I was in the field at a client, when I noticed the Human Resource Manager handing out payroll checks. My reaction was so immediate – I jumped all over him, “You aren’t supposed to be handing out the checks!” I even startled myself. And in hindsight, I realized that I missed paying attention to his reaction. . . .

Let me back up and fill you in, as Paul Harvey would say, on “the rest of the story.” This particular client ran various hospitality operations and in the summer months, employee count swelled to almost 200 – with many in the ranks considered temporary or seasonal. Most of these hourly employees received actual paper checks – which is going the way of the dinosaur as so many payroll transactions occur electronically.

However, for this company, they were slow to force all employees to a 100% electronic environment. The accounting and human resource staff was limited to four individuals with varied skills and a growing number of responsibilities to account for and track especially during the peak seasons. In the internal control environment, there is the concern that tasks will not have a segregation of duties and one person will have control or responsibility of an entire cash or operating cycle. We call this a “circle of one.” In this clients’ case, the Human Resource Manager managed the employee files and benefits, filtered all hires and terminations as well as handled the actual payroll processing.

One recommendation that we made to the client and discussed annually included our suggestions to add steps to mitigate the “circle of one” by adding some simple procedures into the mix as oversight. An easy one to implement, and management agreed, was to have accounting, not human resources, receive the payroll once it has been processed and the checks would be distributed to department managers for ultimate distribution to the employees. This procedure would provide oversight that if bogus or phantom employees were being paid, those checks would be left over in accounting. Also department managers might note if an employee received a check in a period that they did not work. And so it was, that I noticed the Human Resource Manager handing out the checks to employees directly, was a clear indicator that currently the internal control procedures were at risk.

And what happened next should not be a surprise to anyone. After my outburst, I had apparently created some nervousness in the HR Manager. Upon our discussion with management to review the process again, I scheduled a meeting with the HR Manager. I learned that he abruptly resigned and prior to leaving he spent a few days deliberately shredding documents, scrambling employee records and deleting computer files. We spent several months looking through records and assisting the new HR Manager to pick up the process, when we identified that hand written checks were manually made out to and endorsed by the previous HR Manager. The “circle of one” was tighter than we had expected. Management was unaware (or forgot) that he was an authorized check signor of the account and management was unaware that manual checks were being issued.  The HR Manager also was responsible for reconciling the payroll bank statements and had deliberately destroyed the copies of the checks that were returned with the monthly statements. We had made requests for duplicates directly from the bank of all checks made out to that individual. 

It didn’t take much longer to uncover how the scheme was carried out. Past employees were continued to be paid at significantly higher amounts and processed through the third-party payroll. Those checks were destroyed and new manual checks were written in the net amounts and cashed by the HR Manager. The total amount of this fraud exceeded $200,000.  Incredible you say!  Indeed! 

Consider the following suggestions that, if implemented and working effectively, should have detected the fraud and strengthened the internal controls.

10 Tips to Avoid Business Fraud

1. Human resource function could be separate from the payroll function.
2. Maintain a separate bank account for payroll activities.  Transfer only as much cash to cover the current payroll which will minimize available funds.
3. If using a third party payroll:  the individual responsible for processing the payroll is not the same individual receiving the payroll.
4. Payroll checks should be distributed to department managers for distribution.  Any “left over” checks should be forwarded to someone (in accounting or management) other than the individual responsible for processing the payroll.
5. The individual processing the payroll should not be an authorized check signor.
6. Procedure to disallow any manual checks written from payroll.
7. Take advantage of the electronic process:  require all employees to receive payroll through an electronic deposit and employees are responsible to access their own check stub information electronically. 
8. Bank reconciliations should not be prepared by the payroll processor.
9. Bank reconciliations are reviewed and approved.
10. Payroll journal entries should be reviewed and approved.

The end of this story is not a happy one – although the client was successful in recovering substantially all of the fraudulent payroll through coverage of an insurance policy, they were violated by a trusted longtime member of the management team, experienced significant disruption to their operations and incurred other costs that were not covered by insurance. The past employee is facing criminal charges.

Looking for an explanation of new requirements for preparing financial statements? Get it here.

Image courtesy of David Castillo Dominici via FreeDigitalPhotos.net