Travel Expense and Payroll Fraud Case Study

By Eric A. Kreuter |  Glenn D. Sacks  |  September 13, 2013  |  Download PDF

Travel expense and payroll fraud have become hot topics within both for profit and non-profit organizations.  Weaknesses in internal controls and greed both contribute to the ongoing problem of assets and profits being slowly siphoned from unwary organizations.  This case study illustrates what can happen, what can be done and what value can be added during and following the forensic engagement.

This article, “Travel Expense and Payroll Fraud Case Study”, was originally published in The Forensic Examiner, Fall 2013.

What happened?

The first scheme was detected The documentation in the case comprised an airline travel itinerary for an international destination, but did not include invoices for hotel accommodations and receipts for transportation and other incidental expenses because the trip had not yet taken place. The total requested reimbursement was $6,250. Jane was pleased . . . but fraud has occurred. How and where were there breakdowns in preventive or detective controls? Company policy was not adhered to. As part of the findings of the investigation, the organization’s Employee Handbook requires that all travel be arranged through the organization’s travel agent and paid for by the organization directly. The investigation continued In February 2012 forensic examiners Eric Kreuter and Sareena Sawhney (“the forensic team”) were invited to a meeting with one of the members of the Board of Directors of a multi-national philanthropic organization to discuss a potential problem with Jane, one of the members of their executive team. During the meeting it was revealed that the Board had recently been informed by anonymous letter that Jane had a previous criminal record for embezzlement – something undisclosed by heron her employment application. The Board realized that it had an obligation to better understand the background of Jane’s prior conviction and to commission a forensic review of her current functions as they relate to her ability to submit expense reports and receive reimbursement since her position requires frequent international travel. Kreuter and Sawhney issued a proposal for forensic services and negotiated an agreement. Planning for the covert investigation began; documents were requested and then analyzed. A dozen anomalies were observed in just the first year of expense reports reviewed. These anomalies included consistent violations of organizational policies requiring certain forms of documentation as well as duplication of reimbursement and missing proof of actual travel. Kreuter and Sawhney provided a preliminary verbal report to the Board member as well as to the organization’s outside legal counsel. In the report, Kreuter and Sawhney recommended that their forensic team conduct a formal interview with Jane for the purpose of presenting her with the anomalous data and eliciting her responses to the concerns raised in the preliminary phase of the forensic examination. The organization and outside counsel agreed to the interview led by the forensic team. The forensic team arranged a meeting with the Senior Vice President of Human Resources (SVP HR) at the organization’s office. The SVP HR asked Jane to join him in the conference room where she met Kreuter and Sawhney. The interview was conducted and Jane was provided with copies of some of the documents from her travel expense files from which questions were raised. Jane’s demeanor and body language both indicated signs of anxiety and evasiveness. For example, she lowered her head following some of the questions and her face turned red when asked about some of the trips; she stated repeatedly that she needed to “review her records.” What was absent from her affect and attitude were any statements expressing her integrity or outrage at being questioned. It was mutually agreed that Jane would bring additional documentation to the office of Kreuter and Sawhney the next day. Kreuter and Sawhney continued to inspect the documents in Jane’s expense reports. There were questions concerning the authenticity of certain airline-generated documents as well as the cost of one particular travel itinerary that seemed unusually high. The forensic team contacted the airline and was provided with information establishing that the actual trip was booked three months after the date of reimbursement and cost much less than Jane indicated on her travel expense reimbursement form.^[1] Kreuter also noticed that the email confirmation from the airline was missing the year in the date reference. When questioned, the airline representative said that such confirmations of travel itineraries always contain the full date reference and that this information was generated automatically through their system. It was further noted that the page containing the purported amount of the flights was on a separate page with no reference to the itinerary and only a reference to a charge on Jane’s credit card. The potential that these documents were altered and/or matched together improperly was significantly increased. The airline also confirmed that two other expensive airline trips, for which Jane was reimbursed, were never booked and never took place. Hours following the agreed appointment, Jane had not appeared for the second meeting and had not gone to the organization’s office that morning. Kreuter contacted outside counsel for the organization and the SVP HR to advise them and to suggest steps to be considered to protect the organization’s data security. A plan was devised. Later that day, Jane sent via email additional documentation to Kreuter, the organization’s outside counsel, and the SVP HR concerning one of the trips in question. This documentation was supposedly meant to corroborate one of Jane’s trips as being taken for a few thousand dollars less than what she was reimbursed and that she owed the excess funds to the organization. What is particularly interesting about this evidence is that Jane indicated that the original air ticket had been cancelled by the CFO the day it was booked and then rebooked at a reduced fare at the end of September.^[2] Jane said that she did receive excess reimbursement in an amount just over $2,000. She then called Kreuter and first explained that there must have been a misunderstanding about the office visit and then she asked if her new document “cleared up the concerns raised” over her travel expenses. Kreuter asked Jane if she repaid the excess reimbursement to which she responded: “I have yet to work that out with them.” When asked why she did not respond to the other questions raised in the first meeting, Jane said she thought the forensic team was primarily interested in that one trip. Based on the information gathered to date and Jane’s responses, the organization made the decision to immediately terminate her employment. She was asked if she would consent to continuing to cooperate with the forensic team’s continuing investigation. She agreed. Kreuter was asked to present the findings reached by him and Sawhney at the organization’s annual Board meeting. Kreuter presented the findings and recommended expansion of the investigation to a careful review of Jane’s travel expense files for several additional years and also to include a review of the expense files of the former CFO based on several suspicious indications about his own travel expenses and possible complicity with Jane.^[3] The Board agreed. The expanded study commenced. Additional discoveries were made. When the files for prior years were delivered to Kreuter and Sawhney there were no expense reimbursement requests for 2009 though there was an odd document – an accounts payable vendor payment summary for Jane labeled: ”Consulting fees.” This was odd because Jane was considered to be an employee and not an independent contractor. An additional inquiry was made, producing evidence that Jane’s status was altered in the organization’s records showing her as an independent contractor, despite no records of her being terminated as an employee in the human resources department, inclusion on the organization’s health and welfare benefits, and inclusion on the organization’s employee census for the retirement plan. The SVP HR was startled at what had been found. Kreuter contacted Jane and requested a second meeting. Jane agreed and did keep her appointment. Kreuter interviewed Jane in the presence of a witness, Glenn Sacks. Jane was first asked about the switch in status from employee to independent contractor. She openly admitted to requesting this change and had the approval from the CFO. She explained that she wanted this status as she had established her own consulting company and wanted to start consulting for other companies as well as the organization. Reverting back to discussing the travel expense concerns, Jane did admit to receiving reimbursement for trips in excess of her cost, receiving reimbursement in advance of booking trips, and for receiving reimbursement for trips that never took place; but she had not admitted to fraud at this point. When shown the airline travel confirmation and told that the airline provided information to Kreuter, refuting Jane’s story, she then confessed to altering the documents for the purpose of receiving additional funds she needed as her personal debts were mounting (persons in such financial need may resort to embezzlement). When re-questioned about the change of status from employee to independent contractor, Jane also admitted to doing so for the purpose of eliminating any tax withholding as she needed the additional funds for her personal financial obligations. She admitted she had continued to receive employee benefits and agreed her actions should result in her being required to make restitution to the organization for funds received in excess of entitlement. She agreed to repay the excess travel reimbursements for her travel during 2011. Jane also understood that the other years’ expense files were being examined and that the amount of employee benefits paid to her during the time she was listed as an independent contractor would be determined at a later date and communicated to her. Importance of the demeanor of the suspect Especially during the initial part of the interview (prior to her confession), Sacks and Kreuter noted that Jane’s appeared to be nervous (her hands were shaking and she continued to drink from a near-empty water bottle after refusing more water). At the start of the interview she indicated that she was sick but showed no outward signs of being sick at any time throughout the proceeding. She reacted with silence and covered her mouth several times during responses to questions that directly related to the incriminating evidence. Her face blushed several times during some tense moments. She cried at one point towards the end of the interview and expressed her sorrow over what she had done, stating that she did not manage her personal finances well. As is evident from the above description of the non-verbal actions of Jane, it is important for an interviewer to play close attention to the body language of the person being interviewed. Very often non-verbal communication can be more important than verbal communication in a conversation. The study of non-verbal behavior related to the interpretation of body language was founded by Mr. Ray Birdwhistell which he coined the science of “Kinesics” Kinesiology – human kinetics: the scientific study of human movement. Birdwhistell believed that words take a back seat to non-verbal communication. He estimated that non-verbal communication conveys 65 to 70 percent of the information in a conversational interaction (Harold and Tobin, 2012, p.1). As described above, the non-verbal communication of Jane was entirely consistent with that of a guilty person. Typically a guilty person will not express outrage at being accused of committing fraud but instead will try to manipulate facts and place the blame on others. As described herein, Jane expressed no outrage at being questioned about her expense reimbursements and employee benefits. Kreuter reported the results of the second meeting to several members of the Board as well as the outside attorney for the organization and the SVP HR. The investigation continued, deepening into internal control weaknesses that were exploited, making it possible for Jane to conceal her embezzlement and alteration of records for a multiple-year period. Side-bar: The Senior Vice President of Human Resources received a handwritten letter from an anonymous author indicating that three employees of the organization have been working as a team to steal from the organization. The three employees were referred to by their respective titles and included the individuals referred to in this article plus the Director of Human Resources, who reports to the Senior Vice President. This letter has created additional concerns, but also serves to highlight the importance of a more detailed investigation into the areas of payroll, expense reimbursement, check writing, and wire transfers. According to Skalek, Golden, Clayton & Pill, 2011, p. 144): The allegations must be carefully sifted to establish those that are potentially genuine and to set priorities for investigation – that is, where the greatest potential problems are in regard to financial loss, physical danger to persons or assets, legal implications, and so on. The tenor of the letter suggests collusion: Collusion with third parties or other employees of the victim company, in which such parties are aware of irregular transactions, but do nothing to prevent them or nothing to bring them to the attention of either their auditors or the counterparty’s auditors (p. 429). We were later informed by the organization that the CFO committed improprieties with respect to submission of excess travel expenses in a prior year for which the organization was reimbursed. Despite being caught doing so, the CFO was allowed to remain in his job. The investigation was extended to a review of travel expense reimbursement of the former CFO where anomalies were uncovered, leading to the need to commence a process of inquiry in order to fully understand if additional improprieties have occurred. That investigation determined that the CFO did, in fact, receive excess reimbursement for his own travel expenses. He agreed to make restitution to the organization. The potential for a wider scheme, especially in an environment of collusive activity, exists and warrants the increased investigation. The inherent weaknesses in the organization’s internal control system will be addressed in a formal report and presented to the Board of Directors. The new CFO of the organization will be tasked with implementing new internal control procedures throughout the organization. While the information uncovered in the investigation has been unnerving for the Board and the executive management of the organization, identification of shortcomings in the system of controls will undoubtedly lead to improvements in the system to prevent further defalcations. Importance of an internal control system The importance of a strong internal control system is critical in the fight to prevent fraud in an organization. A strong internal control system helps management achieve its objectives related to the effectiveness and efficiency of its operations, the reliability of its financial reporting, and compliance with applicable laws and regulations. It is management’s responsibility to develop and implement a strong system of internal controls. However, everyone in an organization has some responsibility for internal control. A strong system of internal controls begins with a sound control environment. The control environment sets the tone of the organization often referred to as “tone at the top” and provides an atmosphere in which people carry out their duties. ^[4] An exhibit attached to Statement of Auditing Standard 99 (AU 316), “Consideration of Fraud in a Financial Statement Audit”, provides examples of programs and controls that management can implement to prevent, deter and detect fraud. It describes how it is the organization’s responsibility to create a culture of honesty and high ethics and to clearly communicate acceptable behavior and expectations of each employee. Part of creating an appropriate culture is to hire and promote appropriate employees and to have a consistent method of responding to incidents of alleged or suspected fraud. Management can play a key role in designing control activities to prevent or detect fraud. Finally, an entity should also have an appropriate oversight and monitoring function in place. It is important for all organizations, even those with the most robust control systems, in order to continue to monitor the effectiveness of controls in place. Monitoring activities can typically be carried out by internal auditors, members of management and personnel responsible for governance, such as the board of directors. Internal controls systems are not static; they are constantly changing and adapting to changing conditions about perceived fraud risks. When a problem arises, such as that depicted in this case study, there is an opportunity to evaluate and fine-tune the internal control system and institute top-down changes. The end result of an organizational willingness to examine its policies and procedures with a view towards tightening controls is reduced risk. Despite management’s best efforts to establish and maintain an effective system of internal controls, there always remains the possibility that fraud can and will occur. It is very difficult to overcome collusion between people or management override of established controls. Employees also can make honest mistakes in judgment which can cause well-designed internal systems to fail. Side bar: Recently in the news we read about Jeff Neely, a federal official with the General Services Administration who is being investigated for excess spending related to travel. “In the last year alone, Neely, a GSA regional commissioner, took five GSA-funded trips to Hawaii, Guam and Saipan – and that was after his bosses were warned by the GSA inspector general to curb his travel” (Shields, 2012). Engaging an independent forensic examiner to investigate concerns of the type mentioned in this article will ensure a thorough handling of the concerns raised. Following the investigation, there is usually renewed energy on the part of management to tighten internal controls. Conclusions Jane was terminated for cause and made restitution for monies stolen from the organization. The former CFO has agreed to repay some of the monies owed and the balance is being negotiated. The organization has taken a number of steps towards improvement of its internal systems and has begun to recognize the events that have occurred as a learning experience.

---

[1] Not only was the cost of a coach class ticket far less costly, but Ms. Jane actually upgraded her coach ticket to first class using accumulated air mileage.

[2] It would later be proven that these statements were falsehoods.

[3] The former CFO resigned in the fall of 2011.

[4] Committee of Sponsoring Organizations of the Treadway Commission (COSO) Report, Internal Control – Integrated Framework (1992).

References

Committee of Sponsoring Organizations of the Treadway Commission (COSO) Report, Internal Control – Integrated Framework, 1992. Golden, T.W., Skalek, S.L., Clayton, M.M., & Pill, J. S. (2011). A guide to forensic accounting investigation. Hoboken, NJ: John Wiley & Sons, Inc. Harold, E. & Tobin, S.(2012). Ray Birdwhistell. Retrieved March 28, 2012. www.culturalequity.org/alanlomax/ce_alanlomax_profile_birdwhistell.php Shields, G. (2012). Feds’ trouble in parade$e. New York Post, April 18, p. 6.

About the authors

Dr. Kreuter is a partner, and Ms. Sawhney and Mr. Sacks are directors, in the Litigation and Corporate Financial Advisory Services Division of Marks Paneth LLP, working predominantly in the New York City office. Both Dr. Kreuter and Ms. Sawhney have extensive backgrounds in forensic investigations and also providing litigation support services to attorneys. Mr. Sacks has an extensive background in financial statement fraud and in forensic procedures. They all have been published in the fields of forensics and litigation services. Dr. Kreuter is a member of the American Board of Forensic Accounting and a Diplomate and Fellow of the American College of Forensic Examiners International.

Contact information

Eric A. Kreuter, Ph.D., CPA, CFE Partner Marks Paneth LLP 685 Third Avenue New York, NY 10017 (office) (212) 201-3117 (cell) (914) 393-1688 ekreuter@markspaneth.com

About Eric A. Kreuter

About Glenn D. Sacks