Executive Summary.

$40,000 was stolen from a small company by Debbie Jones, an office worker for the said firm. Because of her
involvement in cash handling and recording tasks—combined with the relatively informal and overly trusting culture of the
company—Debbie was able to commit a lapping scheme for two months. To mitigate the risk of and the possible damages from similar
events occurring in the future, additional controls must be added.

Present Issues Risks Recommendations

Segregation Debbie has control over a
of Duties majority of duties, including
asset custody, customer billing,
and record keeping.
Increased risk of fraud due
to no checks and balances
present under Debbie’s sole
control and minimal
supervision from Susan.
• Custody of assets and record keeping should be
segregated as much as possible.
• Have a clearer demarcation of roles for billing and
similar tasks.
• Hire/assign other workers if costs permit.

Transaction There is a lacking authorization
Authorization procedure from owners when
checks are mailed and
deposited to the bank.
Checks that come in can
easily be cashed out by
employees since there is no
system to account for these.
• Listings of checks coming in should be made to
counter check with deposit tickets.
• The owners or the President should be the one in
charge to stamp the checks to be sent out as final
authorization.
• Use only one stamp (e.g. "For Deposit Only").

Supervision Because Debbie is a family Easier to carry out theft and • Closer & stricter supervision must be implemented to
friend, John and Susan are fraud amongst employees properly guide and monitor the employees.
more permissive and trusting. due to lack of supervision.

Accounting • Sales invoices are not Increased risk of security • Have prenumbered sales invoices.
Records prenumbered. challenges due to a lacking • Send extra copies of the sales invoice along with check
• Checks received from audit trail. payments to account for sales.
customers are not accounted • All customers should be sent monthly bills.
for with corresponding invoices.
• Monthly bills are only sent to
unpaid customers.

Access Too much access is given to
Control Debbie (i.e. custody of checks,
accounting records and ability
to make deposits).
With too much trust and
access given to a single
employee, theft and fraud
can be done with ease.
• Restrict access of employees, especially with regards
to valuable information. (limited only to the task they are
handling)
• Complement the segregation of duties so that no single
employee can access systems implemented to verify
one another.
• Require all employees to take their vacation time,
without exception.

Independent Debbie who is tasked to report
Verification and record daily transactions is
also the one tasked to verify
through making the reports.
High risk of fraud and
money laundering due to
lack of independent
verification.
• Assign verification to an employee independent of the
employee responsible for the tasks/information or to an
internal auditor to avoid falsifying transactions.
• Regularly trace payments to outstanding receivables.
• Track the trend of AR days; a gradual increase may
indicate lapping.

General • Microcomputers can easily
Controls malfunction and have low
Application computational power compared
Controls to mainframes.
(IT Controls) • Microcomputer did not provide
access controls to files and
information; some employees
had unrestricted access.
• There is a lack of backup data
storage & transfer processes.
• High risk of system error
due to outdated systems.
• High risk of intentional
manipulation and
destruction of evidence.
• Have a backup storage. For example, a software that
could update the records from the microcomputer in real
time to another computer that is highly restricted to the
owners may be implemented.
• Procure technologies that can provide certain
restrictions to sensitive information (e.g. an access
control matrix) in order to prevent file manipulation.
• Have logs of user login/activity to provide a better audit
trail.

Conclusion. As the company continues to grow beyond its roots as a small family business, stricter controls must be formalized and
implemented to mitigate the similarly growing risks. While trust and a human touch remain important in hiring and managing the
business—especially when considering the current company size and the persisting need for supervision in the short to medium-term—due
diligence must still be exercised when dealing with transactions and cash flows of this magnitude. From a more formal segregation of duties
to stricter check-handling, the additional controls minimize the risk of embezzlement in a cost-effective manner. Even if embezzlement does
happen in the future, the greater abundance of data and a resultantly more robust audit trail makes analysis and detection far easier.