The Downside of Good Times

ot long ago, CPA Stanley Person uncovered an embezzlement at a small company client. The thief was a veteran employee who had oversight of the company’s finances. Why had the fraud gone undetected for several months? “The company was doing so well nobody noticed it was losing cash.” According to Person, whose 15-person New York firm serves mainly small businesses, one risk of a strong economy is that small clients may loosen their internal controls, thus discovering fraud or theft long after it has happened.

Good times have not necessarily made life easy for small company owners, Person says. “People’s dreams expand as the economy does. They look around and see that their next-door neighbor has just become a multimillionaire. They’re chasing the Golden Fleece much more than they used to, and they forget to pay attention to the basics.”

Person says the most vulnerable are private companies in the $10 million to $30 million range because they are large enough to lose substantial sums but often not yet big enough for adequate finance departments. Since they aren’t public, they aren’t having the audits that might uncover such problems. Even the smallest companies aren’t exempt. “It can happen at a $2 million business with smaller amounts—say, $100 to $200 a shot.”

Could it happen to your clients? Here are some insights into why it happens and suggestions for services CPAs can offer clients to help them avoid it.

The Root of the Problem

Person identified a number of factors that contribute to internal fraud:

Employee resentment. In one case, a client was showing Person his new luxury car when a key employee came in to ask for a small raise. The owner refused, saying he couldn’t afford it. “You just set yourself up for fraud,” Person told him. Employees who spend years taking care of mundane details can become resentful if they are left out when business booms. CPAs should warn clients to be sensitive to employee hopes and expectations—or at least to avoid showing off on the job if they don’t intend to reward workers with improved pay, working conditions or perks. “Fraud doesn’t happen in a vacuum,” Person says. “Someone doesn’t just wake up and say, ‘I’m going to start writing checks to myself.’ The owner has to become a mark.”

While they may be resentful, not all embezzlers can be identified by their sour personalities. “The people doing the stealing are usually very nice to the accountant,” Person observes. “They’ll say to the CPA, ‘Don’t worry, I’ll take care of those bank reconciliations.’”

Misplaced trust. Very often in smaller businesses one long-term employee bears an inordinate amount of financial responsibility. “A company may not have the proper segregation of duties,” says Person. “We’ll look at it and see that Barbara Jones has too much control over cash. She opens the mail, she makes up the deposit slips, she deposits the money in the bank and she signs checks in the absence of the owner. When we bring it to the owner’s attention, he or she will usually say, ‘Why, Barbara Jones has been with me forever!’” While the person may be completely reliable, it makes more sense to distribute these financial duties among more staff members.

Technology. Electronic transfers and computerized check writing make a thief’s work that much easier, according to Person. In one situation he heard about, a worker was paying off her own debts with wire transfers from her employer’s account. The transfers turned up on the company bank statements, but the person who received those statements was the worker herself. “If the business is doing $40 million to $50 million a year in sales and making purchases of $30 million a year, no one is going to miss, say, $10,000 a month, because it’s not a big enough percentage to notice,” Person says.

Besides companies that do a lot of wire transfers, others that can fall victim to fraud are heavy cash businesses, since cash is easy to misappropriate, and those with 10 or fewer employees, because controls are often weak. Another potentially fatal mistake involves company officers who allow others to sign checks or who leave blank checks for employees to use. “Owners should look at checks, check registers and bank reconciliations regularly,” Person advises, but should not review them only at predictable intervals.

They should also keep a tight rein on cash. “Some businesses leave a lot of money sitting in bank accounts without activating a sweep of the funds into another investment or savings program,” and that cash is ripe for misappropriation, Person says. Young businesses are also in danger. “The most poorly organized businesses are newly successful ones because they haven’t grown into their success,” he says. “Maybe they’re run by eight college classmates who only trust each other,” making it easier for a thief among the group to operate and harder for an outsider to impose financial discipline.

A Practice Opportunity

Person’s firm turned the problem into a consulting niche. After he found the embezzlement, Person made a list of 25 small business clients of similar size in terms of sales and employees, that might fall victim to the same type of crime because they shared some of the attributes mentioned above. He wrote a memo outlining the importance of segregation of duties and describing how his firm could analyze and improve their internal controls. In the next year, he picked up six engagements.

The CPAs carefully examine how duties are spread out among employees and how checks and confirmations pass through the office, even using flowcharts where necessary to illustrate workers’ activities. Person says that, among small businesses he’s worked with or heard about, “this is the worst time for internal control I’ve known because of the economy and technology.”

Not all the problems he’s uncovered involved crimes. One client had a $4 million business and 16 employees, including a controller. The owner scoffed at Person’s memo when he first received it because he believed the controller was above reproach. The company typically makes a high volume of payments to outsiders, so Person offered to have a member of his firm scan the payments for three days. While the CPA firm found no sign of dishonesty, it uncovered 12 accidental double payments in the three-day span—despite the fact that the owner reviewed the controller’s work. The firm designed a more effective system that didn’t rely on the busy owner as the only backup for a key employee’s work.

Mitigating Risk

“Most of these losses would not happen in less prosperous times when people are focusing on their businesses rather than on making more money,” Person says. The owner of the business that was making the accidental double payments “loves the stock market. He’s always on the phone to 14 brokers because he has the time now that his business is booming.”

Person believes owners are key in the fight against internal control failures. In a small business, “all fraud starts with the owner. It happens because the owner has been too trustful or is too distracted chasing more business or enjoying success once it happens.” CPAs can make these small company owners aware of how vulnerable they are and how their problems can be addressed.