David Zweighaft

Forensic Accountants Focus on Fraud

Don’t underestimate the damage of small-dollar recurring frauds.

June 22, 2009
by David Zweighaft, CPA, CFF

While the major “eye-popping,” headline-grabbing investor and financial statement frauds have captured the attention of the investing public in recent months, little heed is given to the smaller dollar, repetitive frauds that occur in organizations year in, year out. Forensic accountants and fraud examiners who investigate these transactions understand how they can deplete the resources of an organization in much the same way that wind and water can reshape large boulders — gradually, unnoticeably over time, until the scheme is either discontinued or it is uncovered and brought into focus.

This article examines the factors that allow fraud to flourish “under the radar” of internal controls, and reveals some of the common schemes that occur as well as the forensic accountant’s role in investigating these frauds. Given the impact that the economic crisis has had on the population, these low-risk fraud schemes can put extra dollars into an employee’s pocket at the employer’s expense.

For the sake of clarity, small-dollar recurring fraud can be defined as misappropriation of an entity’s assets, repeated during any given accounting period (e.g., month/year) in an amount insufficient to be detected by the entity’s system of internal controls.

Common Recurring Small-Dollar Fraud Schemes

Since the easiest (and most common) type of fraud is the misappropriation of an entity’s assets, it should come as no surprise that the asset of choice for such fraud is cash. Cash that has not yet been recorded is much easier to steal because there are no accounting entries to make, no ledgers to balance and fewer controls to circumvent.

Cash that is already “in the system” (i.e., recorded by the entity) may be extracted through outright theft or through a fraudulent disbursements scheme. These schemes require a check to be written or cash to be wired for what appear to be a valid business expense, generally to the perpetrator or to a fictitious vendor.

Theft of Cash Before It Is Recorded: Skimming Schemes

Skimming can occur at any point in which funds enter a business, so almost anyone who deals with the process of receiving cash may be in a position to skim money. Employees may be able to slip checks out of incoming mail rather than posting checks to the proper revenue or customer accounts.

Theft of Cash After It Has Been Recorded: Fraudulent Disbursement Schemes

In order to extract cash from an entity, the perpetrator must create an appearance that a bona fide obligation exists and the entity is supposed to make that payment — as part of the normal course of business. Since the focus here is on recurring fraud, these would include payments primarily to vendors and employees. Within an entity, a perpetrator who is in a position to approve, process or record disbursements can forge or manipulate documents to create the appearance of normal business transactions. The only difference is that the disbursement is being directed to the perpetrator, or an account controlled by him or her.

Payments to Vendors

The primary types of payment to vendor schemes are: false invoicing via fictitious vendors and false invoicing via vendors. A fictitious vendor scheme is made easily when the perpetrator has unsupervised authority to approve invoices. Most fictitious vendor schemes involve the purchase of services, rather than goods, because intangible services are harder to verify. The perpetrator uses a fictitious company to purchase legitimate merchandise, and then resells the merchandise to his or her employer at an inflated price.

Payments to Employees

In the normal course of business operations, an entity makes payments to, or on behalf of employees for generally two bona fide reasons: compensation (salary, wages or commissions) and expense reimbursements. At issue with these types of payments are whether the amounts were paid (correctly calculated and commensurate with the salary/wage rate and number of hours worked); the propriety of the payments (payees actually employed by the entity and entitled to receive these payments); and the accurate characterization of the expense being submitted (expenses actually incurred in connection with the individual’s employment and accurately presented).

Compensation Schemes

In compensation schemes the perpetrator may be an hourly employee boosting his or her hours in order to receive additional overtime pay, or a shift supervisor or payroll clerk collecting paychecks for “ghost employees” who were either terminated or never were employed by the company. In either case, funds are being disbursed in excess of the amounts that the payees are authorized to receive.

In the case of the hourly employee, the fraud is committed through either time cards or a handwritten timesheet, which is forwarded to a supervisor or payroll clerk for review. Oftentimes the review is cursory at best, and the inflated hours are forwarded to payroll accounting. Alternatively, the hourly employee may be submitting accurate time records, and then altering them after they have been approved.

Expense Reimbursement Schemes

Employees often incur out-of-pocket expenses in the course of discharging their obligations to their employers. Depending on the nature of the entity and the type of expenses incurred, these expenses may be reimbursed to the employees. The general reporting model for expense reimbursement is that the employee submits documentation for expenses incurred, and it is the job of the accounting department to determine if the expenses are correct, appropriate and reimbursable. The motivation to commit fraud under this reporting model can be very tempting, and an employee with a financial need may see an opportunity to take advantage by letting some personal expenses “slip into” the reimbursement submission. If expense report submissions are verified by the accounting on a sample basis, the perpetrator has a calculable chance of successfully committing this type of fraud on a recurring basis. In general, reimbursable expenses are subject to mischaracterization and overstatement.

Mischaracterized Expenses

The majority of reimbursable expenses fall into the broad categories of “travel, meals, entertainment or miscellaneous.” While only business-related activities are reimbursable, dishonest employees frequently submit personal expenses for reimbursement. These relate primarily to restaurant meals, office supplies purchased for the employee’s personal use and entertainment expenses.

In order to detect mischaracterized expenses, a detailed review of the submitted documentation is required. Scrutinizing dates, times and numbers of persons served and comparing these with a calendar and the employee’s explanation of the reimbursable activities should reveal fraudulent expense. For example, when the reimbursement is for “dinner with client” during the week and the restaurant receipt shows a time stamp of one o’clock in the afternoon on a Saturday, this is a mischaracterized expense.

Overstated Expenses

There are three ways to overstate expenses: overstating the actual costs incurred, submitting fictitious expenses and submitting the same expenses for reimbursement multiple times. While the financial impact of any of these methods may be immaterial in a single instance, the impact of multiple employees committing expense reimbursement fraud over many periods can become substantial.


Small dollar recurring frauds of one kind or another occur in almost every organization. Forensic accountants who routinely investigate these frauds are familiar with the various schemes to misappropriate funds. Many of these frauds can be avoided when management adopts the mindset that they will not allow fraud to occur. To be effective, fraud prevention must be an attitude that is communicated from the management, officers, board of directors to all employees.

In addition, eliminating the opportunity for fraud to take place will significantly reduce the fraud losses that the organization experiences. This requires an awareness of the components of the entities control environment that creates the opportunity. Then, through diligence and with the assistance of trained professionals, the entity can identify those areas of control that can be strengthened economically.

Rate this article 5 (excellent) to 1 (poor). Send your responses here.

David S. Zweighaft, CPA, CFF, CFE, is a Director in the New York office of RGL Forensics, the international forensic accounting and consulting firm. He has more than 20 years of financial accounting and litigation consulting experience across a variety of industries, and focuses on litigation and financial investigations, fraud risk management, corporate governance and compliance issues.