Candace Smith is a member of the internal audit staff at Ace Ltd., a large, diversified company with subsidiaries in numerous industries. While reviewing prior audit plans, Smith realized that one subsidiary, CRL Ltd., had not been subject to an internal audit since its acquisition five years before. When Smith was reviewing the financial results for CRL, she noted that actual expenditures were much higher than budgeted and historic figures. She met with the chief audit executive (CAE) and recommended that this subsidiary be included in the current-year audit plan. The CAE agreed with her assessment, and auditors began to look into CRL's history.
CRL was founded by Wayne Boyd when he was in his early 30s. Boyd had a larger-than-life personality and earned a reputation for lavishly entertaining customers and prospects. Seven years after founding CRL, he sold a majority interest to Ace for more than US$30 million. He remained president of the division, received a generous salary, and was given a US$500,000 annual stipend to cover his entertaining expenses at his various properties. He also had access to a corporate credit card and made frequent use of his expense account.
Accounting and other core business processes remained under Boyd's control and were performed by CRL personnel. Boyd was used to having total control over all aspects of CRL, which allowed him to play fast and loose with the accounting records. He regularly pushed his personal expenses through the company. When Ace took over, it implemented a budget, but day-to-day operations remained in the control of Boyd and his family.
When the internal auditors arrived, they identified many over-budget accounts and requested supporting documentation. Many of the supporting documents did not appear to relate to either CRL or Ace, but to Boyd's personal purchases. Internal audit began to interview CRL employees who were hesitant to speak with Ace representatives. While CRL's accounting personnel were not forthcoming, Boyd's personnel assistant, Mary White, was a wealth of information. She told Smith and the other internal auditors about Boyd and his personal financial habits.
After the acquisition, Boyd went on a spending spree, buying a plane, hunting lodges throughout the region, and a custom vehicle made for his daughter as a birthday present. Because CRL was located 750 miles away and its accounting staff was segregated from the rest of Ace, management at Ace was unaware of these extravagant purchases.
Boyd had numerous groundskeepers and housekeepers who worked at his personal properties on CRL's payroll. Over the course of two years, CRL paid its staff US$610,000. Boyd also charged a variety of additional personal property expenses to CRL for fish to fill his private lake, a grill for cooking for clients, and a taxidermist for stuffing animals killed on hunting trips with customers.
In addition to his wife and children, Boyd also had a girlfriend. She received an annual salary from CRL of US$175,000, though she didn't actually work for the company. In his attempts to conceal the relationship from his wife, Boyd used his corporate credit card to pay for their meals and travel. When his wife became wise to these tricks, Boyd began to use his assistant's credit card.
Boyd also used some of the proceeds from his windfall to flip condominiums. He jointly owned some of these properties with a CRL employee who wrote a check to Boyd every month for his portion of the mortgage. As Boyd became desperate for cash, he stopped remitting those checks to the mortgage company and pocketed the money. The employee's credit score declined dramatically. Later, Boyd refused to pay any portion of the outstanding mortgage. Instead, he arranged to have the employee's pay increased to provide additional funds to pay it.
When Boyd purchased the plane and hired a pilot who didn't know how to fly, he had CRL pay for the pilot's salary and training. He prepared invoices and billed CRL for all of the flights, including those that were personal in nature. Fictitious invoices were submitted for flights that never occurred and wages that were already being paid by CRL to generate additional cash flow for Boyd.
Within five years, Boyd spent almost all of the money that he received in the majority sale of his business, but he continued to live a lavish lifestyle. When a collection agency started calling his office and he was desperate for cash, he began to use his business credit card and his assistant's to cover even more personal expenses. Boyd also would submit duplicate reimbursement requests through an expense report, despite the fact that they were already on his corporate credit card. In an attempt to conceal his fraud, Boyd damaged his receipts to remove the credit card number listed on the bottom. In just two years, he charged more than US$700,000 of personal expenses on CRL's credit cards.
Thanks to the internal audit team, Ace realized that it had a major problem with Boyd and CRL. Ace sent one of its executives to CRL's headquarters to get things in order. When the forensic accounting team was done evaluating the records, it appeared that Boyd embezzled more than US$2.2 million from CRL. He was terminated from the company but no charges were filed.
- When designing the internal audit plan, it is important to ensure that riskier business units receive adequate attention. In CRL's case, there were many red flags that should have drawn the internal audit team's attention sooner, including its geographic distance from Ace, the recent acquisition, and the fact that many key processes remained in the hands of CRL and its former management.
- When performing their work, internal auditors should consider interviewing employees and asking questions about their company's anonymous reporting hotline. Do employees know about the hotline and do they feel comfortable using it? Many employees at CRL knew about Boyd's fraud, but were unwilling to tell Ace until Boyd was terminated.
- Internal audit should consider performing random checks between personnel files and payroll records. All employees receiving a paycheck should have a personnel file. It is also important to perform periodic audits to ensure that all employees are receiving the appropriate rates of pay. Internal audit should determine if policies exist that govern who is allowed to adjust compensation and if those policies are being followed.
- Consider distributing paper paychecks (rather than direct deposit) randomly. This practice would have helped Ace identify ghost employees such as the girlfriend, pilot, housekeepers, and groundskeepers.
- Internal audit should determine if employees with corporate credit cards are also permitted to submit expense reports. If so, it may be beneficial to test some credit card purchases to determine if they are also inappropriately included on expense reports.
- Internal audit should review the acceptable use policy for all corporate-issued credit cards. This policy should clearly state the consequences for misuse of the card. Internal audit also should consider who was involved in designing this agreement — was legal counsel involved to ensure it is enforceable? If no such policy exists, internal audit should consider making a recommendation to management about its adoption and design.
- When reviewing existing processes and procedures, internal audit should determine if the accounts payable staff has had adequate training to spot questionable invoices. Internal audit should also evaluate the processes for resolving unusual items.