ACL-9

Fraud Tutorial2

Payroll FRAUD

For each of the following tutorials prepare a report demonstrating your

response:

PAYROLL: Overpayment
1. Red Flags-Payroll Gross Pay <> Salary: Because part of the data for this
tutorial resides in EMPMAST and part is in PAYROLL, you first need to do a
JOIN the two files:

Load the PAYROLL file, which contains the Gross Pay. JOIN the EMPMAST
file to it, on Employee Number and call the new file PR_GrossToSalary. Then
create a FILTER to locate any check that might be an anomaly.

(a) Create a filter to identify payments that appear to be anomalies.

Response: Gross_Pay <> Pay_Per_Period

This filter compares the actual gross pay for the period in the PAYROLL file with
the stated Pay Per Period in the EMPMAST file.

(b) How many employees appear to have been paid an amount than is different
from the pay per period amount?

The expression returned five records where gross pay and pay per period do not
match.

(c) Explain the results you get.

Two records (employees 20 and 120) are minor discrepancies that may be due to
clerical errors in either the payroll or empmast records.
 The discrepancy for employee 90 is because the employee did not receive a
check. This may be due to a normal situation (he did not work during the period)
or because of a more serious situation in which he/she has left the organization
but is still being carried on the Empmast file.

Employees 108 and 109 have received checks, but are not listed on the Empmast
file. This may be because they are new employees who have not yet been added
to the Empmast file. More seriously, they may be ex-employees (terminated) who
are still receiving paychecks.

(d) What should the auditor do with this information?

Each of these situations needs to be reviewed and reconciled with appropriate

management in the personnel, payroll, and work departments.

PURCHASING FRAUD

PURCHASING: Employee Theft

2. Red Flags-Paying Same Invoice Twice-Part 1: Load AP_TRANS file, which
contains paid vendor invoices. Use a command to search for DUPLICATE
records indicating that a particular invoice was paid twice.

Results:

The following command searches the file for duplicate invoice numbers that
indicates duplicate payments.

As of: 09/11/2010 09:27:14

Command: DUPLICATES ON Invoice_No OTHER Invoice_Amount

Invoice_Date Invoice_No Prodno Quantity Unit_Cost Vendor_No PRESORT TO
SCREEN
Table: Ap_Trans

0 duplicates detected
 3. Red Flags-Paying Same Invoice Twice-Part 2: Use a command to search for
DUPLICATE invoice payments where the invoice number might have been
falsified / altered.

Results:
The following command searches for payment amounts that are the same, but associated
with different (falsified) invoice numbers.

As of: 09/11/2010 09:32:18

Command: DUPLICATES ON Invoice_Amount OTHER Invoice_Amount

Invoice_Date Invoice_No Prodno Quantity Unit_Cost Vendor_No PRESORT TO
SCREEN
Table: Ap_Trans

0 duplicates detected

PURCHASING: Fictitious Vendors

4. Red Flags-Address is a Post Office Box: Load the VENDOR file. Use a
FILTER, and the FIND Function to look for post office box data in the street
address field. Click OK.
How many addresses appear to be post office boxes

No addresses contained the word “Box”.

5. Red Flags-Duplicate Vendors-Part 1: Create a search that identifies different

vendors with the same address.

(a) Display and explain your results.

As of: 09/12/2010 11:14:44

Command: DUPLICATES ON Vendor_Street OTHER Vendor_City Vendor_Name

Vendor_No Vendor_State Vendor_Street Vendor_ZIP PRESORT TO SCREEN
Table: Vendor
3 duplicates detected

Duplicates:

Vendor Vendor Vendor Zip

Vendor Street Vendor City Vendor Name
Number State Code
100 Main Street Gibsland Herbie's Hardware 10787 LA 71028
100 Main Street Washington Great Western Limited 13440 DC 20426
605 Third
Des Moines NOVATECH Wholesale 13808 IA 50319
Avenue
605 Third
Des Moines Steel Case Manufacturing 14299 IA 50319
Avenue
805 3rd Avenue Austin DIDA Limited 11922 TX 78701
Bloom County
805 3rd Avenue Orange 14438 CT 06477
Construction

The search examined only street addresses and returned five records. Four of
these vendors share an address that is similar to another vendor, but in different
towns and states.

Two of the vendors have exactly the same addresses. This may be a legitimate
company that operates under two different names for different lines of business,
or it may indicate form of vendor fraud.

(b) What do you do with a duplicate vendor addresses?

The auditor will need to investigate and reconcile these findings with purchasing
management.

6. Red Flags-Duplicate Vendors-Part 2: Sometimes a fictitious vendor scheme

takes advantage of a legitimate vendor by using a slightly different name to set up
a dummy vendor. The SOUNDSLIKE() function may be used to discover such
attempts at fraud. Build a filter and click on SOUNDSLIKE() function. Replace
“name” with Vendor_name, and sound_like_name with “Larsen Supplies”. Click
OK. Display your results.