PAYROLL FRAUD IS WHEN an organization pays an employee or a fictitious employee for services not performed. We are referring to fraudulent payments schemes as opposed to abuse where employees are taking excessive personal time for personal surfing of Internet social media sites, making phone calls, e-mailing, and texting.

Fraudulent payment schemes fall under three main categories: ghost employees, falsified overtime or hours worked, and fraud related to commissions.

Ghost employees may be an actual or fictitious person. Fictitious ghost employees never existed in the organization. Someone with the authority or computer access hires employees by putting in the appropriate documentation or bypassing controls to create new employees in the payroll system. Setting up these nonexistent people with names similar to actual employees increases the chances of avoiding detection. Those classified as temporary or casual workers are at higher risk of being ghost employees who are fictitious. These workers usually have a high-turnover rate and are difficult to track after they leave the organization, making the fraud hard to detect. Further, actual people who at one time worked for the organization may unwittingly be used as part of the payroll fraud. An example would be a supervisor authorizing pay for one or two pay cycles before the employee actually started work. Another method would be failing to remove a terminated employee from the payroll. Participants of payroll schemes include those on the payroll who do not need to show up for work (typically in remote locations), and those that have some type of relationship to the person in authority, such as a family member. These ghost employees may have limited or no duties at all but are being paid the same as or more than fulltime employees with similar job titles.

It was mentioned that situations where temporary workers are employed have a higher-than-normal risk for ghost employees due to the high-turnover rate. Other situations that lend themselves to the risk of ghost employees include:

Hiring of foreign workers where the fraudster can allege that the workers returned to their native countries if questioned.

• The organization is large and remote locations make oversight more difficult.
  
• Highly decentralized and independent divisions that have their own payroll systems.
  
• Divisions managed by someone with a high degree of authority.
  
• The division has large numbers of employees at entry-level jobs, such as call centers.
  
• Direct deposit pay setup for employees where the regular hiring procedures were bypassed.
  
• Any changes to the payroll master file, such as modifying direct deposit routing, that can be done without other checks and balances.

Whether the ghost employees are fictitious or real, the payroll–payment cycle requires that they must be added to the payroll master file with relevant information, such as hourly wage rates or salary amounts. The time-tracking system must be provided with information, such as vacation days taken for salary staff and hours worked for hourly employees. The pay must be issued and then delivered to the ghost employee or accomplice by way of direct deposit or physical delivery.

Falsified overtime or hours worked likely occur in every organization. Employees may be responsible for inputting their hours worked and filing overtime claims. It is a simple matter to add extra time when doing this. Small additions may not be noticed by the authorizing supervisor. When the authorizing supervisor is lax or when there is collusion with the supervisor, larger amounts can be defrauded. Time documents may also be falsified by forging an authorizing signature or altered after approval. If authorization is through a computerized time system, the fraudster may have access to the password. This is especially true if the fraudster or accomplice works in the payroll department.

While salaried employees who are entitled to overtime can use the falsified overtime-hours scheme, those that cannot claim overtime must increase their salary rate as a way to pocket undeserved extra funds. They need access to the payroll master file to change their rate of pay. More likely, there would be collusion with an employee who has access to change salary amounts or, in the case of hourly employees, the hourly rate. These employees, given the opportunity, would likely be involved in expense-reimbursement schemes, as discussed in Chapter 11.

Commission fraud usually involves falsely increasing sales made by the employee. Prices of items sold can be internally increased or the commission rate increased to increase the amount of commissions. Like wage-rate increases, commission-rate changes need access to the payroll master file that can be accomplished by collusion.

Where the commission rate structure is such that after exceeding a certain quota, a higher rate is applied to all sales made during the year, there is motivation to push higher sales through. Bonuses paid after meeting a set quota may have a similar effect. Sales made near year-end should be reviewed, as sales can be booked and then canceled after the year-end. There could be overselling to the customers with promises of a liberal return policy for unused or unsold merchandise. The salesperson may be providing customers with unauthorized benefits or generous payment terms. At times, it may be worthwhile for the salesperson to generate the sale to a cooperative customer and then personally reimburse or kick back some or the entire amount to the customer if the resulting bonus or the increase in commission rate is higher than the reimbursed amount.

DATA AND DATA FAMILIARIZATION

Our case study will use real-life payroll data from the State of Oklahoma Payroll—Q1 2012 through to Q4 2012.1 An EMPLOYEE_ID field was added to the original data to be displayed in place of the actual employee names.

The data is used to demonstrate how to find anomalies. All data contains anomalies. Most anomalies either just occur or are contributed to by the business system. Most anomalies are not fraudulent, but one must be aware that anomalies are red flags of potential fraud. Most anomalies are also explainable and normal, but the anomalies need to be investigated to arrive at conclusions. We do not have sufficient information and we cannot follow the audit trail to form a conclusion as to whether any of the exceptions identified are errors or fraud.

We do not have a payroll master file associated with the Oklahoma payroll data. However, when obtaining payroll master file data, the following fields should be requested at the minimum:

• Employee name (last and first)
  
• Employee number
  
• Social Security number or Social Insurance number
  
• Address
  
• Phone number
  
• Hire date
  
• Bank information for direct deposits
  
• Employee classification code
  
• Rate of pay (both hourly and salary)
  
• Pay rate history
  
• Overtime hourly rate
  
• Commission rate
  
• Payroll codes (withholding taxes, health, and other benefits, etc.)
  
• Addition/modification field with associated date and who authorized it

The quarterly payroll data files were downloaded in comma-separated values (CSV format). When importing these four files for each year into IDEA, note that the first visible row is field names, so ensure that you place a checkmark to select this. The CSV file contains three fields that are dates. IDEA automatically assigned them to be character fields. For each of the three fields, ensure that you change the field type to “Date” and include the correct date mask of DD-MMM-YY, as entered in Figure 10.1. This will avoid the need to change from character fields to date fields within IDEA.

Once you have imported the first file (e.g., 1st Quarter), a record definition file or RDF is automatically created by IDEA and saved in the Import Definitons.ILB folder under the project folder. Subsequent identical CSV files can be imported using this record definition. You do not have to make any changes to those date fields that were initially selected by IDEA as character fields, as these were already defined in the record definition file.

Once you have the four 2012 quarters imported into IDEA, use the Append files feature and create a file called “Payroll 2012” that contains records for all four quarters.

The “Payroll 2012” file contains the fields displayed in Figure 10.2.

The data set does not contain an employee number or identification number. To uniquely identify the employee for features such as summarization, join, or extractions, we need to include three fields individually: LAST_NAME, FIRST_INITIAL, and MIDDLE_INITIAL. As we probably need to do this many times, some advance data preparation can save us work and time. We can append a new field called NAME using the equation of LAST_NAME + “ ” + FIRST_INITIAL + “ ” + MIDDLE_INITIAL. This concatenates the three name-related fields into one by last name, a space before the first initial, and another space before the middle initial. We can now just select the NAME field when applying our analytical tests. For the purposes of this case study, an EMPLOYEE_ID field is created and the contents generated are based on the new NAME field. We will be using the EMPLOYEE_ID field for display purposes.

Data Familiarization Steps

We should look at the field statistics in Figure 10.3 to get an idea of what the data holds for us.

The only numeric fields of interest are the HOURS field and the AMOUNT field. There are 1,798,710 records. In the HOURS field, there are 250,464 zero items. Zero items are expected in this field. However, the AMOUNT field contains 198,142 zero items. We are now aware that we may have to exclude zero amounts in our future equations to obtain the proper count results.

Next, we examine the field statistics for the date fields in Figure 10.4.

The REPORT_DATE earliest and latest records appear to be monthly reports and the date ranges are as expected. The CHECK_DATE has some records that are outside of the 2012 calendar year that may require investigation. IDEA provides the record number of the earliest and latest date for ease of location. We can just click on the earliest date record number of 103,278 and the record will be displayed for us. In this case, the October 31, 2011, date of payment appears to be a payroll recovery of negative $2,500.00. It is interesting to note that no payments were made on any Saturdays but 84 payments were issued on Sundays. If we were to click on the 84 in Items on Sunday under the CHECK_DATE field, we would see the results displayed as in Figure 10.5.

Upon examination, we determined that the payments on Sundays were all made by the same agency for salaries. All 84 records had blanks in the LAST_NAME field. While the last name may have been removed for privacy reasons before the payroll information was released on the website, this could also be a control issue with the payroll system. Due to the fact that the payments were all made by a single agency on Sundays and the last-name field had no information, these items should be queried. We will later perform a test to determine how many records in the entire data set have blank last names.

For the moment, we will continue with the overview of our data set.

We can summarize ACCOUNT by totaling and averaging on the HOURS and AMOUNT fields. Select to also display the ACCOUNT_DESCRIPTION field.

There are 23 account types for the entire data set in Figure 10.6. Because account 511140 indicates teaching pay, it can be concluded that not all of the 23 account types will be used by all the different agencies as not all agencies would employ educators.

We can determine the number of agencies by summarizing on AGENCY_NUMBER, totaling and averaging on the HOURS and AMOUNT fields; we should also display the AGENCY_NAME field.

The resulting file contains 159 records with each record representing an agency. We can see the number of records for each agency. The number of records represents the number of transactions. For example, record 23 shows agency number 13100, which is the Department of Corrections; it had 124,255 payroll transactions totaling $167,406,142.31. The average payment amount is $1,347.28. However, during our examination of the field statistics there were a number of zero amounts. If the Department of Corrections had some zero amounts in their payments, then the average shown in Figure 10.7 is lower than the actual average due to zero amounts that are counted as valid records.

Before we summarize by employee to determine how many employees were on the state’s payroll, let us see how many transaction results there are in which the employees’ last name field is blank.

We can use the criteria of LAST_NAME = = “ ” to achieve this, as shown in Figure 10.8.

The procedure returned 42,831 records where the last-name field was blank. Again, this could have been deliberately redacted for privacy reasons before making the data public. If these blanks occurred in the original data, the auditors would question some of the transactions and must determine whether there are weaknesses in the payroll system.

By summarizing by the EMPLOYEE_ID field and totaling and averaging on HOURS and AMOUNT fields, the resulting number of records provides us with an indication of how many employees are in the data set.

The resulting file contains 126,598 records, as displayed in Figure 10.9

Only gold members can continue reading. Log In or Register to continue