ACFE Report Says AP-Related Insider Fraud Is Costing a Bundle
October 2008
Don’t look now, but there’s a good chance your own organization’s employees are creating phony invoices, tampering with checks, and padding their expense reports. It’s tough to think that a co-worker is trying to slip a fraud past AP, but it does happen.
Dishonest employees cost U.S. organizations an estimated $994 billion a year in occupational fraud losses. The average company loses 7 percent of its annual revenues to this type of fraud, according to the 2008 Report to the Nation on Occupational Fraud & Abuse, from the Association of Certified Fraud Examiners (ACFE).
Occupational fraud that affects AP is categorized as asset misappropriation, which is one of the three categories the ACFE uses to describe this type of fraud. The other two are corruption and fraudulent financial statements. Asset misappropriation is, by far, the most common, occurring in 89 percent of the 959 cases the ACFE reviewed.
Bogus Invoices Most Common
Fraudulent invoicing, what the ACFE calls "billing" fraud, involves any scheme in which a person causes his or her employer to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. Typically, an employee will create a shell company and then bill the employer for nonexistent services. Or an employee will purchase personal items and submit an invoice for payment.
This type of disbursement fraud is the most common, occurring in 23.9 percent of the cases ACFE studied (see the graphic on page 1). However, the median loss is higher for check tampering, which occurred in 14.7 percent of the cases with a median loss of $138,000. The median loss from phony invoices was $100,000. Expense reimbursement abuse yielded a median loss of $25,000.
Who Is Doing This?
As Exhibit 1 illustrates, most of the fraudsters were either employees (39.7 percent) or managers (37.1 percent). Owners and executives made up about a quarter of the perpetrators.
Not surprisingly, the higher the position of the employee committing a fraud, the greater the loss to the business. Those with significant authority have more access to business resources and, therefore, more ability to override controls that might otherwise disclose fraud.
The ACFE study found that fraud committed by owners and executives resulted in a median loss of $834,000. That’s over five times greater than the median loss caused by managers and nearly 12 times higher than that perpetrated by employees.
The study also compared the type of scheme committed with the department in which the perpetrator worked. The goal was to provide data that could be useful to organizations in structuring their anti-fraud controls by identifying the departments most commonly associated with certain types of occupational fraud.
Employees in accounting or executives and upper management were the ones most likely to commit the four types of fraud that most affect AP. For example, over half (54.1 percent) of all billing and invoice schemes were committed by accounting personnel or the top brass (see Exhibit 2 below).
Accounting staffers were the most likely to commit expense reimbursement fraud, followed by executives and upper management and employees in operations and sales. How does the accounting staff—who are less likely to be traveling on company business—get involved with this scheme? Most likely on the other end of the fraud by processing knowingly false expense reports for payment—reports filed by executives, sales personnel, and others.
Two-thirds (67.4 percent) of check tampering is perpetrated by someone in the accounting department (see Exhibit 2). This typically happens when an employee steals blank-check stock and then makes them out to himself or herself or an accomplice. It can also commonly occur by the employee stealing an outgoing check to a vendor, then depositing it in his or her own bank account. Executives who engage in check tampering are typically those with signatory authority who write company checks to pay personal expenses.
Detecting the Fraud
More often than not, occupational fraud goes undetected for years before it’s discovered. When it is detected, it usually comes to light by tips rather than by other means, including internal and external audits. Tips account for almost half (46.2 percent) of the initial detection of occupational fraud. One in five is detected "by accident"; internal and external audits account for 19.4 percent and 9.1 percent of the detection, respectively; and 23.3 percent of cases are discovered by internal controls.
What to do: Because the most common detection method is by a tip, anonymous fraud reporting mechanisms are a key component to effective anti-fraud prevention. For instance, organizations with anonymous fraud reporting hotlines suffer fewer losses than those without hotlines.
The majority of tips (57.7 percent) were received from employees (see Exhibit 3). However, a significant number of tips came from outside sources.
What to do: When designing a fraud reporting system, be sure to include not only employees but also third parties, such as customers and vendors.
For More Information
The full 68-page 2008 Report to the Nation on Occupational Fraud & Abuse is available at www.acfe.com.
Exhibit 2. AP-Related Fraud Perpetrators, by Department | |||
Expense | |||
Billing | Reimbursement | Check | |
Schemes | Schemes | Tampering | |
Accounting | 33.2% | 26.9% | 67.4% |
Executive /Upper Management | 20.9 | 25.0 | 15.5 |
Operations | 12.2 | 10.2 | 3.1 |
Sales | 10.2 | 10.2 | 1.6 |
Purchasing | 5.6 | 3.7 | – |
Finance | 4.1 | 4.6 | 5.4 |
Manufacturing and Production | 4.1 | 3.7 | 1.6 |
Information Technology | 2.6 | 2.8 | – |
Customer Service | 2.0 | 2.8 | 0.8 |
Marketing/Public Relations | 1.5 | 3.7 | – |
Board of Directors | 1.0 | 0.9 | 1.6 |
Research & Development | 1.0 | 1.9 | – |
Human Resources | 0.5 | – | 0.8 |
Internal Audit | 0.5 | 2.8 | 0.8 |
Legal | 0.5 | 0.9 | 1.6 |
(Source: 2008 ACFE Report to the Nation) |
Perhaps an assessment of such issues within your organization might be in order?