It is generally more difficult to conceal the skimming of receivables than the skimming of sales because receivables payments are expected. The victim organisation knows the customer owes money and it is waiting for the payment to arrive. When unrecorded sales are skimmed, it is as though the sale never existed. But when receivables are skimmed, the absence of the payment appears on the books as a delinquent account. To conceal a skimmed receivable, a perpetrator must somehow account for the payment that was due to the company but never received. There are a number of common techniques fraudsters use to conceal the skimming of receivables.
Forcing Account Balances or Destroying Transaction Records
Among the most dangerous receivables skimming schemes are those in which the perpetrator is in charge of collecting and posting payments. If a fraudster has a hand in both ends of the receipting process, he can falsify records to conceal the theft of receivables payments. For example, the fraudster might post the customer’s payments to its receivables accounts, even though the payments will never be deposited. This keeps the receivable from aging, but it creates an imbalance in the cash account. The perpetrator hides the imbalance by forcing the total on the cash account, overstating it to match the total postings to accounts receivable.
The chief financial officer of a small corporation stole approximately $100,000 from his company by diverting customer cheques. This individual controlled all the books and records for the victim company. He stole cheques from customers and deposited them in his personal bank account. The customers’ payments were still posted to keep the receivables from aging.
The perpetrator stole cheques in an amount equal to the victim company’s tax liability. To keep the books in balance, he would prepare cheques payable to the national tax authority, but he never mailed them. The cheques were recorded in the victim’s records and the false disbursements offset the amount of false postings to accounts receivable. The scheme was uncovered when the government notified the victim company that its taxes were delinquent.
Some fraudsters simply destroy all records that might prove that they have been stealing. Destroying records en masse does not prevent the victim organisation from realising that it is being robbed, but it might help conceal the thief’s identity.
Lapping customer payments is one of the most common methods of concealing receivables skimming. Lapping is the crediting of one account through the abstraction of money from another account. It is the fraudster’s version of “robbing Peter to pay Paul.”
Suppose a company has three customers, A, B, and C. When A’s payment is received, the fraudster steals it instead of posting it to A’s account. Customer A expects that his account will be credited with the payment he has made. If the payment has not been posted by the time A’s next statement is mailed, he will see that the payment was not applied to his account and will almost certainly complain. To avoid this, the thief must take some action to make it appear that the payment was posted.
When B’s cheque arrives, the thief posts this money to A’s account. Payments now appear to be up to date on A’s account, but B’s account is behind. When C’s payment is received, the perpetrator applies it to B’s account. This process continues indefinitely until one of three things happens: (1) someone discovers the scheme, (2) restitution is made to the accounts, or (3) some concealing entry is made to adjust the accounts receivable balances.
A clerk working for a government agency committed a lapping scheme that involved the theft of more than 150 customer payments, causing a total misappropriation of more than $30,000 in government funds. This individual stole taxes, fees, and other incoming payments from customers to cover his personal expenses. When a customer’s payment was stolen, the documentation on that payment would be hidden until a later payment was received. The later payment would be applied to the earlier customer’s records.
As the rotating schedule of applying and misapplying payments became more and more complicated, the perpetrator insisted on exerting more and more control over the receipting process. He insisted on handling all incoming mail, preparing the deposit, and delivering the deposit to the bank so that he could continue to delay the posting of payments. The fraud was detected in large part because several consumers complained that they had not received confirmation of their payments, even though their cheques had cleared months earlier.
Because lapping schemes can become very intricate, fraudsters sometimes keep a second set of books on hand detailing the true nature of the payments received. In many skimming cases, a search of the fraudster’s work area will reveal a set of records tracking the actual payments and how they have been misapplied to conceal the theft. It might seem odd that people would keep records of their illegal activity on hand, but many lapping schemes become extremely complicated as more and more payments are misapplied. The second set of records helps the perpetrator keep track of the funds that were stolen and which accounts need to be credited to conceal the fraud. Uncovering these records, if they exist, will greatly facilitate the investigation of a lapping scheme.
While lapping is more commonly used to conceal receivables skimming, it can also be used to disguise the skimming of sales. Employees sometimes steal all or part of one day’s receipts and replace them with the receipts from the following day. This type of concealment requires the employee to delay making the company deposit until enough money can be collected to recoup the stolen funds. If an organisation rigidly adheres to a deposit schedule, it is unlikely that lapping will be effective in concealing this type of fraud.
When employees skim receivables, they might let the targeted accounts age instead of attempting to force the balances. In other words, they steal an incoming cheque intended as payment on a receivable, and they simply act as if the cheque never arrived. This method keeps the victim organisation’s cash account in balance because the stolen payment is never posted.
Of course, if the customer’s payment is not posted, the receivable will eventually become past due. The customer will have proof in the form of a cancelled cheque that a payment was made on the account. The question will arise: where did the payment go? The answer, of course, is that it went into the fraudster’s pocket. So the fraudster’s goal must be to keep the customer from realising that his account was not credited with the payment. If this can be accomplished, the customer will not complain about the missing payment, and the victim organisation will not realise that skimming has occurred.
One way fraudsters attempt to conceal the fact that they have skimmed a payment from a customer is to intercept the customer’s account statement and/or late notices. In some cases, the perpetrator intercepts the account statement by changing the customer’s address in the billing system so that statements are sent directly to the perpetrator’s home or to an address where he can retrieve them. In other instances, the perpetrator physically intercepts the statements before they are mailed.
Once the real statement indicating that the payment was not received has been intercepted, the fraudster usually alters the statement or produces a counterfeit. The false statements indicate that the customer’s payment was properly posted. This leads the customer to believe that his account is up to date and keeps the customer from complaining about stolen payments.
False Account Entries
Intercepting the customer’s statements will keep him unaware of his account’s status, but as long as the customer’s payments are being skimmed, his account is slipping further and further past due. The perpetrator must bring the account back up to date to conceal his crime. Lapping is one way to keep accounts current as the employee skims from them. Another way is to make false entries in the victim organisation’s accounting system.
DEBITS TO EXPENSE ACCOUNTS
An employee might conceal the skimming of funds by making unsupported entries in the victim company’s books. If a payment is made on a receivable, for instance, the proper entry is a debit to cash and a credit to the receivable. Instead of debiting cash, the employee might choose to debit an expense account. This transaction still keeps the company’s books in balance, but the incoming cash is never recorded. In addition, the customer’s receivable account is credited, so it will not become delinquent.
DEBITS TO AGING OR FICTITIOUS RECEIVABLES
The same method discussed previously is used when employees debit existing or fictitious accounts receivable to conceal skimmed cash. For example, an employee who has skimmed one customer’s payments might add the stolen amounts to aging accounts that will soon be written off as uncollectible, or to very large accounts where a small debit might go unnoticed. Some perpetrators also set up completely fictitious accounts and debit them for the cost of skimmed receivables. The employees then simply wait for the fictitious receivables to age and be written off as uncollectable. In the meantime, the fictitious receivables carry the cost of a skimming scheme where it will not be detected.
WRITING OFF ACCOUNT BALANCES
Some employees cover their skimming by posting entries to contra revenue accounts such as “discounts and allowances.” If, for instance, an employee intercepts a $1,000 payment, he would create a $1,000 “discount” on the account to compensate for the missing money. Another account that might be used in this type of concealment is the bad debts expense account.
A billing manager was authorised to write off certain patient balances as hardship allowances. This employee accepted payments from patients, and then instructed billing personnel to write off the balance in question. The payments were never posted; they were intercepted by the billing manager. She stole approximately $30,000 by using her authority to write off patients’ balances.
A problem for fraudsters in some skimming schemes is the victim organisation’s inventory. Off-book sales of goods (skimming schemes) will always leave an inventory shortage and a corresponding rise in the cost of goods sold.
When a sale of goods is made, the physical inventory is reduced by the amount of merchandise sold. For instance, when a retailer sells a pair of shoes, there is one less pair of shoes in the stock room. If this sale is not recorded, however, the shoes are not removed from the perpetual inventory records. Thus, there is one less pair of shoes on hand than in the perpetual inventory. A reduction in the physical inventory without a corresponding reduction in the perpetual inventory is known as “shrinkage.”
There is no shrinkage when an employee skims sales of services (because there is no inventory for services), but when sales of goods are skimmed, shrinkage always occurs. Some shrinkage is expected due to customer theft, faulty products, and spoilage, but high levels of shrinkage serve as a warning that a company could be a victim of occupational fraud. The general methods used to conceal inventory shrinkage are discussed in detail in the “Asset Misappropriation: Inventory and Other Assets” chapter in this section of the Fraud Examiners Manual.
Short-term skimming is not a distinct method for stealing sales and receivables, but rather a distinct way of using skimmed money. The peculiar aspect to short-term skimming is that the fraudster keeps the stolen money only for a short while before eventually passing the payment on to his employer. The employee merely delays the posting. In a short-term skimming scheme, an employee steals an incoming payment and then places the skimmed funds in an interest-bearing account or in a short-term security. The employee earns interest on the skimmed payments while they remain under his control. Eventually, he withdraws the principal and applies it to the customer’s account, but retains the interest for himself.
Detection of Skimming Schemes
The following are some detection methods that might be effective in detecting skimming schemes.
Receipt- or Sales-Level Detection
Key analytical procedures, such as vertical and horizontal analysis of sales accounts, can be used for skimming detection on a grand scale. These procedures analyse changes in the accounts and can possibly point to skimming problems, including understated sales. Ratio analysis can also provide keys to the detection of skimming schemes. These procedures are discussed in detail in the “Financial Statement Fraud” chapter.
Detailed inventory control procedures can also be used to detect inventory shrinkage due to unrecorded sales. Inventory detection methods include statistical sampling, trend analysis, reviews of receiving reports and inventory records, and verification of material requisition and shipping documentation, as well as actual physical inventory counts. These procedures are reviewed in the “Asset Misappropriation: Inventory and Other Assets” chapter.
Journal Entry Review
Skimming can sometimes be detected by reviewing and analysing all journal entries made to the cash and inventory accounts. Journal entries involving the following topics should be examined:
- False credits to inventory to conceal unrecorded or understated sales
- Write-offs of lost, stolen, or obsolete inventory
- Write-offs of accounts receivable accounts
- Irregular entries to cash accounts
Detecting Lapping of Sales or Receivables
A skimming scheme that involves lapping can be detected by comparing the dates of customers’ payments with the dates that those payments are posted to the books. This requires an examination of the source documents, such as cancelled cheque copies, bank statements, and deposit slips. Any significant discrepancies between these two dates might indicate that a customer’s payment was skimmed, and the fraudster had to wait until another customer paid to post payment to the victim’s account. Any significant discrepancies between deposit date and posting date should be investigated. Confirmation of customers’ accounts is another method that might detect lapping.
Confirmations are especially effective on large accounts where the time value of money is an issue. However, customers who pay on invoice rather than on balance might not know the exact balance of their account. If this is the case, it might be more effective to confirm by invoice and reconstruct the account balance using the source documents in the files and the results of the confirmation. If fraud is suspected, ask the customer or the bank to return a copy of both the front and the back of the cheque(s) used to pay specific invoices. Match the data on the cheque copies with the posting dates in the customer’s account.
Prevention of Skimming Schemes
Receipt- or Sales-Level Control
As with most fraud schemes, internal control procedures are a key to the prevention of skimming schemes. An essential part of developing control procedures is management’s communication to employees. Controlling whether an employee will not record a sale, understate a sale, or steal incoming payments is extremely difficult.
Sales entries and general ledger access controls should include documented policies and procedures, which are communicated directly from management. The control procedures will generally cover the following subjects:
- Appropriate separation of duties and access control procedures regarding who makes ledger transactions will be followed.
- Transactions must be properly recorded as to amount, date of occurrence, and ledger account.
- Proper safeguard measures will be adopted to ensure physical access to the accounting systems. Additional measures should ensure the security of company assets.
- All areas where employees handle cash should be monitored with visible video cameras.
- Independent reconciliations, as well as internal verification of accounts, will be performed on ledger accounts.
It is important to note that since skimming is an off-book fraud, routine account reconciliation is not likely to prevent or detect a skimming scheme. If such a scheme is taking place, reconciling the register records to the cash in the drawer will not indicate there is anything amiss. Reconciling the physical inventory count with the perpetual inventory records, however, might reveal that there is shrinkage, and therefore a skimming scheme.
The discovery of thefts of cheques and cash involves proper controls on the receipt process. Deficiencies in the answers to these typical audit-programme questions might be red flags.
- Is mail opened by someone independent of the cashier, accounts receivable bookkeeper, or other accounting employees who may initiate or post journal entries?
- Is the delivery of unopened business mail prohibited to employees having access to the accounting records?
- Does the employee who opens the mail:
– Place restrictive endorsements (“For Deposit Only”) on all cheques received?
– Prepare a list of the money, cheques, and other receipts?
– Forward all remittances to the person responsible for preparing and making the daily bank deposit?
– Forward the total of all remittances to the person responsible for comparing it to the authenticated deposit ticket and amount recorded?
- Is a lock box used?
- Do cash sales occur? If yes:
– Are cash receipts prenumbered?
– Is an independent cheque of prenumbered receipts done daily and reconciled to cash collections?
- Do cash refunds require approval?
- Are cash receipts deposited intact daily?
- Are employees who handle receipts bonded?
- Is the accounts receivable bookkeeper restricted from:
– Preparing the bank deposit?
– Obtaining access to the cash receipts journal?
– Having access to collections from customers?
– Are banks instructed not to cash cheques drawn to the order of the company?
- Is the cashier restricted from gaining access to the accounts receivable records and bank and customer statements?
- Are areas where physical handling of cash takes place reasonably safeguarded?
- Is the person who makes postings to the general ledger independent of the cash receipts and accounts receivable functions?
- Does a person independent of the cashier or accounts receivable functions handle customer complaints?