Fraud Examination Midterm Study Guide Questions and Complete Solutions

Fraud Examination Midterm Study Guide Questions and Complete Solutions Which of the following best describes the objective of a fraud examination? - Ans: To determine whether a crime has been committed, and if so, who is responsible Once sufficient predication has been established, what is the first step a fraud examiner following the fraud theory approach should take? - Ans: Analyze data In a fraud examination, evidence is usually gathered in a manner that moves from general to specific - Ans: True Which of the following is the correct order for a fraud examiner to interview witnesses? - Ans: Neutral third-parties, corroborative witnesses, co-conspirators, suspect Who developed the Fraud Scale? - Ans: W. Steve Albrecht Which of the following is not one of the legs of the Fraud Triangle? - Ans: Situational environment In a study by Steve Albrecht, Marshall Romney, and Keith Howe, participants were asked to rank personal characteristics as motivating factors that contributed to fraud. The highest ranked factor was: - Ans: Living beyond one's means In a study by Steve Albrecht, Marshall Romney, and Keith Howe, participants were asked to rank characteristics of the organizational environment that contributed to fraud. The highest ranked factor was: - Ans: Placing too much trust in key employees In the 2010 Report to the Nations on Occupational Fraud and Abuse, the category that committed the smallest percentage of occupational fraud was: - Ans: External parties In the 2010 Report to the Nations on Occupational Fraud and Abuse, the median loss in schemes committed by males was higher than the median loss in schemes committed by females - Ans: True In the 2010 Report to the Nations on Occupational Fraud and Abuse, most perpetrators of fraud had been previously charged with or convicted of a fraud-related offense. - Ans: False Eddie Dolan is the manager of shipping and receiving and has been working at the UFA Company for twenty years. He rarely calls in sick and gets good performance reviews every year. For the past year, his wife's company, ABC Co., has been in serious financial trouble. ABC Co. likely will not be able to make the payroll for next month and may have to close down. Which leg of the Fraud Triangle best applies to Dolan's situation? - Ans: Non-sharable financial need Alice Durant works in the accounts payable department for the BC Group. She recently found out that Della Granger, another A/P clerk, received a bigger raise than she did, even though Durant has been with the company longer and frequently has to correct Granger's errors. Which leg of the Fraud Triangle best applies to Durant's situation? - Ans: Rationalization What is fraud examination? - Ans: Fraud examination is a process for resolving allegations of fraud from inception to disposition. Fraud examinations involve not only financial analysis, but also interviewing witnesses, taking statements, writing reports, testifying to findings, and assisting in the prevention and detection of fraud. Occupational fraud and abuse includes any personal enrichment that results from misuse or misapplication of the employing organization's resources or assets. There are four key elements to this activity. What are they? - Ans: The four key elements to occupational fraud abuse are that it (1) is clandestine, (2) violates the employee's fiduciary duties to the organization, (3) is committed for the purpose of direct or ¬indirect financial benefit to the employee, and (4) costs the employing organization assets, revenues, or reserves. Cressey divided the non-shareable problems of the subjects in his research into six different subtypes. What are they and briefly describe each. - Ans: The subtypes are (1) violation of ascribed obligations, (2) problems resulting from personal failure, (3) business reversals, (4) physical isolation, (5) status gaining, and (6) employer-employee relations. What is the fraud theory approach? - Ans: The fraud theory approach is the methodology used for resolving allegations of fraud by developing a worst-case scenario of what could have occurred, then attempting to confirm or refute that theory. What is the difference between occupational fraud and occupational abuse? Give examples. - Ans: Occupational fraud tends to be more costly and less common than abuse. Occupational fraud consists of such actions as asset misappropriations, corruption, and fraudulent financial statements. Occupational abuse consists of petty offenses such as taking extended lunch periods or breaks, showing up late for work or leaving early, and doing slow or sloppy work. Albrecht concluded that there were three factors that led to occupational fraud. What are they? - Ans: Albrecht's list is very similar to the fraud triangle. The three factors he identified are (1) situational pressures, (2) opportunities, and (3) personal integrity. Cressey believed that non-shareable problems provided the motivation for employees to commit occupational fraud. What did he mean by "non-shareable"? - Ans: Cressey meant that the problems, at least in the eyes of the potential offenders, must be kept secret from others, so as to avoid embarrassment or, more importantly, a loss of status. There are several steps involved in the fraud theory approach. What are they? - Ans: The fraud theory approach involves analyzing the available evidence, developing a theory of what fraud could have occurred based on a worst-case scenario, testing the ¬theory, revising it or amending it as necessary, then proving the theory through additional investigative work. _________ controls are designed to stop an undesirable event from occurring, whereas _________ controls are designed to identify an undesirable event that has already occurred. - Ans: Preventive; detective Factors that influence the level of fraud risk faced by an organization include which of the following? - Ans: All: a. The nature of the business b. The effectiveness of the organization's internal control c. The ethics and values of the organization and the people in it The ACFE's 2009 Global Fraud Survey found, among other things, that the frauds committed by women had smaller median losses than those by men. What are some possible explanations for this finding? - Ans: The sizes of losses due to occupational fraud are almost always determined by the employee's access to assets. This explains why executives account for the largest losses. Women, because of the so-called "glass ceiling" (where they are not promoted into jobs equal to their male counterparts'), typically occupy lower-level positions. The objective of a fraud risk assessment is to help management recognize factors that make an organization most vulnerable to fraud so that management can address those factors to reduce the exposure. - Ans: True Effective internal controls can eliminate the need for a fraud risk assessment. - Ans: False Which of the following factors should be considered in assessing the likelihood of occurrence of each fraud risk? - Ans: Internal control environment of the organization Assessing an area as having a high fraud risk means that fraud is occurring there. - Ans: False The results of a fraud risk assessment can help auditors design programs and procedures in a way that enables the auditors to look for fraud in known areas of high risk - Ans: True The vulnerability of an organization to those capable of overcoming the three elements of the fraud triangle is known as which of the following? - Ans: Fraud risk When assessing the potential incentives, pressures, and opportunities to commit fraud, the fraud risk assessment team should evaluate which of the following? - Ans: All: a. Incentive programs and how they may affect employees' behavior when conducting business or applying professional judgment b. Highly complex business transactions and how they might be used to conceal fraudulent acts c. Opportunities for collusion What are four factors that influence the level of fraud risk faced by an organization? - Ans: Four factors that influence the level of fraud risk faced by an organization are (1) the nature of the business, (2) its operating environment, (3) the effectiveness of its internal controls, and (4) the ethics and values of the company and the people within it. Which of the following techniques can be used to evaluate the effectiveness and efficiency of internal controls? - Ans: All: a. Review of the accounting policies and procedures in place b. Interviews with management and employees c. Consideration of the risk of management's override of controls What is the objective of a fraud risk assessment? - Ans: The objective of a fraud risk assessment is to help management recognize the factors that make the organization most vulnerable to fraud so that management can address those factors to reduce the exposure. Both management and auditors have a responsibility for fraud risk management. - Ans: True How can a fraud risk assessment inform and influence the audit process? - Ans: The results of a fraud risk assessment can help auditors design programs and procedures in a way that enables the auditors to look for fraud in known areas of high risk. Who should be included on a fraud risk assessment team? - Ans: The fraud risk assessment team should consist of individuals with diverse knowledge, skills, and perspectives. The team members can include accounting and finance personnel who are familiar with the financial reporting process and internal controls; nonfinancial business unit and operations personnel who have knowledge of day-to-day operations, customer and vendor interactions, and industry issues; risk management personnel who can ensure that the fraud risk assessment process integrates with the organization's enterprise risk management program; the general counsel or other members of the legal department; members of any ethics and compliance functions within the organization; internal auditors; external consultants with fraud and risk experience; and any business leader with direct accountability for the effectiveness of the organization's fraud risk management efforts. When might an organization choose to avoid a risk rather than assume, transfer, or mitigate it? - Ans: Rather than assume, transfer, or mitigate a risk, management might choose to avoid it—by eliminating an asset or exiting an activity—if the control measures required to protect the organization against an identified threat are too expensive. How is fraud risk influenced by a company's ethics, values, and expectations? - Ans: Any gap in alignment between a company's ethics, values, and expectations and those of the individuals that make up the organization can significantly increase an organization's fraud risk. A company may need to undertake an internal investigation into alleged employee fraud for which of the following reasons? - Ans: all: a. To mitigate the company's vicarious liability for the wrongful conduct b. To determine the source and amount of loss c. To guard against wrongful termination accusations The failure to adequately investigate an allegation of employee fraud may be a violation of legal and regulatory requirements - Ans: True Officers and directors of companies are bound by the duties of _________ and _________ in overseeing the operations of their companies. - Ans: loyalty; reasonable care Who are some of the professionals that should be included on a typical fraud examination team? - Ans: Professionals from a variety of fields can provide valuable assistance to the examination. A typical investigation team might include Certified Fraud Examiners, legal counsel, internal auditors, security personnel, IT and computer forensics experts, human resources personnel, a management representative, and outside consultants. In most cases, which of the following parties should be primarily responsible for directing a fraud examination? - Ans: the company's legal counsel To be valid, a search warrant must be issued by a judge and must be served by a law enforcement official - Ans: True _________________ refers to establishing how and when a piece of evidence was received; how it was maintained or stored while in each person's possession; what changes, if any, it underwent in that person's custody; and how it left that person's custody. - Ans: chain of custody When organizing documentary evidence, it is recommended that investigators keep which of the following? - Ans: All: A. Chronologies b. To-do lists c. A separate file for key documents Information concerning a corporation's name, ownership, stock value, initial shareholders, directors, and officers is registered and maintained at which of the following levels? - Ans: State Fraud examinations conclude with: - Ans: a report of investigation findings A well-written, accurate, and understandable investigation report will: - Ans: All: a. Convey all pertinent evidence b. Add credibility to the investigation c. Accomplish the objectives of the case When preparing an investigative report, the fraud examiner should assume that it will be read by outside parties - Ans: True What is evidence? What types of things can be considered evidence? - Ans: Evidence is anything perceivable by the five senses, and includes any proof, such as testimony of witnesses, records, documents, facts, data, or tangible objects, that is legally presented at trial to prove a contention and induce a belief in the minds of a jury. What are some of examples of evidence gathering techniques that might be utilized in a fraud examination? - Ans: Fraud examinations frequently employ a wide variety of investigative techniques to gather evidence. Some of these include interviewing witnesses, examining public sources of information, conducting covert and surveillance operations, using informants, "dumpster diving," acquiring subpoenas and search warrants, and obtaining voluntary consent. When handling documentary evidence, what types of precautions should a fraud examiner take? - Ans: Original documents should be obtained where feasible. However, the originals should not be touched more than necessary, as they may later need to undergo forensic analysis. Therefore, the investigator should make working copies for review, and keep the originals segregated. Additionally, a good filing system for the documents is essential. Losing a key document may irreparably damage the case. So that it can be identified later, all documentary evidence received should be uniquely marked, either by initialing and dating the items or by making small tick marks or other nondescript identifiers on them. What are three characteristics/objectives of a good investigation report? - Ans: The way in which the information is presented at the end of an investigation can often make or break the case. Therefore, a good investigation report should 1) convey all evidence necessary for thorough and proper evaluation of the case, 2) add credibility to the investigation and corroborate earlier facts, and 3) accomplish the objectives of case. What are five sections that should be included in a standard investigation report? What information is found in each of these sections? - Ans: • Summary. This section sets out the main points of the report in a few sentences and should include the subject, basis, findings, and outcome of the investigation. • Introduction/purpose. This section provides more detail on what the report is about and prepares the reader for what is to come, as well as explaining the purpose of the report along with any background information that may be required. • Body. This section identifies the employee(s) and other individuals implicated or involved in the matter and provides any background information that may have been obtained about the employee(s) or other parties. This section also details the methods used to investigate the matter. • Results. This section will range from a sentence or two to a narrative supplemented by spreadsheets or graphics, depending on the nature of the investigation and the information collected. • Follow-up/recommendations. This section identifies any investigation procedures that remain outstanding and outlines any recommendations related to procedures and controls. What are some considerations a fraud examiner should keep in mind when organizing documentary evidence? Which method of evidence organization is preferred? - Ans: A database of documents should be established early on in the case, and should include, at a minimum, the date of the document, the individual from whom the document was obtained, the date it was obtained, the subject to which the document pertains, and a brief description. Documents should be segregated and organized by either witness or transaction. Chronological organization is generally the least preferred method. When reporting the results of an investigation, why is it important that fraud examiners do not express opinions in their professional report? - Ans: The fraud examiner's job is to present the evidence in his report. Opinions regarding technical matters are permitted if the fraud examiner is qualified as an expert in the matter being considered. No opinions of any other kind should be included in the written report. In particular, opinions should not be voiced regarding the guilt or innocence of any person or party, as forming this type of opinion is the job of the judge and jury. What are the five types of interview questions? - Ans: The five types of interview questions are introductory, informational, closing, assessment, and admission seeking. What four steps are involved in introductory questions? - Ans: The steps involved in the introduction are provide the introduction, establish rapport, establish the interview theme, and observe reactions. When should open questions be used? - Ans: Open questions should be used during the informational phase of the interview. When should leading questions be used? - Ans: Leading questions should generally be used during the admission-seeking phase of the interview. What are the purposes of closing questions? - Ans: Closing questions have three purposes: to reconfirm the facts gathered, to obtain additional information, and to ¬conclude the interview. What are some nonverbal clues to deception? - Ans: full-body motions, changes in anatomical physical responses, changes in the rate of illustrators, placing the hands over the mouth, increased use of ¬manipulators, fleeing positions, crossing the arms, inconsistent reactions to evidence, and fake smiles. What are some of the verbal clues to deception? - Ans: changes in speech patterns, repetition of the question, comments regarding the interview environment, displaying a selective memory, making excuses, increased use of oaths, excessive character testimony, answering with a question, overuse of respect, increasingly weaker denials, failure to deny wrongdoing, avoidance of emotive words, refusal to implicate other suspects, tolerant attitudes toward wrongdoing, reluctance to terminate the interview, and feigned unconcern about the issue at hand. Why are introductory questions so important to an interview's success? - Ans: The introduction establishes the tone of the interview. If the witness feels comfortable, he or she is likely to provide information. If the witness feels threatened, this will inhibit fact-finding. Additionally, only when the person is relaxed can you observe nonthreatening behavior and calibrate the witness. What are the key elements of a signed statement? - Ans: State that the accused knew the conduct was wrong; include facts known only to the -accused; estimate the number of instances involved; establish a motive for the offense; state when the misconduct began and concluded; detail others involved; describe any physical -evidence; explain how the proceeds were used, along with the location of any assets accumulated; and give specifics for each offense. Why is establishing goodwill with the witness important during the closing phase of the interview? - Ans: In the case of most witnesses, you may have additional questions at some future point. By establishing and maintaining goodwill, the witness will be more likely to cooperate in any subsequent inquiry. _________ is the theft of cash from a victim entity prior to its entry in an accounting system. - Ans: Skimming To a fraudster, the principle advantage of skimming is the difficulty with which the scheme is detected. - Ans: True Peggy Booth is the bookkeeper for an equipment rental company. After recording the cash sales and preparing the bank deposit, she takes $200 dollars from the total. This is an example of a skimming scheme. - Ans: False Methods of skimming sales include which of the following? - Ans: All: a. Conducting unauthorized sales after hours b. Rigging the cash register so that the sale is not recorded c. Posting a sale for less than the amount collected The customer service department at JNC, Inc. has been receiving phone calls from customers for whom there is no record. This is a red flag of what type of scheme? - Ans: Unrecorded sales Skimming receivables is generally more difficult to conceal than skimming sales. - Ans: True The concealment of receivables skimming can be difficult because: - Ans: The incoming payments are expected. Receivables skimming can be concealed through: - Ans: All: a. Lapping b. Force balancing c. Document destruction A method of concealing receivables skimming by crediting one account while abstracting money from a different account is known as: - Ans: Lapping Mandating supervisory approval for write-offs or discounts can help prevent receivables skimming schemes. - Ans: True Asset misappropriations are broken down into two categories: cash schemes and non-cash schemes. According to the 2010 Report to the Nations on Occupational Fraud and Abuse, cash schemes are much more common than non cash schemes - Ans: True George Albert was a property manager for a large apartment complex while he was going to college. One of his duties was to collect rent from the tenants. If rent was paid after the third of the month, a late fee was tacked on to the amount due. When a tenant paid his rent late, George would backdate the payment, record and remit only the rent portion to his employers, and pocket the late fee. This is an example of what type of fraud? - Ans: Sales skimming Jason Herman works part-time as a retail clerk at a local bookstore. One night while his manager was out of town, Jason decided to keep the store open for a few extra hours. He reset the cash registers at the normal closing time, but continued making sales. Two hours later, when he closed for the night, he reset the registers again, removing all evidence that any extra transactions had been made, and pocketed the money from the after-hours sales. What kind of scheme did Jason commit? - Ans: Unrecorded sales How is the cash register manipulated to conceal skimming? - Ans: There are two common methods. The first is to ring "no sale" on the register and omit giving the customer a receipt for the purchase. The second and less common method is for the cashier to alter the tape itself so that it does not show the sale. This is impossible to accomplish with cash registers that also record the transaction electronically. What are the six principal methods used to conceal receivables skimming? - Ans: The six concealment techniques identified in this chapter are: lapping, force balancing, stealing customer statements, recording fraudulent write-offs or discounts, debiting the wrong account, and document destruction If you suspected skimming of sales at the cash register, what is one of the first things you would check? - Ans: The cash register tape is one of the first things you should check. In a typical cash register skimming scheme, the crooked employee will ring up "no sale" on the register when a sale is made and pocket the money. The customer is not given a receipt. If you notice an excessive amount of "no sales" entered on the cash register, it could mean that the drawer is being opened and no money is being put in. Assume a client who owns a small apartment complex in a different city than where he lives has discovered that the apartment manager has been skimming rental receipts, which are usually paid by check. The manager endorsed the checks with the apartment rental stamp, then endorsed her own name and deposited the proceeds into her own checking account. Because of the size of the operation, hiring a separate employee to keep the books is not practical. How could a scheme like this be prevented in the future? - Ans: Two simple, separate control measures might help prevent such future occurrences. Although it might not be practical for the owner to reconcile the rental receipts himself since he lives in a different city, he could obtain a restrictive endorsement stamps that states "for deposit only." Second, the owner could have rental payments directed to a bank lockbox, where they would be less likely to be stolen. What is the most effective control to prevent receivables skimming? - Ans: In almost all cases of receivables skimming, the person handling the cash and the person keeping the books are one and the same. An employee who opens incoming mail or handles cash should not be permitted to post the transactions. Jeff Lewis is an accounts receivable clerk for FTB Industries. As customers pay off their balances, Lewis posts the payments but pockets the money. He can conceal his theft by: - Ans: All: a. Making unsupported entries for the amount stolen b. Adjusting the account with a discount c. Destroying the records What is the purpose of a shell company and how is it normally formed? - Ans: A shell company is a fictitious entity established for the purpose of committing fraud. It may be nothing more than a fictitious name and a post office box that the employee uses to collect disbursements from false billings. Since checks ¬received will be payable to the shell company, the fraudster will normally set up a bank account in the name of the fictitious company, listing himself as the authorized signer on the account. Explain how separation of duties contributes to the prevention and detection of billing schemes. - Ans: By enforcing a rigid separation of duties in the purchasing process, an organization can significantly limit its exposure to billing schemes. Segregating the purchasing process into four basic functions—purchasing, approval of purchase, receipt of goods, and cash disbursement—can prevent most forms of billing fraud. This is because most billing schemes succeed only when an individual has control over two or more of these functions. If these duties are strictly segregated, it will be very difficult for an employee to commit most forms of billing fraud. What are some of the ways shell company invoices can be identified? - Ans: Auditors, accounting personnel, and other employees should be trained to identify red flags relating to fraudulent invoices. One common red flag is a lack of details such as a telephone, fax, tax identification, or invoice number. Another common red flag is an invoice that lacks detailed descriptions of items ordered. Lastly, using a mail drop or residential address may also indicate a billing fraud scheme. All of these red flags should be investigated. What type of internal controls can be used to help prevent pay-and-return billing schemes? - Ans: pay-and-return schemes can be mostly prevented if the duties of the purchasing, authorizing, and payment functions are separated and if invoices are matched to purchase orders before payments are made. Also, incoming mail should never be delivered directly to an employee, but rather opened at a centralized point with all incoming checks being properly recorded. Organizations should also instruct their banks not to cash checks made payable to the company. There are five principal categories of check tampering frauds. What are they? - Ans: (1) forged maker schemes, (2) forged endorsement schemes, (3) altered payee schemes, (4) concealed check schemes, and (5) authorized maker schemes. Perpetrators of check tampering schemes must obtain a signature on the check. What are methods used to affix a signature to the check? - Ans: The perpetrator can simply write an authorized person's name on the check. A more elaborate method is to create a legitimate signature on a transparency and use it to place a signature on blank checks. Some companies use signature stamps or computerized signatures that a perpetrator can gain access to. The perpetrator may be an authorized signer and will simply sign a check himself. Finally, he may hide a tampered check in a group of legitimate checks and present them for signing by an authorized signer. What is an authorized maker scheme, and why are these frauds especially difficult to prevent through normal internal controls? - Ans: An authorized maker scheme is a type of check tampering fraud in which an employee with signature authority on a company account writes fraudulent checks for his own benefit and signs his own name as the maker. The perpetrator in these schemes can write and sign fraudulent checks without assistance. He does not have to alter a prepared instrument or forge the maker's signature. This may be the most difficult form of check tampering to defend against because in most cases check signers are owners, officers, or otherwise high-ranking employees, and thus have or can obtain access to all the blank checks they need. Even if a company's control structure ostensibly prohibits check signers from handling blank checks, the perpetrator typically has enough influence and authority to override this control. There are several duties that should be segregated among employees to minimize the opportunity for check tampering. List these duties. - Ans: Duties that should be segregated among employees include: (1) check cutting and posting, (2) check signing, (3) check delivery, and (4) bank statement reconciliations. Assume you are a new hire in the accounting department of an organization. One of your responsibilities is the reconciliation of the operating account. After the end of the month you are given a copy of the bank statement and the canceled checks and instructed to perform your reconciliation. You notice there are some faint markings on a portion of the bank statement that could be alterations. What steps would you take in performing the reconciliation? - Ans: The first oddity that should be noticed is that you were given a copy of the bank statement, not the original. This is an indication that the bank statement may have been manipulated. This is further evidenced by the faint markings noted on the copy. These could be from tape, correction fluid, or some other method used to hide the true data on the original bank statement. You should add the individual items on the statement and reconcile the totals to the amounts reported on the bank statement Each canceled check should be compared to the bank statement to ensure all canceled checks reported on the statement are included with the statement. A request should also be made to review the original bank statement and determine why you were given only a copy. A review of the age of reconciling items should be made and any old or unusual items investigated. A comparison should be made between each canceled check and the corresponding listing in the check register and the account to which it was posted. Finally, a review of endorsements may be prudent. There are two ways that an employee working on commission can fraudulently increase his pay. What are they? - Ans: A commissioned employee's wages are based on two factors, the amount of sales he generates and the percentage of those sales he is paid. In other words, there are two ways an employee on commission can fraudulently increase his pay: (1) falsify the amount of sales made (either by creating fictitious sales or by overstating the amount of legitimate sales), or (2) increase his rate of commission. If you suspect a salesperson is inflating his commissions, what would you do to determine if this were occurring? - Ans: If a salesperson is suspected of inflating his commissions, an examiner should compare the salesperson's commissions to those of other salespeople and to his sales figures to determine whether there is an appropriate correlation. Rates at which the salesperson is paid should be determined and verified with personnel or other company records. Proper segregation of duties should also be confirmed. Sue Meyers was an accounts receivable clerk for an insurance broker. When premium payments were received, she would steal the check of every tenth customer and cash it at a liquor store. To conceal her scheme, she would credit the account of the customer that she stole from with a payment that was received from another customer's account. This is an example of: - Ans: Lapping How is "skimming" defined? - Ans: Skimming is the theft of cash from a victim organization prior to its entry in the organization's accounting system. How do sales skimming schemes leave a victim organization's books in balance, despite the theft of funds? - Ans: When an employee skims money by making off-book sales of merchandise, neither the sales transaction nor the incoming cash is ever recorded. For example, suppose a cash register clerk skims $500 in receipts from one sale of goods. At the end of the day, his cash drawer will be short by $500—the amount of money that was stolen. But because the sale was never recorded, the sales records will be understated by $500. Therefore, the books will remain in balance. How do "understated sales" schemes differ from "unrecorded sales"? - Ans: Unrecorded sales schemes are purely off-book transactions. Understated sales, on the other hand, are posted to the victim organization's books, but for a lower amount than what the perpetrator collected from the customer. Typically, the perpetrator will understate a sale by recording a lower sales price for a particular item, or by recording the sale of fewer items of merchandise than the customer actually purchased. What is "lapping" and how is it used to conceal receivables skimming? - Ans: Lapping is the crediting of one account through the abstraction of money from another account. Lapping customer payments is one of the most common methods of concealing receivables skimming. Suppose a company has three ¬customers, A, B, and C. When A's payment is received, the fraudster takes it for himself instead of posting it to A's ¬account. When B's check arrives, the fraudster posts it as a payment to A's account. Likewise, when C's payment is received, the perpetrator applies it to B's account. This process continues indefinitely until one of three things happens: (1) someone discovers the scheme, (2) restitution is made to the accounts, or (3) some concealing entry is made to adjust the accounts receivable balances. Billy Hodges was in charge of preparing checks for the Lightner Company. He entered the payment information into the accounting system, and the completed checks were sent back to him to review. He then forwarded the checks to his supervisor for signing. In each batch of legitimate checks, Hodges would insert checks made payable to himself. When his supervisor was busy, he would take the stack of checks to him and ask him to sign them immediately in order to meet their cycle time deadline. The supervisor would inattentively sign the checks, and then Hodges would extract the checks he made payable to himself. This is an example of what type of check tampering scheme? - Ans: Concealed check scheme In altered payee schemes, the perpetrator changes the name of the intended third party and negotiates the check himself. This can be done by adding a second payee or changing the original payee's name. What is the best method for detecting this type of fraud? - Ans: The best way to detect an altered payee scheme is to include as part of the bank reconciliation process a comparison of canceled checks to the check register to ensure both payees are identical. Implied in this statement is the understanding that the person who performs the reconciliation must be independent of the check-cutting process. Most altered payee schemes are successful only when the perpetrator is in charge of reconciling the bank statement. What is a "ghost employee"? - Ans: refers to someone on the payroll who does not actually work for the victim company. The ghost employee may be a fictitious person or a real individual who simply does not work for the victim employer. When the ghost is a real person, he or she is often a friend or relative of the perpetrator. In some cases the ghost employee is an accomplice of the fraudster who cashes the fraudulent paychecks and splits the money with the perpetrator What is meant by the term "rubber stamp" supervisor and how are these individuals utilized in a payroll fraud scheme? - Ans: The term rubber stamp supervisor refers to a manager who approves timecards without reviewing their accuracy. This is a very serious breach in controls, because the role of the manager in verifying hours worked and authorizing timecards is critical to preventing and detecting payroll fraud. Obviously, rubber stamp supervisors play a part in payroll fraud in the sense that they fail to detect crimes that are otherwise detectable. In addition, the fact that a manager is known to approve timecards without reviewing them may provide the perceived opportunity that convinces an employee to attempt a payroll fraud scheme. The ability to add ghost employees to a company's payroll system is often the result of a breakdown in internal controls. What internal controls prevent an individual from adding fictitious employees to payroll records? - Ans: The most effective method of preventing an individual from adding fictitious employees to a company's payroll records is to segregate duties for payroll preparation, disbursement, distribution, and payroll account reconciliation. As long as these duties are separated, it is very difficult for a single individual to add ghosts to the payroll system. According to this chapter, what are the three main categories of payroll fraud? - Ans: A payroll scheme is an occupational fraud in which a person who works for an organization causes that organization to issue a payment by a making false claim for compensation. There are three main categories of payroll fraud: ghost employee schemes, falsified hours and salary schemes, and commission schemes. Orange Publishing hired Moe McDonnell, CFE, to investigate some large variances in the company's labor costs. While looking through the payroll records for the shipping department, McDonnell noticed several employees who claimed extensive overtime during pay periods in which the company's incoming and outgoing shipments were minimal. McDonnell pulled the timesheets for these pay periods and noticed that those belonging to the suspect employees had signatures that didn't match the signatures on the other timesheets. What type of fraud might these findings indicate? - Ans: Falsified hours and salary scheme During a review of A+ Service's payroll records, Judy Penney, an internal auditor, noticed that Bradley Banks has no deductions taken from his paychecks for withholding taxes or insurance. She then searched for Banks in the personnel records, but could not locate him. Based on this information, what type of scheme did Penney most likely uncover? - Ans: Ghost employee scheme Comparing salaried employees' gross pay from one pay period to the next is one way of testing for payroll fraud. - Ans: True Comparing actual payroll expenses to budget projections can help identify falsified hours and salary schemes. - Ans: True Which of the following computer audit tests can be used to detect ghost employee schemes? - Ans: All: a. Extract users who can write checks and also add new employees in the payroll and timecard system. b. Extract all employees without a social security number. c. Compare employees reported per timecard system to the payroll system. Which of the following controls will help prevent and detect falsified hours and salary schemes? - Ans: The duties of payroll preparation, authorization, and distribution are segregated. If an employee generates a much higher percentage of uncollected sales than his coworkers, what type of scheme might he be committing? - Ans: Commission scheme The most common method of misappropriating funds from the payroll is: - Ans: Overpayment of wages Which of the following analyses can be used to identify ghost employee schemes? - Ans: All: a. Identifying employees who have no withholding taxes taken out b. Comparing actual payroll expenses to budgeted expenses c. Comparing employees who have the same Social Security number, bank account, or physical address Salaried ghost employees are generally easier to create and more difficult to conceal than hourly ghost employees - Ans: True If a fraudster fails to remove a terminated employee from the payroll and collects the former employee's fraudulent paychecks, he or she is committing a: - Ans: Ghost employee scheme Marsha Wood added her one-year-old niece, Jackie, to the payroll at JNC Company and began issuing paychecks in Jackie's name, even though Jackie did not work for the organization. Marsha's niece is not considered a ghost employee because she is a real individual rather than a fictitious person. - Ans: False Which of the following is not necessary for a ghost employee scheme to succeed? - Ans: The perpetrator must have access to a bank account in the ghost employee's name. A _______________ is an individual on the payroll who does not actually work for the organization. - Ans: Ghost employee Melanie Diggers is an internal auditor for Atlantic Equipment Rental and Sales. While performing a routine review of one of the company's bank accounts, she noticed an unusual "adjusting entry" to the account on the general ledger. She also found that several checks that had cleared the bank in the last few months were absent from the stack of canceled checks. She requested copies of these checks from the bank and discovered that they were all made payable to the company's controller who has check signing authority on the account. The controller is also responsible for performing the bank reconciliation and recording month-end journal entries. Which of the following schemes do these signs most likely indicate? - Ans: Authorized maker scheme Kristen Diamond worked in the mailroom at B&R Industries. When attaching postage to the outgoing mail, she would search for payments being sent to a specific vendor, K. D. Sand. She intercepted these checks and carefully changed them to appear payable to K. Diamond. She then endorsed the checks with her own name and deposited them into her personal bank account. What type of scheme did Kristen commit? - Ans: "Tacking on" Methods used to manipulate electronic payments include which of the following? - Ans: All: a. Abusing legitimate access to the employer's payment system b. Gaining access to the employer's payment system through social engineering c. Exploiting weaknesses in the employer's internal control over its electronic payment system Concealing a check tampering scheme generally means hiding both the identity of the perpetrator and the fact that the fraud ever occurred. - Ans: True Which type of check tampering scheme is usually the most difficult to defend against? - Ans: Authorized maker To prevent altered payee schemes, the person who prepares the check should also review the check after it has been signed. - Ans: False To prevent and detect forged maker schemes, an organization should: - Ans: All: a. Separate the duties of check preparation and check signing. b. Rotate authorized check signers. c. Maintain a usage log for the signature stamp. In a forged maker scheme, the perpetrator fraudulently affixes the signature of an authorized maker to a check. - Ans: True The person who prepares and signs the check is known as the ______________ of the check. - Ans: maker To successfully carry out and conceal a check tampering scheme, the fraudster must have: - Ans: All: a. Access to the check stock b. Access to the bank statements c. The ability to forge signatures or alter other information on the check Check tampering includes both fraudulently preparing a company check for one's own benefit and intercepting a company check that is intended for a third party and converting it for one's own benefit. - Ans: True What is a pay-and-return scheme? List three examples of how this type of fraud can be committed. - Ans: In a pay-and-return scheme, an employee intentionally mishandles payments to a vendor and then steals the excess payment when it is returned by the vendor. Generally, the perpetrator either double-pays an invoice, intentionally makes a vendor payment for an excess amount, or sends a payment to the wrong vendor. In all cases, the perpetrator then contacts the non-accomplice vendor, explains that a "mistake" was made, and asks the vendor to return the excess payment to her attention. When the overpayment is returned, the fraudster steals it. Why does collusion among employees in the purchasing process make it very difficult to detect billing schemes? - Ans: One of the main purposes of a well-defined internal control system is to separate the duties of individuals who are involved in the purchasing process in order to prevent any one person from having too much control over a particular business function. It provides a built-in monitoring mechanism in which each person's actions are verified by another person. But, if everyone in this process works together to create fraudulent voucher documents, then billing schemes will be very difficult to detect. There are four ways in which fraudulent invoices are approved for payment. List and explain. - Ans: Fraudulent invoices are approved for payment by self-approval, by a rubber stamp supervisor, or through the normal internal control system by reliance on the authenticity of the false voucher the fraudster creates. In addition, collusion among several employees can overcome even well-designed internal controls and can enable fraudsters to obtain approval on bogus invoices. How is the term "billing schemes" defined, and what are the three categories of billing schemes covered in this chapter? - Ans: Billing schemes are frauds in which a perpetrator causes the victim organization to issue a fraudulent payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. The three categories of billing schemes are: shell company schemes, non-accomplice vendor schemes, and personal purchases schemes. Nicolas Hill, CFE, has been hired to look into suspicious activity at Mason & Jefferson, LLC. The company's controller has reason to believe that the company has fallen victim to a shell company scheme. As part of his investigation, Nicolas should do which of the following? - Ans: Review payments with little or no sequence between invoice numbers Eli Adams is an accounts payable clerk for MJF Productions. By forging signatures, he was able to procure a company credit card. He recently bought home stereo equipment and put it on his company credit card. When the credit card statement arrived at MJF, Eli prepared a check to the credit card company and buried the purchase in the monthly expenses of the company's largest cost center, knowing that his manager is generally inattentive when approving payments. What type of fraud is this? - Ans: Personal purchases scheme Sally Fuller is a buyer for GWA publishing company. Her job is to purchase supplies and services for the printing of technical manuals. Her brother sets up a printing company, and Sally hires him to print most of these manuals for GWA. However, rather than actually printing the manuals, her brother hires another printer to do the work, then sells the printed manuals to GWA at a 50 percent markup. As a result, his prices are much higher than the other printers who serve GWA. This type of scheme is most likely a: - Ans: Pass-through scheme Purchasing personal items using an organization's money is what type of scheme? - Ans: Billing scheme In a shell company scheme, which of the following methods might a fraudster use to get a phony invoice approved for payment? - Ans: All: a. Collusion b. A "rubber stamp" supervisor c. Falsification of purchase orders and receiving reports Which of the following actions is least likely to help prevent and detect schemes involving fraudulent invoices from non-accomplice vendors? - Ans: Matching all bank statement items to canceled checks Warning signs of a shell company scheme include which of the following? - Ans: All: a. Invoices lacking details of the items purchased b. A vendor that is not listed in the phone book c. An unexpected and significant increase in "consulting expenses" In order to start up a shell company, the fraudster will most likely need which of the following? - Ans: All: a. Certificate of incorporation b. Mailing address c. Bank account Invoices that are submitted by shell companies can be for fictitious goods or services or for items that were actually sold to the victim company. - Ans: True Fictitious entities created for the sole purpose of committing fraud are called: - Ans: Shell companies In a ______________ scheme, the perpetrator uses false documentation to cause a payment to be issued for a fraudulent purpose. - Ans: Billing Among the proactive audit techniques suggested in this chapter are the following: (1) a summary, by employee, of discrepancies between cash receipt reports and the sales register system; and (2) a summary, by employee, of discounts, returns, cash receipt adjustments, accounts receivable write-offs, and voids processed. Why would these two tests be effective in detecting cash larceny? - Ans: Because cash larceny involves the theft of on-book funds, it creates an imbalance on the victim organization's books. The first test suggested above would identify employees who tend to have these imbalances, which could signal larceny. This test would be particularly helpful in ¬identifying employees who have multiple, small imbalances that individually are too small to be investigated, but collectively can become quite large. In order to conceal imbalances caused by cash larceny, employees often process fraudulent adjusting entries to bring their cash receipt reports and register sales totals back into balance. The second audit test suggested above would test for this kind of activity by identifying employees who process an inordinate number of adjusting entries, which could be a result of efforts to hide cash larceny schemes. How is the larceny of receivables often detected? - Ans: This type of scheme might be detected by the delay between the time the payment is received and when it is posted to the books. Customer complaints of incorrect account balances are often a clue to a receivables skimming scheme. What are some basic internal control procedures to deter and detect cash larceny schemes? - Ans: The separation of duties related to cash receipts, deposits, and recording is a basic internal control to deter and detect cash larceny schemes. This includes segregation of authorization, recording, and custody functions for cash and related transactions. Assignment rotation, mandatory vacations, surprise cash counts, and physical security of cash can also assist in deterring and detecting cash larceny schemes. What is force balancing and how is it used to conceal cash larceny? - Ans: Force balancing involves the making of unsupported entries in an organization's books and records to produce a fictitious balance. For example, if an employee steals an incoming receivables payment after it has been posted to the appropriate customer account, this will create a shortage in the cash account because the amount of receipts posted will exceed the amount of receipts on hand. If the employee is able to make one or more unsubstantiated entries to cash in the amount of the stolen payment, he or she can eliminate the imbalance. What are the main weaknesses in an internal control system that permit fraudsters the opportunity to commit cash larceny schemes? - Ans: Cash larceny schemes can take place under any ¬circumstances in which an employee has access to cash; therefore, regular supervision and surveillance controls may prevent the opportunity for theft to occur. The lack of, or inadequate, separation of duties for receiving, recording, depositing, and disbursing cash permit cash larceny schemes to occur. What is the difference between cash larceny and skimming? - Ans: Both cash larceny and cash skimming schemes ¬involve theft of the victim company's funds. However, cash larceny involves the removal of money after it has been recorded in the company's books, whereas skimming involves the removal of cash before the funds appear on the books. In other words, cash larceny is an on-book fraud, whereas skimming is an off-book fraud. What is cash larceny? - Ans: Cash larceny involves the intentional taking away of an employer's cash without the consent, and against the will, of the employer. Cash larceny schemes involve the theft of money that has already appeared on the victim company's books. Danielle Boyle, CFE, was hired to investigate some suspicious activity in the accounts receivable department at Red Technologies. While examining the company's accounting records, she noticed several payments posted to customers' accounts that were later reversed with journal entries to "courtesy discounts." What type of scheme might this situation indicate? - Ans: Cash larceny of receivables Mel Turner, the runner for a small bookstore, had a bad habit of helping himself to cash from the deposit on the way to the bank. He covered his tracks by substituting a check from the next day's deposit for the amount he stole from the previous day's deposit. This is an example of what type of concealment? - Ans: Deposit lapping Jan Ashley worked for the R&S Department Store as a sales associate in the fine linens department. As she would give change back to a customer for cash sales, she would also pull out a $10 bill and slip it in her pocket. She concealed her scheme by issuing one false refund at the end of her shift for the total amount she stole that day. This is an example of what type of scheme? - Ans: Larceny at the point of sale Which of the following antifraud controls can help prevent and detect cash larceny from the deposit? - Ans: All: a. Having two copies of the bank statement delivered to different persons in an organization b. Comparing the bank authenticated deposit slip with the general ledger posting of the day's receipts c. Preparing the deposit slip to show each individual check and money order along with currency receipts The most important factor in preventing cash larceny from the deposit is: - Ans: Separating the duties of the deposit function To prevent cash larceny through falsification of cash counts, an independent employee should verify the cash count in each register or cash box at the end of each shift. - Ans: True The central weakness of a cash larceny scheme is the resulting imbalance in the organization's accounting records. - Ans: True Which of the following methods can be used to conceal a larceny scheme that occurred at the point of sale? - Ans: All: a. Falsifying the cash count b. Destroying the register tape c. Stealing from another employee's register Where do most larceny schemes involving cash occur? - Ans: At the point of sale Skimming involves the theft of money that has already appeared on a victim's books, while cash larceny involves stealing money before it has been recorded. - Ans: False What is the primary difference between cash larceny and skimming? - Ans: Cash larceny is an on-book scheme; skimming is an off-book scheme. Cash misappropriations are divided into two broad groups: fraudulent disbursements schemes and cash receipts schemes. - Ans: True While conducting an interview, you have reason to believe that the respondent is not being truthful. What type of questions will help you establish the respondent's credibility? - Ans: assessment ______________ questions are asked if you have a reasonable cause to believe that the respondent is responsible for the fraud under investigation. - Ans: admission seeking During the introductory phase of an interview, the respondent states that he won't provide any information unless he is promised confidentiality. In this situation, you should give in to his request to ensure that you get the information you are seeking. - Ans: false The purpose of informational questions is to gather unbiased, factual information. Which of the following is a type of informational question? - Ans: leading When asking informational questions, you should start with general questions and then proceed to specific questions - Ans: true An open question is a question that is worded in a way that makes it difficult to answer with a simple yes or no - Ans: true During an interview, when an interviewee repeatedly fiddles with a pen or picks lint from her clothing, she is giving non-verbal clues called: - Ans: manipulators During an interview, the respondent frequently uses the phrases "honestly" and "I swear to God." The respondent is giving a type of verbal clue known as: - Ans: oaths Private employers conducting an internal investigation are generally required to give Miranda warnings before commencing an admission-seeking interview with a non-union employee. - Ans: false Oral confessions are as legally binding as written confessions. - Ans: true Generally, there is nothing illegal about accusing an innocent person of misdeeds as long as: - Ans: all: a. The accuser has predication to believe the accused has committed an offense. b. The accusation is made under reasonable conditions and in private. c. The accuser does not take any action that is likely to make an innocent person confess. All notes taken by the interviewer should be preserved, as they may be needed if the case goes to trial. - Ans: true When obtaining a written statement during an admission-seeking interview, the investigator should prepare the statement for the confessor to sign - Ans: true