Fighting fraud, up close and personal

Relationships between an organization and its key suppliers can be a challenge for any organization. Revisiting these close associations on a regular basis can help maintain effective internal controls and a healthy corporate culture

By Kim Mills

Internal controls, particularly those that are necessary for accurate financial reporting, have been the subject of numerous media reports and recent regulatory changes. The new rules focus not only on the need for fair presentation of financial information and full disclosure but also address the need for regular monitoring and assessment of the effectiveness of internal controls. Despite this, the importance of implementing, monitoring and assessing internal controls is often underestimated, even though the impact to an organization of non-existent or ineffective internal controls can be significant.

One area that is often a concern for senior management is the relationship between the organization and its key suppliers. Significant long-term supplier contracts can provide an opportunity for an organization’s employees (as well as employees of the supplier) to obtain inappropriate benefits at the organization’s expense. While internal controls should assist in identifying potentially fraudulent or other inappropriate activity involving a supplier, it’s important to understand and acknowledge other warning signs as they arise. Some of the warning signs include:

• internal audit findings that denote an irregularity with a supplier;
• a significant increase in payments made to a supplier over a short period of time;
• a change in arrangements/agreements with suppliers;
• over-reliance on suppliers; and
• lack of accountability.

For instance, one recent investigation examined the relationship between an organization that had a long-term contract with a company that provided advertising, marketing and other promotional services. The investigation identified that senior executives, employees and the supplier participated in various schemes that resulted in losses in excess of $2 million to the organization. Although the organization had implemented good control procedures, a culture had developed in certain areas of the company that compromised those controls. Several warning signs were identified that, if heeded by senior management, may have stopped the fraudulent activity earlier.

Internal audit

During a routine internal audit of the supplier (as provided for in the contract), it was discovered that the supplier had paid for a golf vacation for a senior employee of the defrauded organization. The cost of the golf vacation was included in the supplier’s invoices and paid for by this organization. Based on discussions with the supplier and the senior employee, the organization believed that this was an isolated incident. The senior employee was terminated, however no further action was taken against the supplier. Had additional audit procedures been performed, further questionable expenses may have been identified.

Significant payment increases

Payments to the supplier (i.e. the marketing company) grew from $5 million to $15 million in a four-year period under the leadership of a new director of marketing. A significant portion of this increase related to new marketing and advertising programs.

However, a large portion was also linked to fictitious invoices issued to the defrauded organization and approved by its senior employees for payment. These invoices were issued by the supplier to cover the costs of providing entertainment, vacations, jewellery, cash and other items to employees of the defrauded organization. (The supplier alleged that payment for these items was necessary, and in some cases demanded, to guarantee that the marketing company would retain its contract.) Had the significant increase in payments to the supplier been identified as a potential risk, invoices from the supplier may have been reviewed and questioned in more detail.

Subcontractor changes

The marketing company initially used two sub-contractors to design, develop and deliver various marketing courses required by the defrauded organization (Subcontractor I and Subcontractor II). The new director of marketing terminated its agreement with Subcontractor I and granted all of the course work to Subcontractor II. The defrauded organization was not consulted about this change. When an explanation for the change was later requested by the organization, the director of marketing informed them that the agreement with Subcontractor I had been cancelled due to “personality differences.” During the investigation, it was discovered that Subcontractor I had refused to pay for significant entertainment and other personal expenses for the defrauded organization’s employees, as requested by the marketing company.

Supplier reliance

Employees of the defrauded organization relied on the supplier to prepare and manage its various marketing project budgets. There was little oversight conducted by the organization’s employees until close to year-end when an assessment of actual spending in comparison to budget became critical. Invoices received from the marketing company were generally approved without assessing the invoice for reasonableness or reviewing back-up information.

Senior managers of the defrauded organization weren’t advised of significant budget overruns until close to year-end. The senior managers couldn’t explain the reasons for significant budget overruns by reviewing the invoices or reports they requested from the supplier. In many instances, they discovered that costs from other unrelated company projects had been transferred to their projects. In some instances, costs from projects in prior years had been transferred to current year projects.

Employees of the victim organization were also unable to obtain sufficient explanations for budget overruns from the marketing company’s project managers or from the director of marketing. The discussions with the supplier always ended with an assurance from the supplier that this wouldn’t happen again in the following year. Because the employees of the defrauded organization had directed the supplier to purchase gifts and other inappropriate items and had knowingly approved fictitious invoices, they were unable to hold the supplier accountable.

Lack of accountability

The quality of work provided by the marketing company was not evaluated. Nor was there a reconciliation of the amounts billed to the defrauded organization with specific project requests. No feedback was requested from those who attended the various marketing courses.

During the investigation, several managers stated that they were concerned with the quality of the work done by the marketing company but because the organization had a long-term contract to provide these types of services, they felt that there was really nothing they could do. It is more likely that the participation and in some cases direction and approval of inappropriate activity by the defrauded organization’s employees prevented them from raising these types of complaints.

Corporate culture

During the investigation, it was discovered that, although the defrauded organization had good internal control procedures in place, the culture that had developed within certain areas of the company resulted in ineffective controls. For example:

• employees of the organization viewed the marketing company as part of their own organization rather than as an external third party supplier. Because of the long-term relationship between the parties, they didn’t appreciate the importance and the necessity of their oversight and review responsibilities;
• several employees of the organization justified their acceptance of gifts, entertainment and other items from the supplier based on the fact that several senior executives also received such items. The senior executives didn’t appreciate that their behaviour, rather than the organization’s rules of conduct, became the benchmark for others;
• several employees of the organization felt that they deserved the gifts, entertainment and other items because they weren’t promoted or otherwise recognized for their contributions to the company; and
• some senior executives of the organization were aware that the managers reporting to them were receiving inappropriate items from the supplier. Because of long-standing friendships, they didn’t know how to deal with the issue and turned a blind eye.

In summary, although the organization had good internal control procedures in place, senior level employees and managers conspired with each other and a key supplier to override these controls and receive significant personal benefits. It’s clear that the behaviour of senior level employees and the culture of an organization have a significant impact on the conduct of its employees. It’s therefore imperative for organizations to not only design and implement good control procedures, but to develop a culture that is consistent with these controls.

Kim Mills, CA.IFA, (kmills@lecg.com) is a managing consultant with LECG Canada Ltd. 

Top