ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD
Once an employee commits fraud, he has limited time to conceal the financial transaction
in the accounting records. Learn how employees hide these fraudulent transactions and what
to look for when reviewing accounting records for evidence of fraud. This session will cover
three separate case studies of significant employee frauds concealed in accounting records,
how the fraud was discovered, and what evidence was used in court for a successful
prosecution.
ROSANNE TERHART, CFE, CA
Senior Manager
BDO Canada LLP
Vancouver, British Columbia
Canada
Rosanne Terhart is a Chartered Accountant and Certified Fraud Examiner. She has over
25 years’ experience in accounting, auditing, and forensic investigations. Ms. Terhart’s
practice focuses on forensic investigations addressing allegations of fraud, quantification of
economic damages, business valuations, special purpose audits, and financial consulting.
Ms. Terhart has provided expert witness testimony for civil and criminal trials in the
Supreme Court of British Columbia. She has also acted as a court-appointed special referee.
Ms. Terhart is a frequent speaker on topics related to fraud for the Institute of Chartered
Accountants of British Columbia, Continuing Legal Education, universities and other
organizations.
“Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,” “ACFE,” and the
ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of
this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without
the prior consent of the author.
©2012
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD
Once an employee commits fraud, he or she has a limited
time to conceal the fraudulent financial transaction in the
accounting records. Many employees can successfully
conceal these transactions for up to 18 months or longer by
these methods. The accounting records can be very
important in prosecution of fraud cases and lend the
elements of “motivation” and “intention” to the evidence.
Examples of Accounting Records
 General ledger

Sub ledgers

Journal entries
 Supporting documents (e.g., invoices and expense
reports)
 Bank statements, cheques, and electronic transfers
Evidence That Is Provided by the Accounting Records
 Who was involved:
 Most accounting systems have users logged in and
out.
 The log in and out timings can provide evidence
regarding who committed the concealing entry.
 This information can be used in court as evidence to
connect the fraud to an individual.
 Evidence of motivation/intention to commit fraud:
 The concealing entry in the accounting system is
very revealing evidence for motivation.
 For instance, if an amount is fraudulently paid to an
employee and fraudulently booked as a freight
expense for the company, this would indicate that
there was an intention to conceal the real
transaction.

Timing of the fraud:
 Accounting records provide good evidence of the
timing of a fraud. The entry must be made within 30
©2012
2012 ACFE Canadian Fraud Conference
1
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD
days of the actual fraud (to ensure not discovered
through preparation of the bank reconciliation).
 The accounting records also help determine the start
and end of the fraud, to determine the full extent.
 Additional fraud schemes:
 Often, additional fraud schemes are identified
though the review of the accounting records.
 For instance, many fraudsters conduct numerous
schemes at the same time. They may have a favorite
place to book these fraudulent transactions. Other
schemes may be found in the same accounting
records.
 Evidence of repayments:
 Accounting records will often show evidence of
repayment of fraudulent amounts.
 Employees will often take and then return funds for
a while, before taking and keeping funds.
Accounting records will show both sides of the
transaction.
How Fraud Is Concealed in the Accounting Records
 The initial entry to record the transaction in the
accounting records must be made in 30 days of the
transaction.
 Bank reconciliations are most often done at the end of
the month. In the process of doing a bank
reconciliation, funds disbursed by the organization that
were not booked would be revealed.
 The initial entry in the accounting system is usually put
into a temporary spot (e.g., suspense account) and then
subsequently moved and placed in a final account that
will flow through to the financial statements.
©2012
2012 ACFE Canadian Fraud Conference
2
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD
What to Look for in the Accounting Records
 Lack of segregation of duties involving cheque signing,
cash handling, and transaction recording can cause an
opportunity for fraud.
 Access to systems and override capability. For
example, access to payroll should be limited to only one
person.
 Look for who performs the bank reconciliation. This is
usually the person who can ensure that fraudulent
disbursements are not found. Most often, this kind of
fraud is found when the preparer of the bank
reconciliation is away on vacation.
 Manual cheques have different and usually lesser
controls than regular cheque runs, and it is much easier
to forge a signature on a manual cheque.
 Cheques that are out of sequence. Fraud is often done
with cheques that are out of sequence with the regular
cheque sequence. This happens when the fraudster has
access to a series of cheques that are out of the normal




system.
Missing, cancelled, or returned cheques. Often
fraudulent disbursements are done by cheques that are
simply destroyed after they are returned from the bank.
Odd or missing signatures on cheques. Odd signature
may reveal a forged signature.
Electronic transfers and online bill payments. There are
often no controls around this. An employee can make
personal payments and book them as business expenses.
Entries in suspense accounts or other non-regular
accounts. Fraud is often initially entered in suspense
accounts and then later transferred out. Also, fraud is
recorded in non-regular accounts, which are not often
scrutinized.
 Round number entries. Most fraudsters do not consider
the tax implications of fraudulent disbursements.
Looking for round number entries may be revealing.
©2012
2012 ACFE Canadian Fraud Conference
3
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD

Invoices and expense reports that lack detail.
 GST/HST entries. The tax accounts are favorite places
to book fraudulent disbursements because they are
often not reconciled on a regular basis.
 Year-end journal entries will show the writing off of
accounts. If a fraudulent disbursement is recorded in an
asset account, the entries can eliminate the asset that
was initially set up to conceal the fraud.
What to Look for in the Financial Statements

Expenses that are inflated from one year to another with
no apparent change in the organization. This may
indicate that fraudulent amounts are booked there.
 New expense or asset categories not in previous
financial statements.
 Assets that are inflated from one year to the next. This
could indicate that a fraudulent transaction was hidden
there.
 Gross margin percentages that change and cannot be
explained. This could indicate that fraudulent expenses
in cost of sales have been made.
Examples of Concealment in the Accounting Records
 Concealment of fraudulent disbursements:
 Cheque written to employee in the amount of
$20,000 is booked in a suspense account and then
moved to a consulting expense account.
 It appears that the company paid $20,000 for an
outside accountant.

Unless a detailed review of the consulting expense
account is done, no one would be the wiser.
 Concealment of misappropriated cash:


©2012
An employee steals $2,000 in cash from a bank
deposit.
The employee replaced the stolen cash with a
cheque from the company.
2012 ACFE Canadian Fraud Conference
4
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD

The transaction is booked to increase accounts
receivable by the amount of the cheque of $2,000.
 If the accounts receivable is not reconciled to
customer payments, the fraudulent amount goes
unnoticed.
 Concealment of a tampered cheque:
 An employee adds $3,000 to a payroll cheque after
it was signed but before being cashed.
 The extra $3,000 is booked into miscellaneous
expense.

It appears the company paid for some miscellaneous
expense in the amount of $3,000. If a detailed
review is not done of this account, it will go
unnoticed.
 Expense account fraud:
 An employee claims the same expense of $1,000
twice.
 The expense is claimed in two different expense
reports.


The expenses are booked in travel expenses.
Expense report conceals the fraud because it is
likely not detailed enough and has not been
reviewed sufficiently.
 A review of the expense report by a supervisor with
the employee’s agenda would reveal the
duplication.
 Payroll fraud:
 An employee enters into the payroll system and
changes payroll deductions for federal and


provincial payroll taxes to zero.
Employee received 100% of pay.
At year-end, the deductions due to Canada Revenue
Agency are paid by cheque from the company,
including fraudulent employee’s portion.
©2012
2012 ACFE Canadian Fraud Conference
5
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD

Amount is booked to employee benefits. Unless a
reconciliation of employee benefits is done, the
fraud is concealed.
Case Examples
 Airplane Company:
 Accounting staff discovers a $30,000 cheque
payable to Bank xx visa while preparing a bank
reconciliation.
 Company does not use Bank xx for visa and
connects it to the controller.








The controller is fired.
CFO puts together evidence, finds additional
suspicious cheques paid to Bank xx and quantifies
at $600,000.
Forensic investigation is required by insurance, civil
and criminal proceedings.
Forensic accountant traces fraudulent cheques to
accounting entry. Operator of entry is controller.
Traced entry to temporary inventory account.
A review of the temporary account reveals how far
back the fraud occurred and reveals the subsequent
entries made and accounts affected. Other
fraudulent amounts were discovered.
Total misappropriation amounted to $1.4 million.
Discovered that $300,000 was paid back, net
misappropriation was $1.1 million.
Fraud lasted 10 years before detection.
The accounting records revealed:
 How fraud was concealed
 Connected concealment to fraudster
 Extent and timing of fraud
 Quantified entire completeness of fraud
 Determined quantum of financial statement
misstatement
 Confirmed amount, if any, repaid
©2012
2012 ACFE Canadian Fraud Conference
6
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD

Non-Profit Organization:
 Director of organization discovers, by accident,
frequent unexplained electronic transfers from bank
accounts.
 Finance manager quits.
 Police put together file of transfers totaling
$500,000
 Forensic accountant reviewed accounting records.
Determined entries made to consulting expenses.
 Traced to invoices, discovered name of consultant.
Discovered email correspondence between finance


manager and consulting regarding misappropriated
funds. Discovered that funds were split between two
individuals. Eventually traced both individual
accounts. Accounting records show fuller extent of
fraud.
Discovered total misappropriated was $900,000.
Both individuals charged. Both admitted.
Fraud lasted two years before detection.

The accounting records revealed:
 How fraud was concealed
 Connected fraud with fraudster
 Connected fraud to another individual
 Increased total fraud quantification
 Insurance Company:
 Organizational controller discovers, by accident, a
short-fall in a daily cash deposit.
 Controller discovers that cash count done by one of
the cash counters. Discovers several other short


©2012
deposits. All done when a particular cash counter
was working.
Controller puts together all short deposits by one
cashier. Amounted to $40,000 short deposits.
Forensic accountant discovers that one other cash
counter was involved, based on the accounting entry
operation information.
2012 ACFE Canadian Fraud Conference
7
NOTES
ACCOUNTING RECORDS: HOW THEY ARE USED TO CONCEAL FRAUD




©2012
Fraud was booked to accounts receivable. Fraud
quantum increased to $140,000.
Two individuals charged.
Fraud lasted eight months before detection.
The accounting records revealed:
 How fraud was concealed
 Connected fraud with fraudster
 Connected fraud to another individual
 Increased total fraud quantification
2012 ACFE Canadian Fraud Conference
8
NOTES