04 Fraudulent Disbursements

Question 1

White, an employee of ABC Corporation, intentionally issued two payments for the same invoice. After the checks had been mailed, White called the vendor and explained that a double payment had been made by mistake. She asked the vendor to return one of the checks to her attention. When the vendor returned the check, White took it and cashed it. This is an example of:

A. A receivables skimming scheme
B. A pay-and-return scheme
C. A pass-through scheme
D. A shell company scheme

Answer 1

B. A pay-and-return scheme

Instead of using shell companies in their overbilling schemes, some employees generate fraudulent disbursements by using the invoices of legitimate third-party vendors who are not a part of the fraud scheme. In a pay-and-return scheme, an employee intentionally mishandles payments that are owed to legitimate vendors. One way to do this is to purposely double-pay an invoice. For instance, a clerk might intentionally pay an invoice twice and then call the vendor and request that one of the checks be returned. The clerk then intercepts the returned check.

Question 2

An excessive number of missing checks without stop payments issued to them is often a red flag of check tampering.

A. True
B. False

Answer 2

A. True

An excessive number of missing checks can be a red flag of a check tampering scheme, especially if stop payments haven’t been issued.

Question 3

Which of the following is TRUE regarding an overstated refund scheme?

A. It requires collusion between the customer and the employee.
B. The company’s inventory balance on the books will be understated.
C. It is based on an entirely fictitious refund transaction.
D. An employee overstates the amount of a legitimate refund and keeps the excess cash.

Answer 3

D. An employee overstates the amount of a legitimate refund and keeps the excess cash.

Rather than create an entirely fictitious refund, some employees merely overstate the amount of a legitimate refund and steal the excess money. For example, if a customer returns $100 worth of merchandise, the employee might ring up a $200 return. The employee gives the customer $100 in return for the merchandise and then keeps the remaining $100. The customer might or might not be aware of the scheme taking place. This will result in shrinkage of $100 worth of inventory. In other words, the inventory balance on the books will be overstated by the amount of the excess refund.

Question 4

Sheila, an accounts payable supervisor for ABC Company, bought supplies for a company she owned on the side. Sheila entered vouchers in ABC Company’s accounts payable system for the cost of the supplies. Checks were cut to pay for these unauthorized expenses during normal daily check runs. The goods were drop-shipped to a location where Sheila could collect them. What type of occupational fraud is this?

A. A pay-and-return scheme
B. An expense reimbursement scheme
C. An invoice kickback scheme
D. A personal purchases with company funds scheme

Answer 4

D. A personal purchases with company funds scheme

Instead of undertaking billing schemes to generate cash, many fraudsters simply purchase personal items with their company’s money. Company accounts are used to buy items for employees, their businesses, their families, and so on. This type of scheme is classified as a fraudulent billing scheme rather than theft of inventory. The heart of the scheme is not the theft of the items but rather the purchase of them. The perpetrator causes the victim company to purchase something it did not actually need, so the damage to the company is the money lost in purchasing the item.

Question 5

Which of the following control procedures will NOT help prevent payroll fraud?

A. Prenumbering payroll checks and issuing them in numerical sequence
B. Maintaining personnel records separately from payroll and timekeeping functions
C. Having the employee who prepares the payroll also review and sign all payroll checks
D. Keeping the payroll accounting function independent of the general ledger function

Answer 5

C. Having the employee who prepares the payroll also review and sign all payroll checks

There are two basic preventive measures for payroll-related fraud: segregation of duties and periodic payroll review and analysis. The following activities should be separated:
* Payroll preparation
* Payroll disbursement (into payroll and withholding tax accounts)
* Payroll distribution
* Payroll bank reconciliations
* Human resource departmental functions
Therefore, the employee who prepares the payroll should NOT review or sign any payroll checks.

Question 6

Pam is the purchasing manager at a retail store. She decides to form her own shell company and purchase merchandise through this entity. She then sells the merchandise to her employer at an inflated price as if she were a legitimate vendor. What type of scheme is Pam committing?

A. A pass-through scheme
B. A need recognition scheme
C. A pay-and-return scheme
D. A cash larceny scheme

Answer 6

A. A pass-through scheme

Pass-through schemes are usually undertaken by employees in charge of purchasing on the victim company’s behalf. Instead of buying merchandise directly from a vendor, the employee sets up a shell company and purchases the merchandise through that fictitious entity. He then resells the merchandise to his employer from the shell company at an inflated price, thereby making an unauthorized profit on the transaction.

Question 7

The most effective way to prevent and detect electronic payment fraud is through proper separation of duties.

A. True
B. False

Answer 7

A. True

The most important practice for preventing and detecting electronic payment fraud is separation of duties. For example, in the case of online bill payments, such as those made through a bank’s website or a third-party business-to-business payment service, separate individuals should be responsible for maintaining payment templates, entering payments, and approving payments. For wire transfers, duties for creating, approving, and releasing wires should be segregated. And to prevent attempts to conceal fraudulent electronic payment activity, no individual involved in the payment process should reconcile the bank statement or even have access to it.
In addition to separating duties, companies should consider segregating their bank accounts to maintain better control over them—for example, separate accounts can be used for paper and electronic transactions.

Question 8

Fraudulent disbursement schemes include which of the following?
A. Register disbursement schemes
B. Payroll schemes
C. Check tampering schemes
D. All of the above

Answer 8

D. All of the above

All of the following are types of fraudulent disbursement schemes:
* Register disbursement schemes
* Check tampering schemes
* Payroll schemes
* Billing schemes
* Expense reimbursement schemes

Question 9

Baker, the managing partner in a small law firm, is the authorized signer on all company checks. When his personal phone bill arrived last month, Baker prepared and signed a company check to pay the bill. He did not disclose this payment to his partners. Baker committed:

A. A forged maker scheme
B. An authorized maker scheme
C. A false billing scheme
D. A mischaracterized expense scheme

Answer 9

B. An authorized maker scheme

An authorized maker scheme is a type of check tampering fraud in which an employee with signature authority on a company account writes fraudulent checks for his own benefit and signs his own name as the maker. The most common example occurs when a majority owner or sole shareholder uses his company to pay personal expenses directly out of company accounts. Baker’s scheme is not a billing scheme because he wrote the check himself and there is no indication that he submitted the phone bill to the firm’s regular payment cycle.

Question 10

Tim, a cash register attendant at a department store, regularly inflates the amount of customer refunds. For instance, if a customer returns an item for $100, Tim records a $150 refund. Then Tim gives the customer $100 and keeps $50 for himself. This scheme is known as:

A. A fictitious refund scheme
B. An overstated refund scheme
C. A false void scheme
D. Skimming

Answer 10

B. An overstated refund scheme

One type of register disbursement scheme is the overstated refund. Rather than creating an entirely fictitious refund, a fraudster might overstate the value of a real customer’s refund, pay the customer the actual amount owed for the returned merchandise, and then keep the excess portion of the return.
In a fictitious refund scheme, an employee processes a transaction as if a customer were returning merchandise, even though there is no actual return. Then the employee takes cash from the register in the amount of the false return. The customer might or might not be aware of the scheme taking place.
Fictitious voids are similar to refund schemes in that they make fraudulent disbursements from the register appear to be legitimate. To process a false void, the first thing the perpetrator needs is the customer’s copy of the sales receipt. Typically, when an employee sets about processing a fictitious void, the employee simply withholds the customer’s receipt at the time of the sale. In many cases, customers do not notice that they are not given a receipt.
Skimming is the removal of cash from a victim entity prior to its entry in an accounting system.

Question 11

Skimmed checks and false voids are types of check tampering schemes.

A. True
B. False

Answer 11

B. False

Neither skimmed checks nor false voids are types of check tampering schemes. Skimmed checks are a form of theft of incoming cash. False voids are a type of register disbursement scheme.
The four major categories of check tampering schemes include:
* Forged maker schemes
* Forged endorsements
* Altered payees
* Authorized maker schemes

Question 12

Which of the following best describes a mischaracterized reimbursement expense scheme?

A. An employee submits a receipt for an item in one expense report and an email confirmation for the same item in the next period’s expense report.
B. An employee produces a fictitious receipt and includes it with an expense report.
C. An employee alters a receipt to reflect a higher cost than what the employee actually paid and submits it for reimbursement.
D. An employee who travels frequently on business submits receipts from a hotel stay during a family vacation as a business expense.

Answer 12

D. An employee who travels frequently on business submits receipts from a hotel stay during a family vacation as a business expense.

One of the most basic expense schemes is perpetrated by simply requesting reimbursement for a personal expense, claiming that it is business related. Examples of mischaracterized expenses include claiming personal travel as a business trip, listing dinner with a friend as “business development” or “client entertainment,” and so on. Fraudsters might submit the receipts from their personal expenses along with their reports and provide business reasons for the incurred costs.
Instead of seeking reimbursement for personal expenses, some employees overstate the cost of actual business expenses. This is considered an overstated expense reimbursement scheme.
In a fictitious expense reimbursement scheme, an employee seeks reimbursement for wholly fictitious expenses. Instead of overstating a real business expense or seeking reimbursement for a personal expense, an employee just invents an expense by producing a fictitious receipt and requests that it be reimbursed.
In a multiple reimbursement scheme, an employee submits several types of support for the same expense in order to get reimbursed multiple times.

Question 13

Most shell company schemes involve the purchase of fictitious:

A. Services
B. Inventory
C. Goods
D. Supplies

Answer 13

A. Services

Most shell company schemes involve the purchase of services rather than goods. The primary reason for this is that services are not tangible. If an employee sets up a shell company to make fictitious sales of goods to his employer, these goods will obviously never arrive. By comparing its purchases to its inventory levels, the victim organization might detect the fraud. It is much more difficult for the victim organization to verify that the services were never rendered. For this reason, many employees involved in shell company schemes bill their employers for things like “consulting services

Question 14

For employee expense reimbursement requests, electronic receipts are preferred to paper receipts because they are more difficult to alter or forge.

A. True
B. False

Answer 14

B. False

Requiring receipts to be submitted electronically is NOT a recommended form of expense reimbursement fraud prevention. In fact, electronic receipts are often much easier to forge or alter than paper receipts.

Question 15

As a means to prevent check fraud, companies should establish maximum amounts above which the company’s bank will not accept checks drawn against the account.

A. True
B. False

Answer 15

A. True

Companies should work in a cooperative effort with banks to prevent check fraud. One way to do this is to establish maximum amounts above which the company’s bank will not accept checks drawn against the account.

Question 16

Bank reconciliations should be performed by an authorized signatory on the account.

A. True
B. False

Answer 16

B. False

To prevent check fraud, bank reconciliations should NOT be performed by an authorized check signatory. Bank statements should be reviewed and reconciled by more than one person each month.

Question 17

Which of the following methods would be useful in detecting a ghost employee scheme?

A. Analyzing payroll withholdings
B. Examining payroll checks for dual endorsements
C. Comparing personnel records to payroll data
D. All of the above

Answer 17

D. All of the above

Comparing personnel records maintained by the human resources department to payroll data can be useful in detecting ghost employee schemes. An analysis of payroll withholdings might also reveal either ghost employees or trust account abuses. Ghost employees often will have no withholding taxes, insurance, or other normal deductions. Therefore, a listing of any employee without these items might reveal a ghost employee. Another way to detect a ghost employee scheme is to examine paychecks for dual endorsements. This might indicate that the fraudster has forged an endorsement in order to deposit the ghost’s paychecks into the fraudster’s own account.

Question 18

Which of the following schemes refers to the falsification of personnel or payroll records, causing paychecks to be generated to someone who does not actually work for the victim company?

A. Falsified salary scheme
B. Inflated commission scheme
C. Record alteration scheme
D. Ghost employee scheme

Answer 18

D. Ghost employee scheme

The term ghost employee refers to someone on the payroll who does not actually work for the victim company. Through the falsification of personnel or payroll records, a fraudster causes paychecks to be generated to a non-employee, or ghost. The fraudster or an accomplice then converts these paychecks. The ghost employee may be a fictitious person or a real individual who simply does not work for the victim employer.

Question 19

How does positive pay help prevent check fraud?
A. The bank scans all checks presented for payment to determine whether the signatures are forged.
B. The bank verifies checks presented for payment against a list of approved checks provided by the company.
C. Positive pay controls which vendors the company’s bank can deposit checks from.
D. Positive pay establishes a maximum amount above which the company’s bank will not accept checks drawn against the account.

Answer 19

B. The bank verifies checks presented for payment against a list of approved checks provided by the company.

Positive pay allows a company and its bank to work together to detect fraudulent items presented for payment. The company provides the bank with a list of checks and amounts that are written each day. The bank verifies items presented for payment against the company’s list. The bank rejects items that are not on the list. Investigations are conducted as to the origin of the “non-listed” items.

Question 20

Gaps in the sequence of transactions on the register log might indicate that a fraudulent register disbursement scheme is taking place.

A. True
B. False

Answer 20

A. True

Red flags of fraudulent register disbursements include the following:
Inappropriate separation of duties exists.
Cashiers, rather than supervisors, have access to the control keys necessary for refunds and voids.
Register employees have the authority to void their own transactions.
Register refunds are not carefully reviewed.
Multiple cashiers operate from a single cash drawer without separate access codes.
Personal checks from cashiers are found in the register.
Voided transactions are not properly documented or approved by a supervisor.
Voided cash receipt forms (manual systems) or supporting documents for voided transactions (cash register systems) are not retained on file.
Gaps exist in the sequence of transactions on the register log.
There is an excessive number of refunds, voids, or no-sales on the register log.
Inventory totals appear forced.
There are multiple refunds or voids for amounts just under the review limit.

Question 21

A register disbursement scheme is easier to conceal when register employees have the authority to void their own transactions.

A. True
B. False

Answer 21

A. True

Red flags of fraudulent register disbursements include the following:
Inappropriate separation of duties exists.
Cashiers, rather than supervisors, have access to the control keys necessary for refunds and voids.
Register employees have the authority to void their own transactions.
Register refunds are not carefully reviewed.
Multiple cashiers operate from a single cash drawer without separate access codes.
Personal checks from cashiers are found in the register.
Voided transactions are not properly documented or approved by a supervisor.
Voided cash receipt forms (manual systems) or supporting documents for voided transactions (cash register systems) are not retained on file.
Gaps exist in the sequence of transactions on the register log.
There is an excessive number of refunds, voids, or no-sales on the register log.
Inventory totals appear forced.
There are multiple refunds or voids for amounts just under the review limit.

Question 22

To prevent fraudulent register disbursements, an employee other than the register worker should be responsible for preparing register count sheets and agreeing them to register totals.

A. True
B. False

Answer 22

A. True

To prevent fraudulent register disbursements, an employee other than the register worker should be responsible for preparing register count sheets and agreeing them to register totals.

Question 23

Duplicate check numbers in the listing of canceled checks are a potential sign of fraud.

A. True
B. False

Answer 23

A. True

Duplicate check numbers indicate potential fraud. These checks might be traceable to the depositor through bank check coding.

Question 24

Pass-through schemes are usually undertaken by employees who receive inventory on the victim company’s behalf.

A. True
B. False

Answer 24

B. False

Pass-through schemes are usually undertaken by employees in charge of purchasing on the victim company’s behalf. Instead of buying merchandise directly from a vendor, the employee sets up a shell company and purchases the merchandise through that fictitious entity. He then resells the merchandise to his employer from the shell company at an inflated price, thereby making an unauthorized profit on the transaction.

Question 25

Which of the following is recommended to prevent fraud in electronic payments? A. Implementing ACH blocks and filters B. Having separate bank accounts for paper checks and electronic payments C. Positive pay for ACH transactions D. All of the above

Answer 25

D. All of the above ## Footnote Most banks offer a number of security services that can help business account holders mitigate the risk of fraudulent electronic payments. For example, ACH blocks allow account holders to notify their banks that ACH debits should not be allowed on specific accounts. ACH filters enable account holders to provide their banks with a list of defined criteria against which banks can filter ACH debits and reject any unauthorized transactions. Positive pay for ACH is another security feature offered by banks to their account holders. With positive pay, banks match the details of ACH payments with those on a list of legitimate and expected payments provided by the account holder. Only authorized electronic transactions are allowed to be withdrawn from the account; exceptions are reported to the customer for review. Companies should consider segregating their bank accounts to maintain better control over them—for example, separate accounts can be used for paper and electronic transactions. Having separate bank accounts will facilitate the audit process and help the fraud examiner identify any electronic payments that seem suspicious.

Question 26

Which of the following is a method of committing a falsified hours and salary scheme? A. Colluding with a supervisor B. Forging a supervisor’s signature C. Altering a timesheet after it has been approved D. All of the above

Answer 26

D. All of the above ## Footnote The most common method of misappropriating funds from the payroll is the overpayment of wages. For hourly employees, the size of a paycheck is based on two factors: the number of hours worked and the rate of pay. Therefore, for hourly employees to fraudulently increase the size of their paycheck, they must either falsify the number of hours they have worked or change their wage rate. Common ways to commit a falsified hours and salary scheme include: * Inflating the number of hours worked * Inflating the rate of pay * Forging a supervisor’s signature * Collusion with a supervisor * Implementing poor custody procedures * Altering a timesheet after it has been approved

Question 27

Sean is responsible for delivering timesheets to the payroll department on behalf of his supervisor. One day he decides to withhold his timesheet from those being sent to his supervisor for approval. He falsely increases the number of hours he has worked and then forges his supervisor’s signature on his timesheet. He adds the timesheet to the stack of authorized sheets and delivers them to payroll. This is an example of: A. A ghost employee scheme B. A check tampering scheme C. A fictitious reimbursement scheme D. A falsified hours and salary scheme

Answer 27

D. A falsified hours and salary scheme ## Footnote For hourly employees, the size of a paycheck is based on two essential factors: the number of hours worked and the rate of pay. Therefore, for hourly employees to fraudulently increase the size of their paycheck, they must either falsify the number of hours they have worked or change their wage rate. One form of control breakdown that is common in falsified hours and salary schemes is the failure to maintain proper control over timecards. In a properly run system, once timecards are authorized by management, they should be sent directly to payroll. Those who prepare the timecards should not have access to them after they have been approved. When this procedure is not observed, the person who prepared a timecard can alter it after that person’s supervisor has approved it but before it is delivered to payroll. Common ways to commit a falsified hours and salary scheme include: * Inflating the number of hours worked * Inflating the rate of pay * Forging a supervisor’s signature * Collusion with a supervisor * Implementing poor custody procedures * Altering a timesheet after it has been approved

Question 28

All of the following are classifications of billing schemes EXCEPT: A. Personal purchases with company funds B. Invoicing via nonaccomplice vendors C. Bid rigging D. Shell company schemes

Answer 28

C. Bid rigging ## Footnote There are three principal types of billing schemes: * Invoicing via shell companies * Invoicing via non-accomplice vendors * Personal purchases with company funds

Question 29

All of the following are types of expense reimbursement schemes EXCEPT: A. Multiple reimbursements B. Ghost expense reports C. Mischaracterized expenses D. Fictitious expenses

Answer 29

B. Ghost expense reports ## Footnote The four main types of expense reimbursement schemes are: * Mischaracterized expenses * Overstated expenses * Fictitious expenses * Multiple reimbursements There is no such scheme as ghost expense reports. Ghost employees, however, are a common payroll fraud scheme.

Question 30

A recommended practice to detect expense reimbursement schemes is to compare current period expenses to both historical expenditure amounts and budgeted expense amounts. A. True B. False

Answer 30

A. True ## Footnote Generally, expense account review uses one of two methods: historical comparisons or comparisons with budgeted amounts. A historical comparison compares the balance expended this period in relation to the balance spent in prior, similar periods. Budgets are estimates of the money and/or time necessary to complete a task. They are based on past experience with consideration for current and future business conditions. Therefore, when comparing actual and budgeted expenses, determining excessive expenses or inaccurate budget estimates is important.

Question 31

Annika, a bookkeeper for a small company, created checks to a local vendor and had her boss sign them. She then used correctional fluid to cover up the vendor's name and insert her own. She also changed the amounts of the checks in the same manner. Then she cashed the checks. What kind of scheme did Annika commit? A. A cash larceny scheme B. An altered payee scheme C. A forged endorsement scheme D. A forged maker scheme

Answer 31

B. An altered payee scheme ## Footnote The altered payee scheme is a type of check tampering fraud in which an employee intercepts a company check intended for a third party and alters the payee designation so that the check can be converted by the employee or an accomplice. The fraudster inserts his own name, the name of a fictitious entity, or some other name on the check’s payee line.

Question 32

Rachel's boss was an authorized maker on the company checks. Rachel stole one of the checks and forged her boss's signature. This check tampering scheme is known as a forged endorsement scheme. A. True B. False

Answer 32

B. False ## Footnote Rachel committed a forged maker scheme, not a forged endorsement scheme. The person who signs a check is known as the “maker” of the check. A forged maker scheme is defined as a check tampering scheme in which an employee misappropriates a check and fraudulently affixes the signature of an authorized maker thereon. In a forged endorsement scheme, an employee intercepts a company check intended for a third party and converts the check by endorsing it with the third party’s name.

Question 33

All of the following are payroll scheme types EXCEPT: A. Stolen paychecks B. Commission schemes C. Falsified hours and salary D. Ghost employees

Answer 33

A. Stolen paychecks ## Footnote In general, payroll schemes fall into one of the following categories: * Ghost employees * Falsified hours and salary * Commission schemes If an employee stole paychecks, this would fall under check tampering, not payroll fraud. The reason is that the heart of the scheme is stealing the check, not generating false payroll disbursements.

Question 34

What happens when an employee records a fictitious refund of goods at the employee's cash register? A. The victim company's inventory is overstated B. Inventory is returned to the store C. The register total is out of balance with the register log D. None of the above

Answer 34

A. The victim company's inventory is overstated ## Footnote A refund shows a disbursement of money from the register as the customer gets his money back. In a fictitious refund scheme, an employee processes a transaction as if a customer were returning merchandise, even though no actual return takes place. Two things result from this fraudulent transaction. First, the employee takes cash from the register in the amount of the false return. Since the register log shows that a merchandise return has been made, it appears that the disbursement is legitimate. The second thing that happens in a fictitious refund scheme is that a debit is made to the inventory system showing that the merchandise has been returned. Since the transaction is fictitious, no merchandise is actually returned. The result is that the company’s inventory is overstated.

Question 35

Which of the following would be considered a forged maker scheme? A. Lindsay’s employer writes her a check to reimburse her for travel expenses. The check is for $350. She carefully changes the 3 to an 8 so that the check amount now appears to be $850. B. Jeff is an employee at Carlisle Company. He obtains a check intended for Lewis, one of Carlisle’s vendors. Jeff covers up Lewis’s name with correction fluid, inserts his own name, and cashes the check for himself. C. Stewart intercepts a check written from his employer, Alamo Corp., to Richard Johnson, one of Alamo’s contractors. He then forges Johnson’s name on the check’s endorsement line and cashes it for himself. D. Erica steals a check from her employer, makes it payable to herself, and then forges the CFO’s signature on the check. The CFO is an authorized check signer at the company.

Answer 35

D. Erica steals a check from her employer, makes it payable to herself, and then forges the CFO’s signature on the check. The CFO is an authorized check signer at the company. ## Footnote The person who signs a check is known as the “maker” of the check. A forged maker scheme is defined as a check tampering scheme in which an employee misappropriates a check and fraudulently affixes the signature of an authorized maker thereon. Erica committed a forged maker scheme because she forged the signature of the CFO, an authorized maker, on her employer’s check. In a forged endorsement scheme, an employee intercepts a company check intended for a third party and converts the check by endorsing it with the third party’s name. Stewart committed a forged endorsement scheme because he signed Johnson’s name on the back of the check and cashed it himself. In an altered payee scheme, an employee intercepts a company check intended for a third party and alters the payee designation so that the employee or an accomplice can convert the check. The employee inserts his own name, the accomplice’s name, or a fictitious entity’s name on the check’s payee line. In addition to altering the payee designation, the amount of the check can be altered by tacking on extra numbers if the person preparing the check is careless and leaves space for extra numbers in the “amount” portion of the check. Jeff and Lindsay both committed altered payee schemes. Jeff altered the payee line by inserting his own name on the check intended for Lewis, and Lindsay altered the amount on the check that was intended for her.

Question 36

In order for hourly employees to commit a falsified hours and salary scheme, they may overstate either the number of hours worked or their rate of pay. A. True B. False

Answer 36

A. True ## Footnote For hourly employees, the size of a paycheck is based on two essential factors: the number of hours worked and the rate of pay. Therefore, for hourly employees to fraudulently increase the size of their paycheck, they must either falsify the number of hours they have worked or change their wage rate.

Question 37

_______________ is a system by which the bank verifies checks presented for payment against the list provided by the company of approved checks written on the account. A. Verification control B. Positive pay C. Check matching D. Payment patrol

Answer 37

B. Positive pay ## Footnote Positive pay allows a company and its bank to work together to detect fraudulent items presented for payment. The company provides the bank with a list of checks and amounts that are written each day. The bank verifies items presented for payment against the company’s list. The bank rejects items that are not on the list. Investigations are conducted as to the origin of the “non-listed” items.

Question 38

Which of the following does NOT happen in a fictitious refund scheme? A. The company's inventory is overstated. B. A fraudster processes a transaction as if a customer were returning merchandise. C. Merchandise is returned to the stock room. D. The register log balances with the amount of money in the register.

Answer 38

C. Merchandise is returned to the stock room. ## Footnote In a fictitious refund scheme, an employee processes a transaction as if a customer were returning merchandise, even though no actual return takes place. Two things result from this fraudulent transaction. First, the employee takes cash from the register in the amount of the false return. Since the register log shows that a merchandise return has been made, the disbursement appears legitimate. The register log balances with the amount of money in the register because the money that was taken by the employee is supposed to have been removed and given to a customer as a refund. The second thing that happens in a fictitious refund scheme is that a debit is made to the inventory system showing that the merchandise has been returned to the inventory. Because the transaction is fictitious, no merchandise actually is returned. As a result, the company's inventory is overstated.

Question 39

Zach was booking travel arrangements for a business trip. He purchased an airline ticket online using his own funds and obtained a receipt for the ticket via email. Using photo-editing software, Zach inflated the ticket price on the electronic receipt and submitted the altered receipt to his employer for reimbursement. This is an example of what type of fraud scheme? A. Personal purchases with company funds B. Multiple reimbursement scheme C. Mischaracterized expense scheme D. Overstated expense scheme

Answer 39

D. Overstated expense scheme ## Footnote Instead of seeking reimbursement for personal expenses, some employees overstate the cost of actual business expenses. The most fundamental example of an overstated expense reimbursement scheme occurs when an employee alters a receipt or other supporting documentation to reflect a higher cost than what the employee actually paid.

Question 40

Electronic payment tampering is generally easier to detect than traditional check tampering because it leaves a clear audit trail. A. True B. False

Answer 40

B. False ## Footnote Electronic payment tampering is generally more difficult to detect than traditional check tampering schemes. As with other schemes, once the fraudulent payment has been made, the employee must cover his tracks. However, the lack of physical evidence and forged signatures can make concealment of fraudulent electronic payments less challenging than other check tampering schemes. Some fraudsters attempt to conceal their schemes by altering the bank statement, miscoding transactions in the accounting records, or sending fraudulent payments to a shell company with a name similar to that of an existing vendor. Others merely rely on the company’s failure to monitor or reconcile its accounts.

Question 41

Which of the following describes the primary purpose of an ACH filter? A. It matches the details of incoming payments with those on a list of expected payments provided by the account holder. B. It requires the bank to contact the account holder before any payments are made. C. It is a tool used by auditors to examine electronic payment activity on the bank records. D. It enables account holders to provide their banks with a list of criteria to ensure only designated individuals get paid.

Answer 41

D. It enables account holders to provide their banks with a list of criteria to ensure only designated individuals get paid. ## Footnote Most banks offer a number of security services that can help business account holders mitigate the risk of fraudulent electronic payments. For example, ACH blocks allow account holders to notify their banks that ACH debits should not be allowed on specific accounts. ACH filters enable account holders to provide their banks with a list of defined criteria (such as the sending company ID, account number, and transaction code) against which banks can filter ACH debits and reject any unauthorized transactions. Positive pay for ACH is another security feature offered by banks to their account holders. With positive pay, banks match the details of ACH payments with those on a list of legitimate and expected payments provided by the account holder. Only authorized electronic transactions are allowed to be withdrawn from the account; exceptions are reported to the customer for review.

Question 42

Which of the following is one of the four major categories of check tampering schemes? A. Forged maker schemes B. Altered payee schemes C. Forged endorsement schemes D. All of the above

Answer 42

D. All of the above ## Footnote The four major categories of check tampering schemes include: * Forged maker schemes * Forged endorsements * Altered payees * Authorized maker schemes

Question 43

A detailed expense report should require which of the following components? A. Time period when the expense occurred B. Original receipts (when possible) C. Explanation of the business purpose of each expense D. All of the above

Answer 43

D. All of the above ## Footnote Detailed expense reports should require the following information: * Receipts or other support documentation * Explanation of the expense, including specific business purpose * Time period when the expense occurred * Place of expenditure * Amount When possible, require that employees submit original paper receipts. Given the amount of electronic and Internet commerce that happens in today’s world, this is not always possible. Keep in mind that electronic copies of receipts are often much easier to forge and alter than paper receipts. Special attention should be paid to any receipts that come via email or email attachment. Consider corroborating prices on Internet receipts with those found on the vendor’s website. It is not enough to have the detailed reports submitted if they are not reviewed. A policy requiring the periodic review of expense reports, coupled with examining the appropriate detail, will help deter employees from submitting personal expenses for reimbursement.

Question 44

Joe formed a company called Glenn Corp. He opened a bank account in Glenn Corp.’s name and used his home computer to create fraudulent invoices from Glenn Corp. for "consulting services." However, Glenn Corp. is a fictitious entity that was created solely to commit fraud, and no services have been rendered. Joe mailed these invoices to his employer, Paisley Company. Paisley Company promptly submitted payment to Glenn Corp., not realizing that the company was fake, and Joe deposited the money. What type of billing scheme did Joe commit? A. A pay-and-return scheme B. A cash larceny scheme C. A shell company scheme D. A pass-through scheme

Answer 44

C. A shell company scheme ## Footnote Shell companies, though sometimes created for legitimate purposes, are often fictitious entities created for the sole purpose of committing fraud. They might be nothing more than a fabricated name and address that an employee uses to collect disbursements from false billings. However, since the checks received are made out in the name of the shell company, the perpetrator normally also sets up a bank account in the shell company’s name. Once a shell company has been formed and a bank account has been opened, the corrupt employee is in a position to begin billing his employer by mailing forged invoices for fictitious goods and/or services.

Question 45

If an employee intercepts a company check intended for a third party and converts that check for his own benefit, he has committed: A. Skimming B. Check tampering C. Billing fraud D. Economic extortion

Answer 45

B. Check tampering ## Footnote Check tampering is a type of fraudulent disbursement scheme in which an employee either (1) prepares a fraudulent check for his own benefit or (2) intercepts a check intended for a third party and converts the check for his own benefit.

Question 46

Baker used his company credit card to pay for a business dinner at which he was entertaining a client, knowing the credit card bill would be paid by Baker's employer. Baker saved the receipt and later filed an expense report seeking reimbursement for the cost of the meal, attaching the receipt as support. This is an example of what kind of fraud? A. Personal purchases with company funds B. Multiple reimbursement scheme C. Mischaracterized expense scheme D. False billing scheme

Answer 46

B. Multiple reimbursement scheme ## Footnote A multiple expense reimbursement scheme involves the submission of a single expense several times to receive multiple reimbursements. The most frequent example of such a scheme is the submission of several types of support for the same expense. However, rather than file two expense reports, employees might also charge an item to the company credit card, save the receipt, and attach it to an expense report as if they paid for the item themselves. The victim company therefore ends up paying twice for the same expense.

Question 47

Julia, a fraud examiner, is performing tests to look for potential asset misappropriation schemes at her company. One of her routine tests is to compare the payroll records to the human resources files. What type of fraud scheme is she most likely looking for when performing this test? A. A ghost employee scheme B. A falsified hours and wages scheme C. A check tampering scheme D. A fraudulent commissions scheme

Answer 47

A. A ghost employee scheme ## Footnote Comparing personnel records maintained by the human resources department to payroll data can be useful in detecting ghost employee schemes. The term ghost employee refers to someone on the payroll who does not actually work for the victim company. Through the falsification of personnel or payroll records, a fraudster causes paychecks to be generated to a non-employee, or ghost. For example, comparing employee names, addresses, government-issued identifications, and bank account numbers can determine if there are any unexpected duplicates or discrepancies that would indicate a ghost on the payroll.

Question 48

All of the following measures are recommended to help mitigate the risk of billing schemes EXCEPT: A. Provide objective compensation for purchasing staff. B. Separate the purchasing function from the payment function. C. Implement a hotline function. D. Prohibit competitive bidding.

Answer 48

D. Prohibit competitive bidding. ## Footnote The prevention of purchasing fraud can be especially difficult. Probably the most effective purchasing fraud prevention measure is education and training of the purchasing and accounts payable personnel. The second most effective purchasing fraud prevention measure is an objective compensation arrangement with people responsible for purchasing decisions. For the best results and accountability, each company sufficient in size should have a separate purchasing department. Regardless of the company size, the purchasing function should be separate from the payment function. Furthermore, companies should implement a hotline function to provide a forum for complaints and fraud tips by employees and outsiders. Whenever possible, companies should enforce competitive bidding. Competitive bidding is a transparent procurement method in which bids from competing contractors, suppliers, or vendors are invited by openly publicizing the scope, specifications, and terms and conditions of the proposed contract, as well as the criteria by which the bids will be evaluated. Competitive bidding aims at obtaining goods and services at the lowest prices by stimulating competition and preventing partiality and fraud.

Question 49

Which of the following is considered a red flag of check tampering? A. Non-payroll checks payable to employees B. Large gaps in the check register C. Payee addresses that match employee addresses D. All of the above

Answer 49

D. All of the above ## Footnote The following are red flags of check tampering: Missing checks or large gaps in the check register might indicate lax control over the physical safekeeping of checks. Stop payments should be issued for all missing checks. Checks payable to employees, with the exception of regular payroll checks, should be closely scrutinized. Such an examination might indicate other schemes, such as conflicts of interest, fictitious vendors, or duplicate expense reimbursements. Altered endorsements or dual endorsements of returned checks might indicate possible tampering. Returned checks with obviously forged or questionable signature endorsements should be verified with the original payee. Altered payees on returned checks should be verified with the intended payee. Duplicate or counterfeit checks indicate fraud. These checks might be traceable to the depositor through bank check coding. An examination of all cash advances might reveal that not all advances are properly documented and, therefore, inappropriate payments have been made to employees. A questionable payee or payee address on a check should trigger review of the corresponding check and support documentation. Checks payable to cash are typically considered suspicious and merit further investigation.

Question 50

For a ghost employee scheme involving an hourly employee to be successful, all of the following must happen EXCEPT: A. A paycheck must be issued to the ghost employee. B. Timekeeping information must be collected for the ghost employee. C. The ghost employee must be a fictitious person. D. The ghost employee must be added to the payroll.

Answer 50

C. The ghost employee must be a fictitious person. ## Footnote For a ghost employee scheme to work, four things must happen: (1) the ghost must be added to the payroll, (2) timekeeping (for an hourly employee) and wage rate information must be collected, (3) a paycheck must be issued to the ghost, and (4) the check must be delivered to the perpetrator or an accomplice. The ghost employee may be a fictitious person or a real individual who simply does not work for the victim employer. When the ghost is a real person, it is often the perpetrator’s friend or relative. In some cases, the ghost employee is an accomplice of the fraudster who cashes the fraudulent paychecks and splits the money with the perpetrator.

Question 51

Which of the following measures should be in place to help prevent check tampering schemes? A. Companies should set up a positive pay system with their bank B. Checks should be mailed immediately after they are signed C. Bank reconciliations should be performed by someone who is NOT an authorized signatory on the account D. All of the above

Answer 51

D. All of the above ## Footnote Companies should work in a cooperative effort with banks to prevent check fraud. Consider the following control measures that might be taken in regard to a firm’s checking accounts: Establish maximum amounts above which the company’s bank will not accept checks drawn against the account. Use positive pay banking controls. Positive pay allows a company and its bank to work together to detect fraudulent items presented for payment. The company provides the bank with a list of checks and amounts that are written each day. The bank verifies items presented for payment against the company’s list. The bank rejects items that are not on the list. Investigations are conducted as to the origin of the “non-listed” items. In addition, the following activities will help tighten controls and possibly deter employees from giving in to the temptation to commit check fraud: Checks should be mailed immediately after signing. Bank reconciliations should not be made by signatories on the account.

Question 52

A forged maker scheme is a check tampering scheme in which an employee intercepts a company check intended for a third party and converts the check by signing the third party’s name on the check’s endorsement line. A. True B. False

Answer 52

B. False ## Footnote Forged endorsement frauds are those check tampering schemes in which an employee intercepts a company check intended for a third party and converts the check by signing the third party’s name on the check’s endorsement line. The person who signs a check is known as the “maker” of the check. A forged maker scheme is defined as a check tampering scheme in which an employee misappropriates a check and fraudulently affixes the signature of an authorized maker thereon.

Question 53

Examples of expense reimbursement schemes include which of the following? A. Listing dinner with a friend as a business development expense B. Listing personal travel as business travel C. Requesting reimbursement for an expense that was never incurred D. All of the above

Answer 53

D. All of the above ## Footnote Employees can manipulate an organization’s expense reimbursement procedures to generate fraudulent disbursements. The four most common types of expense reimbursement schemes are mischaracterized expenses, overstated expenses, fictitious expenses, and multiple reimbursements.

Question 54

Which of the following is an example of a fictitious expense reimbursement scheme? A. An employee submits a receipt for a hotel reservation in one expense report and a copy of his credit card statement reflecting the same reservation in the next period’s expense report. B. An employee alters an electronic receipt using photo editing software to reflect a higher cost than what the employee actually paid. C. An employee who travels frequently on business submits receipts from a hotel stay during a family vacation as a business expense. D. An employee generates a fake receipt using basic computer software and includes it with an expense report.

Answer 54

D. An employee generates a fake receipt using basic computer software and includes it with an expense report. ## Footnote Expense reimbursements are sometimes sought by employees for wholly fictitious items. Instead of overstating a real business expense or seeking reimbursement for a personal expense, an employee just invents a purchase that needs to be reimbursed. One way to generate a reimbursement for a fictitious expense is to create fraudulent support documents, such as false receipts. Using simple computer software, it is easy for employees to create realistic-looking counterfeit receipts at home. These counterfeits are often very sophisticated, even including the logos of the stores in which goods or services were allegedly purchased. Instead of seeking reimbursement for personal expenses, some employees overstate the cost of actual business expenses. This is considered an overstated expense reimbursement scheme. In a multiple reimbursement scheme, an employee submits several types of support for the same expense in order to get reimbursed multiple times. In a mischaracterized expense scheme, an employee requests reimbursement for a personal expense, claiming that it is business related.

Question 55

Jacob was on a business trip in another city. One night, he met up with some friends (unrelated to his work) at an expensive restaurant and paid for the group's entire meal on his credit card, announcing that “the company would pay for it.” He submitted the receipt for the dinner along with the rest of his legitimate business receipts from the trip and described the dinner as “client entertainment.” What type of scheme did Jacob commit? A. A fictitious expense scheme B. An overstated expense scheme C. A mischaracterized expense scheme D. A multiple reimbursement scheme

Answer 55

C. A mischaracterized expense scheme ## Footnote One of the most basic expense reimbursement schemes is perpetrated by simply requesting reimbursement for a personal expense, claiming that it is business related. Examples of mischaracterized expenses include claiming personal travel as a business trip, listing dinner with a friend as “business development” or “client entertainment,” and so on. Fraudsters might submit the receipts from their personal expenses along with their reports and provide business reasons for the incurred costs.

Question 56

Jill is an accountant who needs to satisfy continuing professional education (CPE) requirements throughout the year to maintain her professional license. Her supervisor usually signs off on these requests without paying them much attention or scrutiny. Wanting to use this to her advantage, Jill figures out that it would be easy to copy the image of the logo from a popular CPE provider and generate a receipt using basic computer software. She creates a fraudulent receipt and submits it to her supervisor for reimbursement. What type of scheme is Jill committing? A. Collusion with a supervisor B. A fictitious expense scheme C. A mischaracterized expense scheme D. A multiple reimbursement scheme

Answer 56

B. A fictitious expense scheme ## Footnote Expense reimbursements are sometimes sought by employees for wholly fictitious items. Instead of overstating a real business expense or seeking reimbursement for a personal expense, an employee just invents a purchase that needs to be reimbursed. One way to generate a reimbursement for a fictitious expense is to create fraudulent support documents, such as false receipts. Using simple computer software, it is easy for employees to create realistic-looking counterfeit receipts at home. These counterfeits are often very sophisticated, even including the logos of the stores in which goods or services were allegedly purchased.

Question 57

Which of the following is a red flag of fraudulent register disbursements? A. There are multiple refunds or voids just under the review limit B. Voided transactions are not properly documented or approved by a supervisor C. Personal checks from cashiers are found in the register D. All of the above

Answer 57

D. All of the above ## Footnote Red flags of fraudulent register disbursements include the following: Inappropriate separation of duties exists. Cashiers, rather than supervisors, have access to the control keys necessary for refunds and voids. Register employees have the authority to void their own transactions. Register refunds are not carefully reviewed. Multiple cashiers operate from a single cash drawer without separate access codes. Personal checks from cashiers are found in the register. Voided transactions are not properly documented or approved by a supervisor. Voided cash receipt forms (manual systems) or supporting documents for voided transactions (cash register systems) are not retained on file. Gaps exist in the sequence of transactions on the register log. There is an excessive number of refunds, voids, or no-sales on the register log. Inventory totals appear forced. There are multiple refunds or voids for amounts just under the review limit.

Question 58

Which of the following statements is TRUE regarding a fictitious refund scheme? A. The victim company’s inventory is understated B. Inventory is returned to the store C. The amount of cash in the register balances with the register log D. All of the above

Answer 58

C. The amount of cash in the register balances with the register log ## Footnote In a fictitious refund scheme, an employee processes a transaction as if a customer were returning merchandise, even though no actual return takes place. The register log balances with the amount of cash in the register because the money that was taken by the fraudster is supposed to have been removed and given to the customer as a refund. Instead, however, the employee keeps this cash. The second thing that happens in a fictitious refund scheme is that a debit is made to the inventory system showing that the merchandise has been returned. Since the transaction is fictitious, no merchandise is actually returned. The result is that the company’s inventory is overstated.