Fraud Detection and Investigation: Microcomputer Consulting Services
ABSTRACT: This nonfictional case of inventory fraud in a university setting exposes students to fraud detection and investigation. These skills are becoming increasingly important for auditors, as evidenced by the alarming rate of fraud. The accounting profession has acknowledged the seriousness of this issue with the issuance of SAS No. 99, Consideration of Fraud in a Financial Statement Audit, developed in part to improve detection of frauds by auditors.
The case raises many of the fraud-related issues faced by accountants: recognizing red flags indicative of fraud; the importance of a good system of internal controls; the profile of the typical fraud perpetrator; the fine line auditors walk when investigating a fraud; the need to develop an audit team with the appropriate level of expertise which may require members from a variety of disciplines (e.g., investigative, legal and forensic areas); and the difficulty of obtaining sufficient evidence to prosecute and convict perpetrators.
Part 1: The Initial Audit
The Internal Audit Department of "X State University"2 performs an unscheduled audit whenever a university department head desires assistance in determining the financial status of his department's operation, and reports its audit results to the Vice President of Administration and Finance. In addition, unknown to most university employees, it is standard operating procedure for the Internal Audit Department to perform an unscheduled audit prior to the departure of key employees (e.g., an employee responsible for handling large amounts of cash). In December 1988, the campus computing services director requested that the Internal Audit Department audit the campus Microcomputer Store (MCS) operations, prior to the imminent departure of the MCS manager. The manager had held the position for eight years. During the past year he purchased a new house in the community, he had been seen driving a new sports car to work, and he had just returned from his European honeymoon prior to the start of the audit.
The internal auditors completed the engagement in six weeks. Their findings were as follows:
1) All employees were on the payroll of the MCS and there were no additional or "ghost" employees on the payroll. The MCS manager earned approximately $18,000 a year in salary.
2) For select samples, the university's purchasing guidelines were adhered to by the MCS operation. However, the use of personal computers was becoming much more common during the 1980s. There was one personal computer on campus in 1981, but by 1988 there were approximately 1,500 units on campus. Consequently, the volume of computers purchased for campus use had risen close to 200 percent per year in each of the past five years.
3) There were no written position descriptions for any of the positions in the MCS, nor were there any written operations manuals or guidelines for any daily transactions.
4) Despite their best efforts, the Internal Audit Department was able to compile only a few fully documented transactions, from requisition/ order, to receiving, to setup and delivery, to billing and finally to additions in the Capital Property Control records. The problems noted included: few of the forms were prenumbered; the files were widely dispersed in the center; documents were not attached to each other and were not in any particular order; and often a billing statement or a purchase order would be missing all related documentation- only a handwritten note by the MCS manager on the billing statement or purchase order would support the transaction. To compound these problems, there were no "checks and balances" built into the MCS accounting system as compensating controls.
5) The direct supervisor for the MCS manager was aware of how the MCS operated in general, but knew nothing about the operating details of what was essentially a one-person operation (i.e., the MCS manager).
6) Purchases, as far as the internal auditors were able to ascertain, approached $1,200,000 in the most recent year.
Required:
1) What additional work could the Internal Audit Department perform prior to issuing the audit report?
2) What recommendations to the campus computing services director and the university administration would be appropriate for the MCS?
Part 2: The Plot Thickens
Three weeks later, the Internal Audit Department received a telephone call from a local repair shop owner who was working on a personal computer brought in from the public library for warranty repair. However, the box in which the personal computer was delivered had a shipping address for the university. There was even a bill of lading in the shipping envelope showing the university as the ordering party and referencing a university purchase order number. After verifying the information as factual, one of the internal auditors contacted the library director, and they met later in the day to determine how the personal computer had come to be in a box destined for the university.
The library director told the internal auditor that the library had been working with a university employee who owned a consulting company called MCS (Micro-computing Consulting Services). In addition, the library director indicated that the library had ordered several personal computers and printers from MCS, as well as the associated software, and had paid the consultant for the products and his fine service.
Required:
1) At what point should the Internal Audit Department suspect a fraud? What actions should be considered to ensure that professional auditing standards are met? Whom does the Internal Audit Department need to inform?
2) What red flags might have initially tipped off the internal auditors that this employee might be involved in a fraud?
3) In what ways does the MCS manager fit the profile of the typical fraud perpetrator?
Part 3: The Fraud Audit
The auditors then began to try to uncover the full extent of the suspected fraud. Department orders for computers, printers and software were traced to purchases, to sales records and to billing receipts. The Internal Audit Department even worked directly with computer manufacturers to identify the serial numbers of all personal computers and printers shipped to the university in the previous 18 months. The vendors provided all sales records to assist in the audit, but were unable to provide serial numbers for the computers shipped to the university.
Tracking sales to campus departments proved to be worthwhile, as three employees stated that they had made personal purchases from the MCS manager acting in his "professional capacity." The employees provided canceled checks for the purchases, made payable to MCS. The Internal Audit Department was able to trace some equipment serial numbers back to the actual university purchase orders and bills of lading. After ten weeks of work, the Internal Audit Department's report revealed that they could not account in full for purchases exceeding $140,000 that had been ordered by MCS, for which the university had paid the vendors. They also confirmed that equipment worth slightly more than $14,500 had been ordered and paid for by the university, but had never been recorded as sold, yet was in the personal custody of people and organizations who sincerely believed that they had bought the equipment from the university. The university did have a policy for MCS that stated there were to be no sales of hardware, software or peripheral devices to any private party for personal use; sales were to be made only to the campus departments for university-related work use.
Required:
1) What should have been the key points of the audit/fraud investigation report? What supportable audit conclusions could be drawn?
2) What additional steps might have been taken by the Internal Audit Department or Fraud Examiner to uncover evidence regarding the existence and the extent of the suspected fraud?
Part 4: Closure
After extensive discussions with the administration, the university attorney, the state attorney general (because the university was a public institution), and the local county attorney, a decision was made not to criminally prosecute because the attorneys believed the evidence was not sufficient to obtain a conviction in court. Therefore, the university attempted to contact the former MCS manager, now living across the country, to see if a confession and partial restitution could be arranged. After weeks of telephone calls back and forth, and relentless pressure from the Internal Audit Department trying to determine the full extent of the fraud, the former MCS manager hired a local attorney to work with the university to clear his name. After fully reviewing the Internal Audit Department's working papers, the local attorney recommended to his client that restitution in the amount of $14,500 be provided to the university, with no admission of guilt.
The university did insist on including a summary letter of the situation in the personnel file of the former employee. All parties agreed to these conditions, restitution was paid to the university, and the personnel file was appropriately documented. Shortly after the MCS manager had moved across the country, he applied for a job with the National Security Council. Three weeks after the summary letter had been included in his personnel file, a representative of the National Security Council telephoned the university to ensure that its new employee, the former MCS manager, could receive top-security clearance. As a result of the evidence contained in the documented personnel file, the Internal Audit Department was advised soon afterwards that the clearance was denied and the job offer to the former MCS manager was withdrawn.
Required:
1) Do you think the university should have brought criminal charges against the MCS manager? Why or why not? Besides the reason of insufficient evidence, why might a company be unwilling to prosecute a suspected fraud perpetrator?
2) What other work remains to be done by the internal auditors to bring this case to a close?
3) A confession by the MCS manager would have made this an "open-and-shut" case. Should the internal auditors have tried harder to obtain a confession, perhaps by relying more upon the university's legal counsel and law enforcement officers in the investigation?
4) Fraud researchers have coined the phrase "fraud triangle" to describe why people commit fraud. The three elements that make up the fraud triangle are pressure, perceived opportunity and rationalization; all three must be present for a fraud to occur. The pressure provides the motive to commit the fraud, and usually involves financial need. The opportunity typically presents itself in the form of weak or nonexistent internal controls. Fraud perpetrators must believe that they will be able to commit the fraud and remain undetected. Finally, fraud perpetrators must be able to rationalize or justify their fraudulent actions as morally acceptable.
One of the most common rationalizations is that the fraud perpetrator will pay back the stolen funds, so that the perpetrator is only "borrowing" the money for the moment. Apply the fraud triangle to this case and describe the pressure, perceived opportunity and rationalization that were present and that allowed the MCS manager to commit his fraud.