Our Fraud Awareness in the Church series continues as we look at Payroll Fraud and Phantom Employees. We asked churches to respond to these statements:
“Someone not involved in the payroll preparation process distributes paychecks or direct deposit stubs.”
“We review direct deposit account information for duplicate accounts.”
Survey Results – Very few churches do any kind of employee verification once the employee has been hired. According to our survey only 25% of the churches engage in any form of paycheck verification (check stubs in the case of direct deposit). A little higher percentage, particularly among NACBA members, perform periodic reviews of direct deposit data (Social Security numbers, addresses, duplicate accounts, names of relatives, etc.)
KEY: To avoid phantom employees and payroll fraud, a church must KNOW who their employees are.
The term “phantom employee” refers to situations like this:
An employee is terminated but a supervisor continues to submit hours so that the “employee” continues to receive a check for months, sometimes years, after the employee left. The supervisor either colludes with the phantom in order to have the check endorsed and cashed or resorts to forgery.
A payroll clerk creates fictitious employees. These often are friends and relatives and once again, the fraudster will collude or forge.
I suspect the compliance is low regarding these questions because most “church” employees are easy to identify due to the relatively small staff size of most churches (25 to 50) and turnover is relatively low. HOWEVER, this is not the case with satellite operations such as a daycare program. Many, if not most, daycare programs are staffed by low paid, low hour, often temporary employees. Almost by definition, the turnover rate of a daycare program will be volatile compared to the parent organization, the church. With so many people coming and going, it is almost impossible to know each and every employee – an ideal place to breed “phantom employees.”
Our Fraud Awareness in the Church series continues as we look at Payroll Fraud. PSK in cooperation with the National Association of Church Business Administration (NACBA) conducted a survey to determine the extent of fraud awareness in the church environment. We asked churches to respond to this statement:
“Each quarter we reconcile the total payroll amounts on the quarterly payroll reports (941s) to the total payroll amounts recorded in the payroll journal and general ledger.”
Survey Results – 75% of the churches reported performing this task.
I was surprised by the strength of these numbers. In my experience, reconciling the quarterly 941 total wages with the salaries and wages reported in the church general ledger did not seem to be a common practice. As a matter of fact, many times when our auditors would attempt to do this, the chore was almost impossible.
Why? Because churches usually have a multitude of salary/wage general ledger accounts. AND other expense items remotely connected to personnel issues are often “dumped” into the payroll line items. I repeat, reconciling payroll is one of auditors’ most difficult tasks. Which makes my point.
KEY: Fraudsters prefer to hide in the tall weeds. (Big numbers)
Thieves try to hide their deeds in the big numbers, or accounts that have a great deal of activity. The reason is simple: their actions will not stand out there. The biggest of the big numbers for a church is PAYROLL.
KEY: You must know what is going on in your payroll accounts to avoid payroll fraud!
Part 5 of our series on Cash Disbursements. In our recent Fraud Survey, we asked churches to respond to these statements:
“Our church issues credit cards (in the church’s name) to employees and/or volunteers.”
“Our church has implemented a written credit card policy to control credit card purchases.”
Survey Results – The first question had the largest variance between all respondents (58%) and respondents active in the NACBA (43%). My assumption is that because NACBA members, through local chapter meetings, certification training, and the national conference, have heard plenty of the horror stories about credit cards “gone wild”.
It remains a mystery to me why churches handle credit cards in this manner (i.e. giving cards to ministers in the church’s name). It is definitely not the practice in the business world. Even if a corporation does issue corporate cards, the employee’s name is on the account too. The employee pays the bill after being reimbursed under an accountable plan. But if no backup is produced, or a personal expense is incurred, the employee pays the bill.
My worry that so many churches issue credit cards is somewhat alleviated by the results of the second question: Of the churches that hand out credit cards, almost three fourths have a written credit card policy in place.
KEY: A word of warning. The worst fraud investigation of my career was in the 7 figure range. 75% of the theft was accomplished with church issued credit cards.
Part 4 of our series on Cash Disbursements. In our recent Fraud Survey, we asked churches to respond to this statement:
“Our church has established a “Positive Pay” program with our bank.”
Survey Results – Less than 5% of the respondents use such a program.
While the phrase “Positive Pay” is the trade name of one commercial bank, it has become a generic term for an agreement between a bank and its customer that works like this:
- The church establishes a standard routine for paying bills, for most churches once each week.
- A list of approved bills is compiled and transmitted to the bank.
- The bank only clears checks or other charges presented for payment that are on the church’s list.
- The church is also informed of any checks or charges presented for payment that were not included on the list.
Increasingly, businesses are using arrangements like this to address a newer face of economic fraud. Fraud experts have historically used the “fraud triangle” of pressure, rationalization, and opportunity to describe the key ingredients of a fraudulent act. Generally, this discussion has focused on “inside jobs”.
However, with the advance of technology, a new face has arrived on the scene – the “hacker” completely outside the organization (in many cases completely outside the country!). Using Positive Pay is one protection against this type of fraud activity.
Perhaps a new leg needs to be added to the fraud triangle. (I guess that would make it a square…)
Part 3 of our series on Cash Disbursements. In our recent Fraud Survey, we asked churches to respond to this statement:
“Our church has established an “approved vendor” list. All payments for goods or services are made only to vendors on the list.”
Survey Results – Only 20% of the churches surveyed reported using an approved vendor list.
The low compliance rate of this question was a big surprise to me. The surprise was that so few churches have a formal process for determining who they choose to do business with.
In a previous post we discussed collusion. One of the methods of theft, resulting in some of the largest dollar losses, is vendor fraud. Vendor fraud often occurs when a purchasing agent within an organization COLLUDES with a corrupt vendor outside of the organization.
What makes this type of fraud especially effective (from the fraudster’s point of view) is that it is extremely difficult to detect, by both the church and its auditors.
KEY: Fraud prevention includes KNOWING who you are doing business with.
Having a vendor application, approval and acceptance process helps the church apply this key.
Part 2 of our series on Cash Disbursements. In our recent Fraud Survey, we asked churches to respond to this statement:
“Our church uses pre-printed, pre-numbered purchase orders or check request forms to initiate purchases.”
Survey results – The positive response to this question was extremely low, causing me to believe that the question was poorly worded. It should have included the use of electronic purchase orders generated by most church management software.
Not being able to rely on the survey results, however, does not keep me from sharing the main point.
KEY: A documented approval and bill payment process is a must!
Keep in mind one of our previous posts: Fraudsters Hate Baselines. A well documented bill paying system forms a part of the baseline.
Our Fraud Awareness in the Church series continues with a 5-part series on Cash Disbursements.
When churches finally get around to considering their exposure to fraud, they almost universally focus on the cash receipts or the inflow part of their cash processes. Without doubt, many churches have been hit by fraudsters skimming from the offering plates. But in most cases, the losses are relatively small for two reasons:
- Most churches have strong count team processes, although more of them should add some rotation to their teller mix.
- The vast majority of offerings come in the form of checks or credit cards. Very little is cash.
KEY: The fact is, the biggest scams usually occur on the “outflow stream” not the inflow…
In the next series of posts we will see how well protected our church survey participants are on this side of the ledger.
Part 7 of our series on Segregation of Duties. In our recent Fraud Survey, we asked churches to respond to this statement:
“Our church requires volunteers to collect, administer and account for special event receipts using a written report developed to properly account for such events.”
Survey Results – Once again, a little over one-half of our respondents are in compliance with this fraud prevention measure.
KEY: Many churches farm out the reporting of special event accounting and require little or no accountability from their volunteers.
A significant example of this took place in our region a few years ago. It took place within our local school district, but the same thing can and has happened at churches. A sports booster club held two annual fundraisers. Some agitated parents (whose children evidently didn’t make the team…) discovered or were tipped off to the fact that checks received during the event were deposited in the club bank account. However, cash received was deposited in the coach’s personal account. The parents didn’t report it to the school district first – they turned him into the newspapers!
Part 6 of our series on Segregation of Duties. In our recent Fraud Survey, we asked churches to respond to this statement:
“We present a list of authorized check signers to the leadership team/elders, etc. for review at least annually.”
Survey results – Approximately 55% of respondents reported reviewing their bank accounts and related signature information at least annually.
Dormant Bank Accounts
I would imagine if we had sent a question asking if they knew why this annual review was important the result would probably be close to zero! This question was lifted right out of our firm’s audit procedures. We ask this question each year and are often asked why this is important.
Here are two good reasons:
Poor management of check signing authority can result in a once-authorized check signer to continue to be one, even though they may have not been a church member/employee for years.
More importantly, poor management of signatures indicates poor management of bank accounts. Occasionally churches will even forget about a few bank accounts that are infrequently used. Unfortunately, fraudsters do not forget once they have found an untended, forgotten about account.
KEY: DORMANT BANK ACCOUNTS can be a useful tool to a thief allowing him to store stolen funds and later transferring them to personal accounts with little chance of detection.
Part 5 of our series on Segregation of Duties. In our recent Fraud Survey, we asked churches to respond to these statements:
“Our church has a formal policy describing the characteristics required for participation on the count team, including limiting related individuals and restricting the same individual from participating in more than one component of the process.”
“Church volunteers are required to “rotate off” their assignments periodically.”
Survey results – 70% of our respondents reported using some type of screening process for determining teller team members. Unfortunately, only 25% reported that they required all team members to periodically rotate off the count team on a systematic basis. My guess of why this number is so low is that, from my observations, many people serving on count teams consider the service they provide a ministry. It is very difficult for many churches to limit anyone’s ministry.
Collusion
If a church does screen its volunteers (as 70% appear to do) why is teller team rotation important to fraud prevention? This question can be answered with one word – COLLUSION. Even the strongest internal control systems can be penetrated when two or more people collude (conspire) to commit economic fraud.
The longer people serve together in any role, the more comfortable with each other they become. Over time, they may become tempted. It is much easier to broach the subject of committing fraud with a close acquaintance, than a stranger.
KEY: Being a relative or long-time friend with a fellow volunteer makes collusion a little bit easier.
