End of Chapter Material

Chapter 5

ANSWER KEY – CHAPTER 5 END OF CHAPTER MATERIAL

CRITICAL THINKING

CT-1 The Butcher. A clerk in the butcher shop is 5’ 10” tall. What does he weigh?

Answer: meat

CT-2 The 3rd word in … the English Language. Think of words ending in –GRY. Angry and hungry are two
of them. There are only three words in the English language. What is the third word? (Hint: The word is
something that everyone uses every day. If you have read carefully, I have already told you what it is.)

Answer: the third word in “the English language” is language. For this critical thinking exercise, the
student must focus on the question, and the hint, and not be distracted by irrelevant information.
The first two sentences are irrelevant.

REVIEW QUESTIONS

5-1. What are the five major categories of fraudulent disbursements?

Answer: Fraudulent disbursements include: billing schemes, check tampering, payroll schemes, expense
reimbursement schemes, and register disbursements.

5-2. What is a shell company and how is it formed?

Answer: Shell companies are fictitious entities created for the purpose of committing fraud. The entity may
be nothing more than a fabricated name and a post office box that an employee uses to collect
disbursements from false billings. However, since the checks received will be made out in the name of the
shell company, the perpetrator will normally also set up a bank account in his new company’s name, listing
himself as an authorized signer on the account.

In order to open a bank account for a shell company, a fraudster will probably have to present the bank
with a certificate of incorporation or an assumed-name certificate. In more sophisticated economies, most
often that shell company is registered at the state level (State Secretary of State’s Office) and has a federal
tax identification number. Both items are required in the United States to open a business bank account.

A more effective way for a fraudster to hide the connection to a false company is to form the company
under a fictitious name. The other issue involved in forming a shell company is the entity’s address—where
fraudulent checks will be collected. Often, an employee rents a post office box and lists it as the mailing
address of his shell company. One reason employees might be hesitant to use post office boxes in shell
company schemes is that some businesses are especially wary of sending checks to vendors that do not
have street addresses (in addition to a post office box address). For this reason, fraudsters may use the
address of a relative, friend, or accomplice as a collection point for fraudulent checks.

5-3. How do pay-and-return schemes work?

Answer: In pay-and-return schemes employees intentionally mishandle payments that are owed to the
legitimate vendors. One way to accomplish this is to double-pay an invoice, and then request that the
recipient return one of the checks. The fraudster intercepts the returned check and then deposits it into his
own bank account.

5-4. What are the five principal categories of check tampering?

Answer: The five principal categories of check tampering include: forged maker, forged endorsement,
altered payee, concealed checks, and authorized maker schemes.

5-5. What are the differences between forged maker and forged endorsement schemes?

Answer: Both forged maker and forged endorsement schemes involve the false signing of another person’s
name on a check, however, in a forged maker scheme, the perpetrator is normally working with a blank
check. The trick to this kind of scheme is in gaining access to blank checks and producing a signature that
appears authentic.

In a forged endorsement scheme, the perpetrator is tampering with a check that has already been written,
so the key to these schemes is obtaining the checks after they are signed but before they are properly
delivered. If this is accomplished, the actual forging of the endorsement is somewhat secondary.

5-6. How can theft and alteration of outgoing company checks be prevented and detected?

Answer: It is very important that the functions of writing checks, signing checks, and delivering checks be
separated. If a check preparer is also allowed to have custody of signed checks, it is easy to commit check
tampering. The individual can draft a check for a fraudulent purpose, wait for it to be signed, and simply
pocket it. However, if the individual knows he or she will not see the check after it has been signed, then
that person is less likely to attempt this kind of scheme because of the diminished perceived opportunity
for success.

Organizations should also train employees to look for this kind of scheme and should establish routine
procedures designed to help detect check theft and alteration, if and when it occurs.

If an employee steals a check payable to a vendor and does not issue a replacement, the vendor will almost
certainly complain about the nonpayment. This is the point at which most forged endorsement schemes
may be detected. Every organization should have a structure in place to handle both vendor and customer
complaints. All complaints should be investigated by someone independent of the payables function so
that the fraudster will not be able to cover her own tracks.

Some employees who steal outgoing checks will cause a replacement check to be issued so that the vendor
will not complain. In order to detect these schemes, an organization’s accounting system should be set up
to detect duplicate payments of invoices. Paid vouchers should immediately be stamped “paid” and
computerized systems should automatically flag duplicate invoice numbers. In addition, payables reports
sorted by payee and amount should be periodically generated in order to detect duplicates when invoice
numbers have been altered for the second check.

Instead of stealing checks on the company premises, some employees will cause them to be mis-delivered
by changing the mailing address of the intended recipient in the organization’s payables system. For this
reason, authority to make changes to vendor records should be restricted, user names and passwords
protected and the organization’s accounting system should automatically track who makes changes to
vendor records.

To convert an intercepted check, the perpetrator may have to use a dual endorsement. Any canceled
checks with more than one endorsement should be investigated, as should any non-payroll check that an
employee has endorsed.
Another procedure that all organizations should have in place is to chart the date of mailing for every
outgoing check. In the event that a signed check is stolen, the date of mailing can be compared to work
records of mailroom personnel and other employees who have contact with outgoing checks to determine
a list of possible suspects.

Finally, organizations should consider installing surveillance cameras in their mail-rooms. Mailroom
personnel are in a good position to steal outgoing checks, and also to skim incoming revenues or
merchandise shipments. If a theft is discovered, security camera tapes or digital files may help identify the
wrongdoer. More importantly, the presence of surveillance cameras can help deter employees from
stealing.

5-7. What is a ghost employee and what are the four steps needed to make this scheme work?

Answer: The term ghost employee refers to someone on the payroll who does not actually work for the
victim company. In order for a ghost employee scheme to work, four things must happen: (1) the ghost
must be added to the payroll, (2) timekeeping and wage rate information must be collected, (3) a paycheck
must be issued to the ghost, and (4) the check must be delivered to the perpetrator or an accomplice.

5-8. How do employees overstate legitimate expenses on their expense reports?

Answer: Some employees overstate the cost of actual business expenses by altering their receipts, over-
purchasing business expenses, or overstating another employees expenses and pocketing the excess. In
some cases, an employee may falsify the expense report at the direction of a supervisor (the perpetrator).

5-9. What red flags are commonly associated with fictitious expense schemes?

Answer: There are a number of red flags that may indicate an employee is seeking reimbursement for
fictitious travel and entertainment expenses. One of the most common is the employee who claims items
—particularly high-dollar items—were paid with cash. Other common red flags include the following:

• Expenses that are consistently rounded off, ending with a “0” or a “5,” which tends to indicate that
the employee is fabricating the numbers.
• Patterns in which expenses are consistently for the same amount (i.e., a salesperson’s business
dinners always cost $120).
• Reimbursement requests from an employee that consistently fall at or just below the organization’s
reimbursement limit.
• Receipts from a restaurant that are submitted over an extended period of time, yet are
consecutively numbered. This tends to indicate that the employee has obtained a stack of blank receipts
and is using them to support fictitious expenses.
• Receipts or other support that does not look professional or lacks relevant information about the
vendor, such as phone numbers, physical addresses, logos, contact email addresses, web addresses, etc.

5-10. How do fraudulent disbursements at the cash register differ from other register frauds?

Answer: When money is taken from a register in a skimming or larceny scheme, there is no record of the
transaction; the money is simply missing.

Fraudulent disbursement schemes differ from the other register frauds in that, when money is taken from
the cash register, the removal of money is recorded on the register tape. A false transaction is recorded as
though it were a legitimate disbursement to justify the removal of money (e.g., fictitious void or falsified
refund).
MULTIPLE CHOICE QUESTIONS

1. Which of the following is not one of the five major categories of fraudulent disbursements?
A. Payroll schemes.
B. Expense reimbursement schemes.
C. Shell company schemes.
D. Billing schemes.

Answer: C. A shell company may be incorporated in billing scheme, but it is not a separately identified
fraud.

2. Which of the following is the first step to form a shell company?

A. Obtain a certificate of incorporation from the state.
B. Open a bank account.
C. Obtain a tax identification number.
D. File the company by-laws at the local court house.

Answer: A. Registering the shell company with the state is usually the first step, followed by the tax
identification number. The establishment of a bank account is typically the final step.

3. Which of the following is an integral step in a pay-and-return scheme?

A. Establish a shell company.
B. Misappropriate the incoming check related to returned goods and deposit the check in a
bank account other than the company’s.
C. Purchase legitimate goods that are paid by the organization and return them.
D. Adjust the legitimate good inventory to conceal the shortage related to the returned
goods.

Answer: C. While the answer is not complete, this is the best answer consistent with a pay-and-return
scheme. Upon return, the perpetrator needs to ensure that any refunded money ends up not going to the
organization but rather to the perpetrator.

4. Which of the following is one of the five principal categories of check tampering?
A. Creation of a check for a ghost employee.
B. Creation of a check payable to a shell company.
C. Creation of a check to an employee for fictitious travel expenses.
D. Creation of a check and altering the payee after the check is signed.

Answer: D. Answer A is a payroll disbursement scheme. Answer B is a billing scheme. Answer C is an

expense reimbursement scheme.

5. Which of the following is indicative of the actions of the forged maker perpetrator?
A. Issues two checks for the same invoice and get both signed by an authorized signatory.
B. Issues two checks for the same invoice and fraudulently signs and cashes the second
check.
C. Issues two checks for the same invoice and runs both through the automatic check- signing
machine.
D. Issues two payroll checks to himself and gets both signed by an authorized signatory.

Answer: B. Both answers B and C involve the perpetrator creating the check but with the forged maker,
generally the perpetrator also signs the check. As such, answer B is the best answer.
6. Which of the following is not a method to deter, prevent and detect the theft and alteration of
outgoing accounts payable checks?
A. Identify vendors with no mailing address or phone number.
B. Identify vendors with a mailing address that matches an employee’s address.
C. Hand each paycheck to the employee while checking appropriate identification.
D. Identify, review and summarize all manual checks not created through the accounts
payable system.

Answer: C. Answer C is a deterrence and detection method for payroll disbursement fraud, not applicable
to accounts payable.

7. For a ghost employee, which of the following is not one of the four primary steps needed to make
this scheme work?
A. Delivery of the paycheck to the ghost.
B. Input a valid home address for the ghost.
C. Adding the ghost to the payroll records.
D. Creating timekeeping information for the ghost.

Answer: B. Any address for the ghost facilitate the scheme. Since the ghost doesn’t exist, the ghost has no
valid address.

8. Which of the following is not a typical method that employees use to overstate legitimate
expenses on their expense reports?
A. Creating receipts.
B. Purchase an item at an inflated price and request reimbursement at that price while
obtaining a vendor refund.
C. Purchasing more quantity than is necessary and requesting reimbursement.
D. Altering the delivery paperwork for inventory receipts at the warehouse.

Answer: D. Answer D is more consistent with a billing scheme.

9. Which of the following red flags is commonly associated with fictitious expense reimbursement
schemes?
A. Patterns when expense reimbursements are for the same amount.
B. Ghost employees receiving expense reimbursements.
C. Cash disbursements where the cancelled checks have been altered.
D. Billing errors from a problem vendor.

Answer: A. Answer A is the only option associated with expense reimbursement: Answer B is a payroll
disbursement fraud; Answer C is concealment method for a billing scheme; Answer D is a potential red flag
for a billing scheme.

10. Which of the following red flags is seldom associated with cash register disbursement frauds?
A. Excessive voids.
B. Un-cashed personal checks in the cash drawer received from employees.
C. Excessive customer refunds.
D. Higher than expected uncollectible receivables.

Answer D. Cash register disbursement frauds may impact the credit card receivable but are generally more
closely associated with voids and refunds. A personal check may be used to cover-up cash missing from the
register drawer.
FRAUD CASEBOOK
Adelphia: A Family Affair

Please identify and review the following:

Complete an Internet search using the terms: Adelphia fraud, Rigas, 2002. Choose one detailed news
article for reading.

Securities and Exchange Commission, Litigation Release No. 17627 and Accounting and Auditing
Enforcement Release No. 1599, July 24, 2002.

McClam, Erin, “Adelphia Founder Sentenced to 15 Years,” Associated Press / Yahoo! News, June 20,
2005

Summary and Solutions to Discussion Questions

Adelphia, founded in 1952 by John Rigas to diversify against declining revenues in his movie theaters, was a
cable television company headquartered in Coudersport, Pennsylvania. While the company went public in
1986, the Rigas family retained control over Adelphia through their exclusive ownership of Adelphia's Class
B shares that were convertible into the company’s Class A stock. Whenever Adelphia issued Class A shares
to the general public, Adelphia would make a corresponding award of Class B shares to the Rigas family so
that the Rigases' ownership and majority voting interests would not be diluted. In addition to their
controlling ownership of Adelphia, the Rigas family held five of nine seats on Adelphia's board of directors.
Rigas family members involved in Adelphia included John (Founder, Chairman and CEO), son Tim (CFO), son
Michael (EVP), son James (EVP) and Son-in-law Peter Venetis, all of whom were Board members.

Members of the Rigas family also owned other private companies ("Rigas Entities"). Adelphia used its own
personnel, inventory, trucks, and equipment to provide services to the customers of these companies. One
cause of considerable confusion was that Adelphia, its subsidiaries, and the Rigas Entities shared a
centralized treasury system organized using cost centers, in which the cash balances of each company were
separately maintained. Adelphia charged a fee for providing the Rigas Entities management, accounting,
and other services.

By 2000, Adelphia was the 6th largest cable television and telecommunications service provider in the
United States. Similar to WorldCom, Adelphia had grown through acquisition of other cable companies.
Presumably to cover the purchase prices of the acquisitions, Adelphia's debt increased significantly.
Between 1996 and 2000, Adelphia, its subsidiaries, and some Rigas Entities entered as co-borrowers into a
series of credit agreements. By 1999, Adelphia and the Rigas Entities were indebted by more than $1
billion. In 2000, they tripled their outstanding credit obligations.

In January 2002, following the collapse of Enron, the Securities and Exchange Commission released
guidance clarifying the disclosures that issuers should consider making with respect to related party
transactions. In an effort to comply with the reporting requirements, Adelphia disclosed for the first time
the extent of the Rigas Entities' co-borrowed debt. The disclosure alarmed investors and analysts and
Adelphia's board of directors initiated a formal investigation. The findings included the previously
undisclosed related party transactions as well as alleged accounting irregularities.

The Securities and Exchange Commission alleged that the company via its founder, John Rigas, his three
sons (Timothy, Michael, and James), and two executives, James Brown and Michael Mulcahey, committed
the following fraudulent acts:

• Between mid-1999 and the end of 2001, Adelphia fraudulently excluded from the Company's
annual and quarterly consolidated financial statements over $2.3 billion in bank debt by deliberately
shifting those liabilities onto the books of Adelphia's off- balance sheet, unconsolidated affiliates. Failure to
record this debt on Adelphia’s books violated GAAP requirements and laid the foundation for a series of
misrepresentations about those liabilities by Adelphia, the Rigas’, Brown and Mulcahey, including the
creation of: (1) sham transactions backed by fictitious documents to give the false appearance that
Adelphia had actually repaid debts when, it had simply shifted them to unconsolidated Rigas-controlled
entities, and (2) misleading financial statements by giving the false impression through the use of footnotes
that liabilities listed in the Company's financials included all outstanding debts.

• Timothy and Michael Rigas and James Brown made repeated false statements in press releases,
earnings reports, and SEC filings about Adelphia's performance in the cable industry by inflating: (1)
Adelphia's basic cable subscriber numbers; (2) the extent of Adelphia's cable plant "rebuild" or upgrade;
and (3) Adelphia's earnings. Each of these represents a key performance metric by which Wall Street
evaluates cable companies.

• Since at least 1998, Adelphia had made fraudulent misrepresentations and omissions of material
facts to conceal extensive self-dealing by the Rigas Family. Such self-dealing included the use of Adelphia
funds to finance undisclosed open market stock purchases by the Rigas Family, purchase timber rights to
land in Pennsylvania, construct a golf club for $12.8 million, pay off personal margin loans ($250 million)
and other Rigas Family debts, and purchase luxury condominiums in Colorado, Mexico, and New York City
for the Rigas Family.

Adelphia's stock price declined from about $30 per share in January 2002 to $0.30 per share in June 2002,
and the stock was delisted from the Nasdaq market. Adelphia filed for bankruptcy under Chapter 11 in
June 2002.

At the age of 80, John Rigas was sentenced to 15 years in prison. Nevertheless, before the sentencing, John
Rigis, the family patriarch, stated that “in my heart and conscience, I’ll go to my grave believing truly that I
did nothing but try to improve conditions. John’s son Timothy, the company’s CFO, was sentenced to 20
years in prison at age 48. In contrast, James Rigas was never formally charged with criminal violations
while Michael Rigas and Michael Mulcahey were not convicted. At the height of the fraud, when Timothy
discovered the extent of the problems, by some accounts, he limited John’s spending to a mere $1 million
per month.

Short Answer Questions

1. Why was Adelphia cable company formed?

2. In what year was the original company formed?
3. In what year did Adelphia go public?
4. How many Rigas-related parties were in executive leadership roles at Adelphia?
5. In what month and year did Adelphia file for bankruptcy?
6. For how many years was John Rigas sentenced to prison?

Answers to Short Answer Questions

1. As an off-set to declining movie theater revenues

2. 1952
3. 1986
4. Five
5. June 2002
6. 15 years

Discussion Questions
1. In addition to financial reporting fraud, what other types of asset misappropriation schemes were
perpetrated by the Rigas family members?
2. Discuss why collusive frauds, especially when perpetrated among related parties, is particularly
difficult to detect?
3. List five symptoms of fraud that Adelphia exhibited and explain the reasoning for your choices?

Answers to Discussion Questions can be found within the Fraud Casebook Summary.

BRIEF CASES

1. Assume that your data analytics examination related to employee records resulted in the following
summary table a employees with annual salaries greater than $75,000:

Employee Social Employee Address Salary

Name Security
Bill Smithbob 288-47-1624 127 Discovery Place, Johnsonville, PA 15243 $125,000
Jenny Gump 412-85-1524 54320 University Avenue, Johnsonville, PA 15244 $80,000
Clare Johnson 666-54-7430 12 Scenery Johnsonville, PA 15243 $150,000
Andrew Samuel 856-47-5234 785 Summertime Way, Johnsonville, PA 15243 $75,000
sunny day 999-99-9999 Weirton, PA 15243 $99,999

Assume that your data analytics examination related to the A/P vendor master file resulted in the
following summary table for vendors with annual disbursements greater than $250,000:

Vendor Name Contact Address Phone # Website

DGL, LLC Doug Landau 1234 Willey Street, Johnsonville, PA 15243 412-581-6802 Yes
Marriott Motels none PO Box 2701, Johnsonville, PA 15243-2701 None none
John’s Plumbing John Carter 523 Chambers St, Johnsonville, PA 15243 412-792-2578 Yes
BSB Supply House Wendy Bob 127 Discovery Place, Johnsonville, PA 412-581-1102 none
15243
Johnsonville Water none 1 Water Street, County Courthouse, 412-824-water Yes
& Sewer, Inc Johnsonville, PA 15243

Case Discussion:
a. Given this fact pattern, identify up to four anomalies that might be consistent with a red flag
associated with fraudulent disbursements, if any, and describe your rationale?
b. Given your answer in case discussion “a,” rank order those in terms of risk and discuss the rationale
for your ranking.

Solution:

Rank #1 – Bill Smithbob and BSB Supply house share the same mailing address.
Bill Smithbob 288-47-1624 127 Discovery Place, Johnsonville, PA 15243
BSB Supply House Wendy Bob 127 Discovery Place, Johnsonville, PA 412-581-1102 None
15243

Rank #2 – sunny day is a possible ghost employee. Red flags include an unusual name, lower case spelling,
fake social security number, no mailing address and an unusual salary amount, just below $100,000.
sunny day 999-99-9999 Weirton, PA 15243 $99,999

Note: BSB Supply is ranked above the potential ghost employee only because the vendor expenditure is
greater than $250,000, exceeding sunny day’s salary of $99,999.
Rank #3 – This vendor has a name similar to Marriott Hotels, has no contact, phone number or website.
Marriott Motels none PO Box 2701, Johnsonville, PA 15243-2701 None none

Possible Rank #4 – While this vendor has no contact, the name, address, phone number and website offer
legitimacy. A call to the vendor can efficiently and effectively identify whether this is an anomaly.
Johnsonville Water none 1 Water Street, County Courthouse, 412-824-water Yes
& Sewer, Inc Johnsonville, PA 15243

2. Assume that the following store employees earn 100% of their payroll income from commissions. All
sales have commissions associated with them. Further assume that your data analytics examination of
store # 1246 cash registers yielded the following summary:

# sales
Employee Name transactions # voids # refunds
James Smith 2,000 25 (1.3%) 10 (0.5%)
Robbin Mead 200 15 (7.5%) 10 (5.0%
Glen Biwen 1,000 10 (1.0%) 5 (0.5%)
Ken Mason 3,000 35 (1.2%) 90 (3.0%)
William Close 1,100 10 (0.9%) 10 (0.9%)

Store 5-year average

– per employee 1,250 15 (1.2%) 8 (0.64%)

a. Case Discussion: Given this fact pattern, which employee’s register data might be consistent with a
red flag associated with fraudulent cash register disbursements, if any, and describe your
rationale?
b. Given your answer in case discussion “a,” rank order those in terms of risk and discuss the rationale
for your ranking.

Solution:
Rank #1 – Ken Mason has high transaction numbers and high refund percentages compared to the store 5-
year per employee average. This might suggest that he is creating fake sales to earn higher commissions
and when customers complain, he refunds the sales.

Rank #2 – Robbin Mead has low transaction numbers and very high void and refund percentages compared
to the store 5-year per employee average.

MAJOR CASE INVESTIGATION

The following is the “inventory” of items received to continue the examination at Johnson Real Estate. In
this chapter, the goal is to focus on the missing deposits: who, what, when, where and how.

 Probable Cause Memo

 Joan Rogers Premium Bank Account
o Bank statements
o Disbursements Summary
 Memorandum – Joan Rogers Bank Deposits
These items will be provided by the course instructor.

Assignment:
Continuing to focus on evidence associated with the act, concealment and conversion, use the evidentiary
material to continue the investigation. In addition, as the examiner also start to think of terms of who,
what (did the person(s) do), when (during what period?), where (physical place, location in books and
records) and how (perpetrated, hidden and did the perpetrator benefit). Your primary assignment is to
examine the information and activity in Joan Roger’s bank data in terms of what (scheme), how was the act
be perpetrated and what benefits are there, if any. As with any data, consider patterns, breaks in patterns
and anomalies. Your focus is what you can conclude from the evidence, understanding that cases are
solved, not with an all-telling piece of evidence, the “smoking gun,” but rather by assembling small pieces
of evidence into a coherent picture.

Solution:

Based on the results of evidence provided in the prior chapters (and corresponding analysis), the prosecutor
determined that probable cause requirements had been met and issued a subpoena for Joan Rogers’ bank
account information from her bank. This is a good time to discuss the threshold for probable cause which
tends to be a lower standard than most students believe.

Case Dataset No. 2 contains two primary pieces of data Joan Roger’s bank information: bank statements
and cancelled checks.

From this bank data, the students should observe the following:

1. Joan Rogers’ bank account data has a clear and distinct pattern that changes:
(a) Initially, her bank has little activity. On the January-June statements she received two
deposited, each $969.22.
(b) It appears that most of her Johnson Real estate earnings are “swept” into some type of
family bank account, leaving her with very little spending money. $819 or approximately
85% is transferred to her family and she has very little discretionary money to spend on
herself.
(c) Starting in July, 20X8, a mysterious $2,000 deposit appears in Jan Rogers’ checking
account, at which time Joan Rogers’ spending habits changes and payments for motels and
other unusual items appear in the bank records. This is just after a $2,000 check (#1307) is
written to Longshore for “furniture.” The students should provide a detailed analysis of
changes in her spending habits – both in amount and in type of expenditure.
(d) Starting in March, 20X9, the mysterious deposits continue but the amount increases
and varies by month. This increase is the approximate amount of the JRE monthly fraud.
See CDS-2b Commissions – Memo – Solution
(e) The mysterious deposits peak at $5,000 per month before dropping back down to
$2,000 per month in November and December, 20X9.
(f) the students will discover in Case Dataset #3 that the mysterious deposits apparently
came from a company called “Hume trucking and Hauling.”

2. Given the prior relationship between Joan Rogers and Hume Trucking and Hauling (se Joan Rogers’
background report), the evidence suggests that Hume may be the source of the mysterious
deposits. Further, given that the missing Jonson Real Estate commission dollars start near the time
that Joan Rogers’ spending habits change, a hypothesis that Joan Rogers may have stolen money
from company deposits should be carried forward. Some of the other alternative hypotheses may
have been discredited. The null hypothesis that no crime was committed should be carried through
the conclusion of the investigation.
IDEA Exercises
Assignment 5

Case Background: See Chapter 1.

Question. Does Fairmont have any duplicate payroll records?

1. Select the “Payroll for Contactors” data tab

2. Select “Analysis”
3. Select “Duplicate Key” down-arrow located in the “Explore” box
4. Select “Detection”
5. In the “File Name” box, type “Duplicate Payroll”
6. Click on “Key” (red box)

7. “Record” is the unique identifier for payroll disbursements. It has already been identified in the
“Field” box

8. Click “OK”
9. Click “OK”

Student Task: Students should (a) present a listing of any duplicate payroll disbursements and (b)
discuss the finding and recommend investigative next steps.
The results (solution):

Duplicate payroll disbursements records were identified for only one administrative employee, Carrie
Rutten who should not be paid via the contractor payroll. Further, Ms. Rutten is a general accountant
with no payroll duties, responsibilities nor authority. Thus, this anomaly requires further examination.
Further, the non-compliance has been charged to one client, client 10008 who has complained about
the amount of charges from Fairmont.
Tableau Exercises

Assignment 5

Case Tableau Background: See Chapter 1.

The forensic audit has revealed that Fairmont has one employee (Carrie Rutten) that has been paid twice
on the same date for the exact number of hours and appear to be duplicate payroll disbursements.

Question. Can you present a graphic of duplicate payroll disbursements that includes the person’s name,
the dates on which duplicate payments were made and the count (number of payments on that date)?

1. Click on a sheet “+” to create a new worksheet

2. Right-click on the new, duplicate worksheet and change the name to “Duplicate Payroll”
3. Drag “A Emp” to the Columns shelf
4. Drag “Gross” to the “Rows shelf
5. Click on the “Emp” = 0 Bar and click on “Exclude”
6. Drag “LastName” to Columns shelf

7. Right-click on “Alexan” and click “Exclude”

8. Right-click on “Perez” and click “Exclude”
9. Drag “Date” from Dimensions and drop on the Rows shelf
10. In the Row shelf, click on the down-arrow for “YEAR(Date)” and click on “More”
11. Click on “Custom”, then select “Month / Day / Year”
12. Drag “Hours” to the Columns shelf and drop
13. Click on the down-arrow for “Hours” on the Columns shelf and select “Measure”
14. Click on “Count”
15. Click on the down-arrow for “Automatic” below “Marks” and change to “Circles”

Student Task: Students should (a) present the graphic of any duplicate payroll disbursements including
the person’s name, the dates on which duplicate payments were made and the number of payments
on that date (b) discuss the finding and recommend investigative next steps.

The results (solution):

Note: The red squares reflect the dates with duplicate payroll disbursements and the name of the
employee, Rutten, and the count that is equal to two (2).

Duplicate payroll disbursements records were identified for one employee, Carrie Rutten. Ms. Rutten is
a general accountant with no payroll duties, responsibilities nor authority. Thus, this anomaly requires
further examination.