AuditNet®
CAATT Tales
Above Scrutiny: Fraud Detection and Investigation
By Don Sparks, CIA, CISA, ARM
Audimation Services, Inc.
Experts in Data Analysis
Volume 1 Issue 3
Like so many internal auditing functions there is the audit universe and then there are the sacred off-limit areas from auditing “eyes and ears”. But of course they say ‘things change’. A timely word or question from a board member can make all the difference.
Such was the case of a financial services company. The management insisted that only the external audit firm conduct a review of the Officers Travel and Entertainment reports. The Internal Auditing function conducted all other T&E reviews (excluding Officers).
The audit program used by the external auditing firm consisted of randomly selecting 5 weekly expense reports for the calendar year and determining that one, they footed and cross-footed correctly; two; all expenses over $25 had an appropriate supporting document and three; each expense report was approved for reimbursement by the right “approver”.
One day, a discussion on expense reports occurred in the quarterly board audit committee meeting. Apparently, one of the board members received a tip that one of the officers had loaned his company car to a special friend that also worked at the same company. In fact, the friend drove the car every day and parked it with the other employees in the parking lot.
In the audit committee meeting, a board member indicated that they had been on the committee for two years and could not recall ever receiving a report from the internal auditing function on Officer T&E Reports. At our company, we have an annual audit conducted by the internal auditing function as they are in the best position to understand the basis for the expense.
The CFO jumped into the discussion and indicated the responsibility for that belonged to the external auditors. If the audit committee would like a special audit conducted by the external auditing firm the CFO could make that happen. The audit committee member replied looking at 5 expense reports spread across 15 officers in a one year period did not constitute an audit.
At this point the chairman turned to the chief internal auditor and requested that a 100% audit for the past year be done for all officers. The chairman further indicated that the audit program is simple. At the next meeting you need to look this board straight in the eye and state that all officers use and follow the same T&E guidelines as every other employee in the company.
On Monday, the chief auditor explained the audit committee request to the auditing staff which was met with mixed reactions. As the auditors regularly audited T&E reports they were aware that the C level suite did not appreciate being questioned about expense report items especially if the expense report was approved by the correct approver.
The chief auditor requested that it was important to get started immediately as the next board session was in basically 90 days. If officers were going to be difficult then the field work needed to be completed as soon as possible to allow sufficient time for responses to audit conclusions.
Where to Start
The auditors requested one year of officer level expense report data to be copied/extracted and delivered to the auditors electronically over the company shared X drive. Within three days the data was obtained and the auditors imported the data and easily created a summary analysis report (a standard pivot table). A review of the report disclosed two unexpected anomalies that would require some additional investigation.
Investigation
The first issue was that one officer that traveled regularly had not submitted an expense report all year. In fact, the previous year this officer expenses over $45,000. Discussions with the Officer revealed he was going through a divorce and had not gotten around to completing the expense reports. The auditor asked if he was aware of the company policy that failure to submit a report within two weeks of completion of the activity could result in no reimbursement. He said he was aware but thought under the circumstances the Ethics Committee would understand.
The other item was going to take some investigation. The annual gasoline reimbursement for a company leased car (all officers were entitled to a company car) was about 400% higher than any of the other officers. In fact, if calculations were correct, the officer was getting about one mile per gallon of gasoline.
The auditors decided to go down to the underground parking garage for officers and directors to see the car. They noticed that the car had about a quarter of an inch of dust on it and clearly was not being driven. On the way out, the auditors talked to the security guard who explained that the officer was not driving that car as it had too many miles, i.e., near the 36,000 mile annual allowance. The security officer pointed to another car as the one the executive was driving and explained that the executive had a maintenance employee fly to Boston and drive the car back to Chicago for his use.
A review of the maintenance workers expense report confirmed the trip and the auditors noticed that not only was gasoline charged but also standard mileage per diem was charged and approved by the officer as a bonus for the maintenance worker.
The paper expense reports had arrived from the storage area so the auditors decided to look at the gasoline receipts on the officer’s expense report. It appeared that just about every other day an expense for gasoline was created. Further review revealed that the documents were from an office supply store and were all hand written.
Discussions with the Treasury staff that reviewed all expense reports disclosed that company written procedures merely indicated that a supporting document was required and did not state the nature of the document.
Data Mining
The auditors decided to key the gasoline documents into a spreadsheet that they could then import into a data analysis tool for data mining. Once the receipts were in, the auditor sorted the invoice numbers into date order and then again in invoice number order.
This easily disclosed that the officer had multiple tickers per day. not only were there no gaps in the invoices, there were duplicates as the officer had used the copy as a separate invoice on a different day and amount. While keying in the receipts, the auditors had noticed that some of the invoice numbers were in red while others were in black but did not notice the significance as they had different dates with different amounts.
At this point, the auditors believed they had enough information to discuss with the CEO. The CEO indicated that he was not going to do the auditors job and that the auditors would have to meet with the executive in question.
In the meeting the executive got rather irritated and moved the meeting into the CEO’s office immediately. In the CEO’s office the auditor learned that the executive was using company cars to support a school club sport for his son’s team. Parents were using spare company cars to transport there sons to games some as far as two states over. They were reimbursed for gas expenses via the office supply documents. So the gas receipts were not only for the officer’s car but all of the company cars being used by the other parents.
The auditor had his response and presented the report at the next audit committee. The audit committee tone had changed remarkably since the previous meeting and in fact other than a comment to the CEO that if this were my company that executive would be fired it was decided that no further action would be taken by the board. The auditors were complimented on the audit work that was done and directed to conductrepeat audits on an annual basis.
To
respond to this solution or provide data analysis questions you would
like answered in future newsletter articles, please send an email to
dons@audimation.com
The opinions, beliefs and viewpoints expressed by the various authors and forum participants on this web site do not necessarily reflect the opinions, beliefs and viewpoints of AuditNet®