Download - 11e-Chp5-IM (1)
-
7/23/2019 11e-Chp5-IM (1)
1/34
CHAPTER 5
COMPUTER FRAUD AND ABUSE
Instructors Manual
Learning O!ecti"es:
1. Define fraud and describe the process one follows to perpetuate a
fraud.
2. Discuss who perpetrates fraud and why it occurs, including the
pressures, opportunities and rationalizations that are present in
most frauds.
3. Define computer fraud and discuss the different computer fraud
classifications.
4. Compare and contrast the approaches and techniues that are used
to commit computer fraud.
#uestions to e a$$resse$ in t%is c%a&ter'
!ho perpetrates fraud and why"
!hat is computer fraud, and what forms does it ta#e"
!hat approaches and techniues are used to commit computer fraud"
!hat is fraud, and how are frauds perpetrated"
(ason antici&ate$ t%e )ollo*ing +uestions t%at ,anage,ent *as going toas-'
1. !hat constitutes a fraud, and is the withholding problem a fraud"
2. $f this is indeed a fraud, how was it perpetrated" !hat moti%ated
Don to commit it"
3. !hy did the company not catch these mista#es earlier"
4. !as there a brea#down in controls"
&. !hat can the company do to detect and pre%ent fraud"
'. (ust how %ulnerable are computer systems to fraud"
)ur society has become increasingly dependent on accounting information
systems.
*s system comple+ity and our dependence on systems increase, companies
face the growing ris# of their systems being compromised.
Page . o) /0
Intro$uction
-
7/23/2019 11e-Chp5-IM (1)
2/34
* recent sur%ey disclosed that
'- of companies had a security breach
)%er 4&- were targeted by organized crime
'- reported financial losses.
/he )our t1&es o) t%reatsa company faces are e+plained in Tale 52.onPage .0/
Four T1&es O) S1ste,s T%reats'
.3 Natural an$ &olitical $isasters
43 So)t*are errors an$ e+ui&,ent ,al)unctions
/3 Unintentional acts
03 Intentional acts co,&uter cri,es6
.3 Natural an$ &olitical $isasters
0ires, e+cessi%e heat, floods, earthua#es, high winds, war
and attac#s by terrorists
!orld /rade Center in ew or# City
0lood in Chicago
ea%y ains 5ississippi and 5issouri i%ers
6arthua#es in 7os *ngeles and 8an 0rancisco
*ttac#s on 9o%ernment $nformation 8ystems by 0oreign
Countries, 6spionage *gents and /errorists
43 So)t*are Errors An$ E+ui&,ent Mal)unctions
7osses due to software bugs at almost ' billion a year.
5ore than '- of the companies studied had significant
software errors in the pre%ious year. 0or e+ample,
;ugs in new ta+ accounting system were to blame for
California
-
7/23/2019 11e-Chp5-IM (1)
3/34
* software bug in ;urger =ing- of security problems.
0orrester esearch estimates that employees unintentionally
create legal, regulatory or financial ris#s in 2&- of their
outbound e?mails.
@rogrammers ma#e logic errors. 6+amples include the
following::
$n (apan, a data entry cler# at 5izuho 8ecurities
mista#enly #eyed in a sale for '1, shares of (?Com
for 1 yen instead of the sale of 1 share for '1,
yen. /he error cost the company 2& million.
* ban# programmer mista#enly calculated interest for
each month using 31 days. esulted in o%er 1, in
e+cess interest paid.
*n error in a 0annie 5ae spreadsheet resulted in a
1.2 billion misstatement of its earnings.
A@8 lost a cardboard bo+ with computer tapes
containing information, such as names, 8ocial 8ecurity
numbers, account numbers and payment histories on 3.B
million Citigroup customers.
/reasury Department mista#e in interest rate >.'-that should ha%e been '.>-. /his was caught before
the chec#s were sent out could ha%e resulted in
o%erpayments of o%er 14 million.
Note to Instructor' T%e )ollo*ing e7a,&le is not in t%e ..t%
e$ition o) t%is oo-3 Ho*e"er8 it *as in t%e .9t%e$ition o)t%e oo-3
* data entry cler# at 9iant 0ood mista#e in uarterly
di%idend 2.& should be .2&. esulted in 1
million in e+cess di%idends
03 Intentional Acts Co,&uter Cri,es6
/he most freuent type of computer crime is )rau$. /his iswhere the intent is to steal something of %alue.
/he threat can also be in the form of saotage, in which theintent is to destroy or harm a system or some of its
components.
Page / o) /0
-
7/23/2019 11e-Chp5-IM (1)
4/34
$nformation systems are increasingly %ulnerable to attac#.
$n a recent three?year period, the number of networ#s that
were compromised rose -
6+ample of Securit1 Breac%es, consider the case of)pen/able, a restaurant reser%ation ser%ice that did not
design its coo-ieproperly.
* Coo-ieis data that !eb sites store on yourcomputer. /he coo#ie identifies the !eb sites to your
computer and identifies you to the !eb site so you do
not ha%e to log on each time you %isit the site.
*t )pen/able, the customer number stored in the
coo#ie was %ery easy to change.
*n e+perienced programmer opened an account at
)pen/able and, in less than an hour, wrote a
program that cycled through all the customer
numbers and downloaded most of the company
-
7/23/2019 11e-Chp5-IM (1)
5/34
&. *n inury or loss suffered by the %ictim
Atte,&ts To Esti,ate T%e Staggering Losses Fro, Frau$'
/he *ssociation of Certi)ie$ Frau$ E7a,inersestimates totalfraud losses in the Anited 8tates to be about ;>'
Frau$ta#es t*o )or,s
Misa&&ro&riationof *ssets and
Frau$ulent0inancial eporting
Misa&&ro&riation o) Assets
Misa&&ro&riation o) Assetsoften referred to as E,&lo1eeFrau$
8ome e+amples include:
*lbert 5iano, a,anagerat eader
-
7/23/2019 11e-Chp5-IM (1)
6/34
Note to Instructor' T%e )ollo*ing e7a,&le isnot in t%e ..t%e$ition o) t%is oo-3 Ho*e"er8it *as in t%e .9t%e$ition o) t%e oo-3
$t was disco%ered that the,anagerstillhad an acti"e accountand&ass*or$as thefirm where he was fired
8o, the manager was able to
regularly browse the old newspaper
company
-
7/23/2019 11e-Chp5-IM (1)
7/34
usually on an e+tra%agant lifestyle. arely do
they sa%e or in%est the money they ta#e. 8ome of
these high cost lu+urious items include, big
homes, fancy cars, gambling or ust a big
spender type person
5any perpetrators that become greedy, not only
start ta#ing greater amounts of monies, but also
ta#e the monies more often.
*s pre%iously mentioned, perpetrators at some
point start getting bra%er and grow careless or
o%erconfident. /his is the point where they can
also ma#e a mista#e and get caught.
/he fraud perpetrator cannot get away with
stealing cash or property fore%er. *t some
point, although it may ta#e some time, they are
going to get caught.
/he most significant contributing factors inmost employee frauds is the absence of internal
controls or failure to enforce e+isting internal
controls.
*fter all, if a person that is already
dishonest in hisJher nature if they find
out the management is not concerned about
internal controls
this ma#es it %ery easy for them to
become a fraud perpetrator and start
stealing cash or property
Frau$ulent Financial Re&orting
/he Trea$*a1 Co,,issiondefined )rau$ulent )inancialre&ortingas intentional or rec#less conduct, whether by actor omission, that results in materially misleading financial
statements
/he /readway Commission studied 4& lawsuits against
auditors and found undetected fraud to be a factor in
half of them.
8ome prime e+amples are 6nron, !orldCom, /yco,
*delphia, ealth8outh, 9lobal Crossing and Kero+.
6+ecuti%es coo# the boo#s, as they say, by fictitiously
inflating re%enues, recognizing re%enues before they are
earned, closing the boo#s early Edelaying current period
e+penses to a later periodF, o%erstating in%entories or
fi+ed assets, and concealing losses and liabilities.
/he /readway Commission recommended )our actionsto reducethe possibility of fraudulent financial reporting:
Page = o) /0
-
7/23/2019 11e-Chp5-IM (1)
8/34
1. 6stablish an organizational en%ironment that
contributes to the integrity of the financial
reporting process.
2. $dentify and understand the factors that lead to
fraudulent financial reporting
3. *ssess the ris# of fraudulent financial reporting
within the company
4. Design and implement internal controls to pro%ide
reasonable assurance that fraudulent financial
reporting is pre%ented.
* study by the *ssociation of Certified 0raud 6+aminers found that
misappropriation of assets by employees is more than 1 times more
li#ely than fraudulent financial reporting.
SAS No3 >>' T%e Au$itors Res&onsiilit1 to Detect Frau$
SAS No3 >> re+uires au$itors to:
Anderstand fraud
Discuss the ris#s of material fraudulent misstatements
)btain information
$dentify, assess and respond to ris#s
6%aluate the results of their audit tests
Document and communicate findings
$ncorporate a technology focus
Multi&le C%oice 4
/he *ssociation of Certified 0raud 6+aminers estimates total fraud
losses in the Anited 8tates to be o%er
a. 3& billion a year
b. '' billion a year
c. 1 billion a year
d. > billion a year
Multi&le C%oice /
!hich of the following statements is false"
a. 0or an act to be fraudulent there must be a false
statement, representation, or disclosure.
b. 0raud perpetrators are often referred to as management
fraud.
c. 5isappropriation of assets is often referred to as
employee fraud.
d. 8*8 o. >2 was adopted in 1BB.
Page o) /0
-
7/23/2019 11e-Chp5-IM (1)
9/34
@%o Per&etrates Frau$ an$ @%1 It Occurs
@erpetrators of computer fraud tend to be younger and possess more
computer #nowledge, e+perience, and s#ills
8ome hac#ers and computer fraud perpetrators are more moti%ated by
curiosity, a uest for #nowledge, the desire to learn how things
wor#, and the challenge of Gbeating the system.H
5ost ha%e no pre%ious criminal record
esearch shows that three conditions are necessary for fraud to
occur: a&ressure, an o&&ortunit1, and a rationaliation. /his isreferred to as the fraud triangle and is shown as the middle
triangle in Figure 52.on Page .0.
Pressures
* pressure is a person. Tale 52/on Page .59pro%ides the pressures that can lead tofinancial statement fraud.
O&&ortunities
*s shown in the opportunity triangle in Figure 52.on Page .0,o&&ortunit1is the condition or situation that allows a person ororganization to do three things:
.3 Co,,it t%e )rau$
5ost fraudulent financial reporting consists of the
o%erstatement of assets or re%enues or the understatement of
liabilities, or the failure to disclose information.
43 Conceal t%e )rau$
* common and effecti%e way to hide a theft is to charge the
stolen item to an e+pense account. 0or e+ample, charge
supplies to an e+pense account when they are initially
purchased before they are used. /his allows the perpetrator
the opportunity to use some of the supplies for personal
benefit at the e+pense of the company. /hese unused supplies
Page > o) /0
Learning O!ecti"e T*o
Discuss *%o &er&etrates )rau$ an$ *%1 it occurs8inclu$ing t%e &ressures8 o&&ortunities an$rationaliations t%at are &resent in ,ost )rau$s
-
7/23/2019 11e-Chp5-IM (1)
10/34
should ha%e been recorded as an asset called 8upplies until
they are used.
*nother way to hide a decrease in assets is by la&&ing. $n ala&&ing scheme, the perpetrator steals the cash or chec#that customer * mails in to pay its accounts recei%able.
0unds recei%ed at a later date from customer ; are used to
pay off customer *
-
7/23/2019 11e-Chp5-IM (1)
11/34
BAN A BAN B PERPETRATOR BAN C
:. .. .8999 c%ec- .8999 Bal3 2.8999 .. Bal3 .8999 NSF $ue on ./ :4 .4 @D 2.8999 .4 .8999
Bal3 292 No NSF Due
./ .8999 :/ ./ .8999 c%ec- Bal3 292 Bal32.8999 No NSF Due NSF Due .5 :0 .5 .8999 c%ec- .8999 Bal3 2.8999 Bal3 292 NSF Due .= No NSF Due De&osit .8999.
Note :.' At t%is &oint t%e &er&etrator ,a1 *ant to $e&osit t%e ;.8999 %e %as %a$ )or 5 $a1s .4t%roug% .
-
7/23/2019 11e-Chp5-IM (1)
12/34
T%is &age is le)t lan- intentionall1J
Page .4 o) /0
-
7/23/2019 11e-Chp5-IM (1)
13/34
Rationaliations
ationalization allows perpetrators to ustify their illegal
beha%ior.
A list o) so,e o) t%e rationaliations &eo&le use'
$ am only GborrowingH the money Eor assetF and will
repay my Gloan.H
ou would understand if you #now how badly $ needed it
!hat $ did was not that serious
$t was for a good cause Ethe obin ood syndrome,
robbing from the rich to gi%e to the poorF.
$ occupy a %ery important position of trust. $ am
abo%e the rules.
6%eryone else is doing it, so it is not that wrong.
o one will e%er #now
/he company owes it to me, and $ am ta#ing no more
than is rightfully mine
Multi&le C%oice 0
/he three conditions that are present when fraud occurs includes:
a. *ttitude
b. )pportunity
c. 7ac# of controld. 0inancial
Multi&le C%oice 5
/he pressures that can lead to employee fraud include
a. 0ear of losing ob
b. 7ac# of control
c. @oor performance ratings
d. 0amilyJpeer pressure
e. * and D
Multi&le C%oice ,.
/hree?fourths of the fraud offenses are committed by college?educated
white males. /he data indicate that about &> percent of the reported
fraud and abuse cases were committed by nonmanagerial employees, 3
percent by managers, and 12 percent by ownerJe+ecuti%es. 5edian losses
caused by e+ecuti%es were 1' times those of their employees. /he %ictims
in this report are organizations. /he most costly abuses occurred in
firms with less than 1 employees. Common %iolations include asset
Page 4 o) /0
-
7/23/2019 11e-Chp5-IM (1)
29/34
misappropriation, corruption, false financial statements, false
o%ertime, petty theft and pilferage, use of company property for
personal benefit, and payroll and sic# time abuses.
/he *ssociation of C06
-
7/23/2019 11e-Chp5-IM (1)
30/34
the super%isory pri%ileges to ma#e networ# additions, changes, and
deletions. $n the wa#e of the damage caused by the logic bomb, )mega has
installed state?of?the?art internal controls, and the firm will no
longer put all it eggs in one bas#et. $t is ma#ing sure that duplicates
of all data?base information, software code, and files are stored off?
site.
Q*dapted from =im 9irard, G6+?6mployee abbed in 15 ac# *ttac#,H
Computerworld, 0ebruary 2>, 1BB> p. '.
Note to t%e Instructor' T%e )ollo*ing is ta-en )ro, t%e Certi)ie$ Frau$E7a,iners Manual t%at inclu$es a$$itional in)or,ation regar$ing )rau$sc%e,es t%at ,a1 e inclu$e$ )or t%e stu$ents3
65@7)66 0*AD 8C6568
Cash
Cash is the focal point of most accounting entries. Cash, both on
deposit in ban#s and petty cash, can be misappropriated through manydifferent schemes. /hese schemes can be either on?boo# or off?boo#,
depending on where they occur. 9enerally, cash schemes are smaller than
other internal fraud schemes because companies ha%e a tendency to ha%e
comprehensi%e internal controls o%er cash and those internal controls
are adhered to. Cash fraud schemes follow general basic patters,
including s#imming, %oidsJunderrings, swapping chec#s for cash,
alteration of cash receipts tapes, fictitious refunds and discounts,
ournal entries and #iting.
8#imming
8#imming in%ol%es remo%ing cash from the entity before the cash is
recorded in the accounting system. /his is an off?boo# scheme receiptof the cash is ne%er reported to the entity. * related type of scheme is
to ring up a sale for less than the actual sale amount. E/he difference
between the actual sale and the amount on the cash register tape can
then be di%erted.F /his is of particular concern in retail operations
Efor e+ample, fast food restaurantsF where much of the daily sales are
in cash, and not by chec# or credit card.
6K*5@76
Accor$ing to an in"estigation8 )are re"enues on t%e C%icagoTransit Aut%orit1s CTA6 rail s1ste, allege$l1 *ere
,isa&&ro&riate$ 1 agenc1 e,&lo1ees3 T%e statistics in$icate t%att%e t%e)ts are not con)ine$ to t%e one station t%at originall1 *as
sus&ecte$ an$ t%at t%e )are2s-i,,ing 1 transit *or-ers ,ig%t %a"eeen re$uce$ 1 ne*s o) t%e in"estigation3 IN t%e )our $a1s a)terre&orts o) s-i,,ing sur)ace$8 aout ;=>48999 *as turne$ in 1station agents s1ste, *i$e3 In a si,ilar Mon$a1 t%roug% Fri$a1
&erio$ onl1 ;=4/8999 *as turne$ in 1 station agents3
CTA o))icials esti,ate$ t%at a &lanne$ installation o) a ;/,illion auto,ate$ )are2collection s1ste, *oul$ eli,inate ;
-
7/23/2019 11e-Chp5-IM (1)
31/34
t%e)t3 At least .9 *or-ers %a"e een in"estigate$8 inclu$ing ninetic-et agents an$ one su&er"isor or cler-3 Earl1 re&orts in$icate$t%at agents &oc-ete$ ,one1 a)ter recor$ing trans)er or ,ont%l1
&asses as cas%2&a1ing custo,ers &asse$ t%roug% turnstiles3
LoidsJAnder?ings
/here are three basic %oidsJunder?ring schemes. /he first is to record a
saleJcash receipt and then %oid the same sale, thereby remo%ing the cash
from the register. /he second, and more common %ariation, is to purchase
merchandise at unauthorized discounts. /he third scheme, which is a
%ariation of the unauthorized discount, is to sell merchandise to a
friend or co?conspirator using the employee
-
7/23/2019 11e-Chp5-IM (1)
32/34
Au$itors $etecte$ t%e $ela1e$ transactions $uring an unannounce$cas% count3 On t%e $a1 o) t%e count8 t%e )un$ custo$ian %a$ onl1 a)e* %un$re$ $ollars in %is an- account con)ir,e$ 1 tele&%oneu&on recei&ts o) custo$ians aut%oriation63 @%en all 4/ &ersonalc%ec-s *ere $e&osite$ in t%e $istricts account8 se"eral *erereturne$ as NSF3 A)ter &a1$a18 all NSF c%ec-s suse+uentl1 cleare$t%e an-3 T%e custo$ians e,&lo1,ent *it% t%e $istrict *aster,inate$3
Alteration o) cas% Recei&ts $ocu,entation
* lac# of segregation of duties can create an opportunity for an
employee to misappropriate company funds. 0or e+ample, if the same
person is responsible for both collecting and depositing the cash
receipts, then this person has the opportunity to remo%e funds from the
business for his own personal use and conceal such theft through the
deposits. /his is often the case in smaller organizations where there
are few personnel to di%ide the daily operations. * %ariation of this
scheme is to mutilate or destroy the cash receipts documentation so that
any attempt to reconcile the cash deposited with the cash receipts is
thwarted.
EAMPLE
An electe$ count1 treasurer allege$l1 stole ;
-
7/23/2019 11e-Chp5-IM (1)
33/34
uni"ersit13 T%e ,one1 *as allege$l1 ta-en )ro, t%e TuitionAssistance Progra,8 o&erate$ 1 t%e Ne* Kor- State Hig%erE$ucation Ser"ices Cor&oration to &ro"i$e e7&enses ,one1 to nee$1stu$ents3 Ho*e"er8 NKU o))icials assert t%at t%e )un$s ca,e )ro, aUni"ersit1 account8 not )ro, State ,one13
Mal)ricis !o *as to assure t%at stu$ents entitle$ to )un$s )ro,t%e Cor&oration recei"e$ t%eir c%ec-s3 Accor$ing to t%e U3S3
Attorne18 s%e arrange$ )or c%ec-s to e ,a$e out to %un$re$s o)legiti,ate NKU stu$ents *%o *ere not entitle$ to recei"e an1)un$s3 T%ese stu$ents *ere -e&t una*are o) t%is ecause t%e c%ec-s
*ere $e&osite$ into an- accounts in Man%attan an$ Ne* (erse1 t%atallege$l1 *ere controlle$ 1 t%e Mal)ricis3 T%ese c%ec-s *ere ,a$eo"er to Eliaet% Pa&&a e)ore eing $e&osite$ into accounts int%at na,e3 So,e ot%er c%ec-s *ere ,a$e &a1ale $irectl1 to Pa&&a3T%e FBI *as unale to locate Eliaet% Pa&&a an$ elie"es t%atsuc% a &erson ne"er e7iste$3 Re&orte$l1 t%e Mal)ricis s&en$;=58999 o) t%e )un$s in +uestion on e7&ensi"e !e*elr1 an$ ;58999
o) t%e ,one1 on Flori$a real estate3
=iting
=iting is the process whereby cash is recorded in more than one ban#
account, but in reality, the cash is either none+istent or is in
transit. =iting schemes can be perpetrated using one ban# and more than
one account or between se%eral ban#s and se%eral different accounts.
*lthough ban#s generally ha%e a daily repot that indicates potential
#iting schemes, e+perience has shown that they are somewhat hesitant to
report the scheme until the balance in their customers< accounts is
zero.
/here is one important element to chec# #iting schemes: all #iting
schemes reuire ban#s to pay on unfunded deposits. /his is not to say
that all payments on unfunded deposits are #iting schemes, but rather,
that all #iting schemes reuire payments be made on unfunded deposits.
$n other words, if a ban# allows its customers to withdraw funds on
deposits that the ban# has not yet collected the cash, then #iting
schemes are possible. $n today
-
7/23/2019 11e-Chp5-IM (1)
34/34
Cut o)) )ro, S1l"ias su&&l1 o) cas%8 ran$ones account *it% t%eBan- o) Boston *as le)t o"er$ra*n 1 ;>9=89993 ran$one *asor$ere$ to ,a-e restitution to t%e Ban- o) Boston3