How a Lack of Internal Controls Can Impact the Outcome of a Fraud Investigation

By Megan Brown, CPA, PI

Internal controls not only help deter fraud, but if fraud does occur, they are vital to building your case. A few years ago, I worked on a case where the client had no internal controls over cash. This not only provided an opportunity for the employee to steal, but it made our job of quantifying the client’s loss difficult – and nearly impossible.

The client owned a small business that received payments in the form of cash, check, and credit card. One day they discovered their bookkeeper was stealing money from the cash drawer. Normally in a case like this, we would compare the cash sales records to the amount of cash that was deposited in the bank – net of any cash balance kept in the drawer. In interviewing the client, he advised that cash was regularly taken out of the drawer to pay for office lunches. The amount of cash used for lunches was not tracked, and receipts for the office lunches were not retained. We also learned that cash drawer reconciliations were never performed. With this information, we quickly learned that we would not have a beginning or ending balance for the cash drawer; therefore, we were unable to quantify the amount of cash stolen directly related to this employee. We could have provided the total difference between cash sales and cash deposits to the bank, but with so few internal controls, and multiple people handling cash, there was no definitive way to connect the missing cash to the suspected employee.  

In addition to the client’s concerns about cash, he also believed the same employee was inflating time on her time sheets. The employee was scheduled to work 28 hours per week with no overtime and no paid vacation. Hourly employees tracked their time manually and submitted paper time sheets, without any supervisor’s approval or review, to an offsite accountant who administered payroll for the office. If time sheets had been submitted to a supervisor for approval, we could have compared those time sheets with the time sheet submitted to the accountant or to the actual payroll records. In this case we were only able to compare the employee’s paper time sheets with what her schedule should have been. We did identify that the employee was submitting excess regular hours as well as vacation hours. The Fair Labor Standards Act states that hours worked are compensable time, meaning you must pay the employee for worked hours whether they are allowed to work extra hours or not.  In our client’s case, they did not have approved time sheets, or time clock records, or any other data supporting his claim that the employee did not work those excess hours. Ultimately, we could only calculate the loss related to the excess vacation hours or days in which she was paid for time when she was out of the office.

This case was a good example in learning that internal controls may not always prevent fraud, but they are definitely important in providing evidence for proving fraud.

Have you run into something similar? We’d love to hear from you in the comments or send us an email directly at services@workmanforensics.com.