships, and wondering how to handle this.
I of course recommended pursuing legal action, but she was so far in the hole, that she couldn’t afford it at this point.
So she closed her business and filed bankruptcy. And sadly, this is how a lot of small fraud cases go. The employee moves on and can perpetrate again in the future because the victim of the fraud (the company) doesn’t have the resources to pursue legal action.
Overall, if I remember correctly, he stole close to $300k in overpaid commissions which is not nothing to a small business—one where the owner is putting her own money into the business to keep it afloat, strapped with SBA loan debt from trying to survive covid, and not once taking a salary for herself.
Not all cases are this extreme.
Fraud can happen at a much smaller level, to where no one even truly think it’s fraud. It’s misappropriation: like using company credit cards to add your own personal item to an amazon order. Or taking a little bit of product off the shelf of the store. Or taking office supplies. But if something small like that goes unnoticed, the taking becomes bigger later on, because the opportunity is there.
This is where the Fraud Triangle comes in
When all 3 Opportunity, Rationalization, and Pressure/Motivation are present, even the most trusted employee can succumb to the temptation (if they are lacking morals).
Graphic source: https://www.agacgfm.org/resource/the-fraud-triangle/
This article suggests that statistically, only 10% of the population would never commit fraud.
So, how do you mitigate/prevent the rest of your employees from doing so?
Preventing fraud in small businesses with Controls
A control is just a process that mitigates (doesn’t always prevent) fraud/theft/misappropriation of assets. It helps keep the 90% capable of committing fraud honest.
1. Eliminate the Opportunity
Even in a small business, you may not think there isn’t much opportunity to commit fraud, if no one else has direct access to your bank accounts. But it can happen in the form of taking products, over-ordering with company cards and slipping in personal items on those orders for the office/shelves.
Company Cards: Require receipts
One area I’m starting to see risk for my own clients is in providing company cards to the employees to manage ordering products and/or travel. If you are doing this, it’s important to require receipts for every transaction. And make sure someone is looking at them (this is something we do, and provide the software to submit receipts: Hubdoc).
As a business owner you are required to have support for every transaction anyway. Have a policy and a written agreement that the employee signs agreeing to this before you hand over a card. Check out this article for more on this >
Spending Thresholds
With company cards, you can setup spending limits or approval thresholds. Require approval of someone in a higher position (you, if there aren’t layers of management) if they need to spend over their own threshold. You can implement spending thresholds in Relay and require receipts in that platform for expense management.
Separation of Duties
The person paying vendor bills & signing checks should not be the person reconciling the bank account unless you put other controls in place, like reviewing the check run with supporting documents before everything gets paid.
This is one reason why we only want statement user access to bank accounts and we don’t provide bill pay service or make payments to employees without owner approval.
Don’t have signature stamps or blank checks lying around
When I worked in a small tax firm just out of college, we had a very successful restaurant client whose long-time trusted family friend bookkeeper managed all accounts payable and office duties. Since they were a restaurant in those days, liquor deliveries were often COD (Cash on Delivery) so the client kept signed checks in the office.
When we took over doing the bank reconciliations we identified that lots of checks were being written to cash (which is normal for COD) but the endorsement on the back of the check was the bookkeeper’s signature. She stole multi six figures over the course of the time she was working there.
Do periodic inventory counts
If you have employees managing shipping and receiving, there are a slew of proceses that need to be in place (along with separation of duties) but inventory counts are also crucial to ensure product isn’t disappearing.
I could go on & on… if you suspect you have areas that need better controls in place, I am happy to do an internal control review and come up with areas for improvement with you. Head over to our contact page and get in touch!
2. Eliminate Rationalization
This one is a little more nuanced and requires your company culture to be top tier, and your hiring process as well. You want to eliminate the possibility of employees becoming disgruntled and complacent. Which starts with hiring A Players and keeping people engaged as well as leading with a good tone from the top.
Because theft isn’t always as tangible as stealing money. It could be padding time sheets to receive more pay because the team member doesn’t feel well-compensated.
3. Eliminate Pressure
Now as you can see from the graphic above, not all pressure/motivation can be controlled by you as the business owner. A lot of it can be external. But having a true open door policy with your team can help, when your team trusts you enough to bring their whole self to the workplace. Frequently on 1-1 meetings with team we discuss personal and financial goals, so I can help support them in their growth. I know when my team is making a big shift in life, and what is going on outside of work that can affect their performance.
What you can control is the pressure you’re placing on the team to perform & workload. This area applies more to larger companies (like manipulation financials to hit earnings targets) but can absolutely become a pressure that combines with rationalization when someone feels over worked and under-paid.
What you can do today
I’ve been sitting on this story for years now. I wrote it out and left it in notion to die. And then I started having conversations with other bookkeepers in my community about their concern for the opportunity for fraud in their clients’ businesses. Then I started seeing my own clients becoming too hands-off with their own numbers, issuing company cards to employees, and not requiring receipts to be submitted. Thank you to the clients who have now implemented this policy for their team! I love it when clients take my advice.
But I thought that if I’m seeing this pop up in my tiny little slice of the client base out there, I wanted to share with others.
So if you read this article and see your own gaps in your controls, start making changes today, before it’s too late.
Specifically:
Look at your numbers. Ask Questions.
Reviewing your financials is one of the best ways to detect fraud. The numbers don’t lie. They can’t hide theft. If your office supply account looks higher than you’d like, dig into the detail. Start asking your team questions.
If your cost of goods sold margin doesn’t align with industry standards, dig into why. It could be valid, but it could be over-buying, or shrinkage via theft.
And if you don’t have a bookkeeper that helps you look at your numbers and points things out like this, maybe it’s time to switch.
We’re generally accepting new clients. You can inquire here >>
Or book a one-time consultation to chat about your situation here >>
Create a Plan.
Another great way to catch issues early on, is to actually create a plan (aka budget) that you are comparing your actual performance against every month. If something is way different than the plan, it forces you to dig in and ask questions about why. And if spend hasn’t aligned with expectations, you’ll immediately see it.
Where you’ll get my eyes on your situation for a whole day. We can develop your budget and even discuss ways to improve your internal controls.
DISCLAIMER
We are not engaged to detect or prevent fraud, but the level of service we provide for clients can illuminate potential issues.
AFFILIATE DISCLAIMER
We participate in affiliate marketing programs, which means we may earn a commission from purchases made through the links on our blog. However, our recommendations are based on our own research and expertise, and your trust is our priority.