FRAUD AND INTERNAL CONTROL

1. We have learned many Computer Audit Tests related to various types of schemes. If you were a CFE and hired to investigate this Duraf case immediately after the hotline report, what are the necessary Computer Audit Tests that you will be performing to well examine and prepare the proper evidence for this fraud case? Please also justify your purpose.

2. Do you have any suggestions/comments to help re-design and/or reenforce Duraf current internal control systems? Please details your suggestions to convince CEO and Board of Directors to implement. (Hint: segregation of duties, independent checks, etc. if you find it applicable).

Note: Be specific in supporting your points. For example, simply stating that the companys segregation of duties appear satisfactory as a strength will receive NO credit. You must clearly articulate which duty is segregated from what other duties and how this segregation helps to strengthen the companys internal control.

The CASE: Sandys initial success at embezzlement prompted him to try it again. What led Sandy to jeopardize his career and personal well-being, knowing full well that what he was doing was wrong? ABSTRACT

Businesses today rely heavily on computers to cut costs, increase transaction speed, create competitive advantages and store vital information. This embrace of computer technology often means moving to large systems and networks. Although these systems and networks come with built-in controls, such as segregation of duties, they can never replace honest management. In this case, a manager under financial pressure used his influence over his employees to bypass the system controls. He was able to embezzle money until one employee courageously stood up to his questionable procedures.

BACKGROUND

Duarf, Inc. owned several media businesses, such as newspapers, radio stations and magazines. It operated in many of the largest markets in the United States and Canada. The company had grown primarily through acquisitions over the past ten years and still used several of the acquired business systems. Last year, the company decided to centralize all of its accounts payable processing, such as purchase orders, vendor maintenance, invoice processing and check printing. To accomplish this centralization plan, the company purchased the latest technology. Following the purchase, training sessions were held to ensure all processors and management could use all of the system's functions. This technology included a robust database software package. The software provided internal controls, including matching invoices to purchase orders and receiving reports, signature dollar limits, segregation of processing duties and a controlled vendor list. All of the internal controls associated with the software were adequately designed. They were tested and found to be functioning properly within the system. Before the centralization, Duarf, Inc. had eight separate accounts payable departments throughout the subsidiaries that processed approximately 7,000 transactions per month. At month-end, each department had to submit a consolidation package to corporate accounting. After the centralization, the accounts payable department was processing approximately the same number of transactions but was staffed with fewer full-time employees. Also, the consolidation process had been reduced to one package each month instead of eight. Duarf, Inc. had realized the planned cost savings and management was delighted with the results.

THE PROBLEM

Sandy Blanquet was a senior manager supervising the accounts payable process at Duarf, Inc. Sandy started at Cloudy News, a mid-size newspaper, about ten years ago. When Duarf, Inc. acquired Cloudy News two years ago, Sandy was the accounting controller. As a result of the acquisition, Sandy was offered the opportunity to take part in centralizing the accounts payable processing for all of Duarf, Inc.'s subsidiaries. After the centralization process was completed, Sandy took on the responsibility of overseeing the entire department, from opening mail to processing payables to cutting checks. He managed 20 employees through four supervisors. In addition to managing the department, he was a check signer. Sandy's system access only allowed him to view accounts payable data. He could not process any transactions, edit the vendor list or print checks. However, he did review all voucher packages requiring a second signature. All checks had a facsimile signature printed by the computer system's check printers. Checks over $5,000 required a second signature (in other words, Sandy's signature). Checks over $50,000 required a third signature (i.e., vice president or above).

FINANCIAL PRESSURE

Sandy had always enjoyed the high life. He drove a new sports car. He lived in an upscale home. He took great vacations. Some might have said he lived just barely within his means. Having just returned from an extended vacation to Hawaii with his credit cards closing in on their limits, Sandy found that the advertising market had taken a turn for the worse. A couple of months later Sandy was in trouble because most of his savings were invested in Duarf, Inc. stock. He was overdue on his car payment and his mortgage. "If I can just get some money, a loan or something, for a couple of months, I could get ahead," he thought, sitting at his desk on the fourth floor at Duarf, Inc.'s headquarters. He rubbed his eyes. "Think," he murmured, knocking the side of his head with his knuckles. Then it dawned on him. "Ah. Maybe I can borrow some money from Duarf. A check. No one will miss it and I will repay it as soon as I can." He turned to his computer screen and started to form a plan. Employee 1 Jack Cross started at Duarf, Inc. three years ago as a corporate accounts payable associate. His primary responsibility was to process invoices paid by the corporate headquarters. His work ethic and knowledge of the process were valuable assets to Sandy during the centralization process. After the centralization was completed, Jack was promoted to senior associate responsible for maintaining the approved vendor list. "Hey Jack, this 'Designing Pluz' invoice was just overnighted to me with a rush on it from some vice president at our Los Angeles printing site. Is this an approved vendor?" asked Sandy, sounding a little irritated. Jack looked up, slightly startled to see Sandy enter his cubicle. "No, I don't see them in here," Jack said, fumbling with the keyboard. "Do you want me to add them to the vendor list?"

"Yeah, could you do that right now? I am going to walk this over to Mabali for processing. Don't bother with the verification form, it will take too much time," Sandy added somewhat curtly, knowing that if Jack completed the verification form, he would call the telephone number on the invoice to verify the vendor's information. Jack quickly added the vendor to the list. Employee 2 Mabali Smith recently returned from her honeymoon. She had spent three weeks in India, touring and visiting relatives. Mabali started with Duarf, Inc. at the time of the centralization and was an accounts payable associate with invoice processing responsibilities. Chris Topper, a senior associate, reviewed her vouchers for posting. "Mabali, I have a rush invoice here from the L.A. printing site. Are you busy?" Sandy asked as he approached Mabali's desk. Mabali, who was talking to her husband on the telephone, quickly hung up. "Oh, hi, Sandy. Uh, no, I'm not busy. Who's it from?" sputtered Mabali, obviously surprised by Sandy's presence. "It's from some V.P. over there. He thinks he can just send me an invoice and expect it to be processed immediately. Here is his signature." Sandy pointed to the invoice. "Are you sure you are not too busy?" "Oh no. I'm not too familiar with this signature. Should I look him up in the authorization limits file to make sure he can approve this invoice?" asked Mabali. "Don't worry about it. If he's a V.P., he's authorized up to $50,000," counseled Sandy. Mabali entered the invoice into the system. "I can put this in Chris's in-box and let him know it's a rush job." Mabali suggested. "Actually, I'm going to have Juan post it. I have to talk with him anyway." Sandy took the invoice and walked towards Juan's cubicle, knowing that Juan had authority to override the purchase order matching process. Employee 3 Juan Namkaps started with Cloudy News five years ago, and had known Sandy for most of those years. When Cloudy News was acquired by Duarf, Inc., Juan was offered a supervisor position in the accounts payable department. His primary responsibilities were to review all of the purchase order matching exceptions and to supervise five associates. "Juan, what going on?" Sandy announced as he approached Juan's cubicle. Sandy sat down across from Juan.

"Hey, Sandy. What's up?" Juan said. "Some V.P. at the L.A. printing site overnighted me an invoice and demanded that I run it through ASAP," Sandy explained while tossing the invoice across Juan's desk. Juan picked it up. "Can you post it?" Juan attempted to post the invoice, but it did not match any purchase orders in the system. "No P.O., Sandy." Juan looked up and saw Sandy's face starting to get red. "What? You have got to be kidding me! He overnights me an invoice and there's no P.O. in the system," Sandy blurted, looking past Juan at the computer screen. "Well, just override it and I'll have a chat with our L.A. friend." Juan overrode the matching exception and posted the invoice for payment. Sandy grabbed the invoice and stomped back to his office. Employee 4 Darlene Beau was primarily responsible for printing the afternoon check run. She was hired only three months ago but had experience with the system Duarf, Inc. used to process payments. Knowing the check for this Designing Pluz invoice would require his signature, Sandy telephoned Darlene. Sandy explained to her that there would be a special check in the afternoon run and, since it would require his signature, he would save her time by reviewing the voucher package himself. She willingly accepted and even thanked him for his thoughtfulness. Getting the check out the door The check was printed, signed and mailed following the normal operating procedures. However, it was mailed to a post office box owned by Sandy and he deposited the $32,450 into his new business account-"Designing Pluz." Repeating the job Although the money did help alleviate Sandy's financial pressures, he found himself wanting to try it again. He realized that with the fake Designing Pluz account already on the approved vendor list, he could easily push another invoice through the process. Less than two weeks after the first phony invoice was paid, he attempted it again. Sandy created another Designing Pluz invoice for $12,945. He was careful to keep the amount low enough that both checks combined would not stand out on the L.A. printing site's monthly budget for actual analysis. He decided to use different accounts payable associates to process the payment but to tell the same story. Employee 5 Rachel Nicki had been with Duarf, Inc. for two years. She was an associate whose primary responsibility was processing supply invoices, such as paper, ink and press materials. Most people did not know that she was married to one of Duarf, Inc.'s senior internal auditors

because she did not take his last name. Her husband had been working on implementing a fraud hotline for the company and spoke to her often about it. "Rachel, I have a rush invoice here from the L.A. printing site. Are you busy?" "No, not too busy. Hold on, just a second," Rachel said. Sandy had interrupted her in the middle of processing an invoice. She finished up with what she was doing and asked, "Why the rush?" "Some V.P. over there wants it processed ASAP. Here is his signature." Sandy pointed to the invoice as he handed it to her. Rachel studied the invoice and the signature. She began to open the authorization limits file on her computer, but Sandy stopped her. "Rachel, I really don't have time for that now. He's a V.P." "I'm sorry Sandy. I have to check him out to see if he's authorized to approve invoices," Rachel explained, looking curiously at Sandy. She found the file and began to scan it for the name. She looked back at the signature and asked, "Is this Sandman or Zachvan?" "Look, I appreciate your insisting on processing this by the book, but I really need this processed now. Take my word for it, he's authorized." Sandy said. Somewhat shocked by what Sandy had said, Rachel began, "When I process something, my initials are input into the data record and I don't put my name on anything unless it's by the book." However, Sandy snatched the invoice and walked away before she could finish. Two hours later, Rachel was still puzzled by Sandy's behavior. She had a funny feeling about that invoice and decided to call the company's fraud hotline. The operator was pleasant and let her know she could remain anonymous. The operator inquired about the situation, then thanked her for the information. He explained that he would recommend an internal review of the Designing Pluz vendor.

DISCOVERY

Two months later, Rachel received a department-wide e-mail saying that Sandy was leaving the company. The e-mail added that Sandy would be prosecuted for allegedly embezzling over $40,000.