Episode 36: Comparing Internal Audit Functions and Fraud Investigations with Jami Shine, CIA, CISA, CRISC
Have you ever wondered where internal audit functions and fraud investigations intersect? How they're different? On this week's episode of The Investigation Game Podcast, Leah interviews Jami Shine, Corporate and IT Audit Manager for QuikTrip Corporation about this very topic. Join us either via audio or video this week wherever you listen to podcasts or YouTube!
Jami Shine graduated summa cum laude from the Honors Program at Oral Roberts University and has over 13 years of combined internal and external audit experience. She is currently the Corporate and IT Audit Manager for QuikTrip Corporation, where she manages operational, IT, and financial audits and consulting engagements. She also co-facilitates the Enterprise Risk Management (“ERM”) program and conducts the annual risk assessment process with the CAE. Her favorite project at QuikTrip was getting to write and facilitate a series of training videos for the 20,000+ store employees. Jami enjoys being a facilitator for the Institute of Internal Auditors (“IIA”), leading both online and in-person trainings, as well as being a recurring speaker at IIA and MISTI conferences, IIA and ISACA chapters, and other local organizations. She also loves serving as a member of the IIA’s North American Chapter Relations Committee. She was honored with the IIA Tulsa Chapter’s “Auditor of the Year” Award in 2018.
Connect with Jami: jshine@quiktrip.com
LinkedIn: https://www.linkedin.com/in/jamishine/
Subscribe to Workman Forensics
Transcript of Episode 36: Comparing Internal Audit Functions and Fraud Investigations with Jami Shine, CIA, CISA, CRISC
Leah Wietholter (00:00):
Hi, I'm Leah Wietholter, owner of Workman forensics.
Speaker 2 (00:03):
And this is the investigation game podcast.
Leah Wietholter (00:09):
Welcome to the investigation game podcast. I'm your host, Leah Wietholter CEO of Workman Forensics in Tulsa, Oklahoma. Today I have with me, one of my very good friends who also just so happens to be and work in internal audit with tons of experience. So today I'm joined by Jamie Shine. Jamie, thanks for joining me today.
Leah Wietholter (00:26):
Thanks for having me Leah.
Leah Wietholter (00:28):
So currently Jami is the corporate and it internal audit manager at quick trip. That was pretty impressive. Okay. Look at that. It's like I did my homework or something amazing. So we didn't actually know each other at, or at oral Roberts university, but we both went there. I think you graduated maybe two years before I did maybe, right. Oh, just a year before me then with a degree in accounting and then you worked in external audit and the, now of course, internal audit for a quick trip.
Leah Wietholter (00:59):
So, and I know that you are just a huge QuikTrip fan all around, which I'm going to let you tell all of our listeners who, by the way, we now are in all 50 States. So now all 50 States can learn about quick trip. Like how proud Tulsa is a quick trip from this, from this. And so at QT you manage the corporate and it internal audits and you do some consulting engagements, but then you also facilitate and speak at different and Institute of internal auditor events. And you're really involved with them. So if it is a about internal audit, like Jamie is a superstar. So, so happy to have you on the podcast today. And another fun fact about Jamie is that, and actually this might've been how I ran into you though in our friend group, way back in the day was actually that you were acting in a movie with one of my other good friends who was also a good friend of yours.
Leah Wietholter (01:57):
Who's also an accountant and auditor. So, so basically I think the takeaway here is that if you're an auditor, you should also probably be acting to just, you know, put it on your, to do list for this weekend. Right. Right. This is as close as I'm going to get to that. The fact that we're making this podcast video right now, but yeah, just start a YouTube video if you're an accountant auditor. Yeah. Perfect. So and then I think after meeting you, I knew you and your role acting with our friend James, and then I'm like, Oh my gosh, you're an accountant too. Okay. This is, this is amazing. We have lots of nerd talks over breakfast. That's true. And yeah, still do. And so we have a coffee group almost every week until I just, after quarantine, I was just too tired. So now we have to turn it into brunch because I just can't get up that early right now, but okay. Enough about that. So we have a couple of interesting topics to discuss today about our different worlds and how they interact with each other, but then also how they're different and just the different strengths in our two
Leah Wietholter (03:00):
Respective fields. But I wanted to, for you just to share your story with me, cause I actually don't think, I know that the, this part, even though we've been friends for a long time how did you decide to get into accounting when you were so interested in acting like, how did all of that work together?
Jami Shine (03:15):
It's actually kind of a terrible story. So I started out as a theater major in college, and then I switched my major to business administration thinking I'll learn how to run my own theater company. So then my senior year of college, my professor in accounting said, why aren't you going out for any accounting jobs? Oh, and I switched my major to accounting my senior year because I thought this is a great backup land. Oh, everybody's horrible. Right. Great backup plan. Like I kept taking accounting classes cause I thought they were fun.
Jami Shine (03:42):
And so then I realized I had enough credits to get an accounting degree instead of business admin. So I went and talked to my professor and I was a real idiot in college. And I said, no, no, which is a better backup plan, like an accounting degree or business admin degree. Cause I'm going to be an actress. But you know, just in case I need something for a little while, what do you think? And he looked at me like I was an idiot because I was, and then he said definitely an accounting degree. And I said, great, we're doing that. So my goodness, I wasn't planning on interviewing anywhere. I was going to go work for a theater company in South Carolina, had a job offer already. And then he convinced me just for fun to go to a couple of interviews on campus. So I interviewed with Ernst and young fell in love with them.
Jami Shine (04:22):
When I did the office visit thought it was a great fit, ended up working there and really didn't expect to love it as much as I did. So that's kind of been my career path. It's been a lot of fun and surprisingly more similar to acting than you would think. Okay. Now you have to explain that. Well, I think that acting is a way to express yourself and really bring truth. Actors are truth seekers. They want to experiment or explore and experiment with, but actors want to explore the human condition. And I think internal audit is very similar. Internal audit requires being analytical, being an actor requires speaking extremely analytical. Internal auditing is very social. And so is acting you're on set with people all day internal audit. You're working with people all day, which is how I love it so much. I don't think I could sit at a desk all day and not interact with people.
Jami Shine (05:11):
So that's been a lot of fun too.
Leah Wietholter (05:13):
Yeah. Okay. That definitely, that definitely makes sense. And yeah, I never realized, so did you take a lot of crazy hours your senior year in order to, or you just already had a bunch of just accounting?
Jami Shine (05:25):
I had enough accounting credits, so worked out. Wow. That's crazy. They were elective, so yeah. Well, yeah. That's, that's just so funny. Yeah. Huge nerd, but wow.
Leah Wietholter (05:35):
That's awesome. I love it. So I definitely can't do an interview with you and talk about audit things until I let you talk about your employer because you've worked with them for over eight years now, is that right? And it's quick trip and quick trip started in Tulsa. And maybe like, people don't even know that. I mean maybe, I don't know. I feel like Tulsa has been getting more press lately, but Tulsa is a cool place to live.
Leah Wietholter (06:02):
I think so definitely the spot, but also a lot. And I'm not from here and you're not from here, but we definitely stuck after ORU. So I'm curious, like I love QT and there's plenty of other like nice convenience stores we could go to, but like I only go to QT. So what, but you working there? Why do you love it so much?
Jami Shine (06:24):
Well, honestly I love QT before I went to work there. So when I found out there was an internal audit position open at QT, I was like apply for that internal audit at QT, like two of my favorite things together. And I think what may have sold them at my interview was me just genuinely raving about all the products that I liked. And so, because legitimately I love QT. I love the T at the time I was really into the corn dogs.
Jami Shine (06:47):
Now that we have the full service counter, I'm kind of more about the grilled cheese and the ice cream, but I just loved the culture at QT. I love what QT represents. A QT is an employee owned company. We have over 800 convenience stores. And I believe that even though we've gotten so big, our CEO knows probably everyone in the corporate offices names and a lot of our strong players names. And I feel like QuikTrip really puts the focus in the right place, which is on the employees. Our mission statement is to empower our employees or to enable our employees to grow and succeed. And they really live that. So to me, that's huge that our company exists in order to give people a great career path. The people who work in our stores, they are the heart of our company. And I love that.
Jami Shine (07:32):
That is really evident in everything we do at corporate. We serve them. It's not vice versa. I love that. I know that my role has an auditor is to serve the stores. And so I think that's just their, heart's really in the right place. Everybody that I work with has a great heart. People are really there for each other. I know that sounds cheesy, but it's just a great place to work. And I feel like everybody who is in executive leadership is really focused on taking care of the employees and taking care of our customers too. Yeah. I was going to say, I think that the fact that the employees are taken care of shows up in the stores to me as the customer, because it is if you've never been in a quick trip, it's clean, you make all your own food. I know you talked about this with Trent on his audit podcast, but we just got to go there too, because we don't have the exact same audience, but like they make you guys make it all your own food, which is crazy.
Leah Wietholter (08:21):
And after the podcast that you had with Trent like a couple of days after listening to it, I needed something super fast for lunch and I needed to get fuel as well. So I stopped at obviously quick trip and I was like, you know what? Jamie said that this food is great. So I'm going to try this rap. It was so good, shocking. Like I'm at a gas station picking up a rep and I'm like, like the other day I thought, Oh, you know what? I'm going to go to QT for lunch today. Alicia went and got pizza for lunch from QT the other day. It's just, our pizza is so good. You endorsed the pizza. And what was the other crazy thing? The ice cream pretty much all of our food. I think our ice cream is excellent. Ice cream is so good.
Jami Shine (09:03):
So good. We have these twisters. My favorite and it's so bad. My favorite is a twister and I put butter finger in it. And then whipped cream with cherry on top.
Leah Wietholter (09:12):
So is this like a custom thing that you make? Or like anybody can create it? Like it's not one that's already.
Jami Shine (09:18):
Oh, it's on the menu. Oh, it is on the menu. So let's try it next time. And the grilled cheese sandwich.
Leah Wietholter (09:24):
Oh my gosh. Really?
Jami Shine (09:25):
So good. Best grilled cheese sandwich. You will get at a quick serve restaurant.
Leah Wietholter (09:29):
Oh my gosh. Okay. Well, I don't need a ton of grilled cheeses, but I may splurge this weekend. But we won't go to quick trip for lunch after we record this.
Jami Shine (09:38):
So we totally can.
Leah Wietholter (09:42):
And the coffee's good.
Jami Shine (09:43):
The coffee is so good on the tacos, brisket tacos.
Leah Wietholter (09:47):
What? I didn't even know they had tacos.
Jami Shine (09:49):
So good and fresh Pico and really good.
Leah Wietholter (09:52):
That's awesome. I don't know whether to make a joke of this behind us.
Jami Shine (09:57):
We have a contractor here today. It's fine.
Leah Wietholter (10:00):
We'll be right back to this interview.
Speaker 4 (10:07):
Paradigm investigations has become known as one of Oklahoma's most prompt, reliable self motivated and experienced investigative firms over the past 14 years. If you are looking for clear and constant communication, expedited evidence with court, ready reports, commitment to excellence and integrity to make the paradigm shift today. Call Nic Decker at paradigm investigations at (918) 574-8072 or visit paradigm okay. To schedule your free consultation today.
Leah Wietholter (10:46):
Welcome back to the podcast. Let's go now to internal audit. What an external audit as an auditor. What does a project that you just really enjoyed or that you were really proud of? Either external or internal?
Jami Shine (11:01):
That's hard because it's also different and it's also fun. But I would say I discovered a few years ago that even though I love auditing my favorite thing that I get to do at work is enterprise risk management or, erm, I love it. It's my passion. It's all fun. I feel like you add value in all internal audit projects, but erm, to me, this is a super nerd moment, but every time I walk into an erm, meeting that song from Hamilton, I want to be in the room where it happens. That starts going off in my head. I'm not even have to be like, stop singing this yourself, stop singing it.
Leah Wietholter (11:33):
That's awesome.
Jami Shine (11:34):
But it happens every time because I do feel like it's part of something so important and I love getting to be in that room and getting to facilitate those meetings. I love just getting to walk people through those conversations that they may not have time for it because risk management is built into everything that we do, but it also has to be very intentional and proactive. So I love getting these executives and subject matter experts in a room together and having them talk about anything that could possibly go wrong in an area and then what we're already doing to mitigate it and comparing our current level of risk mitigation to our desired level of risk mitigation and looking at those gaps. I feel like it's been so beneficial for our company. First of all, just in understanding all the risk mitigation we have in place already that maybe some departments weren't aware of getting us all on the same page, getting us aligned to me.
Jami Shine (12:18):
It's just hard not to get excited about that. Getting to look at things from a strategic big picture level.
Leah Wietholter (12:23):
Yeah. And I could see just, I'm assuming the whole part of acting and stuff that you really enjoyed obviously is a lot of creativity. And so I could see being in those meetings being just very creative and like gaining insight into things, but then also looking to improve, which is just such part of a creative like we do a creative workshop every week. So as you're describing what you enjoy about that, I'm like, Oh, Jamie would love our creative workshops because we devote a, you know, an hour of our week where we solve some sort of problem that's going on or look for how can we improve something or how can we create something new? And so, yeah, that's kind of sounds like that.
Leah Wietholter (13:02):
So maybe we should call it our like, erm, meetings to sound more corporate or something. I don't know.
Jami Shine (13:08):
I love that. I love that you do that every week. That's awesome.
Leah Wietholter (13:12):
Yeah. It was a lot of fun people don't like to miss Mondays because they want to be part of the creativity workshop.
Jami Shine (13:18):
So I think we should all roll that out. That's brilliant.
Leah Wietholter (13:21):
It is a great way to start the week for sure. So while you've been at quick trip, I you've mentioned that like, yes, your job is corporate and it financial internal or corporate financial and then it audits, but then you've been able to expand that role as well with more like consulting type engagements. So that's what you, I'm using your words right now. So you can like correct me. I think this is what you call it before. So why do you think you've been given those opportunities and what have you done?
Leah Wietholter (13:54):
What do you think you've done to kind of position yourself to be in that role where you could tap into more of the creative side of things?
Jami Shine (14:04):
I kind of wish I could take credit for it, but I really don't think that I can. I think a lot of that comes down to my boss, Kent, who's our chief audit executive. He's done such a fantastic job of establishing us within the organization as people who want to help. I think sometimes people see internal auditors as gotcha auditors or people who want to catch you doing something wrong. And I think that Kent has established our department from the beginning as that's not who we are. And my goal is certainly never to get anyone in trouble, certainly not to find things. In fact, I love it when I have a clean audit. If there's no recommendations I'm celebrating like literally celebrating one time, I brought up an audit client, a glass or a bottle of wine at the end of an audit because they did so well and I wanted to celebrate them.
Jami Shine (14:45):
So I love that kind of stuff. So I think that he's done such a great job of establishing our department as people who just want to help. And when you look at the definition of internal audit, according to the AIA, it's fascinating to me that it does have such a positive definition it's to enable our companies to achieve their strategic objectives. Everything that we do is about governance, risk and control and positioning our companies for success. So I think that just incorporating that into our mindset and realizing that we're here to serve. We're not, we are independent. Yes, but we're here to serve. We're here to empower the people in these groups. We're here to point out these gaps so that they can meet their own goals. Has really enabled us to branch out a little bit. We've always done a lot of operational auditing we've we do a little bit of financial auditing, not a lot, our external auditors help us out there a lot.
Jami Shine (15:31):
They're wonderful. And then I also do all of our internal it audits, which is a lot of fun, but the consulting kind of came about a few years ago in terms of dedicated consulting engagements. Because Kent being really forward thinking realized it was just another way that we can help people out. So we started small, we started with a project in our projects group, which is under store development. They do a lot of construction. We helped them out with something and then we've done a lot of it consulting work. And then from there, every time we meet with our executives during our risk assessment meetings, we just ask them, Hey, is there anything we can help with from a consulting standpoint? That's been wonderful. I've been really surprised, honestly, in how many people have taken us up on it. It's been a lot of fun.
Leah Wietholter (16:14):
You know, I heard somebody say a long time ago, like, it's amazing what can happen whenever you just say, how can I help? Yes. I love just having that like posture whenever you go into something. I just think that's, that's cool. Cause that does, I can see how that even just that would set your whole team up for success. That, that if that's like the culture of your team is that you're going to go help and that you're not the, you know, teacher with this, like a red pen. I gotta admit, though. I think you're the perfect person for this job because if I did stuff and I didn't find anything, I would be so sad because when we get cases where like 95% of the time, we're going to find stuff, we pride ourselves on finding more than other people, but we're not looking for like process and procedures, breakdowns.
Leah Wietholter (17:02):
We're looking to find more money usually. So that's what we're looking for more. So you say like, I'm so excited whenever I don't find anything. I'm like, Oh, that was like, what we do. We say we follow patterns and we find money, you know, like that's like what we do.
Jami Shine (17:19):
We want to find everything that's there, but I love it when there's nothing to find if you're just doing everything wonderfully.
Leah Wietholter (17:24):
Yes, I get that. That's funny. How do you think, well, you kind of mentioned this a little bit. If you want to expound on it any more, but how do you think internal auditors are typically stereotyped? And did you stereotype them before you actually got into it?
Jami Shine (17:38):
Honestly, I didn't know anything about internal auditors when I was in college. It really wasn't talked about a whole lot, at least that I knew of as a career path.
Jami Shine (17:46):
So I went into public accounting and in accounting, I saw people leaving for internal audit. So I really had a positive impression of internal audit. I worked a little bit with internal auditors at clients that I worked on, but a lot of them didn't have internal audit groups, but people would leave public accounting, go into internal audit and tell us how much they loved it. So to me, it looked like they were living the dream a little bit. I loved external audit, especially my last few years I worked on an amazing team, had an incredible boss and learned so much. But something that I love about internal audit is that we get to work with just one client. So you build these great relationships with your audit clients and then you have to leave in a month and it's kind of sad or a week or whatever that is.
Jami Shine (18:26):
Then you get to see them in a year. But I love that. I just get to work with the same people over and over again, really dig into my organization and that structure and hopefully bring a little bit more value to that organization because I spend so much time with them.
Leah Wietholter (18:40):
Yeah. So my exposure to internal audit was when I was at, or you and I was the VP of the student VP of finance for student association. Right. And we had this like little bank. Do you remember this? It was like Eagles nest. It was like just off the Eagle's nest. ORU are the golden Eagles? Anyway, so the Eagle's nest like under the cafeteria.
Leah Wietholter (19:09):
That's so funny. Okay.
Leah Wietholter (19:10):
So there was like this little bank, I didn't know it existed until I became VP of finance. So anyway, I guess people would go in like cash, their paychecks and stuff. Or like if their parents send them a check, they could cash them or something. I don't know. I mean, I feel like 2006, 2007 wasn't that long ago. But anyway, like that's just not how we would do things now, but anyway, no, like they'd paypal or something anyway. So I was responsible for the bank and the bank always had $3,000 in it and so I had to count it and I worked for the FBI at the time as well. And so I was all about like, let's make sure we've got all this documentation and I'm creating internal controls. Although I didn't like have those words yet, you know, but like I'm creating all of this stuff anyway. But the internal auditor was responsible like that worked for ORU was over this bank. And so that's who I'd have to like report to how much money and did we need more cash and like have to go get it from him. And I just remember, like, I don't, I think they've done some updates to this building, but when I was there, the personnel building, did you ever go over there by the Aerobic center? So it like hardly had any windows on it. And it was like really dark
Leah Wietholter (20:23):
And all I could think was asbestos whenever I went in.
Leah Wietholter (20:28):
Did you ever go in there?
Jami Shine (20:29):
Yes, but not as a student. So a few years after I graduated, I did the audit.
Leah Wietholter (20:33):
That's right. That's right. I forgot that. Oh yeah. That's Oh yeah. Okay. We'll move on. So so I was like, so I would go in, but he didn't get to office with everybody else cause he was internal audit. And so he like literally was like by himself in this little office, just as you walked in. And I just remember his office was always super dark and it had like dark paneling and that was my view of internal audit as a start for him. I felt bad for him. And I think he'd been there forever. I don't even remember his name, but I just remember thinking like, wow, like I guess they really are considering you as a third party. You know?
Leah Wietholter (21:14):
Like you are just completely by yourself over here. Completely independent. I guess that was my original stereotype of internal auditors.
Jami Shine (21:23):
I mean definitely when I tell people I'm an internal auditor or sometimes I get, looks like I hear a lot of the time. You don't seem like an internal auditor. I used to take that as a compliment. And I was like, wait a minute. But internal auditors are really cool. So I don't know what to think about that. Or people think that internal auditors are fuddy duddies, which we're not, we love to have fun. I think sometimes people think that internal auditors are extremely straight laced, like we're rule followers and that can sometimes be true. I'm definitely a rule follower. I wouldn't say that we're straight laced, but we can be rule followers. And it's funny. So I'm on the chapter relations committee, the CRC for the Institute of internal auditors.
Jami Shine (22:02):
And we will tell auditor jokes on ourselves all the time. But if there's like a spelling or grammar mistake, we will point it out. We will notice it. We will find anything that doesn't make sense.
Leah Wietholter (22:12):
You, I won't go into it, but you did audit me on a text that I said our group member, like just a few weeks ago, you're like, I'm going to be the auditor for a second. I don't think that that is a legit post I'm like, that's true. I, gosh, I like put my fraud, examiners hat down to the side just for a second and fell for stupid posts.
Jami Shine (22:30):
I completely forgot.
Leah Wietholter (22:31):
I did not share it on social media. I just sent it in our group text. It was completely fine. She did fact checking. I know. Okay. So one of the things we really wanted to talk about today was like, what is similar and different about? And like how do these two worlds intersect of internal auditing and fraud investigation? So I'd like to know how are they similar? How are they different? How are they intersect and just kind of get that conversation started.
Jami Shine (22:54):
Okay, perfect. So this is something that we talk about a lot just ourselves with our different roles. And I think that our roles are very complimentary and very helpful to each other, but they are very different. Obviously there are some internal auditors who are also fraud investigators. They have that expertise, they have that skillset and all internal auditors have some level of expertise when it comes to fraud investigation, but really we're focused more on the proactive piece of it. Whereas I think that fraud investigators are more reactive. They're coming in after something has already happened. And they're figuring out what the extent of the damage is and trying to make their client whole, whereas internal auditors, our main role is on the front end. Our job is to do audits and every time we're doing an audit, we're thinking about the risk related to fraud, what could go wrong? How could fraud possibly occur? And if we're identifying any risks, we're putting those out so that those opportunities can be shut down. Right? So fraud investigators,
Jami Shine (23:46):
I think certainly we should be working together, but when an actual fraud investigation needs to happen and internal auditor who doesn't have that dedicated training like you do is probably not going to be the best choice to lead the investigation.
Leah Wietholter (24:00):
Yeah. I think sometimes it gets a little blurry when you have this internal, you know, someone in internal audit you know, because you do work for the company. And so if the company has been harmed, especially if you're loyal to that company, you feel like you've been harmed. And so I think that clouds judgment and not to say that like you break your code of ethics and stuff. Right. But of course not, no, no, it doesn't mean that you can't be objective and so forth and the situation, but just, there's a component of that where you're owning kind of some of that harm.
Leah Wietholter (24:34):
Like you also trusted that person, even if you don't know him very well, because you're all a part of this big corporation and you're all working together and like team USA and then the, but then at the same time, somebody has somebody that you thought was on team USA is now harming your team. And so there's just like this defensive newness, you know, and, and all of that is fine. You know, all of that is like normal. And so in the investigations I've worked, we're invested internal auditors have worked at first. A lot of times the work product that came out of it. I'm not saying it's bad, but it's often full of extra things because it's like, it's like, it can't be as focused. And I, I personally think it's because of the emotional factor or, or perhaps pressure for management. You know, cause management feels so robbed.
Leah Wietholter (25:28):
So then the internal audit is trying to do their best to take care of that, you know, whatever pressure they have there which is not bad. It's just a very emotionally trying situation. I mean, I can't tell you how many clients that we have that go through like massive embezzlement and they lose sleep. The next time I see them, they've lost hair or it's great, or I mean, it's a significant amount of stress. And so I think that working inside of that company that just makes it where you can't necessarily get to the desired outcome and, you know, law enforcement really just wants to see the facts. And so there's kind of this, like you're in the company. And so you've prepared all this information and you have the training as an internal auditor to prepare this information, you know, what to look for, you know, what systems they broke, but then to communicate that in such a succinct way, without emotion to then prosecute or to insurance or wherever you're looking to recover a or even in a civil court.
Leah Wietholter (26:27):
I mean, it's, it's just, there's just another set of skills that I think comes into play. But as a fraud investigator, I do like working cases where there are internal auditors where we get to work with them because you as internal auditor know your systems, that's true. So when we say we need a payroll report, can you get that completely in Excel? We're going to have a little better success at getting exports than if we were working with somebody else in the organization because we speak similar languages. Even if our, like we have different niches.
Jami Shine (27:01):
I agree. I think that there can be a great complimentary relationship and a lot of collaboration between your fraud investigators and your internal auditors. I think that it can be challenging for us as well, doing the actual investigation because we're trained in how to do an interview. We're not trained in how to do interrogations, unless again, your internal auditor is also like a CFE or a dedicated front of it investigator, but most of us were used to having very open ended conversations where used to asking probing questions and follow up questions. And where you said building relationships with everyone that we have an interview with, whereas a fraud investigator, I'm assuming that your interviews or interrogations look quite a bit different than ours normally would. So it could be a little more challenging. It also might be easier for the people being interviewed in a fraud investigation to open up to somebody who is a third party that they haven't worked with before.
Leah Wietholter (27:48):
Yeah. I think that, well, at least my interview style is probably closer to what you described. I'm not much of a good cop, bad cop type situation. I'm more of a, let's be friends and you just tell me everything, you know? Um but, but I do think that it's easier. I think it's also easier as a third party to go sit across from someone that I just met in this interview. And if I need to sit and wait on them to answer my question for two hours, I can. And I don't care if it's weird because I am a third party as opposed to, if I have to do that with somebody that I know on my staff. So different, like so different, I would prefer to bring somebody in, okay, you need to get this information out to them. You just go in there and you stare them down. You know, when, when it's not like when you don't already know these people or you don't already feel part of like a family or a culture. And I do think that's, that's easier. And I think too I've actually, I actually, I just thought of this.
Leah Wietholter (28:55):
I was on the defense side of an embezzlement where the investment case was worked by the company's internal auditors. And so I worked at the defense of that work and my client, the charges were dropped actually because the internal auditors weren't independent enough. And I'm not saying that that's characteristic of call internal auditors. It's just an interesting, I had never thought about that part of that case before because the the fraud, the alleged fraud was reported by a coworker of my client. And then like, it turned, it went to internal audit and then internal audit just believed the tipster, but didn't look at all the data. Oh, wow. And so, you know, if a third party like myself had been hired, I would have said, okay, I see these discrepancies that they've pointed out, but let's run it on the entire company.
Leah Wietholter (29:58):
Let's run it on this entire branch, this entire department so that we could see if anybody else shook out. And so actually part of our defense was okay, send us the information for all the other employees, and let's see what the other employees look like. That makes sense. And the charges were dropped. So that's just one of the things that I think there's just this internal auditors have a difficult line to walk because you just, like you said, you work for the company, but then you also are supposed to be independent. And so that's, it's a delicate balance.
Jami Shine (30:32):
It's a fine line. It's something that we talk about constantly. And it's always at the forefront, especially since I think all audit shops. I know ours in particular has really been moving towards taking more of a collaborative approach to auditing, which we still have to maintain our independence. We still have to maintain our objectivity, but it really is at the forefront that we're on our client's side. And they need to understand that. Now, granted, I do think that in that case, that you're talking about, the internal audit department should have been more objective. That's a little sad and scary, like worst case scenario. I mean, definitely not. But I do think that as auditors, we do tend to, and we should, in our audits, we're so focused on root cause analysis because we need to be, that's, what's important with a longterm relationship with a company. If something goes wrong, the first thing I'm thinking is, well, how did this happen? And how do we fix it? Yeah. We like to fix things. And obviously, because of independence, we can't be the ones actually putting the fixes into place, but we're always thinking about that end goal. How do we fix things? Whereas I think for true fraud investigation, the goal isn't necessarily, or the main goal isn't necessarily to fix things from a control standpoint, it's figuring out what's the damage. How do we make restitution to my client? So I think we have different objectives.
Leah Wietholter (31:46):
Yes, for sure. And I like that when you're looking at the fraud triangle, I'm looking at the fraud triangle to decide what's the most efficient way to find the evidence and the facts and the data to support what this, like, how did this person do it and how much, and then how are we going to going to help recover, just assist in the road to recovery on this? I think internal auditors are looking at the fraud triangle. You're focusing on opportunity, like you said, but you're setting your team up to win. You're even like protecting your, the people in your company from themselves. Yes. Very much so. So by limiting and removing those opportunities or catching it before, it's a $10 million problem.
Jami Shine (32:29):
Definitely having those detective controls, but something that we always talk about, preventative controls are better than detective controls, but you still need the detective controls because preventative controls fail sometimes. But our main focus is getting those preventative controls in place, making sure that it can't happen to begin with, or that it's very difficult to happen to begin with. And then do we have those detective controls in place on the backend? And I do think that we're very effective in working with fraud investigators to figure out, okay, this is what happened. How do we shut it down next time? So I think that something internal audit should be doing anytime, a fraud is discovered is doing a look back, maybe facilitating it with management and saying, okay. And I think we can also do this very tactfully as internal auditors because we're part of the company, how did this happen? Everyone's hurt. We're hurt too. Right? Like you said, it is emotional for everyone in the company, but how do we prevent this going forward? What do we need to put in place? And also making sure we don't overreact. I think we've all read through policy manuals or procedure manuals and said, what on earth is this about there's 20 million controls and these cost a lot of money. So what's our risk appetite. What are we willing to accept? Just because something happened one time, do we really need to put a control in place? These are discussions we can facilitate pretty easily with management just based on the concept of risk.
Leah Wietholter (33:41):
I love it. I love it. So I know you mentioned at the beginning of this episode that you had worked a fraud investigation when you were an external audit, what type of you know, I mean, obviously we don't talk about names or places or anything thing like that, but what type of fraud had occurred,
Jami Shine (34:00):
It was payroll fraud primarily, and also some poor use of petty cash and expense reimbursements. But it was at a nonprofit. I literally cried when we found it because I loved this nonprofit. I still love that nonprofit, but I loved this nonprofit so much. And the person who had committed the fraud, and I don't want to say I trusted him because I'm an auditor. I need to be professionally skeptical, but there were no signs that anything was going on. He seemed to really believe in the mission of the nonprofit was a really good nonprofit. So it was devastating to everyone there. And I was, for whatever reason, I was kind of left to lead that investigation. I think some of the other people on the team were on vacation. The audit was supposed to be over. And so I got to spend some extra time on site and work with the executive director and he was devastated. He was amazing, amazing, man. So it was a really good experience for my career. And I did feel very invested in, we need to figure out what happened to make this client right, because I care about this client so much, but it was also really hard experience for me. I realized I don't want to be a fraud investigator. I don't like finding people, doing things wrong. I like, I like helping people put things in place to prevent bad things from happening. So maybe part of that is my personality. When we have coffee, sometimes you tell me stories and I'm like, Oh, I couldn't do that. That makes me so sad. Or you tell stories about people doing that things. And my response is why would they do that? That's horrible. It's so sad. So we have such different personalities, which I think fit very well for our careers. I can come in on the positive side and look at processes and how do we make our processes optimal to prevent these things from happening? You can come in and clean house.
Leah Wietholter (35:39):
I don't know. I don't know that I'm that, you know, it's funny, I'm I know I've laughed here talking about you crying and hugging your client that had the fraud investigation. But I will say that while I don't have that emotional response, whenever I'm necessarily working with a client, cause it is just all business to me. Like we're just going to come in there. And the sooner we can, like, like I will listen, obviously emotions are gonna play a part. So I am very empathetic and I'm going to listen, but I don't get drawn in. Then the difficult part for me is interviewing the fraudster. I get really emotional about that. And my law enforcement friends who have sat in on these interviews with me, whenever we finish, I'm like, Oh my goodness. I almost like I almost started crying in there. They're like, what is your problem? You know, but there's something about I really don't go into fraud investigations thinking that that person is different from me, given a similar, such as, you know, set of circumstances and a situation, what I have made the same decision. And I think that there's always the chance that I could have. And I, you know, we all like to say that we wouldn't, but and I think that that's why talking about ethics and talking about fraud is so important because it's a slippery slope, you know? And the one that comes to mind is a guy that when I sat with him, his whole goal was just to put his kids through college and cause he never got to go. And so he stole almost $800,000 just putting his kids through private school and private colleges. Cause he had several kids and he paid for all their cars and all their food and all this stuff. And I'm sitting there like, Oh my gosh. And you know, a deacon in their church and just this really great person. But given the situation, he decided that the way he was going to live up to what he said, he was always going to do. He made this choice and, and that one will always stand out to me because there was not like this malicious intent.
Jami Shine (37:38):
I think that's a great point. And I certainly haven't been as involved with fraud investigations, but just from the stories that I hear, like Toby groves is a great example of a fraudster. Who's now basically living his life, trying to undo what he did and and make sure that it doesn't happen in other organizations, but he had a huge fraud and it started out with lying on a loan application to save his business. It's crazy. It starts so small. And they say that for the vast majority of people that start small, but I've even read articles about how most people who commit these fairly large fraud, it starts really small and they don't even realize that first action is wrong. Right? And then they start covering it up and then they start doing bigger and bigger things to cover it up. And they're just stuck in this horrible situation, which is why it's so important to block that opportunity to begin with. We really can't block or do anything about the other two pieces of the fraud triangle, other than making sure people are happy. And don't hate us. I think about that a lot in all of my it audits. I always want to ask questions and want to know about employee satisfaction because the keys to the kingdom, I'm like, I want you happy. I want to make sure that you love everyone in your company and that you work with. If you have any problems with morale, I want to know about them so we can get these fixed because we need you happy with it.
Leah Wietholter (38:47):
Right. It's so true, man. I mean, yes. Gosh, it audit would be a whole other discussion. Okay. So let's go back to the payroll fraud case. It's cause we just keep going down rabbit trails and I want to know how was the guy doing it? How, like, How was the fraud committed?
Jami Shine (39:04):
It was all about opportunity. It was lack of segregation of duties. It was a small nonprofit. They had two staff and accounting. They both trusted each other and they both been there for a long time. So the executive, not executive director, the finance director or the CFO, I don't remember his title, but he was unhappy. It started off with that. I think he got a bad performance review. And then he also felt like he was underpaid because he looked at salaries for other people who would be at his level working for nonprofits, but working in industry. And so he just changed his pay rate to match what he would be getting paid if he wasn't working for a nonprofit or what he thought he deserved to be paid. So it started out with that and that happened over a couple of years. So this wasn't a huge fraud money-wise I think it was maybe 40, 50,000, something like that. And then he also was just doing dumb stuff with expense reporting and with petty cash because he had access and the review wasn't at a detailed enough level to catch things. I think that, and this is a personal belief that might be a little controversial, but when Sarbanes Oxley came out, it seems like everybody wanted to have 1 million key controls. And obviously that's a gross exaggeration, but we just didn't know yet. So everything was a key control. So then AS5 came out a few years later, which paired it down a lot. And I think that the intent of [inaudible] was very, very good. And this is many, many years ago. So I'm probably dating myself. There may be many standards that have superseded this now, but I remember that some clients would try to use AS5, which said you could start with top down controls and then add in your detailed controls as needed. They started trying to tell us things like, Oh, well, five people review all of our reports. So that's all the controls we need. Well, first of all, if five people are reviewing any report, nobody's reviewing it. And second of all, I would literally find spreadsheet errors. I'd find that their reports were wrong and I would bring it up and say, I don't think the control pass. And they'd be like, no, we signed off on it pass. So not really the control. And so I think that that really has resulted in some of these things as well. I think some companies pair down their controls so much and they're only focused on these top level controls like somebody reviewing a report. Well, unless that person is really reviewing that report effectively and in detail, it's possible for things like that to happen. And I say that because a lot of smaller companies who can't have segregation of duties, they're mitigating control that they like to put in place is that we review reports. Well, that's great. And that can detect it, but that review needs to be effective.
Leah Wietholter (41:31):
Right. So how was this found?
Jami Shine (41:34):
It was actually found in detailed payroll testing. We randomly ended up picking him as one of our samples to look at his pay rate. So I'd like to say that we had some brilliant way of finding it. It really was kind of by accident. So we needed the signed form for his pay rate. He couldn't produce it. He confessed. It was a pretty easy one.
Leah Wietholter (41:55):
Yeah. Well that that's one that in ACFE report to the nations, whenever they talk about like what's the most common way that frauds are discovered Um external audits, one of the lowest, but you made that number higher if it had been reported. So good job as an external audit, that was like one more point for the external auditors. That's awesome. But also we talk about it, part of our data sleuthing and you know, how to data sleuths within your payroll is to look at your payroll reports because had they been looking at the payroll report, you know, someone within the organization would have known that he was getting paid too much. And so then you catch it just like that.
Jami Shine (42:34):
I think people rely on auditor's too much too. And I say this as an auditor. So don't hate me, everyone.
Leah Wietholter (42:38):
There is a misconception that, that, that you're looking at everything.
Jami Shine (42:41):
Exactly. And we can't look at everything like a quick trip. We have three internal auditors and we have, I think it's 24,000 employees. We have a very large organization. And so we can't possibly look at everything, but I will say I'm grateful at QuikTrip. They understand that. And we have a lot of second line of defense and first line of defense functions in place. So we're not the only people who are looking at things. We're not people that people testing things. We're nothing like people looking at controls. Thank goodness. Cause we would miss stuff. Right. There's three of us.
Leah Wietholter (43:07):
Yes. Yeah. I mean, that's just like way too much if you don't have those other processes or systems in place. So yeah.
Jami Shine (43:15):
You have to have a strong second line of defense. And so for those smaller companies that can be challenging to do, but so often people think, and I think especially about external auditors, I don't know why. Oh, well there can't be a frog cause they didn't catch it. Let's say they're testing for testing. They're testing to make sure that your financial statements are materially. Correct. Right. And materially is a big word there because when you look at financial statements, your materiality threshold can be very high in external audit and it should be, they're doing their job, but their job isn't designed to detect all fraud. And so many people have that misconception about auditors that we're specifically looking for any type of fraud and testing for, and it would be found by us.
Leah Wietholter (43:54):
Yeah. And it's just, that's not even economically feasible. Can you imagine how much those annual audits would be because fraud lies in the immaterial.
Jami Shine (44:02):
Oh, that's so that's so true. That's such a great point. I'm going to quote you on that.
Leah Wietholter (44:06):
Okay. You can, we can do a hashtag or something.
Jami Shine (44:09):
I think there should definitely be a hashtag.
Leah Wietholter (44:11):
Well, this has been awesome. Thank you so much. I feel like we probably could talk about this forever, but we'll leave just a little for Alicia to edit out and get it down to her normal length. But this, this has been great. Thank you so much for being here.
Leah Wietholter (44:24):
And for participating in a video podcast today, that's so exciting. It's been a pleasure. So if anybody has any questions about what we talked about today or maybe even anything related to IIA or I dunno, a quick trip, but internal audit. What is one of the best ways for them to connect with you?
Jami Shine (44:44):
Oh, well you can definitely connect with me on LinkedIn or you can email me at J shine. J S H I N e@quiktrip.com unless you absolutely hated everything that I said, in which case my name is Leah Wietholter.
Leah Wietholter (44:58):
Right. They already have my contact information. Right. or Alycia. She's so positive. She'll spin it. Well, thanks again. We'll put your LinkedIn link and email in the show notes and it's been a pleasure. Thanks for joining me. Thank you so much for having me.
Leah Wietholter (45:19):
The investigation game podcast is a production of Workman forensics. For more information about the topics we discuss on each episode, please visit workmanforensics.com. If you enjoy this podcast, please make sure to subscribe and leave us a review. You can also connect with us on any of the social media platforms by searching Workman forensics. If you have any questions, comments, or topic ideas for the podcast, please email podcast@workmanforensics.com.