# Fraud, Audit & Controls — DynamicAccounting.net Embezzlement stories, fraud prevention, internal controls, audit, SOX. Original articles first (newest first), then short link posts. --- ## These are a few of my favorite frauds - URL: https://dynamicaccounting.net/these-are-a-few-of-my-favorite-frauds/ - Date: 2023-12-29 - Topics: Fraud, Audit & Controls - Type: original article Yes, it’s weird to have favorite frauds, but after a year of covering a fraud a week, there are a few that stand out. [Bold](/100-million-fraud-at-abb-in-only-2-years/.)est – Myeong-se Oh was the Treasurer and one of two ethical ombudsmen at ABB South Korea. In only two years he made off with $100 million and has yet to be caught. Oh caused the company to borrow money and factor receivables to get as much cash a possible and then he disappeared with it. [Biggest](/wheres-the-beef-ghost-cattle-fraud/) – $244 million for ghost cattle lost betting on cattle futures. This might also be one of the weirdest. Arguably [Razzlekhan and boyfriend](/wp-admin/post.php) stole more, but much of that was recovered and its value is tied to the volatility of bitcoin. [FTX](/ftx-how-to-do-fraud-at-a-futures-exchange/) and [Celcius](/celsius-crypto-commingling-fraud/) may also turn out to be larger, but there are still opportunities for recovery in those cases. Plus, ghost cattle. [Saddest](/romance-steal-1-million-pounds-for-your-non-existent-lover/) – The story of Manjit Singh stealing £1 Million for her lover who then turned out to be a fraud is just sad. [Mostest](/wp-admin/post.php) – Girardi Keese was not the largest fraud we covered but when the named partner of a law firm is stealing customer funds and the CFO is separately stealing funds, there’s a lot of fraud going on all at once. [Funnest](/wp-admin/post.php) – Committing a fraud inspired by the movie Office Space, which has a fraud scheme running through it, is not the best idea. The perpetrators got caught in the movie and in real life. Still, it’s a lot of fun from the outside. What did I learn from doing a year of fraud reporting? I learned that many, many frauds are boring. Someone with too much access writes checks to themselves and does the minimum to cover it up. They get away with it for years. Why do we still let this happen? We can do better. Do better in the new year. --- ## Leftovers in theLightning Round - URL: https://dynamicaccounting.net/leftovers-in-thelightning-round/ - Date: 2023-12-29 - Topics: Fraud, Audit & Controls - Type: original article As we get to end I don’t have a big bang final fraud. Instead we’ve got a quick look at some post holiday leftover frauds. **Grandma got her fraud on** [Patricia Bennett is a 69 year old grandma who worked for the same firm for 25 years.](https://apple.news/A1sTcUzIgQsyvGsMoD_dqjw) She is accused of stealing £163,000 from her employer. She was an accounting manager and she reportedly shuffled funds to 3 bank accounts she controlled. She appears to have made payments to herself disguised as payments to legitimate vendors. Her successor discovered the fraud that wend back at least 13 years. She seems to have spend the money mostly on vacations with her husband. Patricia served 18 months in prison for the fraud. The smartest thing Patricia did was take small amounts of money over a long time. **Even the Legion isn’t immune** [The former president and treasure of a Canadian Legion branch have been charged with fraud.](https://apple.news/AufwoWYhuT0ClRi-V5zgzdA) It’s alleged that Giuseppina Fedele, a former president of a Royal Canadian Legion Branch in Woodbridge, Ont. wrote cheques to herself using the Legion’s account and used the funds for her personal use. Between 2017 and 2019, she wrote 34 cheques (spelled this way because Canada) and 7 electronic money transfers to herself for more than $33k. *[Sidebar: Does Cheque fraud carry a different sentence than Check fraud?]* Police said the former treasurer, 61-year-old Nicola Pinto, partook by signing 24 of the written cheques to Fedele. **Stealing Dough** [The former chief financial officer at collapsed bakery chain Patisserie Valerie is accused of  inflating profits, hiding debts, and presenting bogus figures in the company’s annual reports and public statements.](https://apple.news/AXMj0nFc8QamORV3CV-Wsqg) The company hole in the company’s financials is alleged to be as high as $94 million. Part of the allegations include presenting false invoices to their auditor, Grant Thornton. --- ## More HOA fraud, $3 million and counting - URL: https://dynamicaccounting.net/more-hoa-fraud-3-million-and-counting/ - Date: 2023-12-22 - Topics: Fraud, Audit & Controls, Payables & Receivables - Type: original article The Hammocks is considered the largest homeowner’s association (HOA) in South Florida with more than 18,000 residents across single family homes and condos. The Miami area group of 40 subdivisions is larger than many towns in the U.S. The HOA took in $4million a year in dues and fees. For years residents complained of mismanagement, a lack of transparency, and significant fee increases. In one case HOA dues increased 400% in a single year. [In 2017 authorities started investigating The Hammocks HOA. It would take five years, but in November of 2022 they finally arrested five people, four ex-board members of the HOA and the husband of an ex-board member.](https://therealdeal.com/magazine/national-january-2023/recipe-for-fraud/) The amount missing is still in dispute, but $1 million quickly became $2 million and now the number is north of $3 million. The current tally is $3.4 million. The core of this scheme is a fraudulent vendor scheme. Board president Marglli Gallego is alleged to have funneled cash to five companies, two controlled by her husband Jose Antonio Gonzalez. The companies in question were paid for services not rendered. Board members Myriam Rodgers, 77; Monica Ghilardi, 52; and Yoleidis Lopez Garcia, 47 are also alleged to have written checks to these fraudulent vendors. Vendors not controlled by Gonzalez were paid for services not rendered. They then kicked back part of those payments to Gallego and Gonzalez. [![](/wp-content/uploads/2023/10/image-1024x577.png)](/wp-content/uploads/2023/10/image.png) Attorney Sebastian Jaramillo said it is as if the board members didn’t try to mask their alleged chicanery.  “The fraud to me seems very unsophisticated. It’s a situation where she is paying to her husband’s company, which is domiciled in her own addresses,” he said, referring to Excellent Work. “There isn’t even any attempt to hide it.” While they didn’t do a great job of hiding their fraud, they are accused of retaliating against homeowners who fought for greater disclosure and even against police during the investigation. The common reference to HOA board members as petty tyrants seems appropriate here. A single firm tied to Gonzalez is alleged to have received more than $1.1 million in payments. Additionally, Gallego. who was initially arrested in 2021, is alleged to have spent more than $800k of HOA funds on her criminal defense. Florida law mandates annual financial audits for HOA’s, which the Hammocks allegedly ignored starting in 2018. Yet the statute requires HOAs to provide the reports only once a records request is made. After the revelations a judge took the unusual step of putting the Hammocks HOA in receivership, essentially bankruptcy, with an appointed receiver. Subsequent to the arrests, David Gersten, the receiver overseeing the Hammocks, filed a lawsuit against the other four board members alleging “[they failed to curb their arrested colleagues, including letting them funnel funds ‘without insisting on even minimal documentation to support the illicit payments](https://therealdeal.com/miami/2023/09/21/hammocks-wins-2m-settlement-in-case-against-ex-board-members/),'” Ultimately the parties settled with the board members tendering the full $2 million available under directors and officers insurance. I think the lesson here is simple. If money is involved, ask to see the controls. The less sophisticated the organization, the more like it is to be messy. --- ## A different kind of mail fraud to the tune of $875k - URL: https://dynamicaccounting.net/a-different-kind-of-mail-fraud-to-the-tune-of-875k/ - Date: 2023-12-15 - Topics: Fraud, Audit & Controls - Type: original article It’s not unusual to see a conviction for wire fraud or mail fraud in corporate fraud cases. Mailing a check or electronically transferring money is common in schemes and tends to be an easier conviction. [Today we have a different kind of mail fraud.](https://www.usatoday.com/story/news/nation/2023/10/20/usps-worker-connecticut-pleads-guilty-defrauding-schemes/71261575007/) Ephrem D. Nguyen was a postmaster for the Danbury, Connecticut post office. Part of Nguyen’s responsibilities included supervising maintenance and repair for USPS equipment, facilities and vehicles. Late in 2020, Nguyen required that all postal vehicles go to a specific shop for repairs, despite that shop not being the contract by the postal service for that office. As part of redirecting the service. Nguyen insisted on free car repairs and service for himself, a co-worker, one of his children, and more. In 2022 he insisted on a cash bribe from the shop of $90k. All of these costs were passed on to the postal service by overcharging for services. Ultimately his bribes, embezzlement, and kickbacks resulted in an estimated loss to USPS of $875k. Just a reminder, kickbacks are illegal because the employee is putting their interests above their employer’s interests. That violates the fiduciary duty they have as part of being an employee and as part of having responsibility for financial matters. Too many people view kickbacks as a way of doing business. They tell themselves no one is getting hurt. It’s still illegal. --- ## $2 Million of Chicken Fried Fraud - URL: https://dynamicaccounting.net/2-million-of-chicken-fried-fraud/ - Date: 2023-12-08 - Topics: Fraud, Audit & Controls - Type: original article Humans are rarely as creative as when they are committing fraud. I never thought I’d be talking about chicken frames when I started this series, but here we are. William Hickman and Brian Whiteman worked for Raeford Farms in Louisiana as the sales manager and assistant sales manager respectively. As [reported in Meat+Poultry](https://www.meatpoultry.com/articles/29153-former-raeford-farms-employees-sentenced-for-fraud) of all places, the two were convicted of concocting a scheme to extract money from Raeford Farms by inserting fake intermediaries into the sales process. Essentially they created a wholesaler that would purchase chicken frames from Raeford and sell them to places like Heritage Food at a markup. The intermediary provided no value and never took delivery of the product. Hickman would sell the frames to a company he controlled at rock-bottom prices then turn around and sell them to Heritage Farms and pocket the markup. This is a variation on a kickback. Hickman and Whiteman were operating in bad faith. Rather than selling to the customer and letting the company make the profit, they were siphoning off profit for themselves. Whiteman helped conceal the fraud. He had control of inventory and shipping making him a good choice as an accomplice. The two were convicted of fraud totaling more than $2 million. Interestingly, each of them faces restitution of more than $2 million along with jail time. Hickman got 52 months and $2.6 million in restitution. Whiteman was sentenced to 20 months and $2 million in restitution. For the record, I avoided any puns about the two getting cocky during their scheme. You’re welcome. --- ## Tax Fraud…at the IRS! - URL: https://dynamicaccounting.net/tax-fraud-at-the-irs/ - Date: 2023-12-01 - Topics: Fraud, Audit & Controls - Type: original article I wasn’t going to cover this. I usually don’t cover tax fraud, but this is closer to garden variety fraud committed as part of a tax case. The irony of the IRS committing fraud in a tax case is simply too good to pass up. This gets technical so hang on, it’s worth it. Congress created “syndicated conservation easements” in the 1980’s. Essentially land owners could donate development rights on a piece of land to a qualified charity in exchange for a tax deduction. Essentially this is a tax break for not covering every piece of land in concrete. Unsurprisingly, the easements have become big business. Companies buy up land, have it appraised for its foregone developmental value, and then sell stakes to investors who receive the tax benefit. Unsurprisingly, some people don’t like this aspect and the IRS started cracking down on inflated land appraisals. There’s just one hiccup. [The federal tax code requires an IRS supervisor to approve in writing the initial determination of a penalty.](https://www.columbiamissourian.com/opinion/guest_commentaries/a-case-of-tax-fraud-at-the-irs/article_98e9e550-6312-11ee-bf77-cb91258486e7.html) It told you this would get technical. In the case of *[Lakepoint Land II LLC v. Commissioner](https://apple.news/Ax4Yw83_PTGimApg8p7MqeA)* that didn’t happen in 2016 like it should have. The company presented emails in the case which showed the IRS didn’t get a supervisor’s written approval for a $15 million penalty. Okay. Somebody made a mistake. No harm, no foul, the company gets off on a technicality, right? It happens. Wrong. [They say the problem is not the crime but the coverup and boy did the IRS appear to engage in a coverup.](https://www.taxnotes.com/research/federal/court-documents/court-opinions-and-orders/tax-court-vacates-penalty-approval-decision%2c-will-sanction-irs/7h7th) The supervisor backdated her signature by seven months. This wasn’t a case of forgetting to sign on Friday so she signed on Monday and back-dated it. Seven months is not an honest mistake. Additionally, IRS attorneys swore to the accuracy of the date and continued to mislead the court even after the lie was discovered. This paragraph is too good not to quote: “A judge in U.S. Tax Court had sanctioned the IRS in the case, ripping the agency’s counsel for acting in “bad faith” and having “multiplied the proceedings in this case unreasonably and vexatiously” by failing to tell the court that documents it used to assess a penalty had been backdated.” The IRS agreed to settle this case without any penalties to Lakewood, IRS attorneys were sanctioned, read fined, and the IRS was ordered to pay Lakewood’s attorney fees and costs. The Wall Street Journal opinion article alleges that there are other cases like this. This is still fraud and monkey business like this goes on in non-governmental organizations as well. --- ## Sticking it to the HOA(s) - URL: https://dynamicaccounting.net/sticking-it-to-the-hoas/ - Date: 2023-11-24 - Topics: Fraud, Audit & Controls, Accounting & Career - Type: original article Occasionally there are scenarios where all the players are villains and you hope everyone loses. This isn’t quite that…but for some people it’s going to be close. Many, many people hate their Homeowner’s Association (HOA). It’s not unusual for this hatred to come from petty tyrants on the board or petty snitches reporting their neighbors. As a simple example, a lot of years ago we put up our Christmas tree early. Like the first of November early. We were going to be traveling a lot during the holidays and options were early or late, so we put it up early. This was the Christmas tree INSIDE our house. It was visible in the front window, but it was in our house. Someone complained to the HOA board. My wife happened to be at the meeting. Long story short, the Christmas tree stayed up as a giant ~~middle finger~~ symbol of the holidays. [There is no evidence that David Efrem Katz, 56 was trying to stick it to the HOA, but boy did he do it on a grand scale.](https://www.justice.gov/usao-mn/pr/former-cfo-pleads-guilty-embezzling-more-3-million-employer) Katz was the CFO of Durand and Associates  (D&A), a property management company that primarily serviced HOAs. Between 2012 and 2017 Katz stole $3 million from his company and customer HOA’s. Katz started as an accountant in 1998 eventually rising to CFO in 2012. Katz’s base salary was a miserly $47,500 so Katz went a head and paid himself $6,500 every two weeks. Essentially more than tripling his salary. I have to give Katz credit. Once he was in, he was all in. Katz opened credit cards in the company’s name and put personal expenses on them. He took out a loan in the company’s name. He reimbursed himself for expenses never incurred. All of this was done with company funds, and according to the indictment, client HOA funds as well. Katz hid the expenses with false entries, no surprise. I do want to stop and look at this. Katz committed payroll fraud, loan fraud, credit card fraud, expense reimbursement fraud. He really went all in. This is up there [Myeong-se Oh from ABB South Korea](/100-million-fraud-at-abb-in-only-2-years/) who factored company receivables to get more money to steal. I wasn’t able to find out how he was caught, but the fraud lasted through 2017 and Katz finally plead guilty in 2023. --- ## 1,300 Felony Fraud Charges is a Lot - URL: https://dynamicaccounting.net/1300-felony-fraud-charges-is-a-lot/ - Date: 2023-11-17 - Topics: Fraud, Audit & Controls - Type: original article We head to northern Pennsylvania this week. From [North Penn News comes the story](https://northpennnow.com/woman-facing-felony-charges-for-embezzlement-scheme-in-upper-gwynedd-p7344-119.htm) of Judith Butt, age 73. Butt is accused of embezzling $375k from the Gwynedd Office Condominium Association (GOCA). From the article: “GOCA is a group of tenants that occupy suites at 311 Sumneytown Pike, and they hired Butt as their accountant in 2009 to maintain their account and pay bills for sewer, electric, landscaping, cleaning, and other expenses.” So we have an office building made up of condos. They have an association to manage shared costs. Butt was hired as the bookkeeper. Simple enough. Butt was paid a little more than $4k a year to manage the account using her own computer and equipment. So about $350/month to write some checks and collect condo dues. Unsurprisingly given what we talk about here, Butt wrote checks for her own use including checks to Diamond Appaloosa Ranch where Butt is a partial owner. She was caught in March 2023 when the sewer authority came looking for $22k in payments dating back 3 years. GOCA checked the bank account and found all kinds of suspicious payments, so they went to Butt. Many folks roll over immediately when confronted, but not Butt. She doubled down. Butt denied GOCA access to Quickbooks claiming her computer was working. She wrote them a check for $7k saying it was for mistakenly writing checks from the GOCA account rather than her personal account. Butt had previously changed all billing and account information for the bank and vendors to her house, making it more difficult to research. If that wasn’t enough: “She later provided 11 sealed envelopes containing check records from the account to GOCA, however police said 10 of the sealed envelopes were faked to appear as if they were sent via USPS, and the checks inside did not match with the account records provided from the bank, according to police.” That’s dedication. Creating fake checks and bank records after you’ve been caught is a bold move. Unfortunately for Butt it wasn’t bold enough. She was arrested and charged with felony counts of dealing in proceeds of unlawful activities, receiving stolen property, thefts by unlawful taking, theft by deception, access device fraud, theft by failing to make required disbursement of funds, and 1,302 counts of forgery. The thefts are alleged to have occurred between 2016 and 2023 but bank records were only available back to 2016. Butt started work in 2009 so the actual theft could be higher. Often we see charges of guilty pleas of wire fraud or mail fraud in cases like this. Those frauds are easier to prove. Thirteen hundred counts of forgery mean the prosecution is mad. Even without any kind of segregation of duties here a simple independent bank rec would have caught this much earlier. --- ## 3rd Fraud is Not the Charm - URL: https://dynamicaccounting.net/3rd-fraud-is-not-the-charm/ - Date: 2023-11-10 - Topics: Fraud, Audit & Controls - Type: original article Buckle up everyone. Previously we looked at an individual who [stole to pay back a previous employer he had stolen from](/stealing-to-payback-stolen-money/). Today we have Mandy Deann Urban, 47. [According to the indictment, Mandy was a senior staff accountant for an unnamed company in Charlotte, NC](https://www.justice.gov/usao-wdnc/pr/twice-convicted-accountant-charged-embezzling-more-11-million-employer). She is accused of stealing $1.1 million. Urban was responsible for general ledger entries and financial statement preparation, along with reconciling AP, AR, and bank accounts. From 2019 to 2022 Urban pulled the unsophisticated, but reliable ploy of transferring data to bank accounts she controlled and making fraudulent entries to cover her tracks. Basic SOD blocking and tackling was missing here. One person managing the GL, moving funds, and performing reconciliations is problematic at best. Urban allegedly made 245 transfers for just over $1.1 million. It alleged that she used the funds to pay personal expenses, including tens of thousands of dollars for mortgage, car, education, and vacation expenses, and to buy cryptocurrency. Additionally, it is alleged that Urban transferred significant amounts of embezzled funds to family members. It is not alleged that she used any of the money to pay restitution due in previous cases. There are some important unknowns here. The indictment says she did this from January 2019 to June 2022. Based on a [Ft. Myers News Press](https://news.yahoo.com/fort-myers-woman-makes-plea-173342645.html?guccounter=1) story from May 2022, she was arrested in Charlotte in early 2021 on an outstanding fugitive warrant. I haven’t been able to find clarification for the date discrepancy. I’m giving the unnamed company the benefit of the doubt that she didn’t continue to work there for another year. I assume someone has their dates wrong. Still, that’s a heck of a way to get caught. Prior to her stint in Charlotte, Urban worked for Quigley Eye Specialists (operating as Eye Health of Fort Myers) and St. John’s Surgery Center. They fired her after noticing “bookkeeping irregularities”. From 2013 to 2017 she wrote herself 108 business checks totaling $267k. While working in Charlotte, she was supposed to be paying more than $283k in restitution. How did she get caught in Ft. Myers? The company found out she had a prior conviction for stealing $135k from a previous employer using fraudulent credit card transactions. There’s not much information on the earliest case, but in Charlotte and Ft. Myers, it was outside influences like an outstanding warrant or finding a previous conviction that got her caught. Without those, Urban could have kept stealing. This is why you should do background checks. I’m all for giving people a chance to turn their lives around just [don’t do it through the accounting department.](/would-you-hire-a-fraud/) --- ## Bigmotor = Godzilla Size Fraud! - URL: https://dynamicaccounting.net/bigmotor-godzilla-size-fraud/ - Date: 2023-11-03 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: original article In this fraud series, I’ve tried to avoid companies that are complete frauds from the beginning. If someone just creates a pump-and-dump stock scheme, it doesn’t make this list because there are no lessons to learn there, other than don’t do fraud. FTX and Celcius both seem to have started as more or less legitimate enterprises that devolved into significant frauds through hubris or laziness. My take for now is that those organizations were so poorly run that they became fraudulent, but they didn’t start that way nor did they intentionally turn fraudulent. The [Bigmotor case is similar](https://www.youtube.com/watch?v=ENl3eh1o-SM&list=FLpSu8R0JDKphHHxW7PcEhxg&index=1), but so much worse. Bigmotor was absolutely a legitimate organization, except that it seems to have intentionally devolved into fraud. Like many things in Japan, it is completely over the top. Bigmotor was the largest used car dealership and repair company in Japan. Kaneshige Hiroyuki started the firm in 1976 and grew to 300 dealerships with a valuation of nearly $1 billion. For comparison purposes Japan has roughly the same area as California, but roughly 2.5 times the population. Thirty-five years after starting the company he hired his son Kouichi. Sales took off and Kouichi was promoted to Vice President of the firm. Sustained insane growth eventually led to questions and in 2023 a number of significant fraudulent items came to light. First, Bigmotor was caught on video showing employees how to falsify repairs. For example, a training video showed how to pop a tire and say all four needed to be replaced. That initial leak led to more allegations including charging for oil changes not performed, extending scratches to increase repair costs, inflicting intentional damage, and more. But that’s just ripping off customers. Kouichi used to work for Sompo, one of the three big car insurance companies in Japan. When he came to Bigmotor he brought more than 30 of his Sompo colleagues. They helped train the staff on how to take photos to increase insurance payouts by making the damage look worse. They also showed how to use chalk to simulate damage that didn’t actually exist. Sompo eventually found out and decided it didn’t care. Sompo was the 2nd largest shareholder after Bigmotor’s founder. Plus, Bigmotor would recommend and sell Sompo insurance for cars sold off their lots. The new insurance sales more than offset the insurance fraud losses. For comparison, imagine if this was Carmax and State Farm. The outcry would be ridiculous. Additionally, Kouichi was way over the line when it came to meeting sales numbers. One of the items that came to light was that dealerships were killing trees if they blocked views of a dealership from the street. This happened enough that multiple Google Street View cars captured employees poisoning trees. It happened enough that it inspired cosplay in Japan. I mean, how many trees do you have to kill to inspire cosplay? This is also a bigger deal in Japan than it would be in the US, but it would still be a problem in the US. Kouichi became famous for berating and mocking salespeople and managers who didn’t make their sales numbers. A visit by Kouichi to a dealership took a multi-day preparation effort to avoid getting fired. Finally, as a new employee, you were also expected to buy a car. One example included a 10-year car loan at 9% interest for a new employee. Yikes. The leaking training video, questions from other insurers, dead trees, and more finally brought the scandal to a head in July of 2023. As a result of the scandal, Kaneshige Hiroyuki and Kouichi resigned. Profits plummeted. Two other competitors have admitted to committing similar fraud trying to keep up with Bigmotor. The CEO of Sompo also resigned. This is worse than just tone at the top. This wasn’t just a CEO hinting at impropriety to make quarterly numbers, this was taking a successful business and burning all remaining ethics to the ground. I also thought it was interesting that competitors felt they had to commit fraud to keep up. It’s interesting that Sompo got pulled into this fraud. The rot wasn’t contained to a single firm but spread to other firms around them. --- ## Payroll Fraud: Raise your own pay 10X - URL: https://dynamicaccounting.net/payroll-fraud-raise-your-own-pay-10x/ - Date: 2023-10-27 - Topics: Fraud, Audit & Controls, Payroll & HR, Accounting & Career - Type: original article We’ve all felt underpaid at various times. This feeling of being underappreciated is a little miserable and can motivate people to act. They find a better job, go back to school for a new degree, or just steal. Our story today looks at another law firm. In March of 2022, [Christiane Irwin pled guilty to stealing $1.48 million from her employer.](https://www.goingconcern.com/controller-inflated-salary-doj/?utm_source=feedly&utm_medium=rss&utm_campaign=controller-inflated-salary-doj) Irwin worked as the controller for the law firm [Simon Greenstone Panatier](https://texaslawbook.net/mystery-dallas-law-firm-bilked-out-of-1-48m-by-former-controller/). Her salary was reportedly $140k a year and part of her job was submitting payroll details to the firm’s payroll provider. Starting in 2019 Ms Irwin began inflating her own salary, first by $30k/month rising to $49k/month by the end. These amounts were direct deposited as part of her payroll every 2 weeks. In total she is alleged to have received improper payments of $1.48 million over 3 years. This seems simple enough. Jacking up your salary when you have responsibility for payroll isn’t sophisticated. Any number of controls could have caught this. A review of payroll, a review of budget to actual for payroll. Even an independent bank reconciliation might have found some good questions to ask. By the end this was like hiring another 3 1/2 Christiane Irwin’s at her salary. Most law firms are light on back office staff. Attorney’s are outwardly focused on clients and they put their money into staff that can be billed out. That’s why we’ve seen a couple of frauds related to law firms, but it’s not a good excuse for ignoring the basics of good controls. --- ## Romance: Steal £1 Million for Your Non-Existent Lover - URL: https://dynamicaccounting.net/romance-steal-1-million-pounds-for-your-non-existent-lover/ - Date: 2023-10-20 - Topics: Fraud, Audit & Controls - Type: original article Today’s fraud is a little sad. People have lots of motivations for committing fraud. Common ones include simple greed, a desire for nice things, consumer debt, gambling debt/losses, investment losses, living beyond one’s means, and feelings of being unappreciated/underpaid. We’ve seen plenty of these motivations this year. The [story of Manjit Singh](https://www.mirror.co.uk/news/uk-news/woman-stole-1m-work-gave-30493682) is different. Singh, 60, fell victim to a romance fraud. She stole from her employer to give money to a boyfriend, Ravi Jani, who didn’t exist. In 2019 Singh went to work for Lei Dat and Baig Solicitors. By 2019 she was trusted enough to work on cases. assist with accounting, transfer funds within the company, and pay third parties. In 2021 the law firm’s owner, Naeem Baig, checked the bank balance expecting to find about £800k. Instead, the balance was closer to £40k. He looked through the bank transactions and found repeated transfers to a Patricia Flannery. They totaled £958,180. Ms Singh initially claimed the transfers had been properly made by the firm. Then she changed her story and claimed it was a mistake and sent a picture of a check (or cheque, it is the UK after all) for £945k. The next day, Ms. Singh claimed the money should have come from her personal account and she would pay it back from £2 million she had in a Malaysian bank account. She then put Ravi Jani on the phone with Mr. Baig. Jani promised the money would be back that day. It must have been an interesting conversation because Baig immediately called the police. Singh met Jani via an online dating service. Jani claimed he lived in Dubai. He told her she was beautiful. Singh was especially vulnerable. She allegedly has long-standing mental health issues and her husband left her for another woman in 2019, while Singh was battling cancer. Ouch. Jani clearly manipulated Singh. It started with a request for a small amount and grew from there into a staggering sum of money. The court seemed sympathetic as well noting: “The amount stolen by you is, in truth, quite staggering. Not only were you a fraudster, you were also the victim of a fraud that has rightly been called a romance fraud. “You did not receive one penny for that which you did dishonestly. At the time, it is quite apparent you had been exploited.” The individual posing as Ravi Jani has not been caught. Funds sent were immediately moved and have proven difficult to trace. Ms. Singh received a sentence of 2 years in jail for her crimes. Good internal controls help prevent scenarios like this. Effective segregation of duties would likely have prevented this or at least mitigated the damage. --- ## Deconstructing Carillon’s Construction Fraud - URL: https://dynamicaccounting.net/deconstructing-carillon/ - Date: 2023-10-13 - Topics: Fraud, Audit & Controls - Type: original article We’re going to stay in the UK for this next fraud. It goes back a little bit. [Carillon, PLC was a construction giant in the UK that collapsed suddenly in 2018.](https://www.globalconstructionreview.com/accounting-tricks-how-carillion-duped-market/) In 2017 Carillon issued a profit warning indicating a decrease in the value of its contracts by £845 million. Later that year, the decrease stretched to more than a billion pounds. By the next year, Carillon was done with liabilities of £7 billion, but only £29 million in the bank. More than 3,000 people lost their jobs and hundreds of projects were impacted. This was classic fraud at the top, but also in the middle and all the way down. Carillon regularly used accounting estimates to misrepresent revenue. Carillon consistently overestimated the revenue they were generating. In a simplified example, Carillon found cracks in concrete columns on a large project. Remediation was estimated to result in a loss on the project of 12.7%. Instead, management overrode the estimate and recorded an expected profit of 4.9%. At some point, this is unsustainable. Additionally, Carillon regularly recorded revenue that was “traded not certified”. This was revenue that clients had not signed off on yet. Often this revenue was in dispute and extremely uncertain. Carillon didn’t disclose the nature of this revenue in its financial statements. In 2016 this amounted to £294 million. Carillon also used reverse factoring to hide debt in its supply chain. Essentially banks would pay the bills, Carillon would pay the banks at a later date. This allowed Carillon to hide longer-term debt as trade payables making the company’s financials look better. Carillon misclassified almost half a billion pounds this way. Ultimately, Carillon failed spectacularly. KPMG was fined £14 million and severely reprimanded for its role as Carillon’s auditor. This was a fraud all the way down. Even as they were making up numbers Carillon was paying out huge dividends. --- ## Man City Fraud - URL: https://dynamicaccounting.net/man-city-fraud/ - Date: 2023-10-06 - Topics: Fraud, Audit & Controls - Type: original article No company is immune to fraud. We’ve seen large companies, small companies, well-known companies, and unknown companies. We’ve got another well-known organization in today’s fraud, Manchester City Football Club. Like other UK frauds, we get some details, but not enough specifics. F[iona Barclay worked as a Business Development Manager for Man City in their hospitality department.](https://www.manchestereveningnews.co.uk/news/greater-manchester-news/greedy-exec-who-stole-manchester-27276292) Her salary was reportedly £30,000 a year. From 2019 to 2021 she stole more than £100,000. In 2021 accountants took note of a £25,000 refund because it was a large round number. They discovered that£15k of that amount had been deposited to Barclay’s personal account. When confronted, Barclay claimed it was an error and returned the £15k. Further digging revealed the full scope of the theft. In various statements, [Barclay claimed she took the money to pay for part of her wedding and to buy gifts for her husband and family](https://www.manchestereveningnews.co.uk/news/greater-manchester-news/greedy-exec-who-stole-manchester-27276292). In later statements, [Barclays claimed the fraud was a ‘coping mechanism’ as a result of her mental health issues](https://www.dailymail.co.uk/news/article-11073629/Manchester-City-executive-worked-clubs-hospitality-arm-stole-100-000.html). The core fraud seems to be that Barclay would redirect all or part of refunds due to Man City to her personal account. Additionally, she was accused of inappropriately accessing customer bank accounts, though Man City claims no customer funds were accessed. This is where the maddening lack of detail comes in. Knowing more would help prevent similar frauds. Still, redirecting refunds is a pretty good fraud. Presumably, the company has already expensed the funds. They may or may not be looking for a refund and the amount of an expected refund may not be clear. That lack of clarity helps make this fraud possible. Barclay was sentenced to 18 months in prison. She served 9 months behind bars and the rest on probation. She was only required to pay back £2,550. --- ## Don’t Steal Cars, Steal $8 Million from the Dealership - URL: https://dynamicaccounting.net/dont-steal-cars-steal-8-million-from-the-dealership/ - Date: 2023-09-29 - Topics: Fraud, Audit & Controls - Type: original article Through 2018, [Mark Esposito was the COO of Fenton Motors Group](https://www.msn.com/en-us/news/crime/dollar8-million-allegedly-stolen-from-fenton-motors-of-frisco/ar-AA1dsP8Z), a Texas-based auto dealer with 20 dealerships across multiple states. He is accused of stealing $8 million dollars to facilitate his lavish lifestyle. He is also accused of working with a co-defendant, William Lavin, the firm’s CFO. If the COO and CFO are colluding to steal from an organization, that company is in real trouble. Fenton Motors was in real trouble. The company ended up selling off dealerships and going out of business. To add insult to injury, the [two co-conspirators blamed cash shortages on the owner, Fenton, accusing him of stealing from the dealership](https://restlinks.blogspot.com/2023/07/feds-former-frisco-auto-dealership-exec.html). That was a bold move. It is alleged that Esposito made transfers to his personal account, paid personal credit cards with company funds, and set up an unauthorized bonus plan for himself. [For example, he opened a personal American Express Card with the name “Fenton Motors” to make it easier to hide improper payments to that card.](https://casetext.com/case/united-states-v-exposito) Lavin was key to this scheme. As CFO he was the only person with access to Quickbooks and actively worked to hide Esposito’s scheme. It’s unclear if or how Lavin benefited. When confronted, Lavin grabbed his laptop and ran out of the building. He later committed suicide so we may never know his full involvement. As straightforward as this case seems, there are plenty of twists still to come. First, Fenton Motors should have seen this coming. In 1987 Esposito was convicted in California of passing fake checks/forgery with a sentence of four years probation and 180 days in jail. In 1998 Esposito was convicted of theft. He stole approximately $50k from a Toyota dealership that he used for vehicle repairs, to pay a cell phone bill, and to pay himself via a false commission. That false commission looks a lot like foreshadowing. Background checks are important. Second, Esposito is the stepson of former Senator Claire McCaskill. Based on recorded calls it is alleged that Esposito tried to get McCaskill to use her influence to help him get out of this mess. She declined. Third, as if $8 million wasn’t enough, Esposito is also accused of improperly collecting $2.5 million in PPP loans from an unrelated business. Esposito had a web of quasi and pseudo-businesses with ties to Dubai. This web led to Esposito initially being denied bail. There’s a lot in here including collusion at the top and a lack of segregation of duties. I mean, the CFO was the only person with access to Quickbooks and he ran out with his laptop that had the only copy of Quickbooks on it. That is a concentration of duties. Ultimately Esposito had a history of financial fraud and really shouldn’t have been hired into a COO position. He certainly shouldn’t have been left without adult supervision. Lavin’s willingness to participate in this scheme raises additional questions about Fenton’s hiring processes. --- ## Fraud Induced Panic at the WANDisco - URL: https://dynamicaccounting.net/fraud-induced-panic-at-the-wandisco/ - Date: 2023-09-22 - Topics: Fraud, Audit & Controls, Payables & Receivables - Type: original article This a frustrating case because it’s still ongoing and a lot of data isn’t available, but we’ll try. WANdisco is a UK company that specializes in moving large amounts of data to the cloud. The name is an acronym for wide-area network distributed computing. They grew organically and had a successful IPO in 2012 on the London Stock Exchange. In 2023 the company was exploring a dual US/UK listing. In March of 2023, the company was forced to restate earnings. [An initial investigation had revealed that purchase orders spanning revenue of $14.9 million last year and sales bookings of $115.4 million had been false, the company said. It meant annual revenues outlined in January should have been $9.7 million, rather than not less than $24 million, and bookings should have been $11.4 million, not $127 million.](https://apple.news/A2i6lEuldT3y4JxobUGIzqw) Ouch. 2/3 of 2022 revenue was false. WANdisco had been audited by PWC through 2018 and subsequently by BDO. An initial investigation by FRP Advisory indicated that they “continue to support the initial view that the irregularities are as a result of the actions of one senior sales employee”. If this is true, one person managed to almost triple revenue fraudulently. There appear to have been at least some red flags. Revenue tripled year over year but with significant growth in the percentage of receivables. [The relationship between sales and receivables should have been consistent, but receivables growth significantly outpaced revenue growth](https://www.accountingweb.co.uk/business/finance-strategy/panic-at-wandisco-as-suspected-fraud-uncovered). The presence of sales without collections is a definite red flag. Additionally, the company kept reporting contract wins without naming the customers. Certainly, there are customers who prefer not to be named in press releases, but not all of them. WANidisco founder and CEO Dave Richards and CFO Erik Miller stepped down in April. Additionally, the company was forced to lay off 30% of its staff and indicate risks to its ability to continue as a going concern. However, the outcome is bigger than just this fraud. Like Wirecard in Germany, [WANdisco was seen as a key example for luring and developing startups in the UK.](https://finance.yahoo.com/news/wandisco-fiasco-shows-why-britain-060000335.html) WANdisco was able to raise another $30 million so it appears that the going concern risk is mitigated for now. It doesn’t take a genius to argue a lack of internal controls here. I would argue that falsified revenue also points to a problem with the tone at the top. It’s months later and there is still no indication of who was responsible which seems odd. This is a publicly-traded company with a material misstatement that seems to clearly indicate a responsible individual. I’m not into conspiracy theories, but this one is weird. --- ## Eldridge, Iowa City Clerk Accused of Misuse of $75k of County Funds - URL: https://dynamicaccounting.net/eldridge-iowa-city-clerk-accused-of-misuse-of-75k-of-county-funds/ - Date: 2023-09-15 - Topics: Fraud, Audit & Controls, General Ledger & Financials, Reporting & BI - Type: original article [In 2022 officials from the City of Eldridge, IA has some concerns about “spending and “certain financial transactions” processed by former city clerk Donna Benson.](https://www.ourquadcities.com/news/local-news/iowa-auditor-investigates-former-eldridge-city-clerks-spending/) They asked the state auditor to review transactions from 2017 through 2022. The auditor’s report covered the period of January of 2017 through October of 2022, not quite 6 years. Over that period the special investigation found a little over $76k in improper disbursements almost $9k of unsupported disbursements. The $76k included: - $42k of personal purchases made with the city’s credit card - $1.1k of unauthorized payroll - $16k in payments to Benson’s personal credit card - $16k in payments to other vendors for personal expenses. The additional $9k was mostly credit card charges and payments to vendors that could not be conclusively proven to be personal. The case has been turned over to law enforcement. If the allegations are true, Donna Benson is no criminal mastermind, but $12k a year was a nice little raise. It gets worse. In March of 2022, six months earlier, the state auditor issued a report recommending the city improve segregate duties, reconcile ending cash and investments, and implement a purchasing policy. None of those recommendations were adopted. The auditor’s special report again recommends strengthening internal controls, including properly segregating duties, performing independent reviews of bank reconciliations, and ensuring all disbursements are properly supported, approved, and paid in a timely manner. This is pretty straightforward stuff. If you think it can’t happen in your organization you’ve simply been lucky. But there’s one more fun piece to this. At the bottom of the article is this [link to all of the State of Iowa’s Auditor reports](https://www.auditor.iowa.gov/reports/audit-reports/?keyword=&EntityTypeID=&CategoryID=10&ReleaseDate=&ReleaseDateTo=&ReportPeriodEnding=&ReportPeriodEndingTo=&FirmID=). [Additionally there is a detailed link for each case including this one.](https://www.auditor.iowa.gov/reports/file/72986/embed) The details are fascinating and the number of investigations is eye opening. Not all of them result in referrals to law enforcement, one case found $151 in improper disbursement for example, but there’s a lot of shenanigans going on. --- ## IT Purchasing Scheme leads to $1.4 Million Fraud - URL: https://dynamicaccounting.net/it-purchasing-scheme-leads-to-1-4-million-fraud/ - Date: 2023-09-08 - Topics: Fraud, Audit & Controls, Sales, Purchasing & Inventory - Type: original article We’re off to New Hampshire this week. In early 2019 Tod Erickson of Londonderry, New Hampshire worked in Massachusetts for a Canadian-owned telecommunication company. He was an IT manager and he had responsibility for submitting purchase requests for IT equipment like computers and hard drives. [It is alleged that from 2012 through February of 2019 Erickson submitted fraudulent requests, essentially requests for unneeded equipment.](https://www.justice.gov/usao-ma/pr/former-information-technology-manager-agrees-plead-guilty-theft-over-14-million-employer) He would then sell the equipment for his personal benefit. In a twist, he is also alleged to have filed false tax returns by not reporting his illegal income. This one could be tricky. If Erickson managed to get the computer equipment properly added to the budget, he could make a legitimate purchase request, get it approved per the budget, appropriately received and invoiced. Everything would be above board coming in the front door and then quietly walk out the back. At least some of these items should have been treated as fixed assets. Controls over assets should have turned up a problem over the seven years of this fraud. Segregation of Duties could have helped if someone else was responsible for managing and distributing the equipment. Appropriate inventory controls over unissued equipment would also help. Like I said, this one could be tricky to catch in a small office. --- ## $400k of HR Fraud at Financial Magazines - URL: https://dynamicaccounting.net/400k-of-hr-fraud-at-financial-magazines/ - Date: 2023-09-01 - Topics: Fraud, Audit & Controls, Payroll & HR - Type: original article We’ve seen plenty of fraud out of the accounting department. We’ve seen fraud out of purchasing and fraud out of IT. Today we’ve got fraud out of HR. Mansueto Ventures is the publisher of Inc. Magazine and Fast Company so this one is a little embarrassing for them. This case is also unique in that it deviates from my theory that fraud is often caught near breakpoints of 10k, 100k, etc. We could catch fraud around these breakpoints because those thresholds trigger additional controls. It could also be because prosecutors like bigger numbers. Either way, that’s what I see in reported frauds. This one falls in the middle at $429k. Nirvani Sabess was Mansueto’s director of people and culture since September 2018. It is alleged that Sabess “[would have had the ability to obtain administrative privileges](https://www.hr-brew.com/stories/2023/05/04/top-hr-executive-at-magazine-publisher-mansueto-ventures-arrested-for-allegedly-defrauding-company)” over the company payroll system. Sabess is accused of keeping payroll active for employees on leave or who had left the company and redirecting their direct deposits to her account.She allegedly used her elevated access to change employees’ passwords and security questions, then reroute their direct deposits to her own account. The indictment is sealed so we don’t get to see the juice specifics yet. Sabees is actively fighting the accusations. Many accused fraudsters quickly confess and take a deal, but not Sabess. $429k might not seem like a lot compared to some other frauds we’ve looked at, but this is a small magazine publisher running with lean staff and $429k is a lot. I really have two takeaways here. First, if Sabess did this as described it shouldn’t be to hard to prove. I’m still trying to think of an innocent reason why departed employees would still be active with your bank account on their record. It’s pretty damning. Second, we are back to beating the same dead horses, namely lack of segregation of duties and excessive access. The allegations don’t describe anything especially creative here. Make it hard to for people to commit fraud at your company. Make them decide to pick another company. --- ## Straight AP Fraud, $3 million over 10 years - URL: https://dynamicaccounting.net/straight-ap-fraud-3-million-over-10-years/ - Date: 2023-08-25 - Topics: Payables & Receivables, Fraud, Audit & Controls - Type: original article This case should be simple, but the info is very thin. The [Justice Department press release is shortest I’ve seen yet.](https://www.justice.gov/usao-sdtx/pr/baytown-woman-admits-embezzling-millions-her-employer) Thanks to [Andrew Jewett](https://www.andrewjowett.net/2023/04/27/baytown-woman-admits-to-embezzling-3m-from-employer/) who dug up more. Judy M. Green of Baytown, TX was hired in 1994 by Liqua Tech where she served as the primary and often only Accounts Payable manager. Liqua Tech services commercial properties and focuses on roofing, siding, and building maintenance. In 2011 Judy started to steal. She created fake invoices in the name of real vendors. Once the invoice was approved, she would change the vendor check name in the accounting system to the name of a credit card company for one of her credit cards or one of her children’s credit cards. Green would then cut a check and forge the owner’s signature since she didn’t have rights to sign checks. Green would then change the payee in the system back to the real vendor and mail the check to the appropriate credit card company. There was a hint of segregation of duties here in that Green couldn’t sign checks. A cursory bank reconciliation with just check numbers and amounts wouldn’t have found this, but any kind of a review of check copies would have. Stricter controls around payments like validating payments to be made, comparing to payments planned, etc. could have helped, but it’s also not something an average business owner does. Ultimately, in 2022 the owner noticed a large payment to an unknown credit card company and the scheme unravelled after, and I emphasize this, 10 years and $3 million. Green confessed and took a plea deal. As I write this, she has not yet been sentenced. --- ## 3 Years in Prison for Ex-CFO who stole $5M to trade crypto and ‘meme stocks’. - URL: https://dynamicaccounting.net/3-years-in-prison-for-ex-cfo-who-stole-5m-to-trade-crypto-and-meme-stocks/ - Date: 2023-08-18 - Topics: Fraud, Audit & Controls - Type: original article People commit fraud for a lot of reasons. Often they want a [lifestyle they can’t afford](/all-the-queens-horses-like-parks-rec-fraud/). Maybe they want to [eliminate debt](/evolution-of-a-payment-fraud/) or they [feel underappreciated](/girardi-keese-part-2-nothing-like-a-little-side-fraud/), Perhaps they are trying to cover [gambling or investment losses](/wheres-the-beef-ghost-cattle-fraud/). Today’s story is a modern twist on fraud to cover investment losses. In 2021 SPAC’s were all the rage. A Special Purpose Acquisition Company (SPAC) is designed to take cash from investors for the purposes of finding a company to take public. The SPAC creates a publicly traded entity, raises cash from investors, and acquires a private company. The owners of the private company get paid with SPAC money and the investors now own shares of a public entity, all without the hassle of a traditional IPO. (Note: I didn’t say this was a great way to go public, but it is a way.) SPACs are not forever. They have a period of time to find a suitable target, usually 2 years. If a suitable target isn’t found within the timeframe, the money is returned to investors. If one is found, it’s used to acquire the target. The bottom line is that it’s not the SPAC’s money to do whatever they want, it’s investor money for a designated purpose. [Cooper Morgenthau didn’t quite agree with that.](https://www.justice.gov/usao-sdny/pr/former-chief-financial-officer-two-spacs-pleads-guilty-fraud-scheme) Morgenthau was the CFO of a SPAC named AGAC. To make this even shadier, AGAC stood for African Gold Acquisition Corp. If you’re thinking Nigerian princes, I am too. Nonetheless, [AGAC raised $360 million at it’s IPO.](https://seekingalpha.com/pr/18215886-african-gold-acquisition-corporation-announces-closing-of-upsized-360-million-initial-public?hasComeFromMpArticle=false) While searching for a target, Morgenthau took $1.2 million from AGAC to personally trade options and equity in crypto currency and meme stocks. Unsurprisingly, he lost just about all of it. To cover his crimes, Morgethau turned to a different fund, SMAC or Strategic Metals Acquistion Corp. This sounds like a more corporate name for African Gold Acquistion, but whatever. SMAC was in the investment phase raising money for an future IPO. Morgenthau took money from that fund to try to recover his losses in AGAC. In total Morgethauh was conviced of stealing about $5 million. In terms of sophistication, this fraud it pretty low. SPAC’s are effectively shells, so there aren’t a lot of employees and in this case, no segregation of duties. Morgenthau simply transferred the money to his personal accounts. [Per the SEC investigation, he had full and unfettered access to the accounts.](https://www.complianceweek.com/regulatory-enforcement/sec-fines-spac-104k-for-control-failures-that-enabled-cfo-embezzlement/32711.article) He then altered bank statements to conceal the fraud. Essentially there were zero controls on $360 million. I’m a little disappointed Morgenthau didn’t just disappear with as much as he could take. Then again, with lots of free time on his hands, he might have lost all of it trading crypto currencies and meme stocks. AGAC was ultimately fined $104k by the SEC for reporting violations. Morgenthau is required to pay back $5.1 million and serve 3 years in prison. Honestly, you can’t make this stuff up. An African Gold SPAC gets defrauded by their own CFO and let’s toss in a SMAC down to make it fun. --- ## City Employee Stole More than $180,000 - URL: https://dynamicaccounting.net/city-employee-stole-more-than-180000/ - Date: 2023-08-11 - Topics: Fraud, Audit & Controls - Type: original article I have this rough theory that the first chance most organizations get to catch fraud is when the loss is in the $10-20k range. If they miss that the next chance is roughly $100-200k. After that, it’s about $1 million. Beyond a million, the sky is the limit. [Today we’ve got a garden variety fraud](https://englishheadline.com/index.php/2023/04/17/former-kentucky-city-employee-used-stolen-180000-on-chanel-bag-home-remodels-more-kentucky-city-employee-stolen-chanel-bag-home-remodels-englishheadline/) and after a couple of big company frauds, it’s fun to go back to the basics. Allison Donaldson worked in the Public Works Department for the City of Covington, KY for 17 years as an administrative manager. As part of her job, she had a city-issued credit card for government-related expenses. Also as part of her job, Donaldson would log credit card purchases made by other employees and upload receipts and invoices into the city’s accounting system. From 2020-2022 Donaldson used her city-issued credit card to buy personal luxury items like a Louis Vuitton agenda, a Channel tote, and repairs to her Mercedes. She also paid for furniture, a master bedroom remodel, and a garage remodel using her city-issued card. Donaldson’s scheme was pretty basic. She would fabricate invoices and receipts, including approvals, and upload those into the accounting system. At some point, she got creative. Remember that Donaldson had access to everyone else’s credit card numbers. She was in charge of logging credit card expenses, so she had access to all the statements. In a twist on her scheme, Donaldson used co-worker cards to purchase personal items. For example, she used a co-worker’s city-issued card to purchase 4 barstools totaling $4,600. I don’t know about you, but north of $1,000 for a single barstool feels expensive. She disguised this purchase as pool filtration equipment for the city pool. Donaldson pled guilty to wire fraud and identity theft. Frustratingly, none of the articles indicate how the fraud was found. Using a P-Card or card controls to limit purchases to certain types of stores can help. Segregating card management from card users is critical. The number of credit card fraud cases where the perpetrator has access to both a card and management of the card payment process is extensive. Don’t let this happen. Card management applications can apply additional controls here, but if the person reviewing charges is the one committing fraud, software can only do so much. --- ## Williams Sonoma $20 Million Fraud - URL: https://dynamicaccounting.net/williams-sonoma-20-million-fraud/ - Date: 2023-08-04 - Topics: Fraud, Audit & Controls - Type: original article Buckle up because this gets creative. Eric Marsiglia was vice president of engineering, projects, planning, facilities, and real estate for Williams Sonoma, a large retailer specializing in cooking and kitchen items. [Marsiglia is accused of running a pair of schemes to defraud his employer.](https://www.sfchronicle.com/sf/article/four-men-charged-defrauding-san-francisco-based-17907069.php) In his position, Marsiglia was responsible for finding potential commercial real estate properties for Williams Sonoma. He would work with landlords and commercial real estate brokers on lease terms. These terms typically included broker commission rebates designed to be paid back to Williams Sonoma. Marsiglia created a shell company with a pair of co-conspirators. The firm was named REM Group, LLC and Marsiglia represented that REM was affiliated with Williams-Sonoma and rebates should be paid to REM. As a result, Williams-Sonoma was overcharged for real estate leases because rebates were directed to REM. Marsiglia and his co-conspirators are alleged to have collected $5.9 million with this scheme. Marsiglia also came to an arrangement with another co-conspirator, Michael Podhurst. Podhurst worked for a forklift and supply chain company. He later founded a storage and materials handling company. Podhurst came to an agreement with Marsiglia in which Williams Sonoma’s business would be directed to companies Podhurst worked for or controlled, in exchange for kickbacks to Marsiglia. As a result, $48 million in business was directed to Podhurst-associated firms and Marsiglia collected $12 million in kickbacks. [The indictment alleges Marsiglia’s schemes netted as much as $20 million.](https://www.irs.gov/compliance/criminal-investigation/former-executive-at-williams-sonoma-inc-charged-with-three-others-in-alleged-multimillion-dollar-fraud-schemes) We say that collusion is hard to find, but clearly, some people do get caught. The charges include the commonly seen wire fraud charge, but Marsiglia and Podhurst also got charged with money laundering. This investigation was run by the IRS so it’s possible that the fraudsters didn’t pay taxes or that their activity triggered a money laundering investigation. Kickbacks are illegal because they affect the ability of employees to make unbiased decisions in the best interests of their organization. The individual is acting in their own interest, not their employer’s. The practice is also considered anti-competitive because it subverts an unbiased bidding process. Kickbacks differ from referral commissions in that they are secretive and typically non-disclosed. In some cases, even referral commissions are illegal. For example, the Federal [Anti-Kickback Statute [42 U.S.C. § 1320a-7b(b)] prohibits the knowing and willful payment of “remuneration” to induce or reward patient referrals or the generation of business involving any item or service payable by the Federal health care programs](https://oig.hhs.gov/compliance/physician-education/fraud-abuse-laws/) Kickbacks from vendors are typically seen in buyer-type roles where an employee has a lot of discretion to select a vendor. Often these frauds are exposed via a tip. Strong vendor controls and regular vendor reviews can help prevent or identify kickbacks. Bidding controls for large projects can help as well. --- ## Stealing to Payback Stolen Money - URL: https://dynamicaccounting.net/stealing-to-payback-stolen-money/ - Date: 2023-07-28 - Topics: Fraud, Audit & Controls - Type: original article This week’s fraud isn’t especially remarkable except for the motive. But it can be a little confusing. From Wales (the country not the species) , Mayur Gaglani (not to be confused with Mayor Giuliani), stole a substantial amount of money from his employer, believed to be about £250,000. It appears he was required to pay the sum back, so Mayur got to work. In 2017 Gaglani got a job with PSE 2 (not PS2), a small company selling electrical systems. .Between June and August of 2022, Gaglani created fake invoices to the tune of £64,000, which the company paid. Additionally, Gagliani went to US on holiday and used the company credit card to rack up £5,000 of personal charges. It was the company card charges that got him caught. So far this is pretty straight forward, falsifying invoices and personal use of the company card. It gets worse. At his sentencing hearing, it was revealed that Gaglani explained to Gary Porter of PSE 2 that he had a previous dispute with an employer and significant debts. Mr. Porter loaned Gaglani £60,000 and gave him a £22,000 salary advance to help him out. Let’s do some math, £64,000+5,000+60,000+22,000 = £151,000. Gaglani said that he committed fraud to pay back money stolen from his previous employer. It’s not clear how much of the stolen money was actually paid back because Gaglani also used part of the money to pay his own debts. Cleary Gaglani was in way over his head. I’m also not sure what his end game was. Did he think he wouldn’t get caught this time? The effect of the fraud on PSE 2 was significant. Instead of growing and being able to hire more employees, they were forced to retrench and 5 employees had to change the nature of their work. Gaglani was sentenced to 20 months in prison. Controls matter. Whether it’s Apple or PSE 2. Big or Small. I see plenty of companies say “we’re too small” to worry about controls, but £151,000 matters a lot more to small company than $20 million does to Apple. --- ## $100 Million Fraud at ABB in only 2 years - URL: https://dynamicaccounting.net/100-million-fraud-at-abb-in-only-2-years/ - Date: 2023-07-21 - Topics: Fraud, Audit & Controls, Reporting & BI - Type: original article This one is a few years old now, it goes back to 2017, but there’s still a mystery here and $100 million is a lot of money. ABB is a global Fortune 500, publicly traded electrical engineering conglomerate with Swedish-Swiss roots. In early February of 2017, an ABB executive in their South Korean operation named Myeong-se Oh disappeared. There were early reports that an internal investigation triggered the disappearance. Later reports indicate that his disappearance was a surprise. It wasn’t only Mr. Oh who disappeared, more than $100 million US was missing. It’s now 2023 and I’m not able to find any reports of the capture of Mr Oh. In a rare case, he appears to have gotten away with it. Mr. Oh is reported to have fled to Hong Kong and then disappeared. It is believed he fled to mainland China which does not have an extradition treaty with South Korea. How did we get here? Even for a company the size of ABB, $100 million is a lot of money. Their South Korean operation did roughly $525 million in revenue in 2015 when this theft is alleged to have started. and by early 2017, Mr. Oh was gone. Insurance payouts covered roughly $30 million of the loss, but pre-tax net income was impacted by roughly $73 million or about a 4% hit to net profit. Ouch. Reports vary, but Mr. Oh was in his fifties and a 25-year veteran of the company. Until 2010, he had been the chief compliance officer. In 2017 he was the South Korean organization’s treasurer and one of two integrity ombudsmen. He was one of the officers designated to receive reports of ethical violations. Oh’s fraud has been described as a “sophisticated criminal scheme” and that seems incredibly appropriate. [Fraud-Magazine.com has some of the most detailed information](https://www.fraud-magazine.com/article.aspx?id=4294999116) based on their reporting and reporting by a German magazine Bilantz. I’ve not been able to drill back to the Bilantz source. Essentially Oh’s fraud had three prongs: 1. Mr. Oh opened bank accounts at various institutions in his name and in the name of a KW Industry for who he was listed as CEO. Mr. Oh then transferred $75 million of ABB cash into his accounts. Simple theft at its finest. 2. Oh borrowed $16 million on behalf of ABB and funneled the money to his own accounts. 3. Oh also factored ABB’s receivables to the tune of $12 million and funneled the cash to his accounts. Quick math gets us to $106 million US. How was this all possible? From the Fraud-Magazine.com article: *Many Asian governments require that each of their businesses must have a single, official red-ink corporate seal for validating legal contracts. Each South Korean business must register its unique handmade seal, the “beobin ingam,” with the government. By law, only the representative director can use the seal. However, the courts will presume that a company has “agreed to be legally bound … if a contract is stamped with the beobin ingam” even if the representative director didn’t use it, [according to “Law in Korea.”](http://tinyurl.com/ya5ac36h)* A beobin ingam costs about $27, so whether Oh had permission to use ABB’s or fraudulently obtained one, he had the apparent authority to execute the moves. Additionally, a report by EY concluded “[ABB Ltd has not maintained effective internal control over financial reporting as of December 31, 201.](https://www.reuters.com/article/abb-fraud/update-1-fraud-at-abb-trims-profit-amid-failure-of-internal-oversight-idUKL5N1GQ16C)” ABB has also admitted “[because of his position in the firm, might have had “Omnipotent Super User” rights within ABB’s enterprise resource planning (ERP) system:”](https://www.fraud-magazine.com/article.aspx?id=4294999116) Finally, [“ABB did not maintain adequate segregation of duties in the treasury function in its South Korean subsidiary and failed to identify certain inappropriate access levels to the local enterprise resource planning system,”](https://www.reuters.com/article/abb-fraud/update-1-fraud-at-abb-trims-profit-amid-failure-of-internal-oversight-idUKL5N1GQ16C) Chief Executive Ulrich Spiesshofer and Chief Financial Officer Eric Elzvik wrote in a joint letter to shareholders. Mr. Oh seems to the be last person one would suspect to commit a crime like this. This appears to have been a systemic failure of internal controls. ABB took a $100 million hit to their reputation, a 4% hit to their bottom line, and replaced all of their South Korean top management post-scandal. As with last week’s Apple case, this is a major corporation with major controls and they still suffered a $100 million fraud. There is simply no substitute for appropriate controls. --- ## An Apple a Day Doesn’t Keep $17 Million in Fraud Away - URL: https://dynamicaccounting.net/an-apple-a-day-doesnt-keep-17-million-in-fraud-away/ - Date: 2023-07-14 - Topics: Fraud, Audit & Controls - Type: original article Large, mature publicly traded companies should have the best internal control structures. Even more so when they are regularly the most valuable company in the world based on market cap. If a company that large and sophisticated can be the victim of fraud, any company is at risk. Today we look at Apple and a case from 2022. For most of his time at Apple from 2008 to 2018, [Dhirendra Prasad was a buyer in Apple’s global service supply chain, purchasing parts and services from vendors.](https://www.theverge.com/2023/4/28/23702239/apple-fraud-fine-prison-sentence-tax-evasion-irs) Specifically, Prasad’s purchasing responsibilities [were related to buying parts and supplies for warranty repairs.](https://www.justice.gov/usao-ndca/pr/former-apple-employee-sentenced-prison-conspiracy-defraud-apple-and-tax-crimes) Having been part of a Fortune 500 purchasing organization, I can tell you that this is typically a role with a lot of discretion. Prasad started misusing his position as early as 2011. He took kickbacks, inflated invoices, stole parts, and fraudulently charged Apple for parts never delivered. In short, he didn’t hold back. Prasad also worked with a couple of co-conspirators, Robert Gary Hanson and Don M. Baker, each of whom ran vendor companies used by Apple. There are some really interesting bits in this case. First, we have the fraud scheme examples: In 2013 Prasad had motherboards shipped from Apple’s inventory to Baker’s company CTrends. CTrends then harvested components off the motherboards and sold those components back to Apple with Prasad’s help. Apple bought its own components back from CTrends and Prasad and Baker split the proceeds. In 2016 Prasad arranged to have components shipped from an Apple warehouse in Nevada to Hanson’s company, Quality Electronics Distributors. Hansen removed the components from their packaging, placed them in new packaging, and shipped them back to Apple. Prasad executed purchase orders for those components and caused Apple to pay the related invoices. In essence, Apple bought its own stolen components back. These are just a couple of examples. To hide his payments, Prasad set up a shell company to issue invoices to CTrends. CTrends would then remit Prasad’s share of fraudulently obtained cash. The second interesting piece here is that the IRS got involved. I’m surprised this isn’t seen more often. As a result of his shell company, Prasad claimed hundreds of thousands of dollars in tax deductions and now the IRS wants their money. Prasad pled guilty to theft of $17 million from Apple. He is required to pay back $17+ million to Apple and $1.8 million to the IRS. As a result, Prasad has also agreed to forfeit $5.4 million in assets and owes $8 million in additional cash restitution. Prasad was sentenced to 3 years in prison and 3 years of supervised release. As with many of these cases, Prasad was technically convicted of conspiracy to commit mail fraud and wire fraud, but he got the extra bonus of pleading guilty to one count of conspiracy to defraud the United States. This is the tax charge. None of the many articles I reviewed describe how Prasad was caught, but the press release from the government notes that the prosecution was the result of an investigation led by the Internal Revenue Service. It is possible that the IRS caught on before Apple did. --- ## Polar Air Cargo – Bribery is Like a Resort Fee - URL: https://dynamicaccounting.net/polar-air-cargo-bribery-is-like-a-resort-fee/ - Date: 2023-07-07 - Topics: Payables & Receivables, Fraud, Audit & Controls, Install, Upgrade & Admin - Type: original article You don’t see much in the way of straight-up bribery these days. It’s incredibly rare for a politician to be handed a suitcase full of cash in exchange for a vote. We are much more sophisticated these days. Instead of stacks of cash, we engage people and organizations as consultants adding a veneer of respectability to the process. Theoretically, it makes explaining the wire transfers easier, but not always. Polar Air Cargo Worldwide is a cargo airline jointly owned by DHL and Atlas Air. In April of 2023, the [US brought bribery charges](https://www.justice.gov/usao-sdny/pr/ten-defendants-charged-decade-long-multi-million-dollar-scheme-defraud-international) against 10 people related to Polar. The list of 10 people includes Polar’s VP of Marketing, VP of Operations, and Senior Director of Customer Service. They allegedly ran a pay-to-play scheme where customers and vendors would pay Polar for shipping and the executives for access. This went on for more than 10 years. From 2009 to 2021 Polar Air’s owners had no idea this was happening. The way the scheme worked was customers would contract with freight forwarders to arrange shipping. Polar Air would quote a great rate or arrange priority for a shipment. To get that rate or move to the front of the line, the freight forwarders had to make an additional payment to one of several other entities controlled by the executives. Polar management would instruct forwarders that the additional “consulting fees” were part of Polar’s normal way of doing business. It was compared to a resort fee, a mandatory fee that is either not disclosed or poorly disclosed but is nevertheless, required. The fee amounts were based on the tonnage of cargo being shipped. As part of the indictment, there is an [8-page spreadsheet](https://assets.bwbx.io/documents/users/iqjWHBFdfxIU/r4bfShrjx8ys/v0) with rates for one shipment as an example. Fees were typically paid monthly via ACH to entities controlled by the executives, with a spreadsheet detailing how payments should be split. This scheme applied to vendors too. Polar Air executives arranged favorable terms for vendors secretly controlled by the executives. The situation at Polar was described as “pervasive corruption”. Accountants never want to hear words like “catastrophic failure of internal controls”, but “pervasive corruption” is barely in their vocabulary. FTX was described as “a complete absence of internal controls”, but even it didn’t rise to “pervasive corruption”. [Polar Air is said to have lost as much as $52 million in direct losses and missed revenue. The executives are accused of pocketing about $23 million.](https://www.freightwaves.com/news/former-polar-air-cargo-executives-charged-in-52m-fraud-scheme) So how did they get caught? This is where the story gets even better. One of Polar’s customers, Cargo On Demand paid a total of $1.6 million in kickbacks from 2016-2021 and got tired of it, [so they sued](https://assets.bwbx.io/documents/users/iqjWHBFdfxIU/re5PdpnyFjXc/v0) under the Racketeer Influenced and Corrupt Organizations Act (RICO). RICO statutes are often used to target organized crime, which technically I guess this was. As a result, the CEO of Cargo On Demand has also been indicted for paying bribes to Polar Air. This feels a little like calling the police because your drugs have been stolen. --- ## Mid Year Review – You Might Be Involved in a Fraud - URL: https://dynamicaccounting.net/mid-year-review-you-might-be-involved-in-a-fraud/ - Date: 2023-06-30 - Topics: Fraud, Audit & Controls - Type: original article We’re halfway through the year and it seems like a good time to review some of the unusual indicators of potential fraud we’ve seen. You won’t find most of these in your accounting textbook, but that doesn’t make them less valid. In the tradition of Jeff Foxworthy’s “You might be a redneck” segment, if you have these indicators, you might be involved in fraud. Note that none of this is legal advice except that I strongly recommend that you don’t commit fraud. 1. If your boss uses phrases like “[orange jumpsuit](/was-frank-a-fraud/)” or “no one will go to prison for this”, you might be involved in fraud…and someone is probably going to prison. 2. If your CEO’s significant other is a wannabe [pop/rock](/girardi-keese-when-good-companies-go-pyramid-scheme/) or [hip hop/rap star](/wp-admin/post.php), you might be involved in fraud. 3. If you work for a [cryptocurrency](/ftx-how-to-do-fraud-at-a-futures-exchange/) exchange, you might be involved in fraud. I know that’s a bold statement, but come on, there’s been a lot of fraud in [failed crypto exchanges.](/ftx-how-to-do-fraud-at-a-futures-exchange/) Even the best of them are very opaque when it comes to reporting. 4. If you or someone you know stars on one of the [Real Housewives](/real-housewives-loan-fraud/) shows, you might be involved in fraud. 9 6. If you see ghosts, whether it be [ghost cattle](/wheres-the-beef-ghost-cattle-fraud/), [ghost receivables](/greensill-capital-and-future-receivables-imaginary-bills-are-hard-to-collect/), [ghost cash](/wirecard-made-it-up-as-they-went-along/), or [ghost services](/8-million-fraud-for-ghost-services/), you might be involved in fraud. 7. If at any point you type or receive messages over text, Whats App, or similar services that include phrases similar to: “If anyone finds out we’re doing this” or “If we get caught”, you might be involved in a fraud. 8. If at any time to feel the need to speak in code like “your 200 chickens have arrived” when in fact you are not referring to chickens, but to something else, like bitcoin, you might be involved in a fraud. --- ## Letter of Credit Fraud - URL: https://dynamicaccounting.net/letter-of-credit-fraud/ - Date: 2023-06-23 - Topics: Fraud, Audit & Controls - Type: original article Letter of Credit Fraud This fraud is a bit unusual in that it deals with letters of credit. It’s a bit more sophisticated than what we’ve seen before and we don’t have the company name. This is a c[ase from the Association of Certified Fraud Examiners](https://www.acfeinsights.com/acfe-insights/2023/3/17/case-study-decoding-the-cobweb-of-letter-of-creditnbsp) so the company and perpetrator are not named. First though, a little background.  From [Wikipedia](https://en.wikipedia.org/wiki/Letter_of_credit): ***A letter of credit*** *(****LC****) … is a payment mechanism used in international trade to provide an economic guarantee from a creditworthy bank to an exporter of goods. Letters of credit are used extensively in the financing of international trade, when the reliability of contracting parties cannot be readily and easily determined. Its economic effect is to introduce a bank as an underwriter that assumes the counterparty risk of the buyer paying the seller for goods.* When I worked for Darden Restaurants they used LCs extensively when buying seafood from all over the world. An LC mitigates the risk of not receiving payment for the exporter and simplifies the process for the importer because a bank is guaranteeing the payment. In our case study, a company defaulted on a loan tied to a letter of credit. The bank hired an auditor to figure out why the loan had really gone unpaid. One thing about an LC, since it’s tied to the international shipping of goods, they typically generate a lot of paperwork for someone to trace. There are the LC and related documents, customs forms, bills of lading, and other shipping documents, etc. The auditor dug in and compared submitted paperwork with public records data, loan documents, and statements about the LC’s purpose, and boy did they find a mess. Specifically: - There were inconsistencies between disbursements and the stated purpose. For example, the borrower dealt in plastics while the supplier specialized in metal rods. - The supplier (payee) appeared to be a related party to the borrower. - The supplier’s office and the borrower’s warehouse had the same address. - During the previous year, 135 draws were made on the letter of credit totaling $73 million. Further investigation revealed that the borrowing company had not held a business license for three years and the transportation company listed as a shipper in the documents did not exist at the address on the paperwork. Ultimately this was straight-up loan fraud, but more sophisticated than a simple take the money and run. There were also allegations of money laundering and that certainly could have been part of this scheme, but nothing beyond the allegation was detailed in the article. Despite the sophistication, the bank missed a lot of red flags. Anti-money laundering efforts like “know your customer” should have helped prevent this. A simple check of business licenses and addresses should have raised red flags. For businesses that are not banks, it’s still important to know your customer before providing significant credit. It’s not unusual for independent partners of very large firms to try to leverage the credit of their partner inappropriately. One more note, $73 million is a lot of money over the course of a year. --- ## Real Housewives Loan Fraud - URL: https://dynamicaccounting.net/real-housewives-loan-fraud/ - Date: 2023-06-16 - Topics: Fraud, Audit & Controls - Type: original article Let’s give a nod to the Real Housewives TV franchise. Few TV shows have exposed as many fraudsters as Real Housewives. It’s even more interesting since that’s not the show’s intent. We’ve looked at Girardi Keese. [Up this time is Joe and Teresa Giudice](https://www.justice.gov/sites/default/files/usao-nj/legacy/2013/11/29/Guidice%2C%20Giuseppe%20and%20Teresa%20Indictment.pdf). This story was all over the news, especially in entertainment news. Joe and Teresa both did jail time, but entertainment news outlets are often thin on details. We’ll try to fill in a few. Joe was the self-employed owner of G&G Stucco. Over several years Joe and Teresa submitted false W-2s and tax returns as part of multiple mortgage applications, typically indicating that Teresa was employed and listing a large salary. In reality, Teresa was unemployed or working for Joe at a much lower salary. Documents were submitted to banks via email or U.S. mail resulting in wire fraud and mail fraud charges. These tend to be easy charges to convict on so we them a lot in fraud cases. In total, Joe and Teresa are accused of fraudulently obtaining a little over $4.5 million. This isn’t a complicated fraud, but you can’t accidentally fake W-2s. From my standpoint, the problems here are analogous to issues granting credit to customers. These frauds took place from 2001-2008. If the mortgage company had properly obtained tax return copies from the IRS, this fraud could have been prevented. My wife used to be a title agent, and in Florida, this is a standard control. Somehow this was missed in New York. Having appropriate controls on customer credit is important. Any business needs to make sure that credit is appropriately matched to the risk of a particular customer. It’s easy to push for the sale or extended terms only to get burned later. What’s missing in all the news stories and the indictment is the why. What was the end game here? We’ve seen straight-up thefts. People stole money, lived crazy lifestyles, and thought they wouldn’t get caught. Joe and Teresa borrowed money fraudulently and that’s a difference. Lenders know the money is out there and they are going to come looking for it, sooner rather than later. I don’t know what the end game was here. Even the bank fraud we looked at earlier was to try to save a business. Theoretically you save the business and can pay back the loan, there is at least a justification. Joe and Teresa don’t seem to have had much of an end game. After their fraud came crashing down and they declared bankruptcy, the pair was also accused of hiding assets in bankruptcy. This included misrepresenting the amounts paid by Real Housewives and hiding some of Teresa’s businesses. Teresa was ultimately sentenced to 15 months in prison. Joe got 41 months and was deported back to Italy following his prison term. --- ## PPP Fraud – There are no Food Trucks in Prison - URL: https://dynamicaccounting.net/ppp-fraud-there-are-no-food-trucks-in-prison/ - Date: 2023-06-09 - Topics: Fraud, Audit & Controls - Type: original article When I started this series, I swore to myself I wouldn’t cover PPP fraud. I’m going to break that promise here. The Paycheck Protection Program (PPP) was a covid emergency loan package for businesses. It came with a series of options to borrow money tied to a few major expenses like rent and payroll. The loans were issued by a participating bank, guaranteed by the federal government, and eligible for forgiveness by the federal government if certain conditions were met. I swore I wouldn’t cover it because it is such a specific event in time and place that it’s not a recurring risk going forward. Also there was so much PPP related fraud being prosecuted that we could do stories every day. But I think there is a lesson in here, mostly, don’t do bank fraud. On a personal level I helped a small church navigate getting a PPP loan and I reviewed the documents for the business my wife works for. Both loans were ultimately approved and forgiven, so I’ve seen the process. Anton Matthews applied for a PPP loan claiming to run a food truck with $103k in gross revenue for 2020. He was granted a loan and managed to actually collect almost $50k in fraudulent loans. The paperwork required for these loans was fairly significant, but there wasn’t much verification of that documentation at the point of the loan. The documentation is being used now to identify and prosecute potential frauds. [There was one big problem with Matthew’s application. He was in jail from November 2016 through October of 2020](https://fraudoftheday.com/covid-19-fraud/no-food-trucks-in-jail/) and then under home confinement until March of 2021. None of those scenarios are conducive to running a food truck in 202O. Matthew was found out and indicted. Matthew’s original jail sentence was for distributing crack cocaine. [On the day of his indictment in this case, he was also indicted on new cocaine trafficking charges. Fortunately for Matthew, he’s been charged with wire fraud in this case](https://www.wvnews.com/news/wvnews/west-virginia-feds-man-behind-bars-said-he-was-operating-food-truck-got-fed-covid/article_ab74265a-aba1-11ed-9001-6fba21172c1c.html). I say fortunately because defrauding a bank in the U.S. carries a maximum sentence of 30 years in prison. In this series we covered [Kevin Co and his theft of $4.8 million](/if-you-stole-4-8-million-how-much-would-spend-playing-game-of-war/). He was also indicted for fraudulent PPP loans of $500k while awaiting sentencing for this theft of almost five million dollars. This wasn’t a real corporate fraud. There wasn’t a real company, or a real food truck. But there was real temptation for a lot of small business owners to fudge the PPP numbers for a bigger loan. Part of the allure was that they probably wouldn’t have to pay it back. More money could save the business. They could avoid bankruptcy. Maybe. But it’s surprisingly easy to cross the fraud line for the “right” reasons. This is still the rationalization of the fraudster. It’s also much harder to get back across once you’ve passed that line. --- ## Why Rob a Bank? That’s Where the Money Is, $40 Million Worth - URL: https://dynamicaccounting.net/why-rob-a-bank-thats-where-the-money-is-40-million-worth/ - Date: 2023-06-02 - Topics: Fraud, Audit & Controls - Type: original article Bank robber, Willie Sutton is often credited as saying: “I rob banks because that’s where the money is.” Sutton stole as much as $2 million. Even with inflation, Edward Rostohar makes Willie Sutton look small-time, and Rostohar only robbed one bank. Technically, it was a credit union, but we are talking about a lot of money, $40 million to be precise. Edward Rostohar is listed in news reports as alternately a manager or the [CEO of CBS Employees Credit Union.](https://www.courthousenews.com/cbs-credit-union-board-sued-after-ceo-admits-to-embezzling-millions/) [The Justice Department press release lists him as a manager](https://www.justice.gov/usao-cdca/pr/ex-credit-union-manager-pleads-guilty-bank-fraud-40-million-embezzlement-rendered), but CEO seems more likely given the time and amounts involved here. Rostohar also had special knowledge, [prior to his job with CBS Employees Credit Union, Rostohar served as an examiner](https://www.cutimes.com/2019/05/15/california-ceo-signs-plea-deal-in-40-million-cu-embezzlement-case/) at the National Credit Union Administration (NCUA), a federal agency that regulates credit unions. What makes this [fraud special is not the amount, but how long it lasted.](https://www.latimes.com/california/story/2019-09-16/after-40-million-embezzlement-former-cbs-credit-union-manager-gets-14-years-in-jail) Rostohar began embezzling in 2000. He was finally caught in March 2019. Over almost 20 years Rostohar managed to steal $40 million. He used his position to make online payments to himself, sometimes forging the signature of another employee. He directed funds to shell companies he controlled and paid personal credit cards with credit union funds. Importantly, Rostohar used his experience as an examiner to hide his fraudulent transactions. The money was spent on gambling, on failed business ventures designed to earn back the money, and on a lavish lifestyle including houses, private jet flights, and a $5k/week allowance for his wife. His business ventures included a coffee shop in Reno that seems to have used more cash than it generated. Rostohar was caught when an employee stumbled upon a $35k check to Rostohar and with a little digging, found $3.8 paid to the CEO that year alone. Rostohar eventually pled guilty. It gets worse. The credit union only had assets of about $21 million when the fraud was discovered and they’ve now been sued for $40 million. The losses generated by Rostohar were so bad that the credit union was forced to liquidate and be absorbed by another credit union. In the interest of transparency, let’s acknowledge that sometimes prosecutors and news reporters get overzealous. Buried in the [LA Times version](https://www.latimes.com/california/story/2019-09-16/after-40-million-embezzlement-former-cbs-credit-union-manager-gets-14-years-in-jail) is that Rostohar actually stole about $25 million, but given the length of this fraud, the interest on those funds would have pushed the cash available to the credit union to $40 million. Know that if you commit fraud, the size of it will be exaggerated, and not in your favor. This was still garden variety payment fraud at the top. Payments were made to the fraudster or their designates. While steps were taken to hide the payments, a simple search of payments to the CEO ultimately uncovered the fraud. But when we look at the [Association of Certified Fraud Examiners’ annual report to the nations](https://legacy.acfe.com/report-to-the-nations/2022/) and see that the average fraud lasts 12 months, realize that this fraud lasted 20 times that. Twenty years is a long time and $40 million is a lot of money, all from a small credit union outside of LA. --- ## Wirecard Made It Up as They Went Along - URL: https://dynamicaccounting.net/wirecard-made-it-up-as-they-went-along/ - Date: 2023-05-26 - Topics: Microsoft & the GP Ecosystem, Fraud, Audit & Controls, Reporting & BI - Type: original article Wirecard is a challenging fraud to explain. It’s a German fraud exposed by a British journalist, and it’s got some fuzzy parts, but I’m going to try. Wirecard was a payment company. I saw it described as PayPal for Europe, but it was more than that. It seems to be a bit of PayPal, a bit of Venmo, that sort of thing. This fraud also comes with a movie if you want more. The documentary Skandal! is now on Netflix and it covers the Wirecard fraud. Wirecard started off in 1999 in Munich, and almost went broke. In 2002 it made, Marcus Braun, a former KPMG consultant, its CEO. The company originally focused on payments for companies frequently turned down by traditional finance like gambling and porn sites. In 2005 Wirecard merged with Electronic Business Systems. This is important because it gave them a listing on the Frankfurt Stock Exchange. There’s nothing inherently wrong with this approach, but it avoids the scrutiny of an IPO. Wirecard used its publicly traded status to raise money including one round worth €500 million. A year later Wirecard bought the e-bank XCOM. This is important because it gave them access to the Visa and Mastercard networks. With this Wirecard set out to become a global payment giant ultimately becoming the card processor for Aldi, Lidl, & several airlines. Wirecard also purchased a large number of Asian payment processors, many of them at alleged inflated values. Multiple articles describe the company’s structure as complex, making it difficult to compare to something like a traditional bank or traditional payment processor. As it grew Wirecard acquired a prepaid card business from Citibank giving it a U.S. presence and at one point it held informal talks to merge with Deutsche Bank. Critics kept nipping at Wirecard over its financial reporting, revenue determination, and perceived cash discrepancies. The responses from the company were aggressive, primarily a mix of deflection, legal threats, and smear tactics. The Financial Times took on Wirecard in 2015. A whistleblower dropped allegations in 2018. Core allegations included “roundtripping”, passing money through a 3rd party and bringing it back as revenue, recognizing money held for 3rd parties as revenue, and fraudulent financial statement filings. Wirecard denied everything. They were audited by EY and insisted they were financially sound. Despite the lingering allegations, they managed to wring €900 million out of venture firm Softbank. KPMG was brought in to do a special audit. Wirecard claimed €1.9 billion in cash in a pair of bank accounts in the Philipines. KPMG indicated in their audit that they were unable to verify much of Wirecard’s revenue. Additionally EY and KPMG were unable to confirm the €1.9 billion in the Philippine banks, Several months later CEO Braun resigned and Wirecard admitted that the €1.9 billion probably did not exist. This became a giant scandal in Germany. Wirecard was Germany’s answer to a global Silicon Valley firm. It was as if Germany’s Google or Apple was a fraud. My take, based solely on external reports, is that Wirecard, as an organization, liked the edge. They liked to take shortcuts. The company started on the edge with businesses that were marginalized, like gambling and porn sites. Wirecard then backed into being public with an acquisition instead of going through the due diligence of a public offering. They then bought their way on the Visa and Mastercard network. None of these things in isolation are wrong, but they do seem to show a pattern of shortcuts. The actual frauds appear to be primarily financial statement and revenue recognition frauds. Namely: - Acquiring firms and showing their revenue as organic growth instead of acquired. There was no reporting analogous to same-store sales to indicate how the core business was doing. Acquisitions were shown as sales growth. - Round Tripping – passing payments through third-party processors and bringing the funds back into the business as revenue to inflate financial statement revenues. - Roughly half of Wirecard’s business was outsourced. They had licensing arrangements with payment processors in countries where they didn’t operate, but they recognized the revenue of those providers as their own. - Cash held in escrow accounts and managed by trustees was reported as Wirecard cash. This really looks like started as a tone-at-top problem. A lot of people, possibly including EY, looked the other way. People wanted Wirecard to succeed. It was a source of national pride. Wirecard was also, big, and complex, even dense in scope. It was also mean when it wanted to be. Braun was a charismatic CEO who dressed and acted like Steve jobs. Wirecard also had deep roots in a lot of politicians. Everybody was encouraged to look the other way. As [*The Economist*](https://go.redirectingat.com/?id=127X678080&xs=1&url=https%3A%2F%2Fwww.economist.com%2Ffinance-and-economics%2F2020%2F06%2F25%2Fhow-wirecard-fooled-most-of-the-people-all-of-the-time&sref=https%3A%2F%2Fwww.esquire.com%2Fuk%2Fculture%2Fa41040983%2Fwirecard-scandal-true-story%2F&xcust=%5Butm_source%7C%5Butm_campaign%7C%5Butm_medium%7C%5Bgclid%7C%5Bmsclkid%7C%5Bfbclid%7C%5Brefdomain%7C%5Bcontent_id%7Cce4204f9-db50-40c0-b35a-238e7bd88e42%5Bcontent_product_id%7Ccc67daa5-a8a1-4cde-9197-f423b59ab5eb%5Bproduct_retailer_id%7C) notes: “Neither equity analysts, asset managers, auditors nor regulators come out of the story well…everyone with influence over the firm, from board members to auditors and regulators, seems to have been complacent. In a darker version of events, the actions of some may have been complicit, even criminal.” Ultimately Braun’s case is going to trial. Former Wirecard COO Jan Marsalek disappeared around the time of Braun’s resignation and is a fugitive from justice. He is believed to be hiding in Belarus. Just to throw a twist into this story, [this New Yorker article](https://www.newyorker.com/magazine/2023/03/06/how-the-biggest-fraud-in-german-history-unravelled) claims that at its core the Wirecard fraud was not a financial fraud, but was instead a massive money laundering operation primarily benefiting Russian oligarchs. It’s not a crazy theory. --- ## Would You Hire a Fraud? - URL: https://dynamicaccounting.net/would-you-hire-a-fraud/ - Date: 2023-05-19 - Topics: Fraud, Audit & Controls, Accounting & Career - Type: original article We’ve seen plenty of cases of good people gone bad. Not all fraud at the top starts that way. Carlos Ghosn was by all accounts a great CEO. Tom Girardi was a great lawyer. Temptation can happen to anyone, but if you start by hiring people more likely to commit crimes, you’ll get more crimes. As a suggestion, maybe do a background check for people with financial access. Prior to starting this series, we talked about [Bonnie Sweeten](/wp-admin/post.php). B[onnie claimed that she and her daughter had been kidnapped.](https://www.yourtango.com/news/kidnapping-hoax-mom-bonnie-sweeten-charged-another-fraud) In fact, Bonnie was at Disney World living it up with her daughter using cash and identity stolen from a co-worker. Bonnie got jail time. After getting out of jail, Bonnie got a job at a law firm and was convicted of stealing more than $600k from her employer and family members. Unsurprisingly this led to more jail time. After 8 years, she was released and a friend gave her another opportunity, this time as a bookkeeper of all things. Sweeten promptly forged checks and made fraudulent purchases on the company credit card. We talked about [Angela Phan](/wp-admin/post.php) who was hired as an accountant off of Craig’s list, worked one day, and stole $15k over 18 months using her 1 paycheck. There’s no indication of previous fraud in the news story, but maybe hiring accountants off of Craig’s list isn’t ideal. Finally, we have today’s story, [Business Rapper, Crypto Rapper](https://www.youtube.com/watch?v=_DIuPPmY9mw), alias Razzlekhan, [and self-described Crocodile of Wall Street, Heather Morgan](https://nypost.com/2023/01/18/crypto-rapper-razzlekhan-lands-nyc-tech-job-while-under-house-arrest/). Heather and her husband Ilya Lichtenstein have been accused of trying to launder $4.6 billion in Bitcoin stolen via a 2016 hack of Bitfinex. Note that the pair is not accused of committing the hack, just trying to launder the money. [They also weren’t very good at it](https://www.bloomberg.com/opinion/articles/2022-02-09/business-rapper-was-bad-at-bitcoin-laundering?cmpid=BBD011723_MONEYSTUFF&utm_medium=email&utm_source=newsletter&utm_term=230117&utm_campaign=moneystuff#xj4y7vzkg). In 2016 119,754 bitcoins were stolen from Bitfinex. At the time they were valued at $71 million. Bitcoin has gone up since then, hence the $4.6 billion valuation now. 94,636 of those Bitcoins have been recovered from the original wallet they were moved to after the heist. Morgan and Lichtenstein are accused of using fictitious identities, multiple accounts, chain hopping, and other techniques to hide the source of the bitcoin, with withdrawals made via Bitcoin ATM. Lichtenstein’s cloud storage account was found to have decryption keys to virtual currency addresses directly tied to the attack. Lichtenstein is being held without bail while Morgan is free on a $1 million bond and confined to house arrest. But this isn’t a story about crypto laundering. The story is that Heather Morgan now has a new job, while under house arrest, working for an unnamed New York tech firm “in the role of growth marketing and business development specialist.” Yes, she made a bit of a name for herself with some cringe-worthy rap, but hiring someone on house arrest gives new meaning to working from home. I know it’s a weird job market out there, but you would think with the great resignation and mass tech layoffs, surely there are better options. If you’re hiring folks into financial roles, do a background check. Actually, do a background check anyway. Lots of non-financial roles carry a risk of fraud or loss including jobs like warehouse work. Plus today’s marketing intern could become tomorrow’s event planner overseeing hundreds of thousands of dollars of marketing spend. Apply due diligence in hiring and don’t buy trouble. Update 7/10/23: There are a couple of good podcasts on the Crocodile of Wall Street case. The [Hacked episode](https://podcasts.apple.com/us/podcast/crocodile-of-wall-street/id1049420219?i=1000584615166) was fun and raised some interesting questions on how the stolen bitcoin would be returned and whether it belongs to Bitfinex or its users. Additionally they mentioned that at the max valuation of $4.6 billion this would have been the largest heist in history surpassing all bank robberies combined in the history of the US. --- ## Was Frank a Fraud? - URL: https://dynamicaccounting.net/was-frank-a-fraud/ - Date: 2023-05-12 - Topics: Fraud, Audit & Controls - Type: original article While trolling the internet, I found an article, now deleted, with the headline “J[P Morgan Chase Acquires Frank.](https://media.chase.com/news/jp-morgan-chase-acquires-frank)” “Oh no!”, I thought, “My friend Frank Vukovits has sold his soul! I hope he got a lot of money!” I kept digging and found an article titled “[JP Morgan says Frank was a Fraud](https://www.bloomberg.com/opinion/articles/2023-01-12/jpmorgan-says-frank-was-fraud#xj4y7vzkg)“. Clearly, they weren’t talking about Frank Vukovits. He is many things, but fraud is not one of them. He’s also not the type of guy to sell his soul. Frank was a website that was designed primarily to help students complete student loan applications. It was started by Charlie Javice now 30, based on her struggles to properly complete paperwork. Also part of the Frank team was Olivier Amar, JP Morgan Chase paid $175 million to purchase Frank in 2021. The theory was simple. Frank purported to have more than 4.25 million college students as users. JP Morgan Chase wanted an opportunity to market their financial products to these college users. It seemed like a win-win [until it wasn’t](https://nypost.com/2023/01/12/jpmorgan-claims-charlie-javice-duped-bank-into-buying-175m-startup-suit/). There are a pair of lawsuits now with J[avice claiming that JP Morgan Chase fired her](https://link.mail.bloombergbusiness.com/click/30232666.256719/aHR0cHM6Ly9hc3NldHMuYndieC5pby9kb2N1bWVudHMvdXNlcnMvaXFqV0hCRmRmeElVL3JfMnB1ckI3VzRsby92MA/6037e0851f82145b103bda2fB9ff73cd0) to avoid an upcoming $20 million payout. She also claims she objected to JP Morgan Chase marketing to these users and that student privacy concerns may prohibit marketing to many of these accounts. [JP Morgan Chase disagrees](https://assets.bwbx.io/documents/users/iqjWHBFdfxIU/rNlNVTl.6yh8/v0). JP Morgan argues that they hired a consultant to perform due diligence and the consultant was okay with a list of 4.25 million users. Post-acquisition JP Morgan asked for a list of 400k users to test the market and only 103 users from that list even clicked through to JP Morgan. This abysmal 0.026% click-through rate led JP Morgan to dig deeper into what was going on. Mostly they dug into Frank emails, which became JP Morgan Chase emails post-acquisition and now passed through JP Morgan servers. The emails showed that before the acquistion Frank didn’t have full information on 4.25 million users, only about 300k users. Much of the rest of their data was incomplete. As a result, Javice decided to make up 4.25 million users based on what little data they had. She went to Frank’s head of engineering to make up user and email records and he refused. That doesn’t happen enough so good for him. “The Director of Engineering questioned whether creating and using such a data set was legal, but Javice tried to assure the engineer by claiming that this was perfectly acceptable in an investment situation and she did not believe that anyone would end up in an “orange jumpsuit” over this project.” If your boss uses the phrase “orange jumpsuit” you should look for a new job. Javice then turned to a data science professor to generate synthetic data. Discussions like this one highlighted by Matt Levine are particularly damning: “Regarding creating physical addresses, the Data Science Professor wrote to Javice, “I can’t seem to find addresses in my raw files . . . . Should I attempt to fabricate them?” Javice responded “I just wouldn’t want the street to not exist in the state.” Later, the Data Science Professor determined that “‘real addresses’ may not be doable,” and Javice responded “If we can’t do real addresses what[’]s the best we can do for that?” … Javice was particularly concerned with the email addresses, asking the Data Science Professor “will the fake emails look real with an eye check or better to use unique ID?” He responded “[t]hey will look fake,” at which point Javice agreed to use a “unique ID” instead.” While Javice was fabricating 4.25 records to fool the due diligence consultant, Olivier Amar was purchasing 4.5 million student records from a marketing firm. At some point they were going to have to give JP Morgan Chase something resembling real college students. Those records were still short email addresses for about 2.5 million users so Amar turned to the same data science professor and third party to help find the relevant email addresses or generate them synthetically…er make them up. This explains the abysmal response rate to JP Morgan Chase’s email test. This was essentially a spam list with half the emails made up. As the lawsuits continue, JP Morgan Chase has since shut down the Frank website. Is this fraud? No one has been convicted of anything, but the emails say Frank the website was willing to sell its soul for $175 million. --- ## Girardi Keese Part 2 – Nothing Like a Little Side Fraud - URL: https://dynamicaccounting.net/girardi-keese-part-2-nothing-like-a-little-side-fraud/ - Date: 2023-05-05 - Topics: Fraud, Audit & Controls - Type: original article We talked last week about [Tom Girardi,](/girardi-keese-when-good-companies-go-pyramid-scheme/) his pop star-wannabe wife, and skinny dipping into the law firm’s trust fund to pay expenses. This ultimately led to the collapse of Girardi Keese. But while all that was going on, it is alleged that the CFO of Girardi Keese, Christopher Kamon, [was running his own side fraud at the law firm.](https://fingfx.thomsonreuters.com/gfx/legaldocs/akpeqzadwpr/USA%20v.%20Kamon%20-%20Guerrero%20affidavit.pdf) Kamon was creative enough to use a variety of frauds at Girardi Keese. It is alleged that Kamon created and paid false vendors (co-conspirators) and received millions in kickbacks from them. He is believed to have paid legitimate vendors with Girardi funds to perform renovations to his personal residence, purchase expensive sports cars, and travel the world. Finally, Kamon appears to have misused at least one company credit card for personal items. Kamon would also transfer money from the firm trust fund to operating accounts at Girardi’s request as part of a separate scheme. Consequently, Kamon’s stolen money came from both firm and client funds. And then there was the “escort” as she’s referred to in the indictment. There’s often a salacious side to frauds like this. Meet Nicole Rokita: “According to Rokita, she met Ramon around 2017 through an online dating website, seekingarrangements.com, which connects affluent, older men with younger women.” Rokita wanted a sugar daddy and she found one in Kamon. He bought her clothes, jewelry, an even a Tesla. He took her on trips around the world and paid her an allowance of $20k a month. He even managed to get her added to the firm’s health insurance. Kamon directed Rokita to form a company and Girardi Keese paid that company with the payments coded as “legal marketing”. Girardi Keese paid Rokita as much as $360k for her “work”. Rokita is important to this story because she gives us a possible glimpse into why Kamon did it. We talked last week that Tom Girardi was the only partner. He controlled the firm. When Rokita and Kamon were together, Kamon put everything on his corporate American Express card. “According to Rokita, when asked how KAMON could charge extensive personal expenses on GK’s AMEX, KAMON claimed that because he could not be a partner at GK, but did so much work for the firm, Girardi allowed him to use the GK AMEX on personal expenses.” Aha! We have a motive! It is the classic case of feeling underappreciated and therefore under-compensated. It’s the feeling that “If I’m not going to be paid what I’m worth, I’ll take what I’m worth!”. Kamon knew he couldn’t be a partner so figured out how to compensate himself like a partner. Ultimately Kamon is accused of taking as much as $10 million via his multiple schemes. We’ve talked about tone at the top before. We’ve talked about fraud at the top before. It’s the most expensive type of fraud by a large margin. I’m not sure how corrupt you have to be to have fraud within a fraud in what appears to be an otherwise legitimate and successful firm. --- ## Girardi Keese – When Good Companies Go Pyramid Scheme - URL: https://dynamicaccounting.net/girardi-keese-when-good-companies-go-pyramid-scheme/ - Date: 2023-04-28 - Topics: Fraud, Audit & Controls, Sales, Purchasing & Inventory, Accounting & Career - Type: original article [Tom Girardi was a pillar of California law](https://www.latimes.com/california/story/2020-12-17/tom-girardi-erika-jayne-rhobh-divorce). Girardi won the case that inspired the movie “Erin Brokovich”. His firm, Girardi Keese, dealt primarily in toxic torts. These included cases like tainted water, plane crashes, cancer from hormone therapies, etc. Toxic torts can be big, complicated, and hard to win. If Girardi Keese won, their clients could get a huge payout, and the firm would get as much as 40% of the total. Tom Girardi was the only partner. However, these are contingency cases. Girardi Keese might put out a large amount of money in expenses for experts, testing, etc., and wait years for a win. If they lost, they would get nothing and be stuck with the expenses. Tom Girardi was a law celebrity. He was picked by California Governor Gavin Newsom to be part of a panel tasked with filling state judgeships. He had a trophy wife, a wannabe pop singer named Erika Jayne. The two of them appeared on Bravo’s Real Housewives of Beverly Hills. There were a pair of ex-wives as well. By all accounts, Girardi was also rich. He had a Pasadena estate, exotic cars, you know, the works. At one point, divorce filings revealed his income to be around $263,000 a month. It’s easy to pick on the trophy wife, so we’ll do that for a minute. Erika Jane was by her own admission expensive. She waited tables in the bar of a restaurant that Giardi co-owned and that’s where she met Tom. In her memoir, [Pretty Mess](https://amzn.to/3ZVe3u3), Erika wrote, “There was nothing more I could buy”. So she decided to be a pop star, with some success. She even had a [song](https://open.spotify.com/track/2G8MDb25Oed8ZAx6qUG7Q8?si=e026e37e85384e72) and [video](https://www.youtube.com/watch?v=3hL99eTKil8) named ‘[XXpen$ive](https://open.spotify.com/track/2G8MDb25Oed8ZAx6qUG7Q8?si=e026e37e85384e72)’. Just a note, these aren’t work friendly. You’re on your own if you click those links. It’s also apparently expensive to try to become a pop star. But just as Erika decided to hang up her risque videos, Real Houswives came calling and she had to keep up. In addition to an expensive wife, Tom Girardi had also been borrowing money. Large contingency cases can take time and cost a lot. As his finances deteriorated, Girardi borrowed from firms that would fund lawsuits, at interest rates as high as 20%. That’s not exactly mafia rates, but it is credit card level. Girardi is also accused of pledging the same collateral to multiple lenders. Finally, there are allegations that loan funds were going to Erika Jayne’s career. Somewhere along the way, it all went wrong. It’s clear that money is missing, as much as $100 million. It’s also clear that as much as $10 million was stolen in a separate but related fraud we will cover next week. (This story keeps on giving.) Tom may have overspent on his trophy wife and his lifestyle during a period when he was not winning enough cases. It could be as simple as that, too much going out and not enough coming in. Still, it seems clear that Girardi did one of the few things that will bring scorn, even from other lawyers, he moved money from his trust account to his operating account. When he did that, he stole funds set aside to pay plaintiffs. The first public hiccup came in 2014 when about two dozen women filed suit alleging their payout from a cancer lawsuit did not match up. Girardi borrowed money and settled the lawsuit. The debt suits kept piling up and they were publicity nightmares. Orphaned Indonesian children in a settlement with Boeing over an airplane crash didn’t get their money. There was a worker with burns over 50% of his body from a pipeline explosion. He didn’t get his money. Girardi’s second wife even showed back up wondering why her $10k a month payments had stopped. Ultimately, Girardi was forced to admit he was broke. The money was gone. Effectively Girardi Reese had morphed into a Ponzi scheme. Once money left the trust account, old cases were paid with new money and borrowed money. There is no way to fix that cycle without putting money back in. My wife used to be a title agent. The firm she worked for handled the cash and conducted real estate closings. They also had a trust account that worked the same way. It doesn’t take many pending house sales in the $200k-400k range to carry a couple of million dollars in a trust account, and that’s for a small firm. Girardi was big. The trust account had to have been a tempting target, but stealing from Indonesian children orphaned in a plane crash is next-level bad. Where were the accountants in this you ask? Why didn’t Girardi Reese’s CFO raise the red flag or publicly quit in protest when money moved from the trust account to an operating account? Tune in next week to find out. --- ## Swisher Hygiene cleaned up fraudulently - URL: https://dynamicaccounting.net/swisher-hygiene-cleaned-up-fraudulently/ - Date: 2023-04-14 - Topics: Fraud, Audit & Controls, Accounting & Career - Type: original article We’re back to a fraud at the top, but again with a couple of twists. Swisher Hygiene was a sanitation company. They sold cleaning supplies and chemicals for restaurants and other businesses. Essentially a lot of kitchen and bathroom cleaning. In 2010 the company went public on the Toronto Stock Exchange via a reverse takeover. Almost immediately, Swisher’s CFO Michael Kipp engaged in a scheme to smooth earnings. Commonly called [Cookie Jar Accounting or Cookie Jar Reserves](https://www.accountingtools.com/articles/cookie-jar-accounting.html), this scheme seeks to manipulate earnings to meet a specific target like net income or EPS. It is often used to smooth earnings and consistently meet earning requirements. In a typical scheme companies pad reserves in good years and deplete them in down years to present a smoother earnings line. The problem with Cookie Jar Accounting is there can be a fine line between a legitimate adjustment of reserves and fraud. Reserves typically require some form of judgment which is why they are ripe for manipulation. It is not uncommon to see companies fined by the SEC for violations related to reserves without those violations resulting in fraud charges. Assisting Kipp was Joanne Viard, a CPA and the Director of External Reporting. Kipp was also in line for an $88k bonus if the company hit earnings targets. So far, this sounds like straightforward financial statement fraud. [The financial statements are alleged to have been manipulated by as much as $96 million over several years.](https://www.pressreader.com/canada/stockwatch-daily/20180412/281500751831885) The first unusual piece here is how they got caught. Swisher’s Controller pushed back on a suspicious request. [From the Justice Department’s report:](https://www.justice.gov/usao-wdnc/pr/federal-judge-convicts-two-former-swisher-hygine-inc-executives-securities-fraud) > “The accounting fraud scheme began to unravel when Swisher’s then Controller pushed back on making a fraudulent entry during the year-end close. The Controller wrote in an email, “I’ll run it by BDO [Swisher’s auditors] so we’re on the same page,” to which Defendant Kipp responded, “You’ll run it by me since I’m the chief accounting officer. I’m out of patience with this.” Later, Kipp fired the Controller for his persistent refusal to book the fraudulent entry. Swisher’s Audit Committee learned of the Controller’s allegations and promptly commissioned an independent internal investigation.” Pushback like this that leads to identifying fraud is pretty unusual. The second unusual piece is that I was doing some ERP consulting there at the time the fraud was identified. We were pretty deep in the weeds so it wasn’t clear at first what was going on. Imagine the largest conference room in your organization stuffed with accountants and auditors all billing at the highest hourly rate you’ve ever seen. They are there before you arrive in the morning and still there when you leave at night. Fraud is expensive, and the clean-up after fraud is expensive as well. I saw some pretty messy parts at Swisher around bank reconciliation and some fixed asset policies, but we were focused on fixing processes, not reserve accounting. Ultimately Kipp and Viard pled guilty and the US assets of Swisher Hygiene were sold to competitor Ecolab. Per the Association of Certified Fraud Examiner’s annual report, having an option for whistle-blowing, a hotline, website, something is the number one way fraud is ultimately caught. We saw this with the $8 million fraud at ING and All the Queen’s horses. It was ultimately a big piece of Enron’s unraveling as well. At Swisher, we had fraud at the top and collusion. That’s enough clout to bypass a lot of controls, but someone still took their fiduciary responsibility seriously and did their job. That is always the hard part about fraud at the top. If you see it, expect to lose your job, either because your report it, or because the fraud ultimately brings down the company. There is a pretty good argument that if you think you see fraud at the top, go get another job. --- ## Amazon Fraud – When Loss Prevention Breaks Bad to the Tune of $10 Million - URL: https://dynamicaccounting.net/amazon-fraud-when-loss-prevention-breaks-bad-to-the-tune-of-10-million/ - Date: 2023-04-07 - Topics: Fraud, Audit & Controls - Type: original article Part of a control environment in any operation with easily moved goods is loss prevention. Amazon warehouses are full of things people want and Amazon has loss prevention roles in the company. From August 2020 to March 2022 Kayricka Wortham was an Operations Manager at an Amazon warehouse in Smyrna, Georgia. In her position, Wortham could approve new vendors and approve vendor payments. Demetrius Hines was a Loss Prevention Multi-Site Lead at Amazon. He also worked at the Smyrna warehouse and at other company sites. In his position, Hines was: > “[responsible for preventing loss, monitoring security risks, and protecting people, products, and information at Amazon.”](https://www.11alive.com/article/news/crime/amazon-workers-scam-10-million-doj-steal/85-d4fb3f16-e815-4e5c-90df-9be92e034a1d) Wortham led this scheme and would provide fraudulent vendor setup information to her subordinates and then approve the vendor setup. [She and others, including Hines, submitted fake invoices to for payment by Amazon in amounts exceeding $10 million. They received payments totaling $9.4 million.](https://www.justice.gov/usao-ndga/pr/former-amazon-employees-plead-guilty-10-million-fraud) Hines was a roadblock and Wortham overcame this roadblock by recruiting him into the scheme. The typical wisdom is that collusion is really hard to find and stop. This is a great example of why. A key control, Hines, was coopted into the scheme. But they were still caught. There were also red flags, primarily people living beyond their means.. Wortham was driving a $200k+ Lamborghini Urus and Hines had multiple cars, a $70k Rolex and diamond jewelry. Also an ops manager might have setup info about the occasional vendor, but it seems like this was a large number of vendors. There are a couple of interesting pieces in here. First, $10 million is a lot to steal in 18 months. Kevin Lee Co stole $4.8 million over 7 years from Holt. Nathan Mueller stole $8 million in 4 years. $10 million in 18 months is a lot. Second there is no information across multiple articles on how the fraudsters were caught, just boilerplate language about the Secret Service being involved. I’m speculating that a $10 million expense increase over 18 months triggered a deeper look and ultimately a criminal investigation. How do you catch fraud like this? Collusion was involved to override preventive controls so it gets harder and we many need to fall back on detective controls and analytics. For example, budget analysis, trend analysis, [Benford analysis on invoice/payment amounts](https://www.acfeinsights.com/acfe-insights/what-is-benfords-law), and anomaly detection could all be part of the process. --- ## TSA Has Typical Control Problems Too - URL: https://dynamicaccounting.net/tsa-has-typical-control-problems-too/ - Date: 2023-03-31 - Topics: Fraud, Audit & Controls - Type: original article Public and Private firms aren’t the only organizations with control problems. Government has problems too. The Transportation and Security Organization’s last audit was 2016 and there were issues. The issues identified were pretty common and a lot of businesses have them too. KPMG performed a [financial statement audit](https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-17-69-Jun17.pdf) and an [audit of select general IT controls (GITC)](https://www.oig.dhs.gov/sites/default/files/assets/2017/OIG-17-73-Jun17.pdf). What did they find? - A number of items related to control of assets including assets not listed, missing asset IDs, etc. - Ineffective controls over the AR estimates. - Control issues related to HR & Payroll, especially around various approvals. - Journal entry approval problems with the year end suspense clearing. - Strong passwords were not consistently enforced. - Access Certification was not performed annually as required. - System access was not timely removed for terminated and/or separated personnel. This is pretty typical stuff. Access Certification in particular is often done via Excel and email and it’s a miserable process. Fixing this with a certification tool is actually pretty easy. System access not removed in a timely manner is another very common problem. Access Certification serves as a backstop for this, but a good identity governance application solves this in a preventative way. --- ## Bank Fraud is Bad - URL: https://dynamicaccounting.net/bank-fraud-is-bad/ - Date: 2023-03-24 - Topics: Fraud, Audit & Controls - Type: original article We’re back to fraud at the top this week, but this one is a little different, also $18 million is a lot of money. [Norman D’Souza was the CFO of crib and baby furniture company Munire’ Furniture. Munire’s was facing a difficult economic period and they needed to borrow money.](https://www.furnituretoday.com/industry-issue/former-baby-furniture-company-exec-pleads-guilty-18m-accounting-fraud/) The company’s financials weren’t conducive to a borrowing a large amount so D’Souza just made up some numbers inflating sales and accounts receivable. This led to a $17 million bank loan. This is straightforward bank fraud and I’ll note that bank fraud carries a sentence of up to 30 years in federal prison. Oops. Around the same time, Munire’ approached the municipality of Gas City, Indiana about a $1 million loan to help build a factory there. D’Souza doubled down here and provided fraudulent financial statements for that loan. The $18 million in loans wasn’t enough and Munire’ ultimately filed for bankruptcy and defaulted on the loans. At the time of bankruptcy the bank loan had an outstanding balance of $16.99 million. What’s different here is that there is no indication that D’Souza benefited personally from this fraud, beyond continuing to get a paycheck. Not all frauds are complex. This one is pretty straightforward, lie to the bank, don’t pay back their money. The lesson is here that loan fraud is still fraud and providing fraudulent financial statements is still fraud, even for a private companies. --- ## $8 Million Fraud for Ghost Services - URL: https://dynamicaccounting.net/8-million-fraud-for-ghost-services/ - Date: 2023-03-10 - Topics: Fraud, Audit & Controls - Type: original article We’ve previously seen [ghost cattle](/wheres-the-beef-ghost-cattle-fraud/) and r[eal horses](/all-the-queens-horses-like-parks-rec-fraud/). We’ve seen [fraud](/carlos-ghosn-and-fraud-at-renault-nissan/) [at the top](/carlos-ghosn-and-fraud-at-renault-nissan/). We’ve seen [fraudulent coders](/life-imitates-office-space-fraud-and-all/) and [controllers](/if-you-stole-4-8-million-how-much-would-spend-playing-game-of-war/). We’ve seen [fraud in the middle](/evolution-of-a-payment-fraud/) of organizations. So far though, much of it has come through various accounting departments and personnel. [For this post, let’s look at IT fraud.](https://www.cbc.ca/news/canada/edmonton/alberta-motor-association-vice-president-fraud-1.4552905) James Gladden started in IT at the Alberta Motor Association in 2008. Think of this as Alberta’s version of AAA. By 2013, James had been promoted to VP of IT. Over three and half years, from early 2013 to mid-2016, James managed to steal about Can$8 million by submitting fraudulent invoices. As VP of IT, Gladden had approval authority for IT-related invoices. [He pled guilty to fabricating or falsifying 55 invoices.](https://edmontonjournal.com/news/crime/former-ama-executive-gets-prison-for-8-million-fraud/) Gladden used a couple of methods for his scheme. He submitted genuine invoices for work done for the benefit of his personal company, Sprockit Apps Inc. In other cases, Gladden fabricated invoices. One example was a $500k invoice paid to a company called Datavox. The payment was allegedly for phone hardware. In fact, Datavox did no work for AMA. None of the articles I could find explained why he did it, beyond simple greed. But we do know he bought a lot of stuff. [Those purchases included luxury watches, two Porsches, a BMW, a Maserati, a 2014 Yamaha boat, a home in southwest Edmonton, and a $500k home in Scottsdale, Ariz.](https://globalnews.ca/news/3543315/former-alberta-motor-association-executive-charged-with-fraud/) We also know how he was caught. Gladden was allowed to spend some time working from home in August 2015 because of a leg injury. He was slow to recover and he remained out of the office for months, regularly failing to show up for meetings. In 2016 he was asked to go on disability and refused. He was later forced onto disability and his replacement found the fraudulent invoices. This is similar to what we saw with the Queen of Horses where an extended vacation surfaced her fraud. AMA has said that they’ve improved their controls after this. Certainly, better capital budgeting controls would have helped. Improved vendor and invoice management would have helped prevent this as well. An audit should have surfaced a false invoice like the Datavox one. Finally, we come back to a fraudster again visibly living beyond their means. --- ## If You Stole $4.8 Million, How Much Would You Spend Playing Game of War? - URL: https://dynamicaccounting.net/if-you-stole-4-8-million-how-much-would-spend-playing-game-of-war/ - Date: 2023-03-03 - Topics: Fraud, Audit & Controls - Type: original article If you stole $4.8 million, how much would you spend playing the freemium mobile phone game, Game of War? For Kevin Lee Co, that answer was $1 million. From 2008 to 2015, Kevin was the controller for Holt, the northern California dealer for Caterpillar heavy equipment. Kevin managed the accounting department and oversaw the company’s commercial credit accounts. [Co abused that authority to conduct hundreds of unauthorized credit card transactions on the company’s account, to manipulate and falsify records regarding the credit account, and to mislead the bank that held the credit account when it made inquiries to Co about suspicious transactions.](https://www.washingtonpost.com/news/morning-mix/wp/2016/12/12/a-calif-man-stole-nearly-5-million-from-his-company-then-spent-1-million-on-a-cellphone-game/) This fraud has always been short on details. The focus is always on how the money was spent. [For this post, I managed to dig up the plea bargain with more detail.](https://cdn.arstechnica.net/wp-content/uploads/2016/12/gameofwar.pdf) In short, this was pretty common corporate card fraud on a grand scale. Kevin was responsible for managing Holt’s purchasing card (p-card) program. He would issue cards, review statements, approve invoices, and was also a cardholder. Kevin hid his transactions by coding them inappropriately throughout the ledger. Holt’s bank, Bank of the West, identified suspicious activity on at least three occasions. Each time the bank called Kevin Co and was reassured that the charges were appropriate. Like our last fraud, Kevin’s got more sophisticated over time. At first, he simply bought personal items on his p-card and hid the expense. Over time he enlisted a co-conspirator, identified as co-conspirator A, a luxury auto dealer, to use his p-card and the p-cards of two former employees to purchase luxury cars and to buy equipment for the co-conspirator. A second co-conspirator, who was not an employee, was also given a p-card and permitted to spend almost $50k. I’m speculating here, but it wouldn’t surprise me if this was a card for a love interest. Given the modest amount versus the total, it seems like it could be a “get yourself something nice” arrangement. Finally, Kevin Lee Co engaged in money laundering. Co-conspirator A would charge the card and then write checks back to Kevin for about half of the money. This story got wild when it was revealed what the money was spent on. The list includes luxury cars, season tickets to the Sacramento Kings and San Francisco 49ers, plastic surgery, and a golf membership at an exclusive club. And then there is Game of War. A mobile phone-based, free-to-play game with in-game purchase options. Co reportedly spent $1 million dollars on those in-game options in the Kate Upton-promoted game. Company credit card fraud is depressingly common. P-cards typically have additional controls and in this case, it appears they were triggered at least 3 times, but when the fraudster is in charge, those controls can only do so much. I’ve personally seen 3 cases of corporate card fraud after the fact. In each case, it was depressingly similar, a controller who coded the cards and entered transactions into the accounting system. The problem with this type of fraud is that it can run for years. A $200k corporate card fraud is a small one. Getting to a million or two is very doable. Still, almost $5 million over 7 years is a long fraud. Obviously, segregation of duties would have addressed this, as would an independent reconciliation of card charges, along with better p-card limits and purchase limitations. I also want to make the case that CEO, CFO, and controller jobs are NOT transactional jobs. No one hires a controller for their ability to key payables transactions. They can advise on transactions, help ensure that coding is correct, etc., but not key transactions. They definitely shouldn’t key transactions regularly. But it didn’t stop there. While out on bail and awaiting sentencing, Co started a company selling generators, solar panels, and windows. During the pandemic, he fraudulently applied for and received Paycheck Protection Program loans from two banks totaling more than $500k. Co was required to disclose on the applications that he had pled guilty to wire fraud and money laundering but conveniently left that out. Co was sentenced to 10 years for the initial fraud. Committing a second fraud while on bail will not help him. --- ## Evolution of a Payment Fraud - URL: https://dynamicaccounting.net/evolution-of-a-payment-fraud/ - Date: 2023-02-24 - Topics: Fraud, Audit & Controls - Type: original article This one is a little older but it’s one of my favorites because we have so much detail and we have it in the fraudster’s voice. I’ve actually covered it before, but it’s worth another look. The core source here is [Journal of Accountancy’s Lessons from an $8 million fraud](https://www.journalofaccountancy.com/issues/2014/aug/fraud-20149862.html). Nathan J. Mueller worked for a Minnesota insurance company, ReliaStar, that was taken over by global insurer ING. Mueller played a lead role in the transition to a new ERP system and along the way he and a co-worker were given payment approval authority up to $250,000. Mueller didn’t even know he had that authority until two years later. Red flags were present early in that users often logged in as each other to get something done when a co-worker was out. With a pregnant wife and a salary that wasn’t quite covering the bills, Mueller logged in as a co-worker and requested a check made out to Universal for $1,100. He then logged in with his credentials and approved it. Universal was an insurance company they paid regularly. The word Universal was also part of the name of his credit card. [This is not in the article, but suspect this was the AT&T Universal Card.] The check cleared and his credit card account went down by $1,100. There was a control point here. It was a different user’s job to receive the checks and mail them out. Mueller was a backup for this process so he waited to request a check until he know the primary person would be out. Occasionally, he gave the primary the day off to make it easier. The organization had a segregation of duties control point here, but it wasn’t functioning as designed. After his start, Mueller paid off his Universal card and then kept transferring balances from other cards and debt to that card. After stealing $88,000 he was out of debt. Right before this though, there was a chance to catch him. He’d send a $4,500 payment without a payment voucher and without an account number. The check was returned to his work and the AP department, instead of investigating, forwarded it to Mueller. It was a close call and the fraud could have been stopped there. It took a few months for Mueller to get past the scare and from there he got smarter. Like the term “Universal”, Ace was part of a company name that regularly received payments so Mueller opened a shadow “Ace”, Ace Business Consulting. He would request and approve payments as before, but now he could just deposit the checks. He did this to the tune of $8 million over 4 years. Mueller needed to cover his tracks. He primarily used two schemes, hiding amounts in accounts with a lot of ledger activity and manipulating foreign currency accounts. He started by simply hiding the payments in high volume accounts. > ***For every credit (to the bank) there has to be a debit, and my debits needed to be hidden somewhere. Our payments were usually for insurance claims, commission expenses, various refunds, or an administrative expense. In 2003 and 2004, I hid all the debits in ledger accounts that had a lot of reconciliation activity, making sure that my debit helped the account reconcile to zero.*** As Mueller’s scheme evolved, he would intentionally weaken the Canadian dollar when calculating the exchange rate for their Canadian subsidiary. Effectively this hid his theft as exchange rate losses. Mueller was the only person to manage the exchange rate calculation for 7 years. He also had to hide his theft from his wife. He had significantly upgraded his lifestyle so he needed an explanation. Mueller decided that he was a successful gambler. He would take junkets to Vegas and return with his own stolen money. His wife remained suspicious and eventually, they divorced. What got him caught was that Mueller’s ex-wife became friendly with one of Mueller’s co-workers. His wife said that she didn’t believe the gambling stories. That set off the alarm bells that led to the discovery of Mueller’s scheme. We know why Mueller did it, financial pressure that morphed into greed. The core issue here is Mueller’s ability to bypass segregation of duties controls. The ability to log in and request payments as a coworker was the key to this scheme. Without that, it might have been possible to redirect a few payments or sneak through a fake Universal invoice, but not to the tune of $8 million. With that access, he managed to avoid the preventative control of a user creating and approving their own invoices. That access made it possible to bypass the control of check mailing being done by a different user. Interestingly, no detective controls caught the fraud either. No large, unexplained budget differences that someone investigated. There was no follow-up on the returned check. There was no application of statistical tools or forensic analysis. Finally, Mueller’s lifestyle of expensive cars, watches, and trips didn’t raise red flags within the company until the very end. Of the $8 million, he paid back $860,000, mostly in seized property. In prison, he paid $75 a month as part of a prison repayment plan. As with other frauds we’ve seen. The money was gone. Mueller’s scheme started out as simple payment fraud. He just cut an extra check to Universal and simply hid it in a complex account. That got him as far as $88k. From there Mueller had to evolve. He set up Ace Business Consulting. He hid the fraud in exchange rate losses and created a gambling backstory. Each adjustment added complexity. Still, once someone decided to look, the fraud was easy to find. --- ## All the Queen’s Horses – Like Parks & Rec + Fraud - URL: https://dynamicaccounting.net/all-the-queens-horses-like-parks-rec-fraud/ - Date: 2023-02-17 - Topics: Fraud, Audit & Controls, General Ledger & Financials - Type: original article This one comes with a movie so grab some popcorn. The documentary [All the Queen’s Horses](https://www.imdb.com/title/tt5709852/) moves around to different streaming services so Google it and grab it. It’s about 75 minutes long and worth it. I try to make sure that every new employee of Fastpath sees this. It helps explain why we matter. Dixon, IL is a modest city with a population of 15,800. Their annual budget is $8-9 million. Over a number of years, their controller Rita A. Crundwell stole $53 million from 1991 through 2012. I’m going to let that number sink in. [On December 8, 1990, Crundwell set up a secret bank account named the Reserve Sewer Capital Development Account (RSCDA)](https://en.wikipedia.org/wiki/Rita_Crundwell). This was not actually a city account, but it looked like one, and Crundwell was the only signatory. Crundwell would move money into the Capital Development Fund. She would then create false state invoices payable to “Treasurer, State of Illinois” and generate checks payable to “Treasurer”, conveniently leaving out the State of Illinois part. Crundwell was the treasurer of the city of Dixon. Those checks were then deposited into the RSDCA account. Her process made it appear that she was making payments to the state when in fact she was moving money into an account over which she had sole control. [Rita was able to accomplish this because she had full control](https://cpahalltalk.com/rita-crundwell-story/)[.](https://cpahalltalk.com/rita-crundwell-story/) She opened the mail, processed invoices, prepared checks, signed checks, managed the accounting system, and performed the bank reconciliation. She did this for 22 years. Rita started small, stealing only $181k in her first year. But her thefts increased from there. In 2008 she stole $5.8 million from a city with a budget of $8-9 million. She averaged about $2.5 million a year over 22 years. It gets worse, the city had a budget and was audited every year. Crundwell managed the budget and she managed to fool the auditors. Rita got caught when she took an extended vacation. Her replacement asked the bank for a list of all bank accounts and found the RSCDA account. Forcing accounting personnel to take vacations is actually a control point. A surprising number of frauds are identified because while the fraudster is out. Often the fraudster is described as “hardworking, they never take vacations”. What did Rita do with all the money? She didn’t blow it on cattle futures, she bought show horses…expensive show horses, and she ran a horse breeding operation. By all accounts, she was good at her hobby too. Her horses won 52 world championships and she was named a leading owner by the American Quarter Horse Association for eight consecutive years. She also had all the accessories like a farm and a multimillion-dollar motorhome for traveling to horse shows. There were red flags. The city ran a deficit while surrounding cities ran surpluses. Crundwell blamed budget shortfalls on the state being late with tax revenue shares. She was also living well beyond her means. [Living beyond one’s means was the number one fraud indicator in every Association of Certified Fraud Examiners annual study since 2008.](https://legacy.acfe.com/report-to-the-nations/2022/) People had questions so they filled in with assumptions. She had inherited the money. Her horse breeding operation was very profitable, etc. Fraud like this should be preventable or at least quickly detected. There are a lot of basic controls for this. First up segregation of duties. Rita Crundwell obviously had too much control of the process. No one person should have complete control of any process. Up next, getting a list of accounts from the bank. The auditors almost certainly confirmed the balances from a list Crundwell gave them. It wasn’t until someone asked the bank that Rita was caught. As an aside, bankruptcy investigators at FTX also had to go find all of their bank accounts. Additionally, a big part of segregating duties is independent bank reconciliations. This is one of the few independent confirmations of company cash flows and the process is often treated as a chore instead of a critical tool. I’ve seen an otherwise very good controller fired because their team couldn’t produce timely bank reconciliations. Finally, having a whistleblower option like a phone line, website, etc. is also an important defense here. Not everyone sees someone living beyond their means. People had questions about Crundwell’s lifestyle but no one spoke up. --- ## Where’s the beef? Ghost Cattle Fraud - URL: https://dynamicaccounting.net/wheres-the-beef-ghost-cattle-fraud/ - Date: 2023-02-10 - Topics: Fraud, Audit & Controls - Type: original article The TV show Yellowstone is all the rage and it’s all about protecting the ranch and the cattle. [But what if the cattle doesn’t exist?](https://www.marketwatch.com/story/wheres-the-beef-rancher-sentenced-to-11-years-for-ripping-off-tyson-foods-of-nearly-250-million-in-ghost-cattle-scam-11664990727) In Washington State a cattle rancher has been sentenced to 11 years in prison for scamming Tyson Foods out of almost $250 million with cattle that didn’t exist. You read that number right, almost a quarter of a billion dollars. I keep saying that fraud at the top is the most expensive fraud. This might be the exception…sort of. In 2016, Cody Easterday of Mesa, WA entered into an arrangement with Tyson Foods. Easterday ran a family farm and feedlot in Washington. Tyson would front the money for cattle and feed, Easterday would maintain the cattle for Tyson and pay 4% interest on the fronted money when the cattle went to slaughter. This looks like a typical outsourcing arrangement. Tyson wanted beef, where presumably it has some control over the conditions of the cows, so it outsources. Given Tyson’s size in the marketplace, it fronts the cash to avoid overwhelming the smaller partner. It charges the partner 4% for fronting the cash. Seems reasonable. The contract totaled more than $2 billion over 4 years. [Easterday is accused of padding the number of cattle by more than 10% and billing Tyson for cattle that didn’t exist, to the tune of $233 million.](https://www.justice.gov/opa/pr/washington-man-pleads-guilty-244-million-ghost-cattle-scam) He pulled a similar stunt with another producer and bilked them out of $11 million for a total of $244 million. Easterday was at the top of his organization, so this is still fraud at the top, he’s just defrauding another organization. Why did he do it? Easterday was trading futures contracts on cattle. We talked about future contracts last time with FTX and I believe I called it really, really, one more really, risky, certainly leveraged future trading is. Easterday managed to lose $200 million trading cattle future contracts. He reportedly started trading cattle futures as a hedge against market fluctuations, perfectly reasonable, but as he took riskier bets it turned into a straight up gambling addiction. Easterday confessed when Tyson became suspicious and asked for a full inventory of cattle purchases. The core lesson here is trust but verify. We don’t have information on how Easterday reported cattle to Tyson, but it’s pretty clear that weren’t conducting any type of audit. I have a friend who did audits of agriculture and it can be tough to audit something like a newly planted field, but you can show a up few months later and confirm. I have another friend who owns a small cattle ranch and cows these days are all tagged , many of them have RFID chips. While cows do move around, they can be counted. If partners are showing red flag like regular invoice corrections, delivery mistakes, etc., it may be time for an audit. If there is already some type of audit in place, review it. That’s what SOC reports do for online providers. They document the controls in place and whether those controls are being performed appropriately. Company can and should review SOC reports where available to get comfortable with a partner’s controls. On a related note, back to last week, I’ve not found any evidence that FTX had a SOC report in any form. --- ## FTX – How to Do Fraud at a Futures Exchange - URL: https://dynamicaccounting.net/ftx-how-to-do-fraud-at-a-futures-exchange/ - Date: 2023-02-03 - Topics: Fraud, Audit & Controls, Tips & Hidden Features - Type: original article I’ve done a lot of research on FTX and I have…opinions. If you haven’t paid attention, FTX was a crypto futures exchange. It had a related/sister crypto hedge fund known as Alameda Research. All of it melted down in late 2022. There are significant fraud allegations and guilty pleas so far. There are also a lot of lurid allegations. Matt Levine’s column, [How to Do Fraud at a Futures Exchange](https://www.justice.gov/usao-sdny/pr/former-chief-financial-officer-two-spacs-pleads-guilty-fraud-scheme) is the clearest explanation of FTX. We’re going to try to go there, but first I have to get a few things off my chest. 1. Sam Bankman-Fried’s “Balance Sheet” that he passed around trying to raise last-minute funds is offensive to me as an accountant. Maybe some investors don’t care, but I’d get fired for showing anything like that to anyone at any job I’ve ever held. A copy of that balance sheet is the image for this post. 2. Quickbooks is not an appropriate accounting system for a company the size of FTX mostly because of its inability to scale to that size. I suspect Quickbooks would be happy to have no association with FTX given what SBF’s balance sheet looked like. 3. If our Craigslist Accountant from a few weeks back worked at FTX (and actually did the work) she could steal $15k/day, every working day for a year, and FTX would only be out $4 million instead of billions. Whew! Ok, where do we start? FTX was a futures exchange. In a futures exchange, people bet on some proposition, say Bitcoin will go up or down. Some people bet up (long) and some down (short) but they place that bet with the exchange, not with each other. To guarantee these bets, customers deposit cash. On some defined time frame, the exchange checks the results and if Bitcoin went up the exchange takes some money from the short bettors and gives some to the long bettors. If it goes down, the reverse happens. If an account goes too low, the exchange asks the bettor to put in more money. This is a margin call. If the bettor doesn’t cover, the exchange automatically closes out the position at a loss. If an account gets high enough, the bettor can take some money out. Ideally, the exchange is smart about this and limits the amount to reasonably match the volatility. If an account goes below zero, that is if a bet on our Bitcoin example falls fast enough that there isn’t time to get more money or close out the position, the bettor owes more than what’s in the account. Collection from the debtor will be problematic at best and the exchange will have to pay out of their own money. This is straightforward futures stuff. It’s very common and well-understood in traditional financial circles. That doesn’t make it easy or safe, but everyone knows that’s how this works. Notice that there are no actual Bitcoins in here, just bets on whether Bitcoin will go up or down. Much like betting on a football game, you don’t own the team, play for the team, or even get to see a game, you’re betting on the performance of something you don’t own. Finally, we’re talking about leveraged futures trading here. Something like deposit $2k and the exchange lends you another $15k to bet on Bitcoin. Alternatively, deposit $2k and the exchange lends you $15k in Bitcoin to bet on. The exchange may hold a little of a given asset like Bitcoin, but it doesn’t really have to because it has customers on both sides of the trade so they more or less offset. Leverage like this is really, really, one more really, risky. That’s a big loan on a small deposit. If prices move in the wrong direction quickly, positions get wiped out leaving the exchange holding the bag. Crypto often moves quickly in the wrong direction for someone. Future Exchanges control risk by: 1. Charging high margins. 2. Tailoring the margin to the riskiness and size of the bets. 3. Monitoring and closing out losing positions quickly. 4. Limiting withdrawals. If a position grows and too much is removed, there isn’t enough to cover a reversal in fortune. At least well-managed ones do. FTX on the other hand: 1. Setup a futures exchange. 2. Advertised their impressive risk engine with customized margin factors designed to carefully take into account volatility, liquidity, account position size, and unusual market moves to quickly close out losing positions and limit withdrawals as appropriate. 3. Did a lot of trades with their own money. 4. Without telling anyone, exempted themselves and related entities from all the risk management stuff they advertised. 5. When bets moved in their favor, they withdrew funds for condos, political contributions, whatever. 6. When bets moved against them, they didn’t put money back in, didn’t close out their bets, just let everything go negative and ignored it. This is fraud because FTX advertised it had good risk management when it actually had bad risk management. Additionally, taking money out when FTX wins and not putting it back when FTX loses predictably moves money from customers to FTX. Third, FTX might be tempted to speed up this process with its own token. Say, create a bajillion magic beans out of thin air, trade a few magic beans with yourself and some friends to establish a price, then borrow against the remaining bajillion beans at the artificial price. This is the crux of the SEC complaint against FTX. The infamous “back door” from early news reports was really exempting related firm Alameda from all the risk management constraints. Also, there was additional comingling going on. FTX’s bank account couldn’t accept some foreign deposits so they went to Alameda who just kept them…apparently. There was some sort of loan(ish) disclosure, but the funds appeared as internal funds, not customer funds. Eventually, if you take money out when you win and don’t put it back when you lose, you run out of money to play with. And when you borrow based on artificially inflated valuations, there is nothing left when the valuations pop. Sam Bankman-Fried is going around apologizing, but this was not a mistake. Like Celsius from a few weeks ago, this was a failure to act as a fiduciary of the customer’s money. Being this reckless is not a mistake, it’s fraud. I’ll try not to do too many of these giant frauds because the lessons are macro lessons. They aren’t actionable for average folks. But, fraud at the top is the most expensive kind of fraud. If you work for a company and see that, run. The tone at the top still matters and people have subsequently shown behaviors by FTX and Sam Bankman-Fried that should have raised red flags. As an FTX user, there doesn’t seem to be much that could have been done, other than quickly withdrawing funds at the first sign of trouble. FTX appears to have melted down into a giant fraud. I don’t think it started that way. I’m not convinced that was the intent, but whether through hubris, a lack of maturity, or missing respect for the customer, it has ended up there. As a footnote, FTX was a mess internally. [We’ve previously seen that Celsius](/celsius-crypto-commingling-fraud/) was a different kind of internal mess. However, both failures were precipitated by credit bubbles and crazy leverage. Richard Rumelt covers this well near the end of Good Strategy. Covering the 2008 housing crisis Rumelt notes that Bear Steans was leveraged by at least 32 to 1. Lehman Brothers were similarly leveraged and it didn’t take much to tip everything over the edge. Before that Worldcom was an earlier example. The crypto winter of 2022 was ultimately a cascading failure of easy credit, probably triggered by the failure of Three Arrows Capital. It is not unusual for leverage-based failures to devolve into financial statement fraud as management tries to keep the company afloat. FTX and Celsius both also suffered from a lack of internal control that made fraud possible. --- ## Craiglist Accountant Fraud – What a Difference a Day Makes - URL: https://dynamicaccounting.net/craiglist-accountant-fraud/ - Date: 2023-01-27 - Topics: Fraud, Audit & Controls, Accounting & Career - Type: original article My colleague Frank Vukovits and I talk about this case a lot. While it seems simple on the surface, there are a lot of unanswered questions and I have not been able to track down answers. The base story is simple, Angela Phan was hired as an accountant for Triplematic Dispensers via a Craigslist ad. She worked one day and stole almost $15,000. [The St. Louis Post-Dispatch story seems to be primary, but it’s behind a paywall.](https://www.stltoday.com/news/local/crime-and-courts/accountant-hired-via-craigslist-bilks-maryland-heights-firm-out-of/article_3c4d47fb-9abf-545c-be4d-dc5bcd4ec1ca.html) [KSDK has an overview for free.](https://www.ksdk.com/article/news/crime/woman-hired-off-craigslist-steals-14000-from-company/63-286074202) Both articles are thin. With a little digging, we find that we don’t know why Angela only worked one day. We don’t know if she quit or was fired. None of the articles say what day she actually worked. We just know that the fraud started in July 2014 and she wasn’t caught until December 2015. Let’s back up. This is simple check fraud. Angela worked one day and got a paycheck mailed to her. The paycheck obviously had the company routing number and account number on the check as all checks do. Angela is alleged to have used that information to pass fraudulent transactions through Triplematic’s bank account to the tune of $14,720.21. If you just read the headline **[Accountant Worked One Day, Allegedly Embezzled $15k](https://www.goingconcern.com/accountant-worked-one-day-allegedly-embezzled-15k/)** it’s funny. When you realize the fraud went on for 18 months it gets weird. That’s a long fraud for only 15k. Phan gets points added for patience and deducted for stealing small amounts. If you’re going to commit felony identity theft (what she was charged with), don’t skimp. A lot of people have suggested that Triplematic brought this on by hiring an accountant via Craiglist. I tend to agree, but she was gone after a day. We’re all allowed an occasional mistake. What I don’t understand is how this continued for 18 months. From the St. Louis Post-Dispatch article: > “The company later noticed several unauthorized transactions had been made on the business checking account. The company’s bank said at least one of the transactions was made to an account connected to Phan.” Assuming the articles are correct, why didn’t they catch these in the July 2014 bank rec and close the account? Why leave this open for 18 months? I’m intrigued enough by this story that I poked around [Missouri CaseNet](https://www.courts.mo.gov/cnet/welcome.do) to see if could find a final disposition. The articles indicate that she confessed to a felony so there should be some kind of resolution, but I couldn’t find anything. That means that Angela Phan could still be out there answering Craigslist ads for accounting jobs. How do companies prevent this? 1. Maybe don’t hire accountants off of Craigslist and do a little due diligence on candidates. In fairness, anyone who gets a check has routing and account information. 2. Use a dedicated payroll account that doesn’t carry extra cash. This makes extra payments stand out. 3. Perform bank reconciliations in a timely manner and investigate suspicious or missing payments. 4. Use positive pay on the account to reject unauthorized payments. Positive Pay is a bank feature used as a control for checking accounts. Account holders submit authorized payments to the bank. Unmatched payments are rejected. Alternatively/Additionally, banks may present transactions online with a short timeline to reject unauthorized transactions. --- ## Life imitates Office Space, Fraud and All - URL: https://dynamicaccounting.net/life-imitates-office-space-fraud-and-all/ - Date: 2023-01-20 - Topics: Fraud, Audit & Controls - Type: original article I love the movie [Office Space](https://www.imdb.com/title/tt0151804/). It’s full of what are now classic nerdy memes and tropes including red staplers, TPS reports, flair, and beyond. But a core piece of the movie revolves around fraud. When Peter finds out that Michael and Samir are going to get downsized, they hatch a plot to steal fractions of cents on each financial transaction. They manage to screw it up. There are other lessons in this movie, but that’s the fraud lesson. Expect to screw it up. Interestingly, in the movie, they stole over $300k. Remember that number. In the real world, [Ermenildo “Ernie” Valdez Castro of Tacoma, Wash is accused of stealing around $300k from Zulily, the online retailer he worked for](https://www.geekwire.com/2022/office-space-movie-plot-gave-zulily-engineer-a-blueprint-for-financial-fraud-prosecutors-allege/). In a reported confession to police, he called his plan the OfficeSpace Project and indicated inspiration from the movie. Heist 101: Don’t name your heist after famous heists, real or fictional. Ernie’s plan was a little different though. He didn’t steal fractional pennies. The specifics are a little fuzzy, but based on the [GeekWire article](https://www.geekwire.com/2022/office-space-movie-plot-gave-zulily-engineer-a-blueprint-for-financial-fraud-prosecutors-allege/), Ernie, a software engineer, wrote code to redirect shipping fees collected from certain customers to a Stripe account he controlled. Additionally, it appears that in some cases, the code double-charged customers for shipping and redirected the additional charge to an account he controlled. Those two schemes netted about $240k. Not content with just that, [Ernie changed pricing to buy items at a substantial discount.](https://brobible.com/culture/article/seattle-tech-worker-arrested-stealing-crime-office-space-inspired/) Those discounts amounted to about $40k. Potentially these items were purchased at a significant discount for resale. The articles aren’t clear, but a pile of products was found at his house. Ernie’s price fixing was found first. After his laptop was seized, the company found evidence of shipping fraud. The side hustle fraud to his main fraud got him caught. So where did all the money go? This is always a fun question because it so often evaporates. > > **“He clarified that he had used the money to invest in stock options, particularly GameStop stock options, and reiterated that all the money was now gone. He denied purchasing any physical assets with that money.”** Points to Ernie for being creative. Redirecting shipping fees is not your garden variety AP payment fraud or AR lapping scheme. Points are deducted for getting caught because the side hustle to your main fraud was exposed. Sloppy. So how do companies find or prevent fraud like this? 1. Segregation of Duties for code changes. It’s pretty clear that Ernie could change production code without a testing and review process. That’s a big no-no. 2. A good budget and reconciliation process would show either shipping costs well below budget or missing cash depending on exactly how the payments were redirected to Stripe. That should lead to a lot of questions. 3. Change tracking, like an audit trail on price changes, would show price reductions and an immediate return to the initial price. Definitely a red flag for investigations. Whether that change was done via code or an interface, my assumption is that the price is stored in a database and not solely in code, making change tracking easier. Based on my experience, that is a reasonable assumption. I see so many companies not wanting to do the work to prevent fraud. It’s work. It takes time. In this case, Zulily is a $200 million dollar subsidiary of a publicly traded, multibillion-dollar entity. Three hundred K is an average fraud and a drop in the bucket. But it could just as easily have been a $3 million startup where a loss of $300k means people get laid off. At the same time Zulily IS a $200 million dollar subsidiary of a publicly traded, multibillion-dollar entity. SOD for code changes, a robust budget/reconciliation process, and reasonable change tracking should already be in place. They can do better. --- ## Celsius, Crypto, & Commingling Fraud - URL: https://dynamicaccounting.net/celsius-crypto-commingling-fraud/ - Date: 2023-01-13 - Topics: Fraud, Audit & Controls, General Ledger & Financials, Payables & Receivables - Type: original article We’ll get to FTX eventually, but first, let’s look at Celsius. [Much of this post comes from the Celsius bankruptcy filing here.](https://cases.stretto.com/public/x191/11749/PLEADINGS/1174911202280000000001.pdf) Celsius was a crypto lending firm founded in 2018. Their primary product was called an Earn account. Customers would deposit crypto asses with Celsius in exchange for rewards. Customers could also borrow against their crypto assets. Celsius would move assets from bridge wallets tied to a customer to aggregator wallets from which it would invest and make loans. Think of this as similar to cash in a bank. If I deposit $100 it does not sit in an envelope with my name on it waiting for me to withdraw. It is comingled, loaned, etc. There is no way to trace my $100 through the bank, there is just a ledger entry that I’m owed $100 by the bank when I ask for it. (For clarity, each type of cryptocurrency, like Bitcoin or Ethereum, had its own aggregator wallet, like aggregating dollars and Euros in separate accounts.) Later, US regulators pressured Celsius to change its business model under the theory that the Earn product was a security that should be regulated. As a result, Celsius launched its Custody program for US customers. Custody accounts were not eligible for rewards and would not be transferred, sold, loaned, etc. The custody model was supposed to be closer to a digital safe deposit box. Because of the regulatory pressure (and their own procrastination), Celsius moved fast to launch Custody accounts and they broke things. A lot of things, Heck everything. Part of this speed run included: - Relying on manual reconciliations of crypto assets without robust controls. If you’ve ever tried to reconcile a bank account where bank deposits were aggregated but the individual checks for that deposit were listed in the accounting system, you understand how ugly this can be. Now multiply that times thousands. - Creating a 3rd product, Withhold accounts, for states where they weren’t licensed for their Custody accounts. The Withhold accounts had no terms of service. - Not creating separate wallets for Withhold accounts and not otherwise separating the funds. To fund the Custody accounts, Celsius transferred crypto assets from the main or aggregator wallets, but they did not have a process to separate new deposits. Deposits continued to come into the aggregator wallets. Celsius’s Custody program did not automatically balance the number of coins reflected in Custody accounts to the number of coins held in aggregated Custody wallets. This is essentially making sure the value and currency type in the big custody envelope matches the ledger of all customers. Celsius had to manually reconcile those balances. Celsius performed this reconciliation 53 times during the 83-day period between April 20, 2022 (when it first reconciled the Custody wallet holdings to the Custody accounts) and July 12, 2022 (the day before Celsius filed for bankruptcy). There were no defined rules or policies to guide this process. Finally, Celcius would move money into and out of custody wallets if reconciliations showed a shortfall or overage. In May 2022, Celsius experienced significant withdrawals leading to a liquidity crisis. They responded by pausing withdrawals. Oddly, because of the speed with which they implemented these products, they had no way to pause deposits, and they kept coming in. As a result, despite a “pause” customer balances still weren’t static. Ultimately Celsius determined that they did not have the capital to fund continued withdrawals or they would take significant losses unwinding positions to fund withdrawals. Remember that Celsius loaned money on cryptocurrencies. Ultimately, Celsius declared bankruptcy. Essentially, Celsius was a run on the bank. With longer-term loans funded by shorter-term deposits, if enough people decide to withdraw, there isn’t enough to pay them because cash is still tied up in loans. But under the hood, the story of Celsius is a story of missing controls. Missing controls to the point that Celsius was never really sure what they had. Missing controls to the point that they appear to have materially misled customers about how Custody and Withhold accounts were actually managed. A couple of quotes that illustrate this: Mr. Koprivica summarized management’s message to the product development team as: “[G]o back to blackboard, do the minimum of all minimums, this may be manual for the start, involve less developers, lets discuss deadlines.” …there was no “common understanding” of the concept of custody between team members with a “finance background”and those without…Celsius did not consider creating a Custody wallet for each Custody customer. In fact, Mr. Noy did not recall that idea ever being suggested. > > …there was no “common understanding” of the concept of custody between team members with a “finance background”and those without…Celsius did not consider creating a Custody wallet for each Custody customer. In fact, Mr. Noy did not recall that idea ever being suggested. > > > > – US BANKRUPTCY FILING SOUTHERN DISTRICT OF NEW YORK – CELSIUS NETWORK LLC, 11/19/22 Also, Celsius made the decision to initially overfund Custody wallets by 10% as a buffer against mistakes. As a result: > Because of the manner in which Celsius initially funded the Custody wallets—most notably the intentional overfunding—on April 15, 2022, no Custody wallet held exactly the number of coins that were supposed to be a part of the Custody program. > > [![](/wp-content/uploads/2023/01/Screenshot-2023-01-03-at-9.18.16-PM-1024x426.png)](/wp-content/uploads/2023/01/Screenshot-2023-01-03-at-9.18.16-PM.png) > > Custody wallet movement and reconciliation process For Celsius, the reconciliation of Custody accounts wasn’t a mitigating control but the process itself. The reconciliation determined the amount rather than confirming the amount. Turning to Withhold accounts, Celsius never separately identified Withhold accounts or funds in management reporting. Withhold funds remained in the main accounts available for any use Celsius saw fit. This is contradictory to communication with customers which encouraged them to withdraw these coins (Celsius no longer had a license for the state where those customers lived) and that the coins would be maintained until withdrawn. When a company tells customers that they aren’t going to loan, sell, or do anything else with their funds, they have a right to rely on that. The company has a fiduciary responsibility to appropriately manage customer assets. Tone at the top continues to be important and fraud at the top of organizations continues to be the most expensive. [Matt Levine of Bloomberg l](https://www.bloomberg.com/opinion/authors/ARbTQlRLRjE/matthew-s-levine)ikes to say that crypto keeps rediscovering all the mistakes of banking and finance at an accelerated rate. I agree. I would add that if the crypto community wants the world to quit treating crypto as play money, they should stop managing it like play money. What are the lessons here? 1. Controls matter – Like what we are seeing at FTX, there were few if any controls at Celsius. 2. Process and infrastructure matter too. Just as the control should match the risk, processes, and infrastructure need to be up to the task. Just as we wouldn’t consider a manual quarterly review of a high-value, high-volume bank account to be adequate, we shouldn’t consider a manual reconciliation against thousands of customers a reasonable, repeatable process. 3. The tone at the top still matters. As much as this is a process failure, it’s also an ethical failure to properly manage customer funds. Update 2023.02.10: The final bankruptcy report has been released. [It’s available here.](https://www.jenner.com/a/web/aag4HeVaPPyEsfWyTp9N5G/4SaB6v/celsius-final-report-shoba-pillay.pdf) Honestly, it’s even worse than what I’ve described. It’s ineptitude up and down the organization. It is, however, a heck of a read. Update 2023.02.16: While FTX gets the press, Celsius is the current story that keeps giving. The latest is that it may not be possible to determine Celsius’ intercompany balances without an army of forensic accountants because [more than 7,000 intercompany transactions were never recorded](https://www.coindesk.com/business/2023/02/17/celsius-failed-to-record-some-7000-intercompany-transfers-worth-billions-leading-up-to-bankruptcy/). People like to hate on accountants, but accountants record stuff. Even when it’s recorded wrong, it gets written down, and that is way easier to fix. “Let’s start a complex business maintaining customer money worldwide and not write much down” is not a business model. When people start calling Celsius a fraud from the beginning its because of things like this. --- ## Carlos Ghosn and Fraud at Renault & Nissan - URL: https://dynamicaccounting.net/carlos-ghosn-and-fraud-at-renault-nissan/ - Date: 2023-01-06 - Topics: Fraud, Audit & Controls, Payables & Receivables, Microsoft & the GP Ecosystem - Type: original article I’m going to be adding a weekly fraud column for 2023. Frankly, I had about a dozen good examples without trying, so this should be fun. Carlos Ghosn was the highly successful CEO of Renault and Nissan, two independent car makers who teamed up in an alliance driven by Ghosn to make both companies better. He ended up as the CEO of both companies at the same time. He is accused of overpaying himself by as much as $100 million. Over Christmas I read [Boundless: The Rise, Fall, and Escape of Carlos Ghosn](The Rise, Fall, and Escape of Carlos Ghosn) by veteran Wall Street Journal writers Nick Kostov and Sean McClain. It has all the details. There is a [smaller WSJ article here (subscription required).](https://www.wsj.com/articles/carlos-ghosn-escape-japan-private-jet-box-hidden-11659733392) The book is absolutely worth a full read. The nutshell version is that Ghosn is accused of manipulating how and what he was paid to hide the amount of his actual pay. Ghosn seemed to have wide latitude in controlling what he was paid, but disclosure of the size could be embarrassing in both France and Japan. Additionally, Nissan paid him in Yen and at one point a swing in currency values left a $20 million hole in his personal finances. Finally, he was required to report his pay to Japanese authorities (a new law at the time) and disclose it in financial statements. The disclosures did not reflect his actual pay and a number of intermediaries were used to hide payments. Kostov and McClain allege that payments to Ghosn were improperly funneled through suppliers. Additionally, there were properties and other items paid for by various Renault and Nissan organizations that may not have been appropriately authorized. What makes this story even more interesting is that Ghosn was arrested in Japan, a country with a 99% conviction rate. Ghosn felt that he couldn’t get a fair trial in Japan and arranged to flee the country hidden in a box ostensibly designed for a large speaker or amplifier. Ghosn was spirited out of the country via private jet while hidden in the box. He fled to his native Lebanon, a country that doesn’t extradite its citizens. [A BBC article here also has escape details.](https://www.bbc.com/news/world-50964040) Ghosn will probably never get his day in court, so there is no way to say definitively say exactly what he did or the extent of the fraud, but there are some lessons in here. 1). Fraud at the top is always more expensive than fraud from within an organization. $100 million is a lot of money. It’s hard to hide that much with garden variety AP or AR fraud. CEOs should still be subject to checks and balances. 2) Resentment over pay remains a key reason for fraud, even at the top. > Carlos Ghosn had been the world’s most prominent car man of the first two decades of the twenty-first century. To the astonishment of naysayers worldwide, he had forged two middling carmakers into a global powerhouse, the Renault-Nissan Alliance. But Ghosn never felt that he had been adequately compensated. Over the years, he had watched as people of lesser talent had made millions more than he did. It had grated on him to the point of obsession. > > Since the financial crisis of 2008, he had started to take matters into his own hands, exploring numerous schemes to secretly pay himself what he thought he was worth. Ten years later, he had been ready to push through his last great act as an executive—a merger between the French and Japanese carmakers—before sailing off into the sunset aboard a 120-foot-long yacht. As part of the deal, he would be entitled to a massive payday, one that would enable him to retire as a very wealthy man.” > > *— Boundless: The Rise, Fall, and Escape of Carlos Ghosn by Nick Kostov, Sean McLain* The fraud triangle is Opportunity, Incentive, and Rationalization. As CEO Ghosn had the opportunity, he was the CEO and had few checks on his pay. He had the incentive, oddities with his pay in multiple currencies created a $20 million hole in Ghosn’s personal finances. Finally, there was rationalization. he felt he was underpaid based on what he had accomplished. This risk exists at multiple levels in every organization. Strong controls are a key defense and Boundless is must read. --- ## Fun with Fraud – Two Strikes - URL: https://dynamicaccounting.net/fun-with-fraud-two-strikes/ - Date: 2022-11-14 - Topics: Fraud, Audit & Controls - Type: original article Frank Vukovits and I do a session together highlighting internal threats. Internally we refer to it as Mark & Frank telling fraud stories. We might start just calling it that externally as well. We have another one for you today, a tale of a second chance gone very wrong. Bonnie Sweeten stole as much as $1 million from her employer (amounts vary in different reports) and claimed she and her daughter were kidnapped but they were found in a luxury suite at Disney World. She was convicted and sentenced to 8 years in prison. After she got out, an excavating firm then gave her a job as…wait for it… a bookkeeper. She stole from the company by writing company checks to herself and fraudulently using the company credit card. I swear you can’t make this stuff up. > [@legaleagle](https://www.tiktok.com/@legaleagle?refer=embed "@legaleagle") > > Mom Who Faked Her Own Kidnapping and Went to Disney World is Bippidi Boppidi Booked Again [#LegalEagle](https://www.tiktok.com/tag/legaleagle?refer=embed "legaleagle") [#Disney](https://www.tiktok.com/tag/disney?refer=embed "disney") [#disneyworld](https://www.tiktok.com/tag/disneyworld?refer=embed "disneyworld") [#crime](https://www.tiktok.com/tag/crime?refer=embed "crime") [#hoax](https://www.tiktok.com/tag/hoax?refer=embed "hoax") [#BucksCounty](https://www.tiktok.com/tag/buckscounty?refer=embed "buckscounty") > > [♬ original sound – Legal Eagle](https://www.tiktok.com/music/original-sound-7159195449939757870?refer=embed "♬ original sound - Legal Eagle") --- ## I you really don’t want to f*ck it up, it needs an internal control. - URL: https://dynamicaccounting.net/i-you-really-dont-want-to-fck-it-up-it-needs-an-internal-control/ - Date: 2022-10-12 - Topics: Fraud, Audit & Controls - Type: original article When we talk about controls at Fastpath, people often think about fraud prevention. If the company is publicly traded, the conversation may center around ensuring the accuracy of the financial statements. But there are some very public scenarios where significant screw-ups could have been prevented by functioning internal controls. Now I have a new example. Buckle up, it’s a doozy. The long version is here:  (subscription may be required). A non-subscription description is here: The short version is Barclays bank wanted to issue about $20 billion in securities in 2019. Because of past transgressions, they had to register these securities with the SEC and include an upper limit. As they approached the $20 bn deadline, they would need to register to issue additional securities above that amount. No big deal, just paperwork. Financial institutions have lots of analysts and lawyers who can do paperwork. The expectation was that someone, somewhere in Barclays would track the issuance of these securities and raise their hand when they got near the $20 bn limit even if that tracking process was just a spreadsheet. Anyone who has ever used a spreadsheet to track stuff over multiple years knows that this idea is fraught with problems. We all see where this is going…except we’d all be wrong. They didn’t use a spreadsheet to track issuances. They didn’t use a database. They didn’t even use a piece of paper. This is not the case of a failed internal control that failed, but of a non-existent internal control. No one tracked the issuance of these securities. > “Over the course of these efforts, it became clear to all involved that there was no internal control in place to track in real time the amount of securities offered and sold against the amount of securities registered.” Instead, Barclays issued $36.4 bn of securities, about 80% more than authorized. This is technically securities fraud because Barclays sold unregistered securities. There was no intent to defraud. It was simply a paperwork mistake. A very expensive mistake. Barclays is being fined $200 million. Everyone who bought these securities above the initial $20 bn limit has an option to unwind their transaction. If they made money, they have an option to keep it. If they lost money, they can ask for it back. This was less of a problem when the stock market was roaring, but as the market has fallen, Barclays has received requests to unwind $7.7 bn, a little under half of the excess, and they are looking at estimated losses of £1.7 bn. Not every company has this specific risk. But every company has important things that need to be managed where, failing that, very bad things happen. The nature of managing risk is that those items need controls too. --- ## Fastpath Completes SOC 1 Type 2 Examination - URL: https://dynamicaccounting.net/fastpath-completes-soc-1-type-2-examination/ - Date: 2018-11-29 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: original article [Fastpath has completed their SOC 1 Type 2 examination.](https://www.gofastpath.com/blog/fastpath-completes-soc-1-type-2-examination) Let’s talk about SOC’s and why they matter. Not socks, though they keep you warm. Not SOX in white or red, though they can be fun to watch, but SOCs. A SOC (service organization control) is an attestation standard, a form of an audit. It means that if you use cloud services, your auditors may rely on the cloud provider’s SOC to reduce their work. It also means that a cloud provider has been deliberate about their controls and those controls have been audited to ensure appropriate operation. Like you, Fastpath has 2 SOCs cleverly known as a SOC 1 and a SOC 2. They break down like this: - SOC 1: Internal Controls over Financial Reporting (ICFR). - SOC 2: Controls at a service organization that are relevant to security, availability, processing integrity confidentiality, or privacy. [] If your cloud provider doesn’t have at least a SOC 2, you’ve got problems. A SOC 2 is tied to control over the provider’s data. Without that, you have to wonder about what kind of protection is in place. A SOC 2 is relevant for any cloud provider. A SOC 1 is appropriate if that cloud provider is also tied to Financial Reporting. But there is also more than one type of each SOC. A type 1 indicates that the company has set up controls and the design of the controls have been reviewed. A type 2 indicates that the controls have been in place for a period of time and then been audited. You can’t get a type 2 overnight. Fastpath has BOTH a SOC 1 Type 2 and a SOC 2 Type 2. These reports aren’t always publicized, so if you’re unsure, ask your cloud providers. If you get dumb looks and blank stares, be very nervous. --- ## ACH Fraud: Steve Endow had a rough couple of days - URL: https://dynamicaccounting.net/ach-fraud-steve-endow-had-a-rough-couple-of-days/ - Date: 2018-09-18 - Topics: Fraud, Audit & Controls - Type: original article ### Steve Endow had a rough couple of and he details the experience in: [My Experience with ACH Fraud: My bank account was empty in 3 days](https://dynamicsgpland.blogspot.com/2018/09/my-experience-with-ach-fraud-my-bank.html?m=1) I don’t completely agree with Steve’s final conclusions. There are some things you can do to reduce ACH fraud risk including using variations on positive pay. However, I totally get that it might not be cost effective for smaller businesses. Also to Steve’s point, banks are swapping risk for efficiency and that ROI calculation may increase some types of fraud. For example, a small business owner I know was recently told that his large bank doesn’t support 2 signatures required on checking accounts for amounts over a certain threshold. I’m still convinced that isn’t true, but 2 signatures increases liability to the bank. If they miss a fraudulent check with only 1 signature it’s their fault, so I suspect they want to discourage it. It’s also ineffecient from their point of view. A human has to look at it. It cheaper to let stuff go through and pay out for fraud, or have an algorithm that occasionally blocks legitimate transactions than to have a person actually do reviews up front. --- ## Duplicate Payments and Internal Controls - URL: https://dynamicaccounting.net/22367-2/ - Date: 2018-09-12 - Topics: Fraud, Audit & Controls - Type: original article Jen Kuntz looks at Duplicate Payments and Internal Controls. It’s still a very process driven area. --- ## Lessons from an $8 million fraud - URL: https://dynamicaccounting.net/lessons-from-an-8-million-fraud/ - Date: 2018-08-28 - Topics: Fraud, Audit & Controls, Install, Upgrade & Admin - Type: original article I talk to a lot of users of ERP systems and their feeling about security cover the full range. Many are overly complacent, but occasionally I run into the excessively paranoid. Still, it’s important to understand what can happen. This story is a couple years old, but the lessons in it are perfect for medium-sized businesses. The article,[Lessons from an $8 million fraud](https://www.journalofaccountancy.com/issues/2014/aug/fraud-20149862.html) includes accidental excessive approval rights, incomplete segregation of duties, work-arounds to “get things done”, manipulation of multicurrency, and exploiting other user’s passwords. All of this started with an accident. I’ve said before that it’s my opinion that we tend to catch fraud at rough break points. If you don’t catch a fraud at $1,000, your next chance is at $10,000 and then $100k, and finally beyond $1 million. In this case, it started with $1,100. The company had a perfect chance to catch this at around $80k and missed it. There are a lot of little lessons in here and it’s definitely worth the read. --- ## Introducing the Microsoft Dynamics GP Security and Audit Field Manual - URL: https://dynamicaccounting.net/introducing-microsoft-dynamics-gp-security-audit-field-manual/ - Date: 2017-09-25 - Topics: Install, Upgrade & Admin, Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Dynamics GP versions mentioned: GP 2010 - Type: original article [![](/wp-content/uploads/2017/09/Microsoft-Dynamics-GP-Security-and-Audit-Field-Manual-Mark-Polino-Andy-Sook.jpg)](/wp-content/uploads/2017/09/Microsoft-Dynamics-GP-Security-and-Audit-Field-Manual-Mark-Polino-Andy-Sook.jpg) Andy Snook and I have talked for years about writing a security book for Dynamics GP. That’s not hyperbole, we started the conversation not long after the Microsoft Dynamics GP 2010 Cookbook was published. Now our security book is a reality with the launch of the [Microsoft Dynamics GP Security and Audit Field Manual](http://amzn.to/2huGY3u). The problem with security books is that they fall into one of two camps. Security books written by auditors explain good security principles, but don’t offer enough detail for use in a specific application. Books written for applications are often filled with details on boxes to check, but thin on important concepts like mitigating controls. In the [Security and Audit Field Manual](http://amzn.to/2huGY3u), we’ve tried to tackle both. Each chapter addresses a set of security principles and details how those principles can be applied using features in Dynamics GP. The only other security book for GP, Richard Whaley’s excellent T*he Dynamics GP Security Handbook,* has gone out of print, and a topic as important as this really needs it’s own reference. We took a field manual approach to the book’s theme because we wanted something a little different. It’s not that we don’t love puppies and fields of flowers on technology books, but we wanted a book that would stand out because it was dog eared and stained from being in the trenches with GP users and consultants. Dynamics GP MVP Mariano Gomez was kind enough to write the forward and MVP Belinda Allen helped review the manuscript to ensure that it met the level of quality we wanted. Frankly, it was kind of annoying. Belinda kept emailing me about windows in the book that she didn’t know existed in GP, and about how it was making her see segregation of duties issues all over the place. She was kind enough to give me a nice quote for the book, so it evened out. [For those of you who don’t know, Belinda is also a friend, and she doesn’t mind being called annoying if it’s for a good cause.] From Belinda: *“This book is a must read for anyone in charge of Dynamics GP. I learned a lot from it, and I’m sure you will too.”* The [Microsoft Dynamics GP Security and Audit Field Manual](http://amzn.to/2huGY3u) is available from [Amazon](http://amzn.to/2huGY3u) in paperback and Kindle formats. We will have a limited number of copies at Summit and we’re happy to sign them for folks, so stop by the Fastpath booth and say Hi! --- ## Weekly Dynamic: Auditing EFT Changes - URL: https://dynamicaccounting.net/weekly-dynamic-auditing-eft-changes/ - Date: 2016-02-09 - Topics: Payables & Receivables, Fraud, Audit & Controls - Type: original article If you’re looking to audit data in GP with a tool like Fastpath’s Audit Trail, auditing changes to EFT settings is important too. I thought I’d mention a few relevant tables here: SY06000 – Address Electronic Funds Transfer Master – Holds EFT settings assigned to a vendor or customer address. This holds a customer/vendor account, routing, swift code, etc. Audit this table to see initial setup of EFT and monitor changes to EFT settings. CM90001 – Checkbook EFT Log – Log file generated when an EFT file is created. Audit this to capture the creation of EFT transactions include file summary information. CM20203 – Checkbook EFT Transaction Batch – EFT Batch information. Audit this for batches related to EFT. CM20202 – Checkbook Transaction Electronic Funds Transfer – EFT Transaction information. Audit this for transaction specifics related to EFT. Generally not recommended due to potentially large volumes. --- ## How is it going at Fastpath? - URL: https://dynamicaccounting.net/how-is-it-going-at-fastpath/ - Date: 2016-01-20 - Topics: Install, Upgrade & Admin, Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: original article Now that I’ve been a [Fastpath](http://www.gofastpath.com) for a couple of months, a lot of people are asking about how it’s going. I thought I would tackle that in a post. Frankly, it’s been terrific. It’s a fantastic group of people and a great set of products. I’ve spent a bunch of time getting deeper into the products, helping with training, and doing some writing. There is one part that is still weird for me. Fastpath provides free support and training to customers. When I’m on a web connection with a user and I’m training on Assure or Audit Trail, the meter isn’t running. The constraint is their time and ability to retain the material, not the department’s training budget. This is significantly different from my time as a consultant. I’m not slamming consultants. It’s a tough job and I did it for a long time. I’ve been a controller too and that’s both a demanding and a distracting job. My point is that training now feels more relaxed. If we’re only able to cover a portion of the features because of time constraints, we’re happy to setup a later time to continue. If a company hired someone new, let’s get them trained and do a refresher for existing users at the same time. The constraint switches to just time rather than time and money. Audit related software purchases are often triggered by an event. That could be an IPO, an outcome from an external audit, or any number of other events.  Often companies need to get beyond the event before they decide how to get the most out of what they’ve bought. We see lots of people coming back later to learn how to get the most from Fastpath’s solutions. That makes free training a big deal. It’s still weird for me though. Some days I still hear the meter running in my head. Occasionally, I still wake up sweating, worried that I haven’t submitted my hours for the week. Clearly I’m still recovering from some fundamental damage cause by consulting for so long. If you’re a Fastpath user and you’d like additional training on one of our products, hit us up at  and note that you want training in the description. --- ## Weekly Dynamic: Source Document - URL: https://dynamicaccounting.net/weekly-dynamic-source-document/ - Date: 2014-11-03 - Topics: Tips & Hidden Features, Fraud, Audit & Controls - Type: original article --- Featured Post --- I’m not a fan of using a 13th period in Dynamics GP. It tends complicate some things unnecessarily. Most folks want a 13th period to be able to isolate and identify audit or post closing adjustments. A 13th period is a way to handle that but there’s a better way. GP allows us to select different sources for GL transactions. Instead of using the default Source Document of GJ, you can use your own source document with a  name like Audit PostClose. To create your own source, simply pick Administration>Posting>Source Document. Give the source an ID and a description. [![Capture4](/wp-content/uploads/2014/11/Capture4-300x290.png)](/wp-content/uploads/2014/11/Capture4.png) When entering an audit adjustment simply change the source document to your new source. This makes it easy to pick out adjustments via SmartLists or other tools. --- ## It’s been a good couple of months for Fastpath - URL: https://dynamicaccounting.net/its-been-a-good-couple-of-months-for-fastpath/ - Date: 2012-08-16 - Topics: Fraud, Audit & Controls, Install, Upgrade & Admin - Type: original article If I were [Fastpath](http://www.gofastpath.com/), I’d be wondering where all the free marketing was coming from and how I could get more. The last several months have seen a number of unrelated items all point to Fastpath’s products for users of a Microsoft Dynamics ERP system. For those of you not familiar, Fastpath makes security related products for all of the options in the Microsoft Dynamics line. For Dynamics GP specifically they offer: **Config AD** – Single sign on and security management tied to active directory. Yes you can log in to GP using AD. **Audit Trail** – Transaction auditing. **Assure** – Separation of Duties evaluator for Dynamics GP. This doesn’t get enough airtime but for risk junkies it’s pretty cool. **Audit View** – Audit/Security report scheduling and delivery. It all started with the July issue of Journal of Accountancy which profiled ten years of Sarbanes-Oxley. I thought, hey, SOX generates plenty of Audit Trail and Assure work for Fastpath. Thought drifted away into the ether. Then my much anticipated August J of A arrived (they are all much anticipated, don’t read anything to the August part) . Lo and behold, it’s all about fraud and we’re back talking about security control, auditing and separation of duties. [Sidebar: For fun, checkout this this fraud, [described at CFO.com](http://ww2.cfo.com/risk-compliance/2012/08/a-peek-inside-a-forensic-fraud-investigation/), that included the CEO colluding with the HR manager because the CFO “always demanded proper documentation”.] Finally, [MSDynamicsWorld.com](http://msdynamicsworld.com/story/microsoft-retire-dynamics-gp-risk-management-suite-concur-integration-december?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld/news+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader) is reporting that Microsoft is killing the native Audit Trail module in Dynamics GP. Frankly, MS bought this functionality and doesn’t appear to have ever spent a dime improving it. I think they got tired of trying to support it.  So in a couple of months span, Fastpath has two J of A issues, not just articles, dedicated to needs and problems that their products help solve and a major competitor exits the business. (By major competitor I really mean inertia and the idea that “It’s included so let’s try to use it”.) Yep, they’ve had a couple of good months. If they are smart, they’ll leverage these marketing gems for a long time to come and hope for September J of  A hat trick. --- ## IRS audits of small business software files - URL: https://dynamicaccounting.net/irs-audits-of-small-business-software-files/ - Date: 2012-01-10 - Topics: Fraud, Audit & Controls, SQL & Data, Microsoft & the GP Ecosystem - Type: original article I’ve wanted to comment on this story [IRS audits of small business software files](http://www.journalofaccountancy.com/Issues/2012/Jan/20114540.htm) for a while. I’ve seen similar stories over the last several months. In a nutshell the IRS can ask for electronic records of your transactions meaning your database. In the case of Quickbooks and Peachtree users they are asking for a full backup copy of the company’s database and then using tools to evaluate transactions that might be inappropriate. For example, in Quickbooks you can delete transactions and that could be used to ask broader questions. If you need a reason to switch from Quickbooks this is a big one in my mind. With Dynamics GP, especially with customizations and ISV solutions it makes it really hard to replicate a companies installation from just a backup. There are also practical problems with the IRS asking for a massive GP.database. It’s also easier to separate out the information the IRS asks for without giving them the whole database to troll through. Then there are tools from companies like [FastPath](http://www.gofastpath.com/) that can provide a complete audit trail for transactions in GP. If you’re looking to move up from Quickbooks, now may be the time. --- ## Uncovering and Preventing Fraud in ERP Implementations - URL: https://dynamicaccounting.net/uncovering-and-preventing-fraud-in-erp-implementations/ - Date: 2011-06-29 - Topics: Fraud, Audit & Controls - Type: original article When I saw the headline Uncovering and Preventing Fraud in ERP Implementations I though it was about finding fraud in companies while performing an ERP implementation. That’s a touchy conversation for sure. But the article is actually a look at a mostly fraudulent $600 million payroll implementation for the City of New York. That’s right, a more than half a BILLION dollar mostly fraudulent payroll implementation.  It’s still a great read. --- ## Nice Features for Auditing Information in GP | Interesting Findings & Knowledge Sharing - URL: https://dynamicaccounting.net/nice-features-for-auditing-information-in-gp-interesting-findings-knowledge-sharing/ - Date: 2011-06-28 - Topics: Fraud, Audit & Controls - Type: original article Sivakumar builds on Vaidy’s post to look at Nice Features for Auditing Information in GP. That’s called community baby. --- ## SAS 70 Being Replaced - URL: https://dynamicaccounting.net/sas-70-being-replaced/ - Date: 2011-02-16 - Topics: Fraud, Audit & Controls, Accounting & Career - Type: original article Technology people can ignore this post. This is for the accountants in the room. Companies that outsource service portions of their of their business (think Payroll to ADP) have requirements around ensuring the controls in place at those organizations. Previously a SAS 70 Audit was used to report on internal control at service providers but there were lots of problems with that. Companies misrepresented the value of a SAS 70 audit in sales literature calling themselves SAS 70 compliant when there was really no standard to comply to. As a result of problems and the growth of new outsourcing options like cloud computing the AICPA is replacing SAS 70 with Service Organization Control Reports. What does this mean to you as a GP user? It means that as you look at ISV outsourced solutions and other outsourcing options that may plug into Dynamics GP it’s time to start looking for SOC not SAS 70. If your vendor gives you a blank stare when you say SOC send them to http://www.aicpa.org/InterestAreas/AccountingAndAuditing/Resources/SOC/Pages/SORHome.aspx and then maybe get a little nervous about the vendor. --- ## Audit Trails – Thing to Keep in Mind - URL: https://dynamicaccounting.net/audit-trails-thing-to-keep-in-mind/ - Date: 2010-11-16 - Topics: Fraud, Audit & Controls - Type: original article veeyeskay builds on Mohammad Daoud’s previous Audit Trails post in his new article Audit Trails – Thing to Keep in Mind --- ## Weekly Review: Easily Audit Payable Thresholds - URL: https://dynamicaccounting.net/weekly-review-easily-audit-payable-thresholds/ - Date: 2010-11-04 - Topics: Tips & Hidden Features, Fraud, Audit & Controls, Payables & Receivables - Type: original article Check thresholds are an important control point in many companies. Often checks over a certain amount require a particular signature or more than one signature. When the control mechanism slows down the work flow (sometimes by design, we don’t want to be in a hurry to write huge checks) users may go around the control. In this case, the control can be circumvented by issuing a number of smaller checks just under the threshold. This can be as innocent as the required signers were not available but everyone knew the check had to go out or it can be blood sucking fraud. It’s not unusual for innocent actions to quickly become fraud as well. An important mechanism to check this control is to review checks cut just below the threshold. This is easy to do in Microsoft Dynamics GP. Simply start with a default Payables Smartlist. - In the columns, remove current trx amount and add document amount. - In the search box add: - Document Type equals Payment - Document Date greater than Beginning of Week (or Beginning of Month if you want to audit monthly) - Document Amount is between a lower amount and your threhold amount For instance, if the threshold for 2 signatures is $10,000 you might set the document amount to be between 9,000 and 10,000. You can fine tune this for your needs but this would show checks cut between 9k and 10k. Save this smartlist as a favorite and pick the Favorite and Reminder choice. This lets you add a reminder for the system to notify you if there are any transactions that meet this criteria. Now all you have to do each week is review the list and physically check items near the threshold. Review all checks cut for the week for that vendor and you may find a large one near the threshold and a smaller one that would have put the check over. Once you find that, the hard work of being a manager really begins. Originally Posted by Mark at [8/25/2008 10:17:00 AM](http://msdynamicsgp.blogspot.com/2008/08/weekly-dynamic-easily-audit-payable.html) --- ## Weekly Dynamic: Segregation of Duties Tool - URL: https://dynamicaccounting.net/weekly-dynamic-segregation-of-duties-tool/ - Date: 2010-09-20 - Topics: Tips & Hidden Features, Fraud, Audit & Controls - Dynamics GP versions mentioned: GP 10 - Type: original article While not strictly a Dynamics GP tool, AuditNet.org has a great, free Segregation of Duties Tool. This Excel tool allows a company to enter a person or role and then check off what that person can do. The tool then figures out where the segregation of duties conflicts lie. This is a fantastic starting point for working with GP 10 or 2010 security to help figure out what user roles should be and what access they should have. Having this as a starting point really makes setting up and documenting GP security easier. --- ## The Microsoft Dynamics GP 2010 Cookbook is a bargain, not a steal - URL: https://dynamicaccounting.net/the-microsoft-dynamics-gp-2010-cookbook-is-a-bargain-not-a-steal/ - Date: 2010-07-19 - Topics: Microsoft & the GP Ecosystem, Fraud, Audit & Controls - Dynamics GP versions mentioned: GP 2010 - Type: original article The [Microsoft Dynamics GP 2010 Cookbook](http://www.amazon.com/gp/product/1849680426?ie=UTF8&tag=polinofamilywebs&linkCode=as2&camp=1789&creative=390957&creativeASIN=1849680426) is selling well and MVP’s and bloggers are consistently happy as they’ve reviewed their copies. Apparently the book has done so well that someone decided to offer the electronic version on the web as a free download. I guess its popular enough to be pirated now and that really sucks. DMCA copyright notices have gone out so I expect the file to come down soon. [DynamicAccounting.net](/) is overflowing with free content. It’s spilling out on to the floor. The book is NOT free. It is the culmination of 10+ years of experience and 9 months of very hard work. My family deserves the small percentage I get from each book. Additionally, I know of at least 2 more Dynamics GP focused books in the works. Those authors deserve an incentive to continue. Watching someone else’s book get stolen is not an incentive. If you are a partner (the infringing site was NOT as far as I know) feel free to buy copies of the book to give to your clients. DON’T buy one copy of the ebook and send it to all of your clients. That would be stealing the book. Yes, I’ve had partners try to take credit for my work. In each case, they’ve plead ignorance removed the infringing items. Sending unpurchased books to clients would be a deliberate act and the publisher and I won’t take it lightly. I’m not afraid to publicly call out partners who steal intellectual property. For partners who would like to buy a large number of books for their clients, the publisher offers bulk discount options via the following links: [http://www.packtpub.com/article/packt-special-offer](http://www.packtpub.com/books/content/packt-special-offer) [http://www.packtpub.com/blog/new-discounts-launched-purchases-multiple-books](http://www.packtpub.com/) I’ve put a ton of work into this book to make it a great resource for Dynamics GP users. It’s priced reasonably, especially when compared to what a consulting hour would cost. Do the right thing and buy the book. --- ## Weekly Dynamic: Easily Audit Payable Thresholds - URL: https://dynamicaccounting.net/weekly-dynamic-easily-audit-payable-thresholds/ - Date: 2008-08-25 - Topics: Tips & Hidden Features, Fraud, Audit & Controls, Payables & Receivables - Type: original article Check thresholds are an important control point in many companies. Often checks over a certain amount require a particular signature or more than one signature. When the control mechanism slows down the work flow (sometimes by design, we don’t want to be in a hurry to write huge checks) users may go around the control. In this case, the control can be circumvented by issuing a number of smaller checks just under the threshold. This can be as innocent as the required signers were not available but everyone knew the check had to go out or it can be blood sucking fraud. It’s not unusual for innocent actions to quickly become fraud as well. An important mechanism to check this control is to review checks cut just below the threshold. This is easy to do in Microsoft Dynamics GP. Simply start with a default Payables Smartlist. - In the columns, remove current trx amount and add document amount. - In the search box add: - Document Type equals Payment - Document Date greater than Beginning of Week (or Beginning of Month if you want to audit monthly) - Document Amount is between a lower amount and your threhold amount For instance, if the threshold for 2 signatures is $10,000 you might set the document amount to be between 9,000 and 10,000. You can fine tune this for your needs but this would show checks cut between 9k and 10k. Save this smartlist as a favorite and pick the Favorite and Reminder choice. This lets you add a reminder for the system to notify you if there are any transactions that meet this criteria. Now all you have to do each week is review the list and physically check items near the threshold. Review all checks cut for the week for that vendor and you may find a large one near the threshold and a smaller one that would have put the check over. Once you find that, the hard work of being a manager really begins. --- ## GP is Having a Compliance Sale - URL: https://dynamicaccounting.net/gp-is-having-a-compliance-sale/ - Date: 2006-09-22 - Topics: Fraud, Audit & Controls - Type: original article Just in time for Audit Season, Microsoft is having a sale on compliance related modules for Dynamics GP. Electronic Signatures and Audit Trails are 20% off. If you buy both you can also get Analytical Accounting, Field Level Security, Account Level Security, and Microsoft® Forecaster for $5,000. Your partner can give you specifics. I can’t point you to a website since the link I got from MS only takes you to the “ask for info” page and the discounts aren’t listed on CustomerSource yet. Speaking personally, we’re looking at compliance products for GP. I’ve seen both the Audit Trails and Electronic Signatures products. My feeling is that they are both overpriced. Audit Trails in particular has several good 3rd party competitors that are considerably cheaper (Rockton, Fastpath) and they appear to have more functionality. I would really argue that in today’s world, the compliance stuff should be built in. Both Audit Trails and Electronic Signatures should have been part of a free enhancement pack. That would really add value to the annual maintenance fees. --- ## Help! My Auditor wants a report for Workflow approval information in Microsoft Dynamics GP - URL: https://dynamicaccounting.net/help-my-auditor-wants-a-report-for-workflow-approval-information-in-microsoft-dynamics-gp/ - Date: 2022-11-08 - Topics: Reporting & BI, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: https://community.dynamics.com/gp/b/dynamicsgp/posts/help-my-auditor-wants-a-report-for-gl-workflow-approval-information-in-microsoft-dynamics-gp We get this request a lot. GP does a good job of showing individual workflow details, but full reporting is newer. Cheryl W. has a great article covering reporting on workflow for Dynamics GP. She includes standard reports and building a Smartlist Designer report. [![](/wp-content/uploads/2022/11/image.png)](/wp-content/uploads/2022/11/image.png) --- ## Updated Security and Audit Field Manual for D365FO - URL: https://dynamicaccounting.net/updated-security-and-audit-field-manual-for-d365fo/ - Date: 2018-09-13 - Topics: Install, Upgrade & Admin, Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: https://www.amazon.com/Security-Audit-Field-Manual-Operations-ebook/dp/B07GXFW7VQ/ref=as_sl_pc_as_ss_li_til?tag=polinofamilywebs&linkCode=w00&linkId=6b040139aa71551bae4dea744aff0baa&creativeASIN=B07GXFW7VQ We are thrilled to announce that we’ve updated the [Security and Audit Field Manual for Dynamics 365 Finance and Operations](https://www.amazon.com/Security-Audit-Field-Manual-Operations-ebook/dp/B07GXFW7VQ/ref=as_sl_pc_as_ss_li_til?tag=polinofamilywebs&linkCode=w00&linkId=6b040139aa71551bae4dea744aff0baa&creativeASIN=B07GXFW7VQ). D365FO is changing rapidly and it was great to be able to incorporate the changes in this update. The new book is available from Amazon in both Kindle and Paperback formats. https://www.amazon.com/Security-Audit-Field-Manual-Operations-ebook/dp/B07GXFW7VQ/ref=as\_sl\_pc\_as\_ss\_li\_til?tag=polinofamilywebs&linkCode=w00&linkId=6b040139aa71551bae4dea744aff0baa&creativeASIN=B07GXFW7VQ --- ## Don’t forget to audit controls! - URL: https://dynamicaccounting.net/dont-forget-to-audit-controls/ - Date: 2018-03-19 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: https://normanmarks.wordpress.com/2018/03/17/dont-forget-to-audit-controls/ > There’s a lot of talk about auditing culture and other significant sources of risk. I am all for focusing our audit plan on the risks that matter to the enterprise as a whole. But, let’s not forget… From Norman Marks: *[Don’t forget to audit controls!](https://normanmarks.wordpress.com/2018/03/17/dont-forget-to-audit-controls/)* --- ## Security and Audit Field Manual for GP 2018 - URL: https://dynamicaccounting.net/security-audit-field-manual-gp-2018/ - Date: 2018-02-28 - Topics: Install, Upgrade & Admin, Fraud, Audit & Controls - Dynamics GP versions mentioned: GP 2018 - Type: link to an external article - Source: http://amzn.to/2EZOMFc [![](/wp-content/uploads/2018/02/GP-Security-2018-Front-Cover-199x300.png)](/wp-content/uploads/2018/02/GP-Security-2018-Front-Cover.png) I’m happy to announce that the [GP 2018 edition of the Microsoft Dynamics GP  Security and Audit Field Manual](http://amzn.to/2EZOMFc) is now available in [Kindle and paperback](http://amzn.to/2EZOMFc) formats. The Security and Audit Field Manual provides coverage of GP’s security features and along with how to use them to deliver good security practices in your organization. [Pick one up now, heck, buy two, they tend to get borrowed and not returned.](http://amzn.to/2EZOMFc) --- ## Segregation of Duties Mitigation Options for Dynamics GP - URL: https://dynamicaccounting.net/segregation-duties-mitigation-options-dynamics-gp/ - Date: 2017-07-18 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.gofastpath.com/blog/segregation-of-duties-mitigation-options-for-dynamics-gp > Have you mitigated your Segregation of Duties conflicts? In securing GP you have options. Security can’t do everything. Understand your *[Segregation of Duties Mitigation Options for Dynamics GP](http://www.gofastpath.com/blog/segregation-of-duties-mitigation-options-for-dynamics-gp)* --- ## Two CFOs tell a tale of fraud at HealthSouth. - URL: https://dynamicaccounting.net/two-cfos-tell-tale-fraud-healthsouth/ - Date: 2017-03-29 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://ww2.cfo.com/fraud/2017/03/two-cfos-tell-tale-fraud-healthsouth/ > Years after going to prison, disgraced CFOs try for redemption by telling finance executives how they went wrong. Lest we forget, financial statement manipulation by a CEO or CFO is really hard to catch. *[Two CFOs tell a tale of fraud at HealthSouth.](http://ww2.cfo.com/fraud/2017/03/two-cfos-tell-tale-fraud-healthsouth/)* --- ## Dynamics GP Land: Don’t Forget- Standard GP SQL Views - URL: https://dynamicaccounting.net/dynamics-gp-land-dont-forget-standard-gp-sql-views/ - Date: 2017-02-16 - Topics: Fraud, Audit & Controls, SQL & Data - Type: link to an external article - Source: https://dynamicsgpland.blogspot.com/2017/02/dont-forget-standard-gp-sql-views.html I knew I was forgetting something. *[Dynamics GP Land: Don’t Forget- Standard GP SQL Views](https://dynamicsgpland.blogspot.com/2017/02/dont-forget-standard-gp-sql-views.html)* --- ## Risky Business: SEC Focuses on Internal Controls - URL: https://dynamicaccounting.net/risky-business-sec-focuses-internal-controls/ - Date: 2016-11-22 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://ww2.cfo.com/financial-reporting-2/2016/11/risky-business-sec-focuses-internal-controls/ > A decline in accounting fraud has freed up time for SEC staff to prioritize internal controls over financial statements. *I found this shift interesting. [Risky Business: SEC Focuses on Internal Controls](http://ww2.cfo.com/financial-reporting-2/2016/11/risky-business-sec-focuses-internal-controls/)* --- ## S&P 500 Firms Beefing Up Audit Disclosures - URL: https://dynamicaccounting.net/sp-500-firms-beefing-audit-disclosures/ - Date: 2016-11-09 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://ww2.cfo.com/disclosure/2016/11/sp-500-firms-beefing-audit-disclosures/ > [![](/wp-content/uploads/2016/11/ThinkstockPhotos-506146978-1.jpg)](http://ww2.cfo.com/disclosure/2016/11/sp-500-firms-beefing-audit-disclosures/)A survey finds disclosure of information on key areas of external auditor oversight has more than doubled in the past two years. Despite the title, it’s not just *[S&P 500 Firms Beefing Up Audit Disclosures](http://ww2.cfo.com/disclosure/2016/11/sp-500-firms-beefing-audit-disclosures/) There are notes in the article on mid-cap firms as well.* --- ## What’s your fraud IQ? - URL: https://dynamicaccounting.net/whats-fraud-iq/ - Date: 2016-06-13 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.journalofaccountancy.com/issues/2016/jun/electronic-payment-and-check-fraud.html > [![](/wp-content/uploads/2016/06/fraud-iq-1.jpg)](http://www.journalofaccountancy.com/issues/2016/jun/electronic-payment-and-check-fraud.html) > > All organizations issue payments for expenditures, whether inventory purchases, repairs and maintenance expenses, utilities, or contract services. How well do you know the warning signs and preventive strategies for check and electronic payment tampering? Test your knowledge in this month’s interactive quiz. From the June 2016 issue of Journal of Accountancy, take the quiz: *[What’s your fraud IQ?](http://www.journalofaccountancy.com/issues/2016/jun/electronic-payment-and-check-fraud.html)* --- ## Auditing Management Reporter - URL: https://dynamicaccounting.net/auditing-management-reporter/ - Date: 2016-03-14 - Topics: Reporting & BI, Fraud, Audit & Controls - Type: link to an external article - Source: http://www.gofastpath.com/blog/auditing-management-reporter > [![](http://cdn2.hubspot.net/hubfs/459548/Blog_images/confusedMRblog.png#keepProtocol)](http://www.gofastpath.com/blog/auditing-management-reporter) On the Fastpath blog I’ve got some thoughts on *[Auditing Management Reporter](http://www.gofastpath.com/blog/auditing-management-reporter)* --- ## 4 Ways Managers Can Reduce Internal Inventory Fraud – Dynavistics - URL: https://dynamicaccounting.net/4-ways-managers-can-reduce-internal-inventory-fraud-dynavistics/ - Date: 2016-01-27 - Topics: Fraud, Audit & Controls, Sales, Purchasing & Inventory - Type: link to an external article - Source: http://dynavistics.com/blog/4-ways-managers-can-reduce-internal-inventory-fraud > [![](/wp-content/uploads/2016/01/Inventory-fraud-300x201.jpg)](http://dynavistics.com/blog/4-ways-managers-can-reduce-internal-inventory-fraud) > Policies and procedures are necessary to discourage both internal and external fraud.  Here are a few tips to reduce internal inventory fraud. From my friends over at Dynavistics comes *[4 Ways Managers Can Reduce Internal Inventory Fraud](http://dynavistics.com/blog/4-ways-managers-can-reduce-internal-inventory-fraud)* --- ## 2 ½ Options for Auditing Batches in Dynamics GP with Fastpath Audit Trail - URL: https://dynamicaccounting.net/2-%C2%BD-options-auditing-batches-dynamics-gp-fastpath-audit-trail/ - Date: 2015-11-18 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.gofastpath.com/blog/2-options-for-auditing-batches-in-dynamics-gp-with-fastpath-audit-trail > [![](http://cdn2.hubspot.net/hubfs/459548/Blog_images/GPpost1.png#keepProtocol)](http://www.gofastpath.com/blog/2-options-for-auditing-batches-in-dynamics-gp-with-fastpath-audit-trail) I’ve got *[2 ½ Options for Auditing Batches in Dynamics GP with Fastpath Audit Trail](http://www.gofastpath.com/blog/2-options-for-auditing-batches-in-dynamics-gp-with-fastpath-audit-trail)*up now on the Fastpath blog. --- ## Dealing with Auditors - URL: https://dynamicaccounting.net/dealing-with-auditors/ - Date: 2015-10-29 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.accountingtools.com/podcasts Checkout [episode 204 of the Accounting Best Practices podcast](http://www.accountingtools.com/podcasts). Steve Bragg offers great advice on dealing with auditors. --- ## Audit Tracking in Microsoft Dynamics GP –Should You Be Doing It? – Microsoft Dynamics GP Community - URL: https://dynamicaccounting.net/audit-tracking-in-microsoft-dynamics-gp-should-you-be-doing-it-microsoft-dynamics-gp-community/ - Date: 2015-09-16 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: https://community.dynamics.com/gp/b/gpteamblog/archive/2015/09/14/audit-tracking-in-microsoft-dynamics-gp-should-you-be-doing-it Liz Giancarli-Piteo tackles auditing GP on the GP Team Blog with  *[Audit Tracking in Microsoft Dynamics GP –Should You Be Doing It? – Microsoft Dynamics GP Community](https://community.dynamics.com/gp/b/gpteamblog/archive/2015/09/14/audit-tracking-in-microsoft-dynamics-gp-should-you-be-doing-it)* --- ## The Importance of Audit Tracking in Microsoft Dynamics GP – And Why Customers Resist It – MSDynamicsWorld.com - URL: https://dynamicaccounting.net/the-importance-of-audit-tracking-in-microsoft-dynamics-gp-and-why-customers-resist-it-msdynamicsworld-com/ - Date: 2015-07-07 - Topics: Fraud, Audit & Controls, Payables & Receivables, Development & Integration - Type: link to an external article - Source: http://msdynamicsworld.com/story/importance-audit-tracking-microsoft-dynamics-gp-and-why-customers-resist-it > One Microsoft Dynamics GP user discovers that a shocking number of his peers have audit tracking tools or processes I couldn’t agree more. *[The Importance of Audit Tracking in Microsoft Dynamics GP – And Why Customers Resist It](http://msdynamicsworld.com/story/importance-audit-tracking-microsoft-dynamics-gp-and-why-customers-resist-it)* --- ## Never forget to Invoice a PO – Microsoft Dynamics GP Community - URL: https://dynamicaccounting.net/never-forget-invoice-po-microsoft-dynamics-gp-community/ - Date: 2015-01-05 - Topics: Sales, Purchasing & Inventory, Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: https://community.dynamics.com/gp/b/dynamicsgp/archive/2015/01/02/draft-never-forget-to-invoice-a-po New GP feature, [Never forget to Invoice a PO](https://community.dynamics.com/gp/b/dynamicsgp/archive/2015/01/02/draft-never-forget-to-invoice-a-po). This was a user request via MS Connect. I’ll have more on this in next week’s Weekly Dynamic. --- ## Kicking Ass and Taking Names—Quit Stealing My Content! | FRxBuzz - URL: https://dynamicaccounting.net/kicking-ass-taking-names-quit-stealing-content-frxbuzz/ - Date: 2014-11-13 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.frxbuzz.com/kicking-ass-and-taking-names-quit-stealing-my-content/ Jan Harrigan is [Kicking Ass and Taking Names—Quit Stealing My Content!](http://www.frxbuzz.com/kicking-ass-and-taking-names-quit-stealing-my-content/) I know exactly how she feels. Its on of the reason why I link to other people’s content instead of reproducing it whole and I always do my best to give credit. I’ve had someone leave my name on a 50 tips presentation and present it as their content. John Lowther has sat in a presentation where another partner presented John’s content as their own. Here’s the thing, my content is available for people to use. I want people to learn about GP but the license does require that you give credit. To Jan’s point, when you write a book or two you learn way more about copyright law than you ever wanted to. The copyright attached at creation. You don’t have to register it and you don’t have to post a copyright notice. Those two things just make it easier to enforce. Last thing, Jan, I think public shaming is the best answer here, but don’t forget about the Digital Millennium Copyright Act (DMCA). If they are stealing your copyrighted content you have a claim there too and may very well be able to get their website taken down if the content isn’t removed. Site admins and ISP tend to do a good job with DCMA requests. --- ## Lessons from an $8 million fraud - URL: https://dynamicaccounting.net/lessons-8-million-fraud/ - Date: 2014-08-13 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.journalofaccountancy.com/Issues/2014/Aug/fraud-20149862.htm# If you’ve never seen a fraud, if you don’t understand how improperly elevated permissions on an ERP system can hurt, or if you don’t really get the importance of  internal controls, please read [Lessons from an $8 million fraud](http://www.journalofaccountancy.com/Issues/2014/Aug/fraud-20149862.htm#) from Journal of Accountancy. It’s a great read. The story moves right along. The protagonist is clever. He almost gets caught early. Eight million dollars later, it’s all over. --- ## Dynamics Confessions Blogspot: Never Forget to Match that Purchase Order Again! - URL: https://dynamicaccounting.net/dynamics-confessions-blogspot-never-forget-match-purchase-order/ - Date: 2014-07-27 - Topics: Sales, Purchasing & Inventory, Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: http://dynamicsconfessions.blogspot.com/2014/07/never-forget-to-match-that-purchase.html Leslie has some suggestions for the next version of GP so that we will[Never Forget to Match that Purchase Order Again!](http://dynamicsconfessions.blogspot.com/2014/07/never-forget-to-match-that-purchase.html) I’ve added some of my own suggestions. Please follow the link to vote! --- ## The Top Five Areas to Monitor For Employee Fraud - URL: https://dynamicaccounting.net/top-five-areas-monitor-employee-fraud/ - Date: 2013-11-07 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://ww2.cfo.com/accounting-tax/2013/11/top-five-areas-monitor-employee-fraud/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+cfo%2Fdaily_briefing+%28Latest+Articles+from+CFO.com%29 CFO.com has [The Top Five Areas to Monitor For Employee Fraud](http://ww2.cfo.com/accounting-tax/2013/11/top-five-areas-monitor-employee-fraud/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+cfo%2Fdaily_briefing+%28Latest+Articles+from+CFO.com%29). The tools that comes to mind when I think of preventing fraud are of course [Fastpath’s Audit Trail and Assure products.](http://www.gofastpath.com) --- ## Microsoft collaborates with AICPA using Audit Data Standards with Dynamics – Dynamics Corporate Performance Management - URL: https://dynamicaccounting.net/microsoft-collaborates-aicpa-using-audit-data-standards-dynamics-dynamics-corporate-performance-management/ - Date: 2013-10-28 - Topics: Fraud, Audit & Controls, Accounting & Career, Install, Upgrade & Admin - Type: link to an external article - Source: https://blogs.msdn.microsoft.com/dynamics_financial_reporting/2013/10/18/microsoft-collaborates-with-aicpa-using-audit-data-standards-with-dynamics/ This is interesting. [Microsoft collaborates with AICPA using Audit Data Standards with Dynamics](https://blogs.msdn.microsoft.com/dynamics_financial_reporting/2013/10/18/microsoft-collaborates-with-aicpa-using-audit-data-standards-with-dynamics/) I’d love to hear some auditor’s take on this. --- ## Windows Azure Clears Deloitte & Touche Security Compliance Audit — Redmond Channel Partner - URL: https://dynamicaccounting.net/windows-azure-clears-deloitte-touche-security-compliance-audit-redmond-channel-partner/ - Date: 2013-08-26 - Topics: Microsoft & the GP Ecosystem, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: https://rcpmag.com/articles/2013/08/23/windows-azure-clears-audit.aspx A little compliance news for the cloud: [Windows Azure Clears Deloitte & Touche Security Compliance Audit](https://rcpmag.com/articles/2013/08/23/windows-azure-clears-audit.aspx) --- ## Oregon Companies Improve Audit Ability of Microsoft Dynamics GP | ERP Software Blog - URL: https://dynamicaccounting.net/oregon-companies-improve-audit-ability-of-microsoft-dynamics-gp-erp-software-blog/ - Date: 2013-07-30 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: http://www.erpsoftwareblog.com/2013/07/oregon-companies-improve-audit-ability-of-microsoft-dynamics-gp/ In a new post titled [Oregon Companies Improve Audit Ability of Microsoft Dynamics GP](http://www.erpsoftwareblog.com/2013/07/oregon-companies-improve-audit-ability-of-microsoft-dynamics-gp/) Gloria Braunschweig offers some great internal control tips for GP. --- ## Electronic payment methods help decrease payments fraud - URL: https://dynamicaccounting.net/electronic-payment-methods-help-decrease-payments-fraud/ - Date: 2013-06-17 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.cgma.org/magazine/news/pages/20137733.aspx?TestCookiesEnabled=redirect Here is one more reason, beyond efficiency, reconciliation and everything else to EFT. [Electronic payment methods help decrease payments fraud](http://www.cgma.org/magazine/news/pages/20137733.aspx?TestCookiesEnabled=redirect). --- ## 8 steps to update internal control - URL: https://dynamicaccounting.net/8-steps-to-update-internal-control/ - Date: 2013-05-21 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.cgma.org/Magazine/News/Pages/20137983.aspx?cm_mmc=CGMANL&utm_source=cgmanl&utm_medium=17May13&utm_term=TopNews&utm_content=COSO&utm_campaign=cgmanl CGMA Mag looks at [8 steps to update internal control](http://www.cgma.org/Magazine/News/Pages/20137983.aspx?cm_mmc=CGMANL&utm_source=cgmanl&utm_medium=17May13&utm_term=TopNews&utm_content=COSO&utm_campaign=cgmanl). Also don’t forget about[Fastpath’s Assure](http://www.gofastpath.com) product which can help identify separation of duties conflicts in GP. --- ## Taking Your Financial Reports to the Next Level with Management Reporter – Postings Audit (5 of 8) - URL: https://dynamicaccounting.net/taking-your-financial-reports-to-the-next-level-with-management-reporter-postings-audit-5-of-8/ - Date: 2013-05-20 - Topics: Reporting & BI, Fraud, Audit & Controls - Type: link to an external article - Source: https://blogs.msdn.microsoft.com/dynamics_financial_reporting/2013/05/17/taking-your-financial-reports-to-the-next-level-with-management-reporter-postings-audit-5-of-8/ The Dynamics Corporate Performance Team continues their series with [Taking Your Financial Reports to the Next Level with Management Reporter – Postings Audit (5 of 8)](https://blogs.msdn.microsoft.com/dynamics_financial_reporting/2013/05/17/taking-your-financial-reports-to-the-next-level-with-management-reporter-postings-audit-5-of-8/) --- ## Dynamics GP Land: When developing eConnect integrations, don’t forget the details… - URL: https://dynamicaccounting.net/dynamics-gp-land-when-developing-econnect-integrations-dont-forget-the-details/ - Date: 2012-11-07 - Topics: Development & Integration, Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpland.blogspot.com/2012/11/when-developing-econnect-integrations.html Steve Endow reminds us [When developing eConnect integrations, don’t forget the details…](http://dynamicsgpland.blogspot.com/2012/11/when-developing-econnect-integrations.html) --- ## New tool aids in evaluation of external auditors - URL: https://dynamicaccounting.net/new-tool-aids-in-evaluation-of-external-auditors/ - Date: 2012-10-23 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.gofastpath.com/ Andy Snook of [Fastpath](http://www.gofastpath.com/) and I did a joint audit compliance session at the GPUG Summit last week. Now I see in CGMA magazine that there is a [New tool to aid in the evaluation of external auditors](http://www.cgma.org/Magazine/News/Pages/20126671.aspx?TestCookiesEnabled=redirect). You can download the tool directly from http://www.thecaq.org/resources/pdfs/AuditorAssessment.pdf. The PDF is a little wordy but the whole document is about a dozen pages and include a couple of nice questionaires around auditor performance. This seems like a nice tool for the audit committee toolbox. --- ## Dynamic Future – Vote – Never Forget to Match that Purchase Order - URL: https://dynamicaccounting.net/dynamic-future-vote-never-forget-to-match-that-purchase-order/ - Date: 2012-10-09 - Topics: Fraud, Audit & Controls, Sales, Purchasing & Inventory - Type: link to an external article - Source: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=http%3A%2F%2Fconnect.microsoft.com&wctx=rm%3D0%26id%3Dpassive%26ru%3D%252Fdynamicssuggestions%252Ffeedback%252Fdetails%252F669719%252Fgp-never-forget-to-match-that-purchase-order-again&wct=2016-04-19T09%3A15%3A39Z&wp=urn%3Aliveid%3AMBI_FED_SSL_URI&wreply=https%3A%2F%2Fconnect.microsoft.com%2Fdashboard%2F Another great suggestion from Leslie Vail. How about a an option in AP to identify open P.O.’s/Receipts when trying to enter an invoice for a particular vendor? If you like this idea, vote for it at: [https://connect.microsoft.com/dynamicssuggestions/feedback/details/669719/gp-never-forget-to-match-that-purchase-order-again](https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=http%3A%2F%2Fconnect.microsoft.com&wctx=rm%3D0%26id%3Dpassive%26ru%3D%252Fdynamicssuggestions%252Ffeedback%252Fdetails%252F669719%252Fgp-never-forget-to-match-that-purchase-order-again&wct=2016-04-19T09%3A15%3A39Z&wp=urn%3Aliveid%3AMBI_FED_SSL_URI&wreply=https%3A%2F%2Fconnect.microsoft.com%2Fdashboard%2F) [![](/img/blogger/cffa9daff4a9f2e5.png)](/img/blogger/1356b806c6403906.png) --- ## Account Maintenance Options: The Forgotten Fields | Dynamics GP Insights - URL: https://dynamicaccounting.net/account-maintenance-options-the-forgotten-fields-dynamics-gp-insights/ - Date: 2012-07-17 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpinsights.com/2012/07/09/account-maintenance-options-the-forgotten-fields/ Christina Phillips covers some of my favorite fields in [Account Maintenance Options: The Forgotten Fields](http://dynamicsgpinsights.com/2012/07/09/account-maintenance-options-the-forgotten-fields/) [![](http://www.dynamicsgpinsights.com/wp-content/uploads/2012/07/6302-1.png "6302-1")](http://www.dynamicsgpinsights.com/wp-content/uploads/2012/07/6302-1.png) --- ## What You Should Know About ERP Systems and SOX Compliance | 360° ERP Blog - URL: https://dynamicaccounting.net/what-you-should-know-about-erp-systems-and-sox-compliance-360-erp-blog/ - Date: 2012-01-19 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: link to an external article - Source: http://panorama-consulting.com/what-you-should-know-about-erp-systems-and-sox-compliance/ Panorama Consulting looks at [What You Should Know About ERP Systems and SOX Compliance.](http://panorama-consulting.com/what-you-should-know-about-erp-systems-and-sox-compliance/) If you’re looking for help with Sox compliance for any of the Dynamics ERP products look at [FastPath](http://www.gofastpath.com/). That’s what I used when I need Sox compliance and I was very happy. --- ## What, When and who? Auditing 101 – SQLServerCentral - URL: https://dynamicaccounting.net/what-when-and-who-auditing-101-sqlservercentral/ - Date: 2011-11-29 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.sqlservercentral.com/articles/Auditing/75790/ SQL Server Central has a nice look at options for auditing SQL server in their article [What, When and who? Auditing 101](http://www.sqlservercentral.com/articles/Auditing/75790/) Frankly, after looking through them, if you want to audit Dynamics GP just buy [FastPath](http://www.gofastpath.com/)’s Audit Trail product and save yourself a lot of work. --- ## Protect Against Check Fraud with Safe Pay | Dynamics GP Insights - URL: https://dynamicaccounting.net/protect-against-check-fraud-with-safe-pay-dynamics-gp-insights/ - Date: 2011-11-17 - Topics: Payables & Receivables, Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpinsights.com/2011/11/16/protect-against-check-fraud-with-safe-pay/ Over at Dynamics GP Insights, Cindy Boersma shows us how to [Protect Against Check Fraud with Safe Pay](http://dynamicsgpinsights.com/2011/11/16/protect-against-check-fraud-with-safe-pay/) ![](http://www.dynamicsgpinsights.com/wp-content/uploads/2011/11/SafePay-A.jpg) --- ## Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP – Part 5 | MSDynamicsWorld.com - URL: https://dynamicaccounting.net/risk-management-tips-and-tricks-to-mitigate-risk-during-an-audited-upgrade-with-microsoft-dynamics-gp-part-5-msdynamicsworld-com/ - Date: 2011-09-07 - Topics: Tips & Hidden Features, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-pa-1?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+MsdwHomePage+%28MSDynamicsWorld.com+Home+Page%29&utm_content=Google+Reader MSDynamicsWorld.com has a continuing look at [Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP.](http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-pa-1?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+MsdwHomePage+%28MSDynamicsWorld.com+Home+Page%29&utm_content=Google+Reader) In part 5 see what can go wrong. It’s a long list. --- ## Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP – Part 4 | MSDynamicsWorld.com - URL: https://dynamicaccounting.net/risk-management-tips-and-tricks-to-mitigate-risk-during-an-audited-upgrade-with-microsoft-dynamics-gp-part-4-msdynamicsworld-com/ - Date: 2011-08-17 - Topics: Tips & Hidden Features, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-pa-0?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld/news+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader Gloria continues her look at [Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP over at MSDynamicsWorld.com](http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-pa-0?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld/news+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader) --- ## Forgetful? Post Dated Pay Rates Can Help! | Dynamics GP Insights - URL: https://dynamicaccounting.net/forgetful-post-dated-pay-rates-can-help-dynamics-gp-insights/ - Date: 2011-08-08 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpinsights.com/2011/08/05/forgetful-post-dated-pay-rates-can-help/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Dynamicsgpinsights+%28dynamicsgpinsights.com%29&utm_content=Google+Reader Christina Phillips dives back into payroll with a look at how [Post Dated Pay Rates Can Help!](http://dynamicsgpinsights.com/2011/08/05/forgetful-post-dated-pay-rates-can-help/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Dynamicsgpinsights+%28dynamicsgpinsights.com%29&utm_content=Google+Reader) [![](http://dynamicsgpinsights.com/wp-content/uploads/2011/08/PayRates-A.jpg "PayRates-A")](http://dynamicsgpinsights.com/wp-content/uploads/2011/08/PayRates-A.jpg) --- ## Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP – Part 3 | MSDynamicsWorld.com - URL: https://dynamicaccounting.net/risk-management-tips-and-tricks-to-mitigate-risk-during-an-audited-upgrade-with-microsoft-dynamics-gp-part-3-msdynamicsworld-com/ - Date: 2011-08-03 - Topics: Tips & Hidden Features, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-par?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld%2Fnews+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader Gloria is back with part 3 of her look at [Risk Management: Tips and Tricks to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP](http://msdynamicsworld.com/story/risk-management-tips-and-tricks-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-par?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld%2Fnews+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader) over at MSDynamicsWorld.com ![](/img/blogger/a07823fab4ec6a10.jpg) --- ## Risk Management: How to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP – Part 2 | MSDynamicsWorld.com - URL: https://dynamicaccounting.net/risk-management-how-to-mitigate-risk-during-an-audited-upgrade-with-microsoft-dynamics-gp-part-2-msdynamicsworld-com/ - Date: 2011-07-21 - Topics: Install, Upgrade & Admin, Tips & Hidden Features, Fraud, Audit & Controls - Type: link to an external article - Source: http://msdynamicsworld.com/story/risk-management-how-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-part-2?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld/news+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader Gloria is back with part 2 of [Risk Management: How to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP](http://msdynamicsworld.com/story/risk-management-how-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp-part-2?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld/news+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader) at MSDynamicsWorld.com --- ## Risk Management: How to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP | MSDynamicsWorld.com - URL: https://dynamicaccounting.net/risk-management-how-to-mitigate-risk-during-an-audited-upgrade-with-microsoft-dynamics-gp-msdynamicsworld-com/ - Date: 2011-07-05 - Topics: Install, Upgrade & Admin, Tips & Hidden Features, Fraud, Audit & Controls - Type: link to an external article - Source: http://msdynamicsworld.com/story/risk-management-how-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld%2Fnews+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader MSDynamicsWorld.com digs into the fun of [Risk Management: How to Mitigate Risk During an Audited Upgrade with Microsoft Dynamics GP](http://msdynamicsworld.com/story/risk-management-how-mitigate-risk-during-audited-upgrade-microsoft-dynamics-gp?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+msdynamicsworld%2Fnews+%28Microsoft+Dynamics+News%29&utm_content=Google+Reader) in a new article. --- ## How to Select Audit Trail Software for Dynamics GP - URL: https://dynamicaccounting.net/how-to-select-audit-trail-software-for-dynamics-gp/ - Date: 2011-06-07 - Topics: Fraud, Audit & Controls, Tips & Hidden Features - Type: link to an external article - Source: http://msdynamicsgp.blogspot.com/p/best-practice-guides.html#AuditTrail I’ve got a brand new Best Practice Guide available as a free download looking at [How to Select Audit Trail Software for Dynamics GP.](http://msdynamicsgp.blogspot.com/p/best-practice-guides.html#AuditTrail) In today’s regulatory environment auditing what goes on in Dynamics GP is even more important than ever. Make sure that you select audit trail software that meets your needs with this free guide. --- ## The eOne Dynamics GP and CRM Blog: Ever Forgotten you wrote something? - URL: https://dynamicaccounting.net/the-eone-dynamics-gp-and-crm-blog-ever-forgotten-you-wrote-something/ - Date: 2011-03-30 - Topics: Microsoft & the GP Ecosystem, Fraud, Audit & Controls - Type: link to an external article - Source: http://eonesolutions.blogspot.com/2011/03/ever-forgotten-you-wrote-something.html Check out Martin’s link to an Extender white paper. He was having a good day when he wrote it. [The eOne Dynamics GP and CRM Blog: Ever Forgotten you wrote something?](http://eonesolutions.blogspot.com/2011/03/ever-forgotten-you-wrote-something.html) [![](/img/blogger/e4ad77499eb13a0d.jpg)](https://www.gpug.com/) --- ## Dynamics GP Land: Forgot the FUTA? Slacking on SUTA? Fix it now! - URL: https://dynamicaccounting.net/dynamics-gp-land-forgot-the-futa-slacking-on-suta-fix-it-now/ - Date: 2011-03-16 - Topics: Payroll & HR, Install, Upgrade & Admin, Fraud, Audit & Controls - Type: link to an external article - Source: http://office.live.com/error/error.html?aspxerrorpath=/view.aspx/Downloads/Dynamic%20GP%20SQL%20Scripts.xlsx Christina Phillips delivers a couple of [SQL Scripts](http://office.live.com/error/error.html?aspxerrorpath=/view.aspx/Downloads/Dynamic%20GP%20SQL%20Scripts.xlsx) for working with payroll in her new post [Forgot the FUTA? Slacking on SUTA? Fix it now!](http://dynamicsgpland.blogspot.com/2011/03/forgot-futa-slacking-on-suta-fix-it-now.html) [![](/img/blogger/e4ad77499eb13a0d.jpg)](https://www.gpug.com/) --- ## Dynamics GP Land: Don’t forget your keys (and the taxable wages)! - URL: https://dynamicaccounting.net/dynamics-gp-land-dont-forget-your-keys-and-the-taxable-wages/ - Date: 2011-01-27 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpland.blogspot.com/2011/01/dont-forget-your-keys-and-taxable-wages.html Steve Endow tackles incorrect taxable wages in [Don’t forget your keys (and the taxable wages)!](http://dynamicsgpland.blogspot.com/2011/01/dont-forget-your-keys-and-taxable-wages.html) It looks like today is shaping up to be a payroll day here at DynamicAccounting.net Oops..make that Christina Phillips. --- ## Payroll Audit Summary SmartList - URL: https://dynamicaccounting.net/payroll-audit-summary-smartlist/ - Date: 2010-12-02 - Topics: Reporting & BI, Payroll & HR, Fraud, Audit & Controls - Type: link to an external article - Source: http://dynamicsgpland.blogspot.com/2010/12/payroll-audit-summary-smartlist-pow.html Christina Phillips walks us through creating a [Payroll Audit Summary SmartList](http://dynamicsgpland.blogspot.com/2010/12/payroll-audit-summary-smartlist-pow.html) using SmartList Builder. --- ## Audit Trails in Dynamics GP - URL: https://dynamicaccounting.net/audit-trails-in-dynamics-gp/ - Date: 2010-11-15 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.gofastpath.com/ Mohammad Daoud has a nice look at Audit Trails in Dynamics GP. I have to say though that I still prefer [FastPath](http://www.gofastpath.com/) for audit trails in Dynamics GP. As a customer I bought [FastPath](http://www.gofastpath.com/) over the GP Audit Trail product and I would do it again without reservation. --- ## .Net Rocks Takes on SOX Compliance - URL: https://dynamicaccounting.net/net-rocks-takes-on-sox-compliance/ - Date: 2008-10-03 - Topics: Fraud, Audit & Controls, Development & Integration - Type: link to an external article - Source: http://www.dotnetrocks.com/default.aspx?ShowNum=382 For those users and developers who just can’t get enough about SOX compliance, the .[Net Rocks podcast is now taking on SOX compliance](http://www.dotnetrocks.com/default.aspx?ShowNum=382) from a developers point of view. It’s not GP specific but if you develop for GP you better understand the basics of SOX compliance. --- ## Working Your SOX Off - URL: https://dynamicaccounting.net/working-your-sox-off/ - Date: 2007-10-01 - Topics: Fraud, Audit & Controls - Type: link to an external article - Source: http://www.sqlservercentral.com/ [SQL Server Central](http://www.sqlservercentral.com/) takes a look at Sarbanes-Oxley from a DBA’s perspective in their [Working Your SOX Off](http://www.sqlservercentral.com/articles/Miscellaneous/3178/) article. (Free registration required). There is some good solid advice in here. With this advice and a few third party pieces like [FastPath’s Audit Trail and Configurator](http://www.gofastpath.com/) software you can seriously smooth out the GP portion of your SOX compliance. Not coincidentally, the next episode of the GP Rocks podcast is almost done and it’s an interview with Andrew Snook of [FastPath](http://www.gofastpath.com/). Look for it here in a day or two. [![](/img/blogger/ccb79557c5fa637c.jpg)](/img/blogger/1dcb6fdd78fde3e2.jpg) --- ## Willowware Audit Trails - URL: https://dynamicaccounting.net/willowware-audit-trails/ - Date: 2007-01-04 - Topics: Microsoft & the GP Ecosystem, Fraud, Audit & Controls - Type: link to an external article - Source: http://willoware.com/ [Willowware](http://willoware.com/) has released it’s [Audit Trails](http://willoware.com) software for Dynamics GP starting at an incredibly low $599. I haven’t demoed the software but it looks good, including a web based reporting interface with the source code. Additionally it use a client license so you can audit as many servers as you like with one client license. Like other auditing software it works at the SQL level and so it’s not dependent on GP but could be used with Dynamics NAV, SL, AX, CRM and conceivably other products. There is a trial download and once I get past all my year end stuff (and there’s a lot of it) I’ll demo it and add a review to our new Module Review section. In the mean time, check it out and you’ll be able to add your review as well. **Clarification, Willowware is partnering with ApexSQL to offer their Audit Trails software to the GP community for $599.** --- ## Nice Review of Audit Trails - URL: https://dynamicaccounting.net/nice-review-of-audit-trails/ - Date: 2006-04-26 - Topics: Fraud, Audit & Controls - Dynamics GP versions mentioned: GP 9 - Type: link to an external article - Source: http://eonesolutions.blogspot.com/2006/04/product-review-audit-trails.html The eOne Dynamics GP blog has a nice review of the upcoming Audit Trails feature for Dynamics GP 9.0. They did such a nice job that all I have to do it to point you to the [link here](http://eonesolutions.blogspot.com/2006/04/product-review-audit-trails.html).