Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

Plot to Defraud

With weak controls, a “trustworthy” manager schemes with co-workers to steal almost US$47,000.​

Comments Views

​Sam Associates, a real estate development compay located in Pakistan, hired Shamool Khan as a receptionist/office assistant when the company was first established. He was hard working, educated, and had excellent communication skills. After successfully completing several assignments ahead of schedule, he came to earn the trust of the business owners and was eventually promoted to general manager. This gave him the opportunity to learn exactly where internal control weaknesses lied.

In winter 2011, Sam and Associates owners discovered, through an employee complaint, that Khan was abusing his power and embezzling funds from the firm with help from his co-workers. During his two years with the company, he had issued bogus cash installment receipts to customers and misappropriated firm funds to the amount of Rs4 million (the equivalent of US$47,000).

After climbing the company ranks, Khan’s first major project was a low-cost housing development that met strict quality standards and the needs of low-income households. Sam Associates acquired 1,500 kanals (approximately 188 acres) of land and planned to develop approximately 1,200 kanals (150 acres) of it. Several firm partners had made personal investments contributing to the project.

As a trusted employee, Khan was uniquely positioned to run an embezzlement scheme. Traditional business controls, such as separation of accounting duties, delegation of authority, system access, and administrative approvals, were not prescribed in the early phase of the business. Khan also wasn’t monitored by the firm owners, which enabled him to undertake enormous fraudulent activities by taking advantage of several internal control weaknesses:

  • Lack of appropriate authorization for commission disbursements.
  • No clearly defined lines of authority, roles, or responsibilities.
  • No independent checks on performance.
  • Inadequate documentation policies.
  • Management override of internal controls.
  • A willingness among employees and third parties, and lower level employees and management, to collude to circumvent controls.
  • Insufficient written policies and procedures to direct department processing.

To help sell the plots of land, Sam Associates used dealerships — loosely defined principal-agent relationships — which are an integral part of commercial real estate activity in Pakistan. Sam Associates did not follow consistent policies concerning commission, returned plots, and recovery of commission. The commission to dealers was supposed to be paid to the dealers in three stages: after initial deposits, after each monthly installment, and after the final lump-sum payment. But instead of commissions being paid in stages, they were paid in full upon the initial deposit.

Dealers were allowed to charge varying commission under each plot sale arrangement. This provided opportunity for dealers to defraud the firm by collusion with Khan. The records were made to appear as if the first dealer — who received a lower commission percentage — returned the plot to the firm. The plot was then sold by a second dealer, who usually charged a higher commission. In the process, accounting department employees colluded with dealers and received a percentage on the second sale. Because there was no policy to recover commissions already paid to dealers, the firm sustained significant commission loss on returned plots. As a part of the sale agreement, the dealers also took responsibility for helping collect payment from customers. But practically all monthly installment payments were collected late and, in many instances, initial deposits were not fully paid. Land plots were sometimes booked on partial deposits and commissions were then paid in full.

Accounting department employees also colluded with Khan to create fake dealer identities in the accounting system. Khan himself was selling plots to customers, channeling dealer commissions through these fake dealers, and keeping 100 percent of the commissions. A junior accountant was responsible for collecting, recording, communicating, and depositing funds for cash and credit collections. The application-level controls in place gave the accountant access rights that permitted him to enter, approve, and review transactions.

When a newly appointed accounting employee tipped off management to Khan’s scheme, an investigation determined that Khan abused his authority, organizational powers, and managerial control. He spent lavishly and lent company money to his co-workers. During his employment, two more obvious warning signs were overlooked within the company: unexplained margin erosion and cash flow problems. He extracted cash from the firm’s coffers by issuing phony receipts and counterfeiting documents, and then pocketed the money. The embezzlement and asset misappropriation schemes continued for almost two years, with the help of two of his colleagues. The owners were shocked and devastated to discover just how extensively their trust was violated by one of their key employees. By the time Khan’s scheme was exposed, it was too late. He and his accomplices had disappeared.

Sam Associates management took the matter to the authorities. During the civil and criminal proceedings against him in absentia, Khan and his accomplices were found guilty. Police are still looking for him.

Lessons Learned

  • When an employee exhibits lifestyle changes, it should be a red flag. Going from a modest lifestyle to a lavish one can be an indication that the individual is stealing from the organization.
  • Absent or weak internal controls are an invitation for fraud. A set of internal control procedures can help safeguard company assets, ensure adherence to company policies, and promote efficiency and disclosure of reliable financial information. Many internal controls are neither time-consuming nor expensive to put in place, and their benefits can be significant.
  • Segregation of duties is an integral part of operational control and can deter collusion among employees. Because frauds with collusion are more difficult to detect, companies should have whistleblower hotlines for reporting indiscretions when employees see them.
  • Lack of management review weakens detection of employee misconduct. Management should maintain documentary evidence of its review and approval of all financial information to demonstrate that it has retained effective control over its financial information.
  • Regular disbursements, such as commissions, should not be allowed without applying regular authorization processes and closely watching all exception cases.
  • Customer control accounts should be regularly monitored and reconciled at least monthly. Any discrepancies should be investigated adequately.
  • A fraud policy gives the perception among employees that management is serious about deterring fraudulent behavior. It should make clear that violators will be terminated and prosecuted.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.



Comment on this article

comments powered by Disqus
  • IIA GRC_July 2020_Premium 1
  • AuditBoard_July 2020_Premium 2
  • IDEA_July 2020_Premium 3