Scenario:

Exchange Limited (Exchange) is an emerging technology start-up which has recently listed on the ASX. Exchange has 150 permanent full-time staff, as well as contractors who are employed on fixed term contracts.

Exchange has a large office in the Sydney central business district (CBD). Most employees and contractors work from that office, however all staff are also able to work from home when needed. Staff working from home have remote access to Exchange's computer system.

Exchange has 4 permanent staff members who work within its payroll processing division. The payroll processing division is managed by Lucas. Staff within the payroll processing division are a very close- knit team. In addition, Lucas is one of the first employees of Exchange and has recently been selected to be featured in an upcoming social media advertising campaign on behalf of the company. Lucas has close family in Canada and often mentions to his team how he would like to relocate to Canada if Exchange ever opened an office there.

Payroll for all permanent staff and contractors is completed on a fortnightly basis using the 'PayRight' processing system. All payroll staff have access to this system. Three people have administrator access to PayRight, which means they can add, delete, and amend payroll entities and transactions. The three people with administrator access are Lucas, the chief financial officer (CFO), and the financial controller.

As a listed entity, Exchange now has its accounts audited by an external audit firm. Recently, the auditors identified potentially suspicious payments made to four contractors over the last three years. The suspicion arises from the fact no employment records can be located to verify these four contractors actually did work for Exchange. The auditors prepared a table for Exchange's CFO to explain the discrepancies:

Contractor Name

Contractor payments (2019/2020)

Contractor payments (2018/2019)

Contractor payments (2017/2018)

Ashleigh

120,000

158,000

173,000

Ahmed

110,000

123,000

113,000

Emma

148,000

99,000

98,000

Cindy

136,000

156,000

165,000

The auditors also told the CFO that the entries for the four contractors were all made by someone with administrator access to PayRight and the contractor payments were made to the following corporate entities:

Contractor Name

Corporate entity which received the payment

Ashleigh

A1 Pty Ltd

Ahmed

A2 Pty Ltd

Emma

A3 Pty Ltd

Cindy

A4 Pty Ltd

During the audit, the auditors also noticed that some superannuation contributions owed by Exchange to its staff had not been paid. Instead, this money seems to have been left in one of Exchange's bank accounts before being transferred to the Royal Bank of Toronto. In total, more than $350,000 (in smaller instalments) has been transferred in the last 6 months. Pursuant to current Exchange internal controls, two authorisers are required for amounts exceeding $10,000 to be transferred from Exchange's bank accounts.

The CFO has asked for your forensic accounting firm to perform an investigation, with a focus on who is responsible for creating fictious contractors and the theft of superannuation funds. The CFO made it clear that the outcome she wants from the investigation is an opinion about who was involved in this conduct, and to recover as much money as possible from those allegedly involved.