Asset Misappropriation and Skimming

Skimming is an off-books fraud: the intercepted cash never appears in the accounting records. A cashier who accepts payment but does not ring the sale, a billing clerk who deposits only part of a cash payment and pockets the rest, and an accounts-receivable employee who intercepts a cheque and destroys the remittance advice are each running a skimming scheme.

Because no entry is ever made, ledger reconciliation cannot reveal the theft. Detection requires evidence outside the books: register tapes compared to cash counts, expected revenue benchmarks compared to recorded revenue, or customer complaints about payments not credited to their accounts.

• Sales skimming: intercepting cash at the point of sale before recording. Detected by surprise cash counts, surveillance, or comparison of physical transaction count to registered sales.
• Receivables skimming: intercepting customer payments before posting to the accounts. Detected by lapping patterns, customer statements, and direct customer confirmation.
• Mail skimming: intercepting cheques or cash from incoming mail before they reach the cashier. Requires access to incoming mail and is usually associated with small organisations lacking mailroom controls.

Fraudulent disbursement schemes direct the organisation's own payment process to send money to the perpetrator or an accomplice. The payment appears in the books as a legitimate expense; the fraud lies in the substance of the transaction, not its form.

Billing schemes are the most common fraudulent disbursement type. The simplest version creates a shell company in the perpetrator's name, registers it in the vendor master file, submits invoices for goods or services never provided, and approves and processes the payment. More sophisticated versions involve real vendors whose invoices are inflated, with the perpetrator receiving a kickback from the vendor.

Payroll fraud takes several forms. Ghost employees are the most studied: a fictitious person or a departed employee whose payroll entry was not terminated continues receiving wages that are diverted to the perpetrator. Commission fraud involves inflating sales figures to generate excess commission payments. Timesheet fraud involves claiming hours not worked. The ACFE data consistently shows payroll schemes have a longer average duration before detection than billing schemes, often running for several years.

Non-cash misappropriation covers theft of any organisational asset other than cash or monetary instruments. The most common forms are inventory theft and misuse of equipment, vehicles, and physical property. Theft of proprietary information and intellectual property is less visible but increasingly significant.

Inventory theft is typically detected through periodic physical counts compared against book records. The core investigation task is separating genuine theft from breakage, shrinkage, and recording errors, all of which produce discrepancies. Consistent shortfalls concentrated in a specific location, product category, or shift are more indicative of theft than of systemic error.

Internal controls against asset misappropriation fall into two categories: preventive controls that make a scheme harder to execute, and detective controls that surface it once under way. Both are necessary. Preventive controls can be overridden by colluding employees or management; detective controls applied only annually may allow a scheme to run for a full year before detection.

• Segregation of duties: split the authorise, record, and custody functions. No single person should be able to approve a payment, record it, and reconcile the bank account.
• Physical controls: locked cash drawers, access-controlled inventory areas, fixed-asset tagging, and vehicle tracking.
• Surprise cash counts: unannounced counts compare physical cash to the register balance at random intervals. Predictable counting schedules allow perpetrators to replace stolen cash for the count.
• Independent bank reconciliation: reconciliation performed by someone who did not process payments, with review of original cancelled cheques or bank images rather than the company's own records.
• Vendor master controls: approval process for adding new vendors; periodic comparison of vendor addresses, telephone numbers, and bank accounts against employee data.
• Payroll controls: independent headcount verification; mandatory holiday policies (many payment schemes require the perpetrator to be present to maintain the fraud); direct deposit to verified employee accounts.

The ACFE data consistently shows that organisations with fewer controls have higher median fraud losses and longer fraud durations. The cost of basic preventive controls, particularly segregation of duties in small finance teams, is frequently cited as a barrier in small and medium organisations, but the cost of a single undetected fraud typically exceeds the annual cost of the control many times over.

Data analytics is the primary detection tool in large organisations because it can examine an entire transaction population. Manual review of a representative sample may miss a scheme that affects only a small percentage of payments.

• Duplicate payment testing: matching invoice number, vendor, and amount across all payment records to find duplicate submissions.
• Round-number testing: filtering for payments ending in .00 or .50, which human-created fictitious invoices favour over the irregular amounts of genuine commerce.
• Vendor-employee match: comparing vendor master addresses, phone numbers, tax IDs, and bank accounts against employee records to find shell companies in employees' names.
• Benford's Law on expense claims: first-digit analysis of expense claim amounts. Human-chosen numbers below a reimbursement threshold (such as $25) cluster unnaturally because the perpetrator chooses amounts to stay under approval limits.
• Sequence gaps and duplicates: invoice sequence gaps suggest missing invoices; duplicate sequences suggest fabricated ones.