Problem
What weaknesses in the organization's control structure must have existed to permit this type of embezzlement?
Cleaver Manufacturing
Stephanie Baskill, an unemployed accountant, lives one block from the Cleaver Manufacturing Company. While walking her dog last year, she noticed some ERP manuals in the dumpsters. Curious, she took the manuals home with her. She found that the documentation in the manual was dated two months prior, so she thought that the information must be fairly current.
Over the next month, Stephanie continued to collect all types of manuals from the dumpster during her dog-walking excursions. Cleaver Manufacturing was apparently updating all of its documentation manuals and placing them online. Eventually, Stephanie found manuals about critical inventory reorder formulas, the billing system, the sales order system, the payables system, and the operating system.
To gain access to the organization, Stephanie took a low-profile position as a cleaning woman, giving her access to all areas in the building. While working, Stephanie snooped through offices, watched people who were working late type in their passwords, and guessed passwords. She ultimately printed out lists of user IDs and passwords using a Trojan horse, thus obtaining all the necessary passwords to set herself up as a supplier, customer, systems operator, and systems librarian.
As a customer, she ordered enough goods to trigger the automatic inventory procurement system to purchase more raw materials. Then, as a supplier, Stephanie would deliver the goods at the specified price. She then adjusted the transaction logs once the bills were paid to cover her tracks.
Stephanie was able embezzle, on average, about $125,000 per month. About sixteen months after she began working at Cleaver, the company controller saw her at a very expensive restaurant one evening, leaving afterwards in a luxury car. The controller then asked the company's security personnel and internal auditors to keep a close watch on Stephanie.