ITS 4450 - Fraud Risk Assessment Tools and Investigation
Chapter 5, Recognizing the Symptoms of Fraud
This lesson presents material from chapter 5. Objectives important
to this lesson:
Symptoms of fraud
Internal control weaknesses
Analytical fraud symptoms
Tips and complaints
The author tells us that fraud may be detected after suspicions are raised.
We are warned that suspicion is simply that, and it is not proof. Investigation
must be made to determine whether a fraud is taking place. To that end,
the author introduces six categories of symptoms of fraud:
accounting anomalies - The text gives an example of fake medical bills
being submitted for several employees by 22 "doctors" who
had the same two addresses. The phony doctors were the inventions of
the manager of the claims payment department. Accounting audits were
satisfied that the bills matched the payments, but a fraud audit raised
suspicion about too many vendors being at each location.
weak internal controls - In the example above, the company never verified
that the patients received care,or that the doctors existed. The text
also mentions that the manager committing the fraud had not taken a
vacation in ten years. This is not clear evidence, but it is a violation
of a standard control that everyone should take time off and have their
job done by someone else on a regular basis. Failure to comply with
this concept is suspicious in staff who control payments.
analytical anomalies - In the example case, more money was paid to
the 22 phone doctors than to real doctors. Company paid medical expenses
went up 29% due to those payments. Payments to the phony doctors were
all made under the company funded program, and nothing was paid to them
under regular insurance coverage.
extravagant lifestyle - Employees whose regular expenses are in excess
of their known income are always suspicious. In the example case, the
manager was spending more money than she earned, but she explained that
there had been an inheritance of a large sum of money. This story was
unusual behavior - Many behaviors may be indicators that an employee
is having problems. The employee in our example was having Jekyll and
Hyde mood swings, which is not a indicator of fraud, but it may be an
indicator of pressure or illness.
tips and complaints - As noted in previous chapters, fraud may be
reported first by employees who notice odd things that auditors and
managers do not. In our example, there was no reporting, which only
goes to show that we cannot rely on having every kind of indicator.
The text turns to accounting anomalies, odd documentation that an accounting
audit should find. The list of possible clues on page 143 requires that
an auditor be familiar with accounting and business practices. The list
on page 145 is a little more accessible to those of us without extensive
accounting training. If you don't know already, an accounting journal
records the events of an a business that add or subtract from its assets
and its liabilities.
journal entries without documentation - we would only be taking
the word of whoever entered the entry that it had happened
unexplained adjustments to receivables amounts owed
to us), payables (amounts we owe to others or to other accounts),
revenues amounts paid to us) , or expenses (amounts we
pay to others or to other accounts)
entries that do not balance - all entries must balance, according
to accounting principles
entries made by persons who do not normally make such entries - this
violates the security principle of integrity
The book gives several illustrations of false journal entries, and we
could conclude that the persons committing these frauds should simple
have been better bookkeepers. (English majors: what is unusual about that
last word?) That is a good point, but a better point is that a good accounting
system is meant to find errors, leading to accurate data for the company
using it. The text cautions us to watch that ledgers are balanced, that
entries in them make sense, and that entries are properly documented.
A fraud investigator must understand the situation and ask the system
the right questions.
On page 147, the text moves on to internal controls, which is
a more common topic in our security classes. A list of common weaknesses
in controls is presented:
lack of segregation of duties
lack of physical safeguards
lack of independent checks
lack of proper authorization
lack of proper documents and records
overriding of existing controls
inadequate accounting system
Each of these weaknesses can be considered as an example of a company
using inadequate checks and balances regarding protection and use of its
assets. The examples that follow illustrate that weaknesses in
the system provide opportunities for people who would otherwise
not find themselves in the fraud triangle. A more pressing danger is the
case of an employee who creates a control weakness in order to exploit
it. This is the reason that we must watch all processes. It probably has
been so. In my opinion, the solution proposed by the text on page
148 for small businesses has a weakness. It makes a single person the
internal control of several processes, which presents that person with
opportunity for fraud. Independent checks might improve this control,
even in a small organization, and would definitely be called for in a
On page 148, the text discusses analytical symptoms of fraud.
The list that appears on that page could be summarized as saying "look
for atypical or abnormal data about anything we measure". An example
is given of a company whose inventory of an asset was overstated, proven
by calculating what the warehouses could actually hold and what the forklifts
in it were capable of moving. Calculations of this sort should be used
regularly to confirm that claimed assets actually exist, that they are
located where records say they are, and that they are properly valued.
The text presents several examples of fraud that was detected through
careful examination of operations and documents.
The key to the next section of the chapter is shown well in the graphic
on page 153. We know that pressure on the perpetrator is one of the causes
of fraud. The graphic tells us that this pressure is often accompanied
by guilt about the crime, and by fear of detection. Add
those three elements together and you can expect that a person committing
fraud will have behavioral changes. The list of changes
on page 153 are things to watch for. The behaviors themselves are not
unique to persons committing fraud., Drastic changes in a person's behavior
can indicate stress, illness, or other conditions. The point is that many
people committing fraud are not sociopaths or professional criminals.
When a 'normal' person commits this crime, we can expect to see warning
The text reminds us to investigate tips and complaints
we receive about possible fraud or other wrongdoing. It is easy to say
that a report is just an attempt to cause trouble for someone the reporter
does not like, but we need to be sure. Staff who work with a fraud are
more likely to notice changes in behavior and improper work performance.
A report about a coworker acting oddly may be an indication that there
is some kind of problem. In a benevolent organization, the first response
should be to refer the reported employee to the Employee Assistance Program.
The investigators in the organization have an obligation to investigate
tips impartially, seeking the truth. If the truth is that there has been
a crime, then the purpose of the investigation changes.
Continue the reading assignments for the course.
Complete the assignments and class discussion made in this module.