Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​The Phony Vendor Fraud

Collusion to submit false invoices from nonexistent companies pays off for two longtime friends.

Comments Views

​Hunter Miller and Thomas Wynne had been friends since high school. They met up at a local bar to reminisce about their high school days and, eventually, their conversation took on a more serious tone.

"Once you send me the drilling pipe inspection information, I'll copy and paste it into an email using my Clean Pipe account to throw anyone off our trail," Miller said after sipping his beer. Wynne nodded in agreement.

The next morning, Miller reported to his job as a policeman and logged into his Clean Pipe email. He found Wynne's email waiting, copied its contents into a new message with his signature and Clean Pipe logo, and hit "send." If caught, he knew he could be charged with wire fraud.

That same morning, Wynne entered True Resources' headquarters, one of Calgary's largest oil exploration and production operators, and sat at his desk. He had advanced rapidly within the company and was making good money, but felt he had stalled and deserved more. He logged into the intranet and initiated the process to request that Clean Pipe be added as a new vendor. It was simple: Enter the vendor name, address, point of contact, and business case.

Wynne then forwarded Miller's email to the drilling superintendent with a note at the top: "This company came highly recommended." Two days later, Wynne received an automated email from the procurement department letting him know Clean Pipe was approved as a vendor. He called Miller and told him that he could submit an invoice in a few weeks.

Wynne also convinced his father-in-law to use JX Oilfield Services, a now defunct business that he kept for tax purposes, as a vendor in the scheme. He was given access to JX Oilfield Services' email account, where he carefully crafted a message that he again forwarded to the drilling superintendent after he completed the process to add a new vendor.

For the next few months, Clean Pipe and JX Oilfield Services submitted invoices through the online invoicing system and Wynne approved them for payment. After they were paid, Wynne's portion was sent to him via Venmo. He and his accomplices couldn't believe how easy it was.

While celebrating at an expensive restaurant, Wynne, Miller, and their wives decided to include additional materials on Clean Pipe's invoices to increase the amount of money they'd be paid. Wynne planned to tell the drilling superintendent that Clean Pipe was giving them a discount on pipe, knowing that the company was stocking most of the pipe on location and the superintendent wouldn't be able to check inventory.

On the test run, Clean Pipe sent an invoice that included line items for inspection services and 25 pieces of pipe measuring 32' by 2 7/8". The invoice also indicated that the pipe was being shipped to a pipe-coating company to be treated before arriving on location. This was normal practice for True Resources, so anyone scrutinizing the invoices wouldn't see it as an issue unless someone called to confirm the pipe's whereabouts. Wynne approved the invoice, and the payment came a week later.

While the couples were on a lavish vacation over the holidays, True Resources' auditor, Kristin Jones, found herself reviewing notes from a third-party audit firm assigned to audit the company's vendors. Jones couldn't believe what she read. She called Matthew Downs, the auditor in charge. She apologized for disturbing him during the holidays but explained that she needed to review his notes.

"I didn't think anyone would get back to us until January," he said, before launching into his laundry list of findings. "We don't normally review invoices from recently-approved vendors, but Clean Pipe and JX Oilfield Services hit our radar." While performing a risk assessment of vendors appearing in certain general ledger accounts, they'd noticed that Clean Pipe seemed like an outlier, so they did a bit of due diligence. First, its website only listed residential work and nothing about oil was mentioned. Second, using background investigation software, they traced the listed principal, Miller, to the Calgary Police Service (CPS). This furthered their hunch that Clean Pipe was not an oilfield services company, so they started reviewing their invoices.

The audit team called Namkoong Pipe, the original supplier of the 32' by 2 7/8" pipe listed on Clean Pipe's invoices, and discovered that it didn't manufacture that size. Also, each invoice included shipping instructions to Shepherd Pipe Coating, so the auditors called the company's owner and inventory manager to verify. Both men stated that they had not conducted business with True Resources in some time, and they never received pipe from a company called Clean Pipe.

Downs then explained that they ran a duplicate invoice check of Clean Pipe field tickets against other vendors, and noted that the invoice numbers were almost identical to those from JX Oilfield Services. Moreover, the look and feel of the invoices from both companies was almost identical, as if the same person created both.

Downs continued, "When we ran JX Oilfield Services in our investigation software, we were able to connect the principal of that company to your company's vice president of Drilling, Mike Wynne."

After the call, Jones called the vice president of Internal Audit, which set off a rapid chain of events with True Resources' executive team, the CPS, and the Royal Canadian Mounted Police (RCMP).

Within six months, the couples raked in almost $1.5 million, which they split 50/50. After multiple interviews with the RCMP, Wynne, Miller, and their wives, and a forensic audit of Clean Pipe's and JX Oilfield Services' invoices and backup, multiple charges were brought against the two men and their wives, including wire fraud, embezzlement, and racketeering. Wynne and Miller were sentenced to four years in prison and ordered to pay restitution in the amount of $250,000 each. Their wives were each sentenced to two years in prison.

Lessons Learned

  • Before onboarding a new vendor, perform a thorough due diligence review of its financial and operational background. Due diligence includes reviewing the vendor's website, blogs, YouTube channel, and LinkedIn posts to confirm the business case for onboarding reflects the online sources.
  • Vendor audits should be conducted as part of every organization's vendor management program. A vendor audit is performed to validate billing and contract compliance, and it can be enhanced with a visit to the vendor's work site and headquarters.
  • Vendor monitoring is a must. Consider using analytics to keep an eye on vendor spending trends, regulatory compliance, and adherence to company policies. Anomalies or red flags should be shared with internal audit, supply chain management, or the company's vendor representative.
  • Three-way matching is a critical procedure that helps prevent overspending or paying for an item never received. Many companies ensure there is a two-way match (a purchase order matched up against an invoice), but fraudsters can avoid detection if they both create the purchase order and approve the invoice. The important piece of the puzzle is the independent person who inspects and receives the goods. Segregation of duties is a key element in this process.

Rick Roybal
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author

 

 

Rick RoybalRick Roybal<p>Rick Roybal, CFE, CISA, is a project manager for Martindale Consultants Inc. in Roanoke, Texas.</p>https://iaonline.theiia.org/authors/Pages/Rick-Roybal.aspx

 

Comment on this article

comments powered by Disqus
  • AuditBoard-September-2021-Premium-1
  • FastPath-September-2021-Premium-2
  • All-Star-September-2021-Premium-3

 

 

Stopwatch Auditinghttps://iaonline.theiia.org/blogs/jacka/2021/Pages/Stopwatch-Auditing.aspxStopwatch Auditing
Thanks, We Already Know Thathttps://iaonline.theiia.org/blogs/jacka/2020/Pages/Thanks-We-Already-Know-That.aspxThanks, We Already Know That
U.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radarhttps://iaonline.theiia.org/blogs/chambers/2021/Pages/US-SEC-Environmental-Social-and-Governance-Risks-Better-Be-on-Your-Radar.aspxU.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radar
Newswire: Week of July 5, 2021https://iaonline.theiia.org/2021/Pages/Newswire-July-5-2021.aspxNewswire: Week of July 5, 2021