Asset Misappropriation and Skimming

Skimming is often described as an off-books fraud because the cash intercepted never appears in the accounting records at all. A cashier who accepts payment from a customer but does not ring the sale, a billing clerk who accepts a customer's cash payment and deposits only a portion while pocketing the rest, and an accounts-receivable employee who intercepts a cheque and destroys the remittance advice are all running skimming schemes.

Because the entry is never made, a standard ledger reconciliation will not reveal the theft. The detection methods must come from outside the books: comparing register tapes to cash counts, comparing expected revenue (from customer count data, transaction volumes, or industry benchmarks) to recorded revenue, or relying on customer complaints about payments that were not credited to their accounts.

• Sales skimming: intercepting cash at the point of sale before recording. Detected by surprise cash counts, surveillance, or comparison of physical transaction count to registered sales.
• Receivables skimming: intercepting customer payments before posting to the accounts. Detected by lapping patterns, customer statements, and direct customer confirmation.
• Mail skimming: intercepting cheques or cash from incoming mail before they reach the cashier. Requires access to incoming mail and is usually associated with small organisations lacking mailroom controls.

Fraudulent disbursement schemes use the organisation's own payment machinery to send money to the perpetrator or an accomplice. Because the payment is processed through normal channels, it appears in the books as a legitimate expense. The fraud is in the substance, not the form, of the payment.

Billing schemes are the most common fraudulent disbursement type. The simplest version creates a shell company in the perpetrator's name, registers it in the vendor master file, submits invoices for goods or services never provided, and approves and processes the payment. More sophisticated versions involve real vendors whose invoices are inflated, with the perpetrator receiving a kickback from the vendor.

Payroll fraud takes several forms. Ghost employees are the most studied: a fictitious person or a departed employee whose payroll entry was not terminated continues receiving wages that are diverted to the perpetrator. Commission fraud involves inflating sales figures to generate excess commission payments. Timesheet fraud involves claiming hours not worked. The ACFE data consistently shows payroll schemes have a longer average duration before detection than billing schemes, often running for several years.

Non-cash misappropriation covers any theft of organisational assets other than cash and monetary instruments. The most common forms are inventory theft and the misuse of equipment, vehicles, and other physical property. Less visible but increasingly significant is the theft of proprietary information and intellectual property.

Inventory theft is often detected through periodic physical counts compared against book inventory records. The investigation task is distinguishing genuine theft from breakage, shrinkage, and recording errors, all of which also produce discrepancies. Consistent discrepancies in specific locations, specific product categories, or specific shifts point toward theft rather than systemic error.

Internal controls against asset misappropriation fall into two categories: preventive controls that make the scheme harder to execute, and detective controls that surface it after it has begun. Both are necessary: preventive controls can be overridden by colluding employees or management, and detective controls that are only applied annually may allow a scheme to run for a year before detection.

• Segregation of duties: split the authorise, record, and custody functions. No single person should be able to approve a payment, record it, and reconcile the bank account.
• Physical controls: locked cash drawers, access-controlled inventory areas, fixed-asset tagging, and vehicle tracking.
• Surprise cash counts: unannounced counts compare physical cash to the register balance at random intervals. Predictable counting schedules allow perpetrators to replace stolen cash for the count.
• Independent bank reconciliation: reconciliation performed by someone who did not process payments, with review of original cancelled cheques or bank images rather than the company's own records.
• Vendor master controls: approval process for adding new vendors; periodic comparison of vendor addresses, telephone numbers, and bank accounts against employee data.
• Payroll controls: independent headcount verification; mandatory holiday policies (many payment schemes require the perpetrator to be present to maintain the fraud); direct deposit to verified employee accounts.

The ACFE data consistently shows that organisations with fewer controls have higher median fraud losses and longer fraud durations. The cost of basic preventive controls, particularly segregation of duties in small finance teams, is frequently cited as a barrier in small and medium organisations, but the cost of a single undetected fraud typically exceeds the annual cost of the control many times over.

Data analytics has become the primary tool for asset-misappropriation detection in large organisations. The central advantage is coverage: manual review of a representative sample of transactions can miss a scheme that affects only a small percentage of payments. Analytics can examine the entire population.

• Duplicate payment testing: matching invoice number, vendor, and amount across all payment records to find duplicate submissions.
• Round-number testing: filtering for payments ending in .00 or .50, which human-created fictitious invoices favour over the irregular amounts of genuine commerce.
• Vendor-employee match: comparing vendor master addresses, phone numbers, tax IDs, and bank accounts against employee records to find shell companies in employees' names.
• Benford's Law on expense claims: first-digit analysis of expense claim amounts. Human-chosen numbers below a reimbursement threshold (such as $25) cluster unnaturally because the perpetrator chooses amounts to stay under approval limits.
• Sequence gaps and duplicates: invoice sequence gaps suggest missing invoices; duplicate sequences suggest fabricated ones.