FRAUD AND INTERNAL CONTROL

1. We have learned many “Computer Audit Tests” related to
various types of schemes. If you were a CFE and hired to
investigate this Duraf case immediately after the hotline report,
what are the necessary Computer Audit Tests that you will be
performing to well examine and prepare the proper evidence for this
fraud case? Please also justify your purpose.

2. Do you have any suggestions/comments to help re-design and/or
reenforce Duraf current internal control systems? Please details
your suggestions to convince CEO and Board of Directors to
implement. (Hint: segregation of duties, independent checks, etc.
if you find it applicable).

Note: Be specific in supporting your points. For
example, simply stating that “the company’s segregation of duties
appear satisfactory as a strength” will receive NO credit. You must
clearly articulate which duty is segregated from what other duties
and how this segregation helps to strengthen the company’s internal
control.

The CASE:
Sandy’s initial success at embezzlement prompted him to try it
again. What led Sandy to jeopardize his career and personal
well-being, knowing full well that what he was doing was
wrong?

ABSTRACT

Businesses today rely heavily on computers to cut costs,
increase transaction speed, create competitive advantages and store
vital information. This embrace of computer technology often means
moving to large systems and networks. Although these systems and
networks come with built-in controls, such as segregation of
duties, they can never replace honest management. In this case, a
manager under financial pressure used his influence over his
employees to bypass the system controls. He was able to embezzle
money until one employee courageously stood up to his questionable
procedures.

BACKGROUND

Duarf, Inc. owned several media businesses, such as newspapers,
radio stations and magazines. It operated in many of the largest
markets in the United States and Canada. The company had grown
primarily through acquisitions over the past ten years and still
used several of the acquired business systems.  

Last year, the company decided to centralize all of its accounts
payable processing, such as purchase orders, vendor maintenance,
invoice processing and check printing. To accomplish this
centralization plan, the company purchased the latest technology.
Following the purchase, training sessions were held to ensure all
processors and management could use all of the system’s
functions.

This technology included a robust database software package. The
software provided internal controls, including matching invoices to
purchase orders and receiving reports, signature dollar limits,
segregation of processing duties and a controlled vendor list. All
of the internal controls associated with the software were
adequately designed. They were tested and found to be functioning
properly within the system.

Before the centralization, Duarf, Inc. had eight separate accounts
payable departments throughout the subsidiaries that processed
approximately 7,000 transactions per month. At month-end, each
department had to submit a consolidation package to corporate
accounting. After the centralization, the accounts payable
department was processing approximately the same number of
transactions but was staffed with fewer full-time employees. Also,
the consolidation process had been reduced to one package each
month instead of eight. Duarf, Inc. had realized the planned cost
savings and management was delighted with the results.

THE PROBLEM

Sandy Blanquet was a senior manager supervising the accounts
payable process at Duarf, Inc. Sandy started at Cloudy News, a
mid-size newspaper, about ten years ago. When Duarf, Inc. acquired
Cloudy News two years ago, Sandy was the accounting controller. As
a result of the acquisition, Sandy was offered the opportunity to
take part in centralizing the accounts payable processing for all
of Duarf, Inc.’s subsidiaries. After the centralization process was
completed, Sandy took on the responsibility of overseeing the
entire department, from opening mail to processing payables to
cutting checks. He managed 20 employees through four supervisors.
In addition to managing the department, he was a check
signer.

Sandy’s system access only allowed him to view accounts payable
data. He could not process any transactions, edit the vendor list
or print checks. However, he did review all voucher packages
requiring a second signature. All checks had a facsimile signature
printed by the computer system’s check printers. Checks over $5,000
required a second signature (in other words, Sandy’s signature).
Checks over $50,000 required a third signature (i.e., vice
president or above).

FINANCIAL PRESSURE

Sandy had always enjoyed the high life. He drove a new sports
car. He lived in an upscale home. He took great vacations. Some
might have said he lived just barely within his means. Having just
returned from an extended vacation to Hawaii with his credit cards
closing in on their limits, Sandy found that the advertising market
had taken a turn for the worse. A couple of months later Sandy was
in trouble because most of his savings were invested in Duarf, Inc.
stock. He was overdue on his car payment and his mortgage. “If I
can just get some money, a loan or something, for a couple of
months, I could get ahead,” he thought, sitting at his desk on the
fourth floor at Duarf, Inc.’s headquarters. He rubbed his eyes.
“Think,” he murmured, knocking the side of his head with his
knuckles. Then it dawned on him. “Ah. Maybe I can borrow some money
from Duarf. A check. No one will miss it and I will repay it as
soon as I can.” He turned to his computer screen and started to
form a plan.

Employee 1
Jack Cross started at Duarf, Inc. three years ago as a corporate
accounts payable associate. His primary responsibility was to
process invoices paid by the corporate headquarters. His work ethic
and knowledge of the process were valuable assets to Sandy during
the centralization process. After the centralization was completed,
Jack was promoted to senior associate responsible for maintaining
the approved vendor list.

“Hey Jack, this ‘Designing Pluz’ invoice was just overnighted to me
with a rush on it from some vice president at our Los Angeles
printing site. Is this an approved vendor?” asked Sandy, sounding a
little irritated. Jack looked up, slightly startled to see Sandy
enter his cubicle.

“No, I don’t see them in here,” Jack said, fumbling with the
keyboard. “Do you want me to add them to the vendor list?”

“Yeah, could you do that right now? I am going to walk this over
to Mabali for processing. Don’t bother with the verification form,
it will take too much time,” Sandy added somewhat curtly, knowing
that if Jack completed the verification form, he would call the
telephone number on the invoice to verify the vendor’s information.
Jack quickly added the vendor to the list.

Employee 2
Mabali Smith recently returned from her honeymoon. She had spent
three weeks in India, touring and visiting relatives. Mabali
started with Duarf, Inc. at the time of the centralization and was
an accounts payable associate with invoice processing
responsibilities. Chris Topper, a senior associate, reviewed her
vouchers for posting.

“Mabali, I have a rush invoice here from the L.A. printing site.
Are you busy?” Sandy asked as he approached Mabali’s desk. Mabali,
who was talking to her husband on the telephone, quickly hung
up.

“Oh, hi, Sandy. Uh, no, I’m not busy. Who’s it from?” sputtered
Mabali, obviously surprised by Sandy’s presence.

“It’s from some V.P. over there. He thinks he can just send me an
invoice and expect it to be processed immediately. Here is his
signature.” Sandy pointed to the invoice. “Are you sure you are not
too busy?”

“Oh no. I’m not too familiar with this signature. Should I look him
up in the authorization limits file to make sure he can approve
this invoice?” asked Mabali.

“Don’t worry about it. If he’s a V.P., he’s authorized up to
$50,000,” counseled Sandy. Mabali entered the invoice into the
system.

“I can put this in Chris’s in-box and let him know it’s a rush
job.” Mabali suggested.

“Actually, I’m going to have Juan post it. I have to talk with him
anyway.” Sandy took the invoice and walked towards Juan’s cubicle,
knowing that Juan had authority to override the purchase order
matching process.

Employee 3
Juan Namkaps started with Cloudy News five years ago, and had known
Sandy for most of those years. When Cloudy News was acquired by
Duarf, Inc., Juan was offered a supervisor position in the accounts
payable department. His primary responsibilities were to review all
of the purchase order matching exceptions and to supervise five
associates.

“Juan, what going on?” Sandy announced as he approached Juan’s
cubicle. Sandy sat down across from Juan.

“Hey, Sandy. What’s up?” Juan said.

“Some V.P. at the L.A. printing site overnighted me an invoice and
demanded that I run it through ASAP,” Sandy explained while tossing
the invoice across Juan’s desk. Juan picked it up. “Can you post
it?” Juan attempted to post the invoice, but it did not match any
purchase orders in the system.

“No P.O., Sandy.” Juan looked up and saw Sandy’s face starting to
get red.

“What? You have got to be kidding me! He overnights me an invoice
and there’s no P.O. in the system,” Sandy blurted, looking past
Juan at the computer screen. “Well, just override it and I’ll have
a chat with our L.A. friend.” Juan overrode the matching exception
and posted the invoice for payment. Sandy grabbed the invoice and
stomped back to his office.

Employee 4
Darlene Beau was primarily responsible for printing the afternoon
check run. She was hired only three months ago but had experience
with the system Duarf, Inc. used to process payments. Knowing the
check for this Designing Pluz invoice would require his signature,
Sandy telephoned Darlene. Sandy explained to her that there would
be a special check in the afternoon run and, since it would require
his signature, he would save her time by reviewing the voucher
package himself. She willingly accepted and even thanked him for
his thoughtfulness.

Getting the check out the door
The check was printed, signed and mailed following the normal
operating procedures. However, it was mailed to a post office box
owned by Sandy and he deposited the $32,450 into his new business
account-“Designing Pluz.”

Repeating the job
Although the money did help alleviate Sandy’s financial pressures,
he found himself wanting to try it again. He realized that with the
fake Designing Pluz account already on the approved vendor list, he
could easily push another invoice through the process. Less than
two weeks after the first phony invoice was paid, he attempted it
again.

Sandy created another Designing Pluz invoice for $12,945. He was
careful to keep the amount low enough that both checks combined
would not stand out on the L.A. printing site’s monthly budget for
actual analysis. He decided to use different accounts payable
associates to process the payment but to tell the same story.

Employee 5
Rachel Nicki had been with Duarf, Inc. for two years. She was an
associate whose primary responsibility was processing supply
invoices, such as paper, ink and press materials. Most people did
not know that she was married to one of Duarf, Inc.’s senior
internal auditors

because she did not take his last name. Her husband had been
working on implementing a fraud hotline for the company and spoke
to her often about it.

“Rachel, I have a rush invoice here from the L.A. printing site.
Are you busy?”  

“No, not too busy. Hold on, just a second,” Rachel said. Sandy had
interrupted her in the middle of processing an invoice. She
finished up with what she was doing and asked, “Why the
rush?”

“Some V.P. over there wants it processed ASAP. Here is his
signature.” Sandy pointed to the invoice as he handed it to her.
Rachel studied the invoice and the signature. She began to open the
authorization limits file on her computer, but Sandy stopped her.
“Rachel, I really don’t have time for that now. He’s a V.P.”

“I’m sorry Sandy. I have to check him out to see if he’s authorized
to approve invoices,” Rachel explained, looking curiously at Sandy.
She found the file and began to scan it for the name. She looked
back at the signature and asked, “Is this Sandman or
Zachvan?”

“Look, I appreciate your insisting on processing this by the book,
but I really need this processed now. Take my word for it, he’s
authorized.” Sandy said.

Somewhat shocked by what Sandy had said, Rachel began, “When I
process something, my initials are input into the data record and I
don’t put my name on anything unless it’s by the book.” However,
Sandy snatched the invoice and walked away before she could
finish.

Two hours later, Rachel was still puzzled by Sandy’s behavior. She
had a funny feeling about that invoice and decided to call the
company’s fraud hotline. The operator was pleasant and let her know
she could remain anonymous. The operator inquired about the
situation, then thanked her for the information. He explained that
he would recommend an internal review of the Designing Pluz
vendor.

DISCOVERY

Two months later, Rachel received a department-wide e-mail
saying that Sandy was leaving the company. The e-mail added that
Sandy would be prosecuted for allegedly embezzling over
$40,000.