The oil field traffic on U.S. Route 85 into Williston, N.D., seemed mild compared to the line of hotel patrons waiting to check in. Not a single person could be called a typical tourist. Rather, the line was mostly occupied by baseball-capped workers, clad in dirty jeans and overalls. Gary Jones gently nudged his audit colleague, Andy Nichols, in the ribs. They smiled quietly when they noticed the worker standing directly in front of them. Like the rest of the rank and file, he was wearing a mud-caked shirt. The screen-printed oil rig logo was mostly faded, but still written clearly on it in a circular fashion were the words "Lyon Roustabouts."
A few weeks earlier, Jones and Nichols, internal auditors with Rock Bottom E&P, were sitting in front of Nichols' computer, pouring over spreadsheets related to a particular vendor — Lyon Roustabouts. To the casual observer, the spreadsheet would have appeared somewhat nonsensical, showing repetitive decimal numbers, first and last names, and names and locations of oil wells. It told them another story though: This vendor needed to be audited.
From Lyon's antiquated website, Jones and Nichols captured all of its services: blade and bulldozer work, welding and fabrication, and pipeline surveys. "Wow, quite an array of services they provide," Nichols joked. "They even paint lease equipment and spray for weeds."
Over the next few days, Jones and Nichols scoured Lyon invoices and other backup in their imaging system. There were several items to note:
The number of invoices Lyon submitted had increased exponentially over the last two years.
The type style of the invoice header was different from the rest of the invoice. Overall, the invoice quality was poor and appeared to have been produced on a typewriter.
Several invoices did not indicate the name of the oil well location where the work was performed, and some failed to denote the person who performed the work or the date the service was performed.
The most time-consuming segment of their audit came after the invoice review: data entry into the structured query language (SQL) database. An initial observation of the data suggested that Lyon workers were a hard-working bunch of roustabouts. "How can Tyler Smith work 26 hours in one day?" Nichols remarked. "And do it consistently, day after day? I want to know his secret."
Once Jones and Nichols gathered enough names for their "total-hours-in-a-day" offenders list, they reviewed individual hours charged for services. Their analytics yielded some interesting number sequencing. For example, when Bill Lyon's services were sorted, they noted that he tended to enter 3.25 hours every time he sprayed for weeds.
"What's the best way to falsify hours worked and elude detection?" Jones asked. "Use rounded hours or numbers with decimals?"
"I imagine the answer is numbers with decimals," Nichols answered. "However, I recall from my forensic accounting class, the professor always said, 'Look for rounded numbers to find your crooks.'"
"That is a good indicator," Jones responded. "However, I've found that crooks have started faking numbers by trying to make them look more precise. Yet, they tend to get lazy. Instead of coming up with various decimal numbers to cover their fraudulent work, they simply cut and paste the same numbers over and over."
Jones and Nichols performed several tests on the expenditure and invoice data, but later turned to more operational data. For example, Nichols created an additional database showing the production status of Rock Bottom's wells. Taken at face value, the data simply showed which wells were producing, which were temporarily shut down (i.e., for repairs), and which were plugged and abandoned (P&A). P&A wells no longer produce or are shut down permanently because of low volumes.
When they combined the production status data with the Lyon invoice data, their suspicions were confirmed. Jones and Nichols found numerous instances where Lyon had performed "routine maintenance" on wells that were already P&A. "We're paying this company to perform fake work on P&A wells," Nichols stated.
When they opened the door to Lyon Roustabouts, the receptionist looked up from her mounds of paperwork and asked in a somewhat bothered manner, "Can I help you?"
"Yes, we work at Rock Bottom E&P," Nichols said. "We called you two days ago about auditing your records."
"Oh, yeah," she replied as her tone turned more negative. "You sure didn't give us a lot of time to prepare for your visit."
Nichols smiled and answered, "Well, our service agreement with your company stipulates that all we need is to provide you with 24-hour notification."
After several hours of reviewing their payroll system, bank statements, and cancelled checks, Jones and Nichols concluded from the sample that on average, Lyon Roustabouts was paying its employees for around 45 hours per week. This data was entirely opposite of what was found from their invoice review. Lyon was charging Rock Bottom, on average, around 53 hours per week per worker. Lyon was overbilling the company.
The last task Jones and Nichols wanted to perform was a field audit over Rock Bottom properties on which Lyon provided its services. Five of the properties they visited did show some signs of work having been performed, but the tell-tale lease was Horn Creek #123. The road obviously had not seen the likes of a bulldozer blade in at least a year. Even more telling was the fact that the lessee's pumping unit was not running (something confirmed in the production status reports) and noxious weeds covered almost every part of the property.
"Why are we out here?" Nichols asked. "We knew that this property had been shut down months ago."
"A picture tells a thousand words," Jones explained. "Let's document what we see, snap a few pictures, and include it in our report to management."
Two weeks later, Jones and Nichols were sitting in their company's executive boardroom along with several vice presidents, the president, general counsel, and chief financial officer (CFO).
"Gentlemen, we want to thank you for your hard work on the Lyon audit," the CFO began. "Unless Lyon resurfaces as a new company, they will never do work for us or any other E&P in North Dakota. Though we probably could recover some fraudulent payments from them, we are not taking legal action to recover that money. I just want to close the book on them." He paused and added, "I can't say we are surprised by your findings, but we had no idea our controls were so weak that we could not catch these material issues. Looks as if your audit team has a lot of work ahead of them."
While Jones was somewhat frustrated that they were not going after the US $200,000 that Nichols and he had found in fraudulent expenditures, he was satisfied that their report would lead to further tightening of their weak internal controls.
Targeting the right vendor to audit goes beyond the simple paid-history query and analysis, or even the fraud hotline. Consider other forms of information — such as operational data the company captures — that can be included in the analysis.
Data analytics can be a very powerful tool to use during an audit. While third-party solutions can be helpful, designing database queries in SQL can provide more actionable insight into the data.
A right-to-audit clause is key to a robust service agreement. Ensure that a limited amount of notification time (24 to 48 hours) is stipulated. Notifying the vendor and then beginning the audit immediately may prevent the vendor from hiding issues or creating documentation that does not exist. Moreover, this clause demonstrates due care and proactive efforts to deter fraudulent behavior.
Consider issuing periodic invoice guidance to your vendors specifying invoice requirements and standards. In this case, Rock Bottom should have stipulated that invoices include the well name and location, the people who provided the service, and the date the service was provided.
Companies should train their accounting staff to scrutinize vendor invoices for missing information or irregularities. The formatting, lack of information detailed, and legibility of an invoice can be indicators of vendor negligence or fraud.
An "invoice job aid" can be created for accounting staff that lists the most prevalent fraud/suspicious invoice indicators, such as lack of supporting detail, unusual remittance instructions, unexplained increase in payments, and sequential invoice numbers.
Leaving invoice review to accounting alone could spell disaster. Ensure that operations also is reviewing invoices and not just rubber stamping them with approval. In this case, Rock Bottom operations should have validated that the well names and the work the vendor stated on the invoice matched what was actually happening out in the field.