Episode 80: Best Evidence: Payroll Reports with Leah Wietholter
At the heart of all successful forensic accounting engagements or fraud investigations is the reliance and analysis of evidence. Best circumstantial evidence in a financial investigation are sources of information or data that are furthest removed from the influence of a subject. If you want to ensure that you uncover facts resulting in defensible investigative analyses in your cases, you are in the right place. In this six-part series, Leah Wietholter reviews the most common best evidence data sources in order of reliability by exchanging seats from host to guest to thoroughly discuss this topic with guest host, Bethany Pigott.
Leah Wietholter, MBA, CFE, PI, CPA is the CEO and founder of Workman Forensics headquartered in Tulsa, Oklahoma. With career aspirations at 12 years old of becoming an investigator, Leah worked for the FBI while completing her accounting undergraduate degree and masters in business administration. After working in public accounting for over two years as a staff tax accountant and forensic accountant, Leah opened Workman Forensics - a firm dedicated to forensic accounting and fraud investigations. Since starting the firm in 2010, Leah has worked over 150 cases providing data-focused solutions resulting in settlements and testifying in both state and federal courts. Read her full bio on the Workman Forensics team page.
The information in today's podcast is just a glimpse of what's inside Leah's book—Data Sleuth: Using Data in Forensic Accounting Engagements and Fraud Investigations. Available on Amazon!
RESOURCES MENTIONED IN TODAY’S EPISODE
Order Leah’s book to learn more about best evidence in forensic accounting and financial investigations Data Sleuth on Amazon.
To schedule a discovery call for your group or team to play The Investigation Game Interactive Case Studies visit investigationgame.com.
Connect with Workman Forensics
Youtube: @WorkmanForensics
Facebook: @wforensics
Twitter: @wforensics
Instagram: @wforensics
LinkedIn: @workmanforensics
Subscribe and listen to this and more episodes of Workman Forensics Podcast on Apple Podcasts, Android, or anywhere you listen.
Transcript:
Leah Wietholter:
Hi, I'm Leah Wietholter, your CEO and founder of Workman Forensics in Tulsa, Oklahoma and this is the Data Sleuth podcast. At the heart of all successful forensic accounting engagements or fraud investigations is the analysis of evidence. Best circumstantial evidence in a financial investigation are those sources of information or data that are furthest removed from the influence of a subject. In this six part series, I'm going to review the most common best evidence data sources in order of reliability by exchanging seats. I'm going to go from host to guest so we can thoroughly discuss this topic with our guest host, Bethany Pigott. If you want to ensure that you uncover facts resulting in defensible, investigative analyses in your cases, you are in the right place.
Bethany Pigott:
Welcome to the Data Sleuth podcast. I'm your host, Bethany Pigott, and I'm joined by Leah and she's going to dive into talking about payroll reports being used as best evidence in this series. Leah, you can just go ahead and just talk to us about what kind of engagements or investigations benefit from using payroll reports as evidence.
Leah Wietholter:
Sure. Kind of like the other episodes we've shared, it's going to be anywhere that someone is paid and those wages are reported to the IRS. If they are paid as a contractor or paid as a vendor, they're not going to show up here. We're talking about actual hourly wages or salaried wages. A lot of times these come into play in cases of embezzlement, a shareholder or partnership dispute. If you have a management company like a property management company, it could even be just a management company that you've hired to run your business, and then also trust in estates. That's the most common use.
If we're talking about divorce, then it's a little different. We're not going to have company payroll reports. Instead we're going to have pay stubs. So we want to look at pay stubs in divorce cases, which is really not the focus of this, but we're going to look at pay stubs to identify what the individual's, the spouse's, total compensation. A lot of times pay stubs are helpful because you can designate different bank accounts for money to go to and so what will happen is a spouse will set up a new bank account under their own name and they will send part of their paycheck there, and then they'll send the rest of the paycheck to the joint account that the other spouse knows about. Pay stubs can help identify that. That's really all I'm going to talk about related to divorce today, but that's one of the uses of pay stubs or payroll reports.
Bethany Pigott:
Why are payroll reports so critical in these investigations?
Leah Wietholter:
Again, if we're starting with our bank statements, we're going to see payroll debits. There's a couple different ways that people get paid. Direct deposit is becoming more and more popular. If somebody gets paid through direct deposit, on the bank statement you're going to see a debit or an electronic transaction that references usually the payroll provider. I use Gusto, I know there's Paychecks, Paycom, things like that. You're going to see their name and a bunch of numbers usually and whatever and it might have actually three transactions. You're going to have the amounts that went to employee bank accounts, you're going to have the amounts that went to the different taxing agencies, and then you're going to have your fee for that payroll to pay the processor.
If someone is paid with a check, those are going to show up on the bank statements typically in the same way, unless ... this is a little detailed, I guess, but unless the payroll provider issues those checks and then it's just part of that debit. But if you use QuickBooks to process your payroll and you're paying with checks, you'll often see those checks come across your bank account. The reason this is important is that most of the time, and this is mainly on the direct deposits that we're talking about here, you're going to see that debit come across for what was paid to employees, but you don't know who was paid, how much they were paid and so like the credit card statements, we need that detail. We're just seeing one line item. We need to see the detail. This operates kind of like a subledger again to a bank statement to give us that detail. When we're analyzing it, we want to analyze it separately from bank statements so that we don't double count anything.
Bethany Pigott:
Will you tell us what kind of information someone can utilize when looking at payroll reports?
Leah Wietholter:
We're going to look at the actual wages that were paid and reported by the payroll processor to the IRS. That's what this report's going to show us, especially if we obtain this directly from the payroll processor. These reports will also show their salary, their hourly wages, the number of hours they worked, bonuses, vacation and PTO pay. Potentially it might even have the balance of the hours that are available to them, any benefits that were paid, and also expense reimbursements are commonly run through payroll. The way that I like to use this information is what I reference in the Data Sleuth book as comparative analysis and it's really just thinking about a Venn diagram. I'm going to take what was actually paid on the payroll reports, and I'm going to compare it to what should have been paid using an employment agreement, offer letter, things like that. That's what I'm going to compare.
I'm going to compare the bonuses or salaries or hours worked to what should have actually happened. When I'm doing this, I want to mention we want to look at all employees related to the concerns. Our whole thing at Workman Forensics is that we're data sleuths, so we're going to use data to answer this. I can analyze one person's payroll from an Excel spreadsheet just as quickly as I can everyone's payroll, I mean, marginally. I want to look at everyone because I don't want to cherry-pick one individual, and I tell this story a lot, but there was a case, and if we get to it, I'll tell the full case, but there was a case where people were being overpaid in their payroll and the person who reported it, because we looked at all of the employees, not just the people she said, "Here are the six people involved in this scheme," we looked at everyone, we actually discovered that the whistleblower who reported it had been part of the scheme in the past.
That's why we want to look at everyone because we would've missed her if we had only analyzed the six people that were involved in the scheme or that she told us were involved in the scheme.
Bethany Pigott:
That sounds a little suspect anyways, like, "Just look at these." All right, let's move on. You've already kind of talked about it as a sub-ledger. Is there anything else you want to say as to why you should look at payroll reports separate from a bank statement or is that just kind of summed up?
Leah Wietholter:
Just as that sub-ledger and it's the details and you don't want to analyze them. I mean, you want to compare. We want to compare my payroll debits on the bank statements to the total payroll reports because that helps us know like credit card statements, does the bank statement support this payroll report? Does the payroll report, is it supported by the bank statement? It just helps with the validity of that evidence. So I want to do that and then also just to be able to see those details.
Bethany Pigott:
How do you take this information from the payroll report and actually put it into useful analysis?
Leah Wietholter:
We want to request these reports one directly from the payroll processor every time we can. The reason being that payroll reports are really nice in the way that they are presented in a PDF, but it's terrible for analysis because they have multiple lines for the same paycheck. What we like to do, go ahead and get those because they're really easy to read, but also ask the payroll processor for an export in a table format, not taking these ... what'll sometimes happen if you're not specific is they'll just take the PDF reports and import it into an Excel spreadsheet using Excel, and then you still end up with multiple lines of information. You can't analyze it, so a lot of times it's helpful if you send them an example table that you would like to have completed if you can't get the right one to download. But the data that is behind the nice easy to read PDF reports is stored in a tabular format so you can get it out in a tabular format.
Bethany Pigott:
Can you tell us, is there any kind of specific kind of analysis that you always make sure to perform when you're using payroll report data?
Leah Wietholter:
As I mentioned earlier, we're going to compare any employment agreements or bonus agreements to the actual amounts paid. If there's something that lists expense reimbursements. We're going to compare that to supporting documentation. We're going to compare vacation hours. We might even do ... if you're an accountant, you probably did this in cost accounting classes where you're going to take a beginning balance, add the formula in cost accounting as beginning balance plus purchases, minus sales is your ending balance roughly. We're going to do the same thing with vacation. We're going to have what was the beginning balance of vacation as of a certain date, or maybe it's zero because it's from when they were hired. We're going to add whatever they were supposed to receive in vacation hours or sick hours, PTO, and then we're going to subtract whatever they used and then what's the remaining balance.
The scheme is, and we actually have one right now that might fall into this category, is that if this person controls payroll and they control their own vacation hours, they take vacation and they just never have anything in that spot that reduces their vacation hours. We can have this formula and then determine using calendars or emails or any types of notices that would say that they were out of office and use that to calculate the real balance of their vacation.
Bethany Pigott:
Is there anything you want to say about using what should be paid to taxing authorities in this conversation?
Leah Wietholter:
When someone is stealing money, the portion that they are stealing, if you think about all the money that comes into an organization, you pay expenses, payroll, you might buy equipment, things like that. You use your cash for all of this. The leftover is your profit. That's the piece that's stolen first. But if you don't have profit to reinvest, at some point it messes up your cash flow. It's also going to mess up the available cash for the subject to steal. So they start dipping into other areas that aren't necessarily spoken for. One of those areas is your payroll taxes because you withhold this from the ... especially if you're not using a payroll processor, because when I use a payroll processor, they're withdrawing those taxes and they're storing them and then they report them. But if somebody's running this through QuickBooks or even manually, which I don't know why anyone would pay payroll manually, if yours is paying payroll manually, find a new bookkeeper. That is unacceptable. Unacceptable. Go do it today.
There's too many, it's way too cheap, you're definitely overpaying and it is a very high risk of fraud. If they're mad about it, you need to investigate. These payroll taxes and even your withholdings, like you're withholding money to report to the IRS for your employees that's used to pay the employees' taxes every April. That becomes kind of a slush fund that nobody's looking at as long as it eventually gets reported and so what I've seen is that the withholdings will get reported, but then the actual payroll taxes that are the employer's side of the payroll taxes, they won't. What we want to do is check to make sure that whatever we said we were paying to the tax authorities that we actually paid, because that will turn into a whole big mess if you have not reported.
I mean, you're going to have fines, all kinds of stuff, so you definitely want to check that. The other thing is that if your bookkeeper is running everything through QuickBooks, you're also going to want to make sure that all those things tie out that we've talked about, but go ahead and check the audit trail to see if there's any payroll checks or payroll entries that are deleted. If we get to it, I'll tell a story about that.
Bethany Pigott:
All right. Awesome. Well, we're going to take a short break and then we'll be back to tell you about how you can obtain these payroll reports that we've been talking so much about.
Who said CPE can't be fun? We've gamified fraud investigation training so you can make learning fun at your next employee training or association event. We've done this by combining real life case studies with interactive in-person and online games that qualify for ethic. Continuing education credit. The interactive case studies are recommended for two CPE credit hours. To schedule a discovery call, visit investigationgame.com.
Welcome back. Now we're going to have Leah answer just a few more questions and give us some stories about payroll reports. Leah, can you tell us how you obtain payroll reports?
Leah Wietholter:
Much like I talk about in the credit card statement episode, we're going to look at the client's access. If the client has access, you're going to request the information either from your payroll processor or download it from online. Again, I won't go into it again, go back to the credit card statement one. But if you're a business owner without access, get access. You have the right to it. Your controller or your bookkeeper cannot keep that from you. They can try, but they don't have a right to it. If the client's an owner but doesn't have access, like a partnership dispute, you're going to go through an attorney. Again, just really, if you're getting anything from the other party that you suspect, you need to be suspicious of the information they're providing to you.
If you don't have access in a trust or if the partnership dispute kind of goes south, they're not cooperating, or if you're a party to a divorce, just work with your attorney to see if you can subpoena that information. Now, a subpoena, obviously, you have to pay the attorney to prepare the subpoena, and there is going to be some research fees on the bank end usually ... No, I don't think I've ever had a payroll provider charge for that, but there might be some research fees, but they're very minimal usually compared to the loss that you're trying to uncover.
Bethany Pigott:
Can you let us in on any cases where this data was critical to the success and the outcome of the case?
Leah Wietholter:
Yes. As I mentioned, and I was hoping we would get to this before we ran out of time, but in the example that I mentioned earlier with the whistleblower and she had been part of the scheme, so the CEO of the company was in charge of payroll, which first of all, why? That doesn't even make sense. I mean, I guess unless you're me. I'm just kidding. I take care of payroll. But no. So the CEO who was not the owner, was in charge of payroll, which is kind of a strange task or responsibility. What she did was she went to some of her closest kind of confidants in the business. It was a home health company. Went to the closest confidants and said, "Hey, you're getting some extra money on your paycheck this next pay period, but whenever you get it and your check clears or direct deposit clears, I want you to go to the bank and I'm going to put an envelope on your desk with a certain dollar amount, and you're going to put that much cash in that envelope."
So the check would clear the person would go to the bank, and if the envelope said $500, they would bring $500 cash back, put it in the envelope, put it in the CEO's office. This went on and on with at least six, maybe eight employees, including our whistleblower till she got cut out. But if you want to hear the whole story about this, we do have a podcast episode about it. It's episode 20. This lady was using vacation hours to ... so she'd go in and just increase their vacation hours, so then they'd get paid for this extra pay. We got the documents or the exports from the payroll company, and then we were able to just compare the hours on the time sheets, and we verified that this time sheet database was correct, so we could compare the hours they had actually worked to the hours they were paid.
Then we were able to identify the overpayment. One of my favorite things about this case was after we issued our report, the attorney for my client called and said, "Hey, one of the attorneys for one of these people involved in the scheme, they're saying that your number showing that they worked 3000 hours in a year, that's just not even possible. Someone can't possibly work 3000 hours." I said, "Well, I'm happy to go back and to check our math. Absolutely, I will go back and make sure that we did math correctly", but also he's right because this is fraud. They would not be able to work 3000 hours in a year, and that is why this is fraud, so he'd kind of proven it to himself.
Another one that I like to talk about that I'm pretty sure is in the book is about this consulting company. They had been paying everyone by check, and this would've been like 2013, 2014. People are actually working from offices and stuff. That's why I make that distinction. So he's paying everyone in check, but he had one person who worked out of state, and this person said, "Hey, instead of me getting paid after everybody else, can you do a direct deposit for me?" So they tell the Bookkeeper, she says, "Yeah, I can do this through QuickBooks. That's how I'm processing payroll anyway." So she sets up direct deposit for the guy out of state, everybody else keeps getting paid in checks, and she would print the checks and then the owner would sign them. So she kept printing her own check.
However, she also added herself as a direct deposit recipient and so she was still getting her checks because the owner needed to see she was still getting paid those, and so it got to the point where they were getting payroll tax notices and she was controlling a lot of it, but she went on vacation and they saw a payroll tax notice, and he's like, "Why? We should have plenty of money. What is going on?" So that's when I got the call and we discovered that she was double dipping on her payroll. What really helped us on this case is that not only could we see she had been paid multiple times when she shouldn't have been, but also she went into QuickBooks and deleted those payments. We could see how much had been spent out of the bank account, and then compare that to the payroll reports we were running and it didn't tie.
By checking, then going into the audit trail and finding those deleted payments, that was really helpful. It's also really good evidence of intent, and we'll talk about that later. But that helped us piece that together. The tricky part on this one is that this employer didn't have employment agreements or bonus agreements and so that's why finding those deletions were really important because if she was supposed to have been paid those amounts, then she wouldn't have deleted them.
Bethany Pigott:
Well, you've given our listeners such great information on where to look, how to look, how to access these things, and really how data just tells a story. Thank you, Leah, for joining us in this series about best evidence for fraud investigation, and we look forward to talking to you again next time.
Leah Wietholter:
Thank you for listening to the Data Sleuth podcast. If you enjoyed this episode, please leave us a review wherever you listen. The Data Sleuth podcast is a production of Workman Forensics in Tulsa, Oklahoma. To learn more about our investigation, services and resources, please visit workmanforensics.com. You can purchase your copy of Data Sleuth using data in forensic accounting engagements and fraud investigations on Amazon, Goodreads, or wherever you like to purchase books.