Fraud Embezzlement: Lessons from the Trenches

1. Fraud & Embezzlement:Lessons from the Trenches

2. Perp Poetry

4. Cost of Fraud & Abuse $2.9 trillion worldwide 5% of revenues 42% recover nothing after fraud is discovered (2008 study)

10. The Fraud Triangle

11. Typical Perpetrator White male College educated Intelligent Married Most loyal employee

12. Profile of Fraud Perpetrator Male or female No prior criminal history (<8%) Well liked by co-workers Likes to give gifts/compulsive shopper Gambling problems not unusual Long-term employee Rationalizes: Starts small or �borrows� Lifestyle clues

15. Econ Impact on Fraud Increased discovery with softening economy Increase in employee financial pressures Increased pressure to show good financial results (pressure for unachievable?) Maintain earnings, meet debt covenants, just keep the doors open

16. Econ Impact on Fraud Increased financial pressure distracts from risk management activities Less effective internal controls during downsizing (or less emphasis on them) Diminished morale Greater pressure = easier rationalization

18. ACFE Study Early 2009Key Findings Level of fraud has increased since beginning of economic crisis Current increase stems from intense pressure faced by so many individuals Employees pose the greatest threat to organizational resources in current economy Fraud levels expected to continue rising

19. ACFE Study Early 2009Key Findings Organizations need to take seriously threat posed by employees Fraud thrives in times of economic turmoil Companies have not cut spending on fraud-related internal controls Pervasive layoffs are leaving holes in internal control systems

21. Key Red Flags Lifestyle clues Unusual results or items Unusual relationships Employees suddenly guarded, secretive, working unusual hours or taking work home Out of balance conditions

22. Key Red Flags Employees with significant increases in debt &/or credit problems Behavioral changes (drugs, alcohol, gambling, fear of losing job) Refusal to take vacations or sick leave Unreasonable reaction to reasonable questioning

23. Key Red Flags Missing supporting documentation Increase in customer complaints Increased write-offs or shortages Manipulated documents, i.e., white out Budget to actual differences

24. Cash Schemes Stealing cash funds processed or on hand Not recording & stealing the cash receipts Under ringing & stealing the difference in cash receipts Altering bank deposits

25. Athletic Dept Schemes Travel expenses Selling tickets for personal gain Misuse of booster funds Misuse of department funds

26. Recent Ticket Scheme Summary of Case Over $1.0 million (face value) in tickets sold to brokers by insiders Multiple employees involved Lasted for at least 5 years Disguised as complimentary tickets/other Ticket broker split profits with employee(s)

27. Accounts Receivable Schemes Lapping Forging checks received Altering credit card receipts Granting bogus credits Bogus bad debt write-offs or account adjustments

28. Accounts Payable & Purchasing Personal bills Fictitious suppliers Kickbacks Straw vendors Ordering personal items Petty cash funds Employee expense accounts Credit cards

29. Common Data Mining Areas Employees & payroll Vendors & accounts payable Expense reimbursement Loans (for financial institutions only) Sales Inventory

30. Vendor Trending Analysis Time Series Analysis: Acceleration

31. Name Mining - Anagrams

32. Address Mining � Mail Drops Fictitious Vendor with UPS Store Address

33. Address Matching Address Match Example

34. Check Sequence Analysis

35. Expense Account Padding

36. Payroll Schemes Ghost employees Manipulated time records Unclaimed payroll checks Writing extra payroll or bonus checks Leave time manipulation Withholding fraud W-2 fraud

37. Protect Your Organization Fraud risk assessment Internal controls Proper environment External review Reporting mechanism Hire right Fidelity bonding Establish �Perception of Detection�

38. Double Down on These Heightened awareness of unusual Monitor, monitor & monitor some more Improve fraud risk assessment practices Carefully watch for lifestyle clues Increase oversight where head count is decreased Be proactive, not reactive & implement electronic analysis of some kind Re-emphasize fraud hotlines

39. Detection of Fraud Schemes

40. What is Fraud Prevention? �Fraud prevention requires a system of rules, which, in their aggregate, minimize the likelihood of fraud occurring, while maximizing the possibility of detecting any fraudulent activity that may transpire. The potential of being caught most often persuades likely perpetrators not to commit the fraud. Because of this principle, the existence of a thorough control system is essential to fraud prevention.� ACFE Fraud Examiners Manual

41. Fraud Prevention is About Being proactive rather than reactive Continually reinforcing antifraud support effort concepts Thinking about fraud risks & solutions Dialoguing about fraud & its prevention Having board & audit committee talk about & emphasize ethics

42. Antifraud Program � 14 Steps Creating Culture of Honesty & High Ethics Tone at the top Creating positive workplace environment Hiring & promoting appropriate employees Training Confirmation Discipline AICPA Management Antifraud Programs & Controls

43. Antifraud Program � 14 Steps Evaluating Antifraud Processes & Controls Identifying & measuring fraud risks Mitigating fraud risks Implementing & monitoring appropriate internal controls AICPA Management Antifraud Programs & Controls

44. Antifraud Program � 14 Steps Developing Appropriate Oversight Audit committee or board Management Internal auditors External auditors Certified fraud examiners AICPA Management Antifraud Programs & Controls

45. Resources Managing the Business Risk of Fraud A Practical Guide (AICPA, ACFE & IIA) Management Antifraud Programs & Controls (exhibit to SAS 99) ACFE Fraud Prevention Check-Up ACFE Best Practices in Ethics Hotlines ACFE Sample Code of Conduct ACFE Sample Ethics Policy

46. Agenda IU background Miscellaneous policies & initiatives Internal control assessment Training & development Sub-certification of units Systems

47. IU Background & Focus Large decentralized university Audited by state agency Internal control concerns 2002 Question � How are we doing? Sarbanes-Oxley SAS 112 Communicating Internal Control Related Matters SAS 104-111 Risk Assessment Standards

48. Senior Management Practices Code of commitment & code of conflict for staff implemented Mandatory background checks for most new faculty & all new staff implemented in 2004 Ethics point implemented June 2007 for anonymous hotline Fraud/fiscal misconduct policies separated CFO signs management representation letter

49. Policies Implemented Role of Fiscal Officer, Account Manager & Account Supervisor, revised December 2002 Internal controls, December 2004 The Board of Trustees & the President of Indiana University are committed to solid structure of internal controls. The University considers internal controls to be crucial in providing reasonable assurance regarding the safeguarding of University assets & achievement of operational, financial reporting & compliance objectives. The Trustees, President, university & campus administrators, deans, department chairs & directors are responsible for setting tone of accountability, high ethical standards & business conduct expectations.

50. Policies Implemented Segregation of Payroll Duties Revised 2004 to include auditing & verification of payroll Fiscal Misconduct, revised March 2005 Revision separated fiscal misconduct from fraud Fraud, March 2005 First time language used in policy Revenue Producing Activities First time language used in policy 2003 established process & approvals 2006 & 2009 outlined allocable receipting mechanics

51. Policies Implemented Financial Sub-certification, July 2006 Took 18 months of due process before final policy completed & implemented Whistleblower Policy, April 2007 Underscores protections & encourages reporting Supports Indiana Code 20-12-1-8 Use of Procurement Contracts mandatory 2010 Penalties of losing APO & P-Card options if abused

52. Internal Control Assessment Completed 2002 by hired consultants Assessment, not audit 105 individuals were interviewed Policies & procedures were evaluated Organizational structure as it relates to internal controls was reviewed Principal objective to identify key control activities & weaknesses & provide recommendations

53. Internal Control Assessment Accounts Payable Accounts Receivable Auxiliary Accounting Capital Asset Management Cash Control Construction Accounting Debt Accounting Endowment Accounting Financial Systems & Operations Internal Audit Investment Accounting Plant Accounting Payroll Purchasing Student Loans Financial Reporting

54. Internal Control Assessment No noted significant deficiencies from COSO controls perspective were found Several weaknesses were identified � mostly pertaining to our very decentralized environment lack of reporting line from fiscal officers to university-level financial managers

55. Fiscal Officer Development Series Created in 2000 to meet the needs of more sophisticated fiscal management Class sizes of 25-30 a year The Fiscal Officer Development Series strives to provide current, new & prospective fiscal officers with "tool kit" for success. Success is defined as the ability to carry out roles & responsibilities of the fiscal officer in manner that benefits the university, the unit & the individual. Upon completion of the series, individuals will have technical tools (policy & procedure knowledge), organizational & cultural tools (an understanding of the unique & diverse operational environments found at IU), & knowledge of the resources & other tools (courses & other opportunities) for building & improving personal & management skills 

56. Fiscal Officer Development Series Myers-Briggs Ethics & Internal Controls Facilities Procurement Fiscal Policies Budget Chart of Accounts Payroll Tax Treasury Functions Departmental IT Research Administration Travel Fund Accounting

57. Other Training Annual Alumni Session for FODS Organizational change updates Policy updates Morale booster Relationship maintenance Regular & Scheduled Training Systems Policies & processes Advanced series Accrual accounting Chart of accounts

58. Sub-certification by Units Internal Control Policy implemented in December 2004 Internal Control Workshop designed, developed & implemented Sub-certification implemented on July 1, 2006

59. Sub-certification by Units Policy discussions were difficult Fiscal officers are afraid of added responsibility Deans feel this is a gotcha & it is beyond what their responsibility should be Some campuses� climates were more accommodating than others

60. Sub-certification by Units Policy requires unit leaders & fiscal officers to sign certification letter Certification letter has 10 certifications that originated from representation letter VPCFO makes to external auditors Certifications letters will go out in July of each year & be required to be turned in before September Board of Trustees is VERY supportive of this initiative

61. Certification Statements We acknowledge we are responsible for the accuracy of the financial statements of our organization Our financial statements include all properly classified (an appropriate account & object code) financial transactions of our organization For our organization, we acknowledge we are responsible for the adoption & implementation of university financial policies, the establishment & maintenance of internal control structure & procedures assisting in preventing & detecting fraud We have no plans or intentions that may affect the carrying value or classification of assets, liabilities or fund balances

62. Certification Statements We review our inventories on a regular basis to assure the value recorded in the university�s accounting records is correct Owned assets have been adjusted for all sold building & equipment items, retired, dismantled, abandoned or otherwise disposed of, or unusable We have identified all accounting estimates for our auxiliary unit activity that could affect our financial statements, including the key factors & significant assumptions underlying those estimates, & we believe the estimates are reasonable in the circumstances. Or, alternatively, we have no auxiliary unit activity

63. Certification Statements There have been no undisclosed Instances of fraudulent financial reporting or misappropriations of assets within our organization Instances of fraudulent financial reporting or misappropriations of assets involving employees outside our organization, but within the university, that could have effect on financial statements Communications to our organization from regulatory agencies concerning noncompliance with, or deficiencies in, financial reporting practices that could have effect on financial statements Shortages or irregularities which were discovered during period ending June 30, 2007. Examples of this would be missing inventory, moveable missing assets, expenditures that don�t seem to fit with mission or budget plan & missing funds from revolving cash account Conflict of interest Conflicts of commitment within meaning of university�s rules

64. Certification Statements The following have been properly recorded or disclosed in our financial statements Joint ventures & related party transactions & related accounts receivable or payable, including revenues, expenditures, loans, transfers & leasing agreements Guarantees, whether written or oral, under which university unit is contingently liable Our organization has complied with all aspects of contractual agreements that would have material effect on our financial statements in event of noncompliance

65. Systems Timekeeping for nonexempt staff Mandatory direct deposit for everyone � no more grandfathering Paid Time Off system for exempt staff � mandatory monthly reporting Electronic routing & signatures

66. New Projects Centralization of accounts payable Reorganization of procurement process Relates to earlier policy change Benchmarking Student services HR/payroll Physical plant

67. Contact Information Angela Morelock, CPA, CFE, CFF, ABV Certified Forensic Accountant� BKD, LLP 901 E. St. Louis Street, Suite 200 Springfield, MO 65806 Phone 417.865.8701 Fax 417.865.0682 Email amorelock@bkd.com

68. Any Questions?