finding payroll fraud using audit software

2/27/2014

1

Copyright © FraudResourceNet LLC

Finding Payroll Fraud Using Audit Software

Special Guest Presenter:Donald E. Sparks, CIA, CISA, CRMA

February 27, 2014


President and Founder of White Collar Crime 101

• Publisher of White-Collar Crime Fighter• Developer of FraudAware® Anti-Fraud Training • Monthly Columnist, The Fraud Examiner, ACFE Newsletter

Member of Editorial Advisory Board, ACFE

Author of “Fraud in the Markets”

• Explains how fraud fueled the financial crisis.

About Peter Goldmann, MSc., CFE

2/27/2014

2


About Jim Kaplan, MSc, CIA, CFE

• President and Founder of AuditNet®, the global resource for auditors (now available on Apple and Android devices)

• Auditor, Web Site Guru,

• Internet for Auditors Pioneer

• Recipient of the IIA’s 2007 Bradford Cadmus Memorial Award.

• Author of “The Auditor’s Guide to Internet Resources” 2nd Edition


About Don Sparks, CIA, CISA, CRMA, CRMA, ARM

• Vice President Industry Relations -Audimation Services, Inc.

• Property/casualty insurance internal audit experience (12 yrs. as CAE)

• Risk Services firms

• The IIA – eLearning: GAIN, Flash Surveys, & Role of Audit in SOX 2002 monthly 2 hour web tv broadcasts

• NAIC IT Working Papers Committee

• Co-Author of GTAG 13 & GTAG 16

• June 2011, Creator & Programmer Auditchannel.tv

Don Sparks

2/27/2014

3


This webinar and its material are the property of FraudResourceNet LLC. Unauthorized usage or recording of this webinar or any of its material is strictly forbidden. We are recording the webinar and you will be provided with a link access to that recording as detailed below. Downloading or otherwise duplicating the webinar recording is expressly prohibited.

Webinar recording link will be sent via email within 5-7 business days.

NASBA rules require us to ask polling questions during the Webinar and CPE certificates will be sent via email to those who answer ALL the polling questions

The CPE certificates and link to the recording will be sent to the email address you registered with in GTW. We are not responsible for delivery problems due to spam filters, attachment restrictions or other controls in place for your email client.

Submit questions via the chat box on your screen and we will answer them either during or at the conclusion.

After the Webinar is over you will have an opportunity to provide feedback. Please complete the feedback questionnaire to help us continuously improve our Webinars

If GTW stops working you may need to close and restart. You can always dial in and listen and follow along with the handout.

Webinar Housekeeping


The views expressed by the presenters do not necessarily represent the views, positions, or opinions of FraudResourceNet LLC (FRN) or the presenters’ respective organizations. These materials, and the oral presentation accompanying them, are for educational purposes only and do not constitute accounting or legal advice or create an accountant‐client relationship.

While FRN makes every effort to ensure information is accurate and complete, FRN makes no representations, guarantees, or warranties as to the accuracy or completeness of the information provided via this presentation. FRN specifically disclaims all liability for any claims or damages that may result from the information contained in this presentation, including any websites maintained by third parties and linked to the FRN website

Any mention of commercial products is for information only; it does not imply recommendation or endorsement by FraudResourceNet LLC

6

Disclaimers

2/27/2014

4


Session Objectives

Costliest forms of internal and external payroll fraud

Who commits payroll fraud

Gathering data for effective payroll fraud data analysis

Powerful and user‐friendly audit automation tests

Techniques for detecting red flags of payroll frauds

Using data analytics to improve payroll internal controls


Agenda

What does Payroll Fraud look like?

Red Flags for audit

Who should conduct the audit

What is your client’s policy on data access, transmission, storage and destruction

Planning to find fraud

Payroll Cycle Data Analytics Objectives

Audit tests

2/27/2014

5


Payments to terminated employees, falsifying payroll records and other payroll schemes including “Ghost” employees:

Cost organizations $48,000 per incident

Last 36 months before detection

Duration is longer than any other form of internal fraud

Payroll is typically a large portion of operating expenses

Payroll fraud happens at all job grade levels

Fraud: The Big Picture

According to the Association of Certified Fraud Examiners 2012 Report to the Nations survey results


As a manager, what type of internal auditor should you assign to conduct a

payroll audit?

Dependable and curious

Analytical, good with data analysis tools

Confidential and discrete

All of the above

Polling Question 1

2/27/2014

6


Individuals listed in the payroll register who are not providing services, but who are receiving a payroll check.

Terminated

Fictitious

No‐show

Temporary

Family

Rehire

PreemploymentThe Fraud Audit: Responding to the Risk of Fraud in Core Business Systems by Leonard W. Vona

Copyright © 2011 John Wiley & Sons, Inc.

Ghost Employee DefinedThe Fraud Audit: Responding to the Risk of Fraud in Core Business Systemsby Leonard W. VonaCopyright © 2011 John Wiley & Sons, Inc.

The Fraud Audit: Responding to the Risk of Fraud in Core Business Systemsby Leonard W. VonaCopyright © 2011 John Wiley & Sons, Inc.




A Florida university fired 41 employees after an internal audit revealed some of them collected a paycheck week after week even though it appears they did no work. The cost to the university: $1.1‐million in annual salaries.

Some did not show up for work. Others left early to go to other jobs off campus. And some got paychecks from the school even though they lived in a different state, according to the audit.

The university also is asking authorities, including the state attorney, to investigate whether nearly another 100 employees who have received a combined $4.7‐million in annual salaries may have done the same thing.

The initial findings of the university's payroll audit released Thursday showed how widespread the school's financial mismanagement was.

The audit found "ghost employees" ‐ people on the payroll who did little real work ‐ in departments across the university, both at the main campus and branch offices. It's not clear how long this went on.

Colleges & Universities

2/27/2014

7


One police officer went shopping at a suburban mall. Another grabbed some food at a restaurant. And a third officer took a trip to the Caribbean.

That’s what the Police Department says.

Problem: The officers were all on sick leave. And they were required to stay home to recuperate unless they called a supervisor first to say where they were going.

Police investigators conducted surveillance and documented them leaving their homes. But none of them contacted their supervisors beforehand, according to the department.

Those cases are among about 1,800 that have been investigated by the department’s Medical Integrity Unit, which was formed in 2009.

As a result of the investigations, the department is seeking to fire 14 officers for alleged violations of the medical policy. Another 19 face possible suspensions and about 70 have received lesser forms of discipline, according to the department.

Large City Police Department


A former employee was sentenced to 32 months in prison on Wednesday after he admitted perpetrating multiple frauds under the guise of performing undercover work as a CIA agent.

Investigation revealed misleading and false statements dating back to hiring by the agency in 1988, followed by payment of retention incentive bonuses amounting to 25% of his salary authorized for a maximum of six years that continued for 22 years. In 1994, as an employee, began falsely claiming to be a CIA agent, a lie that became the core of his scheme to justify frequent absences from the office between 2000 and 2013. Additionally, he cited malaria contracted during Army service in Vietnam – although he neither had malaria nor served in Vietnam – as the basis for obtaining subsidized parking.

The employee also committed travel fraud involving vouchers, lodging, first‐class air accommodations and misuse of a government passport. The frauds were discovered after he was honored at a retirement party in September 2011 but remained on the agency’s payroll until April 2013, when he officially retired. The agency’s Office of General Counsel referred the case to the Office of Inspector General in February 2013.

U.S. Federal Government

2/27/2014

8


County Clerk of Court hired son's live‐in girlfriend as $56,000 executive assistant.

The County's new clerk of court has a close relationship with his personal secretary: potential father‐in‐law. Clerk of Court personally hired and decided to pay her $56,000 a year costing taxpayers $16,000 more than his office's other executive assistant because she is bi‐lingual, Chief Deputy Clerk confirmed.

Two months after being hired she was promoted with her pay raised to $104,000.

Small County Government


Where are good sources for ideas for data analytics to be used in your payroll audit?

A. Local Newspapers and book stores

B. Data Analysis provider websites

C. Internal Audit Conferences/speakers

D. All of the above

Polling Question 2

2/27/2014

9


Changes to wiring information

Terminated—in the last four pay periods prior

to termination

Pre‐employment — after the first pay period prior to the second pay period

Rehire—at the start of the rehire period

Fictitious or no‐show—highest allowable exemptions

Temporary—temporary employment status

Family—bank account number same as another employee

Red Flags of Payroll Fraud


Employee (routing number as basis)

Nonparticipation in benefit program

Missing documentation

Similar handwriting to supervisor

No personal, sick, or vacation time

No company telephone number

Red Flags (continued)

2/27/2014

10


No company computer login ID

No security access records

Use of a common name

No physical address

Missing company employee information

Invalid Social Security number

Last name & city of origin same as another employee

Address same as another employee (zip code or city as basis)

Telephone number same as another employee

Lack of work log or evidence of performance

Red Flags (missing data)


Abnormal frequency of adjustment

Abnormal amount of adjustment

No original source documentation for adjustment

Awareness: Pattern of use of adjustments by one department or manager

Red Flags (Adjustments)

2/27/2014

11


Changes to time card (post‐submission or post‐approval)

Missing time card

Hours using computer do not align with hours reported

Hours in and out in security system do not align with hours reported

Hours using machinery/equipment do not align with hours reported

Hours match a day where the company employee took sick, annual, or holiday leave or a weekend

Red Flags (Overtime )


Alteration of time card

Forged approval

Consistency in overtime hours reported

Increase in hours reported

Lack of firsthand knowledge by supervisor of hours worked

Red Flags (Awareness)

2/27/2014

12


Who Should Conduct the Audit

Anybody, Everybody, Nobody, Somebody

Skill sets: analytics, confidentiality, integrity

Knowledge can be powerful but in the wrong hands it can also be dangerous

Workers Compensation Premium auditors


Understand the Business

Most important, the auditor needs to understand what fraud looks like in the client’s data! Anything is likely to happen if you are looking. Also, have an Incident Response Plan already in place.

2/27/2014

13


What is the key to finding fraud in the payroll process?A. Know the business

B. Know what fraud looks like in the data

C. Keep an open door policy in internal audit

D. All of the above

Polling Question 3


Governance ‐Data Access

Understand the client’s company policy on data access, transmission, use, storage and destruction of data. Payroll data includes high levels of Personal Identifying Information (PII) resulting in civil and criminal actions if it lands in the wrong hands. In many organizations placing payroll data in a laptop or personal desktop computer or carrying the data around on a USB drive is not permissible.

2/27/2014

14


What does PII stand for?

A. Proper Internal Information

B. Personal Identifying Information

C. Please Indicate Instructions

D. Possible Identifying Information

Polling Question 4


What’s In Your Tool Box?

Audit TestActivity

Occurance/existance

Accuracy/valuation

Completeness Cutoff Classify Disclosure

Inspection

Observation

Reconciliation

Data Analysis

Interview

Tracing

Vouching

2/27/2014

15


Red Flags During the Audit

When asked to provide data, documentation or information during the audit:

Reluctance to share information

Fails to respond

Response faster than the data could be retrieved

Funnels all questions & client responses throw them

Appears fabricated and/or manipulated


Planning to Find Fraud

Process

Players

Data

Environment

Develop the Fraud Schemes

Develop the Audit Procedures

Develop the Fraud Triggers

Source: Fraud Brainstorming – Planning to find fraud

by Ryan Hobbs, The Fraud Magazine July/August 2012 pg 46‐53.

2/27/2014

16


Assess the Data

Payroll Database Key Fields

Employee Name Hours worked

Address Pay Date

Social Security Number Pay Type (regular pay, commission, bonus)

Job Title Date of Hire

Unique Employee Number Termination Date

Bank Account Number Bonus Eligibility

Gross Pay Other data fields?

Net Pay


Information Nice to Have

Computer Access Listing & Last Activity from IT Employee Listing from Payroll & 100% Alignment with AccessCross Reference IT to Active Employees Paid Review Employees with High Withholding Exemptions Review Employees with Low (or no) Tax Withholdings Request Data of Employees with No Voluntary Deductions Request a No‐PTO‐Used Report for Employees File from HR of Employees with No Changes > 6 Months Request a Listing of Employee & Deposit AccountsTime card system data

2/27/2014

17


Risk Assessment

Employee name duplicated in payroll master

Terminated employees active in payroll master

Pay checks going to invalid employees

Paid while on unpaid leave of absence

Overtime excessive or non‐existent

Paid for more hours worked

Paid unusually large bonus(es)


Risk Assessment(2)

Commissions calculated incorrectly

Unauthorized wage increases

Unauthorized pay rates

Deductions or taxes calculated incorrectly

Unauthorized amounts withheld from pay

Improper payroll recording causes GL error

Employees

2/27/2014

18


All fraudsters have one thing in common:

A. They think they are smarter than everyone else

B. Do not like a cut in pay

C. Do not respect authority

D. Believe it is ok to disobey orders

Polling Question 5


Payroll Data Analytics Demo

1. Check Control Totals

2. Identify “negative pay”

3. Total Pay by Employee

4. List Top 5 Gross Pay

5. Locate employees with same social security number

2/27/2014

19


Payroll Data Analytics Demo

6. Net Pay = Gross Pay

7. Ghost Employee Search

8. Off‐cycle payments

9. Terminated Employees Paid

10. High Overtime

Source: Fighting Fraud Data Mining Techniquesfrom past AuditnetWebinars


Improve Data Analysis Skills

2/27/2014

20


Where can you quickly (24 by 7) find good internal audit programs for payroll auditing?

a) Ask a friend from another company

b) Search the Auditnet.org library

c) Make your own

d) Call the Institute of Internal Auditors

Polling Question 6


Questions?

2/27/2014

21


Peter Goldmann

FraudResourceNet LLC

800-440-2261

www.fraudresourcenet.com

[email protected]

Jim Kaplan

FraudResourceNet LLC

800-385-1625

www.fraudresourcenet.com

[email protected]

Don Sparks

832‐327‐1877

Thank You!


Coming Up

March Anti‐Fraud Webinars…

The Power of Benford's Law in Finding Fraud , March 5

Finding and Preventing Vendor Procurement & P2P Fraud Using Data Analytics, March 12

How to Use Data Analytics to Expose Fixed Asset and Inventory Fraudsters, March 19

Sign up at:

http://www.fraudresourcenet.com

finding payroll fraud using audit software

Technology