# Presentation: 301789

## Fraud & Internal Controls – Catch Me If You Can

- By Mac McCabe, CPA
- 	Owner, Gaylord L. McCabe CPA 	Accounting Firm
- December 10, 2002
- Best Business Practices Seminar

## Catch Me If You Can

- Why has fraud become such an enormous problem?
- Why are companies susceptible to fraud?
- Is our organization susceptible to fraud?  Why?  How?
- How do the dollar losses from check forgery compare to other types of bank crime?

## Catch Me If You Can

- How have changes in the Uniform Commercial Code affected the corporate customer?
- What procedures can an organization implement to prevent fraud?
- What should we start to do to help deter fraud in our organization?

## Catch Me If You Can

- Why has fraud become such an enormous problem?
- Little prosecution of these crimes.
- Not a lot of emphasis on arresting this type of criminal.
- Why are companies susceptible to fraud?
- They wait until something happens and then react.
- Ethnics are not being taught at home or in school.
- They make it easy for people to steal from them.

## Catch Me If You Can

- Is our organization susceptible to fraud?  Why?  How?
- Based on your organization.
- How do the dollar losses from check forgery compare to other types of bank crime?
- Losses from crime in 1996
- Credit card fraud - $712 million
- Bank robbery - $64 million
- ATM fraud - $15 million
- Check forgery - $12 billion

## Catch Me If You Can

- Forged checks: per day
- Returned by banks unpaid - $1.2 million
- Total amount - $169 million
- How have changes in the Uniform Commercial Code affected the corporate customer?
- Until recently, the bank was liable for check forgery.
- In 1990, California became the first state to revise UCC Section 3-406.
- All states have now revised the code.
- These revisions have moved the liability from the bank to the customer.

## Catch Me If You Can

- What procedures can an organization implement to prevent fraud?
- Open up a zero balance account to receive your wire transfers.
- Do not print signatures of your key executives in the annual report.
- Use common business practices and good sense.
- Perform a background check on your new employees who have access to funds.
- Reconcile your bank statements on a timely basis.
- Be sure you have segregation of duties.
- Store your checks in a secure place.
- Lock up your signature signer in a safe or machine (via passcode).

## Catch Me If You Can

- What should we start to do to help deter fraud in our organization?
- Based on your organization.

## Catch Me If You Can

- How is “ordinary care” defined within the Uniform Commercial Code (UCC)?
- What impact has the new rule providing customers with access to their funds in a shorter period of time had on check fraud?
- What procedures should a company implement to control its check stock?

## Catch Me If You Can

- What controls should a company have over its accounts payable function?
- What is micro-printing?
- How does daily positive pay help detect and prevent unauthorized payments from corporate checking accounts?
- What question should be asked when examining a check’s appearance?

## Catch Me If You Can

- How is “ordinary care” defined within the Uniform Commercial Code (UCC)?
- According to UCC Section 3-103(7), “ordinary care” requires account holders to follow “reasonable commercial standards” prevailing in their area and for their industry or business.  Under 3-406, if they fail to exercise ordinary care, they may be restricted from seeking restitution from the payee bank if their own failures contribute to a forged or altered check.  Section 4-406 requires customers to reconcile their bank statements within a reasonable time and report unauthorized checks immediately.  This typically means reconciling bank statements as soon as they are received and always within 30 days of receipt.

## Catch Me If You Can

- What impact has the new rule providing customers with access to their funds in a shorter period of time had on check fraud?
- The change has significantly increased fraud losses by shortening the time that banks can return checks paying against uncollected funds.  A negative by-product of shortening the time is that it has expanded the window available for criminals to perpetrate fraud.  Criminals often alter a check’s routing and transit numbers, redirecting checks to an incorrect Federal Reserve District.  When the fraudulent checks ultimately are returned to the correct bank, the deposit funds have been withdrawn.

## Catch Me If You Can

- What procedures should a company implement to control its check stock?
- Check stock must be kept in a secure, locked area with access restricted to those persons responsible for issuing checks.  Only these people should have keys or combinations to the locked storage area.  Locks or combinations should be changed each year at least in order to ensure that they have not been compromised.
- Keep check boxes sealed until they are needed.  Inspect the checks upon receipt, and then reseal the boxes.  Write or sign across the tape and box to provide evidence of tampering.

## Catch Me If You Can

- Maintain a detailed inventory log of all checks received into the supply area.  Conduct physical inventory audits to account for every check.
- When checks are being issued, the quantity taken from inventory should always equal the number to be issued.  If extras are required to line up the printer, every check should be accounted for and returned to the check custodian.
- When mechanical signing equipment is used, keep the signature plates in a secure area separate from the check stock.
- Finally, reconcile each check run to detect missing or extra checks.

## Catch Me If You Can

- What controls should a company have over its accounts payable function?
- Accounts payable controls must address how vendors are created, as well as how invoices are processed.  Only authorized persons should have access to these systems, and changing or adding vendors should be restricted and require manager approval, with supporting documentation.

## Catch Me If You Can

- What is micro-printing?
- Micro-printing is printing so small that it appears as a solid line or pattern to the naked eye.  Under magnification, a word or phrase appears.  This level of detail cannot be replicated by most copiers or desktop scanners.

## Catch Me If You Can

- How does daily positive pay help detect and prevent unauthorized payments from corporate checking accounts?
- Daily positive pay is an automated check matching service unparalleled in detecting bogus checks.  This service is extremely effective when the customer sends issued-check information to the bank each day that checks are issued.  Fraudulent checks are identified when the bank compares the in-clearing checks to a file of issued checks maintained at the bank.  If the bank has no in-file match for the presented item, the bank contacts the customer to determine the check’s authenticity.  If a fraud is found, the bank will return the check unpaid, and the counterfeiter is foiled.

## Catch Me If You Can

- What question should be asked when examining a check’s appearance?
- Are the check numbers and issue dates in the same range?
- Does the payee make sense, and does the endorsement match?
- Is the check perforated on at least one edge?  Color copied checks are often not perforated.
- Are the first two digits of the routing number consistent with the location of the bank?  Forgers sometimes change the routing number on the check to an incorrect Federal Reserve District to delay payment.

## Trust Is A Good Thing...Controls Are Better

- Procedures to prevent fraud
- Open up a zero balance account to receive your wire transfers.
- Do not print signatures of your key executives in the annual report.
- Use common business practices and good sense.
- Perform a background check on your new employees who have access to funds.
- Reconcile your bank statements on a timely basis.
- Be sure you have segregation of duties.
- Store your checks in a secure place.
- Lock up your signature signer in a safe or machine (via passcode).

## Trust Is A Good Thing...Controls Are Better

- Companies are susceptible to fraud because:
- They wait until something happens and then react.
- Ethics are not being taught at home or in school.
- They make it easy for people to steal from them.

## Internal Controls: Preventing Fraud

- What experience have you had preventing or detecting fraud?
- Which internal control procedures might have prevented Mike Fulton’s fraud?
- What policies should companies adopt to reduce the possibility of fraud?
- What can the Controller do to prevent corporate frauds?

## Internal Controls: Preventing Fraud

- What can you do to help prevent and detect fraud in your organization?
- What should companies do to develop a model fraud prevention program?
- What effect do these scandals have on employees?

## Internal Controls: Preventing Fraud

- What experience have you had preventing or detecting fraud?
- Based on participant experience.
- Which internal control procedures might have prevented Mike Fulton’s fraud?
- Requiring a second approval for capital expenditures.
- Obtaining confirmation that services were performed.
- Having the Board of Directors emphasize the importance of control procedures and not allowing management overrides.

## Internal Controls: Preventing Fraud

- What policies should companies adopt to reduce the possibility of fraud?
- Establish a tone from the top emphasizing that fraud and dishonesty will not be tolerated.
- Tell people what is expected of them and make clear what is acceptable and what is not.
- Create an environment that makes people aware that fraud will not go undetected.

## Internal Controls: Preventing Fraud

- What can the Controller do to prevent corporate frauds?
- Remind management that this is a serious problem that requires their attention.
- Ensure that staff members are capable of carrying out their tasks and executing the various system control procedures.
- Be alert for “red flags.”

## Internal Controls: Preventing Fraud

- What can you do to help prevent and detect fraud in your organization?
- Based on participant opinion.
- What should companies do to develop a model fraud prevention program?
- Establish a fraud examination unit.
- Utilize a hot line to report misdeeds.
- Become proactive in fraud prevention.
- Conduct surprise audits.

## Internal Controls: Preventing Fraud

- What effect do these scandals have on employees?
- Creates a crisis of confidence.
- Has a strong negative effect throughout the corporation.
- Causes management and other employees to lose their jobs.

## Internal Controls: Preventing Fraud

- What are the three characteristics common to embezzlers?
- What are some of the ways to minimize an employee’s perceived pressures to commit fraud?
- What are some practical ways to minimize an employee's perceived opportunities to commit fraud?

## Internal Controls: Preventing Fraud

- What are the three basic methods for reducing an employee’s rationalizations to commit fraud?
- Identify the characteristics of a high-risk fraud environment?

## Internal Controls: Preventing Fraud

- What are the three characteristics common to embezzlers?
- Motive
- Opportunity
- Rationalization

## Internal Controls: Preventing Fraud

- What are some of the ways to minimize an employee’s perceived pressures to commit fraud?
- Pressures can be especially difficult to detect on the part of the employees.  However, some of the more practical ways to minimize perceived pressures include:
- An open-door policy.
- Management attitudes that include objective measures.
- Employee support programs.

## Internal Controls: Preventing Fraud

- What are some practical ways to minimize an employee’s perceived opportunities to commit fraud?
- Some practical, common sense suggestions include:
- Management oversight.
- Job rotation.
- A proactive audit policy.
- A well-defined and understood fraud reporting program.

## Internal Controls: Preventing Fraud

- What are the three basic methods for reducing an employee’s rationalizations to commit fraud?
- An educational program.
- A written ethics policy.
- Making employees aware that any dishonest acts will be punished.

## Internal Controls: Preventing Fraud

- Identify the characteristics of a high-risk fraud environment?
- Autocratic management, high trust of employees, short-range planning, management by crisis, routine reporting, rigid rules, political reward system, negative feedback, differences repressed, poor promotion opportunity, poorly-defined ethics, hostile environment, high turnover, low loyalty, cash flow problems, unsuccessful company, hostile competitors, reactive management, poor CEO, and formal communication.