A case of check fraud

We will periodically post summaries of our experiences with other small businesses in an effort to share problems and solutions and learn from each other.

The Problem:
A growing company with 50+ employees suddenly discovered that they were the victims of check fraud.  The on-staff bookkeeper had forged the principal’s signature on several checks made payable to herself.  The company had many good internal controls in place:  checks were kept locked, check signers were different than check preparers, and “positive pay” was enforced (a list of all checks with vendor name and amount was uploaded to the bank when checks were issued by the company).  The principals were surprised and dismayed that check forgery fraud had occurred in their business.

The Solution:
First we performed a Data Analysis of the QuickBooks data to evaluate the accuracy and integrity of the financial data.  Then we cleaned up the books and reconciled all of the accounts.  Special attention was paid to vendor balances and bill payments.  We reconciled all open balances due to vendors against vendor statements and contacted vendors to cross-reference what the books were showing.  We uncovered a chronic issue with the bookkeeper notifying vendors that payment had been sent, and vendors never receiving them.  This clean-up work allowed us to prepare a list for the law enforcement authorities of all of the potential fraudulent checks.

Next we implemented a cloud-based bill pay system to use technology for more advanced controls:

• An image of the supporting documentation (the bill from the vendor) and the purchase order (approved by management) is associated to every bill entered.
• Users are assigned specific roles:  enter bills from vendors, approve bills, pay bills.  When users log in, they can only see the screen they have permission to use.  Those who enter bills can not access the pay bills screen.  At least two people are required for every bill payment.  (You can add additional approvers as needed.)
• There is no opportunity to forge a check signature.  When “bill pay” users click to schedule a bill payment, funds are deducted from the company’s bank account.  Next, a payment processing service sends the payment either electronically or via US mail, based on the preference.  Paper checks are printed with the routing and checking account number of the bill pay service, shielding the company from check washing scams.  There is no need to keep blank checks in the office, or at least not for regular usage by non-principals.
• You are automatically updated when checks are not cashed.  Click to void a check and re-issue or to return funds to your account.

Finally, we converted the company’s accounting software to QuickBooks Online.

• The company was previously using QuickBooks Desktop software.  While that is a fantastic accounting software, the access was not good in this situation.  The QuickBooks Desktop data file was stored on the bookkeeper’s laptop on her desk.  To access QuickBooks, they would have to go to the employee’s desk, log in to the Mac laptop, load Parallels to use a Windows operating system, open QuickBooks software and log in.  The principals did have the passwords necessary for access…but there were so many hurdles…they admittedly NEVER did.
• The bill pay app we used is one that is found in the QuickBooks Online app store and therefore integrates with QuickBooks Online.  That means that when a bill is entered, the central Chart of Accounts is used, and the bills and bill payments sync to QuickBooks Online.  No duplicate data entry means reduced labor and reduced chance for error.
• Principals were now one click away from reviewing the books from any browser.

Once the books were cleaned up and the systems set up, the company was able to hire a new Accounts Payable clerk…and feel confident in their internal controls against fraud.  We were engaged for the monthly controller work to manage the accounting systems, reconcile the accounts, and close the periods.

Tip:  In a case of fraud as described above, if you are unable to recoup the money stolen, you can issue a 1099-Misc to that person.  This will report the payments to the IRS for them to collect tax.