Boards of directors, stockholders, management, and the professional standards are expecting auditors to respond to risk of fraud in core business systems. Within a company's accounts payable file, shell companies are being used to steal millions of dollars from companies or the shell company is used to conceal bribe payments that violate anti‐bribery laws. The purpose of this chapter is to explain our methodology and experiences in detecting shell companies within the fraud audit.

In your customer database, internal employees have set up shell companies to sell to themselves at large discounts. We call this a front customer scheme. Internal employee then sells the goods to your customers at a markup. The internal employee then skims off the profit. In your vendor database, internal employees have created shell companies to misappropriate company funds or management has created a shell company to conceal the payment of bribes. In payroll, the internal employee has created the proverbial ghost employee.

The fraud scenario approach to uncovering fraud in core business systems recognizes that every secondary category of the fraud risk structure has one or more inherent fraud schemes. Every fraud scheme has two parts—an entity and a fraudulent action statement. This chapter will discuss fraud data analytics to search for the entity structure of the inherent scheme. In particular, this chapter will discuss fraud data analytics for locating the shell company. Starting with the homogeneous data concept, Figure 6.1 illustrates the concept of three groups of shell companies.

From a fraud data analytics perspective, there are three homogeneous categories of shell companies. A fourth category is a subset of the first three. The shell company describes the vendor or customer. How the list relates to employees will be discussed in Chapter 8.

1. Category one: The traditional shell company
   1. The traditional shell company is an entity that is created by the internal or external person to perpetrate the fraud action statement. The following list provides examples of the permutations:
      • Stand‐alone company legally created.
      • Stand‐alone nonlegally created, a DBA filed in the county of record.
      • Pass‐through stand‐alone company created by an internal source.
      • Pass‐through stand‐alone company created by salesperson at real company.
      • False minority entity in the USA.
      • False government preferred entity outside the USA.
      • For a more sophisticated perpetrator, there are companies that sell legal shell entities. The company was legally created many years ago and has been dormant. The incorporation date provided the illusion that the company has been in business for years.
2. Category two: The assumed entity shell company
   1. The assumed entity is a real company where the perpetrator takes over the identity by changing the address, banking information, telephone number, or email addresses. The assumed entity is similar to the real entity that is not complicit. However, the key difference is that the assumed entity did not process the transaction, whereas the real entity that was not complicit did process the transaction through their books and records.
   2. Assume the identity of dormant vendor or customer.
   3. Temporarily assume identity of the same active vendor or customer.
   4. Temporarily assume identity of the random active vendor or customer.
   5. For a more sophisticated perpetrator, assume a real vendor or customer's identity that is not in the master file and the perpetrator causes real vendor or customer to be added to master file.
3. Category three: The hidden entity shell company
   1. In the hidden entity shell there are a minimum of two companies in your database that have a common ownership. The purpose of the hidden entity is typically to circumvent dollar control levels. The companies usually have different names but may have a common identifier. The primary test is to search for duplicate master file data: addresses, bank accounts, telephone numbers, and email accounts.
   2. Other purposes of the hidden entity are to function as a subcontractor, create false bids, meet government quotas for preferred vendors, or whatever scheme the perpetrator needs two or more organizations. On the revenue side, bad‐debt customers place orders under a new name; customers reaching a credit limit may create a second organization to avoid control levels.
   3. The hidden entity scheme is a real company operating under two or more numbers or names. The companies may be two real standalone companies with a common ownership or two or more companies that operate under one roof.
   4. The hidden entity scheme may also be a shell company where the sole purpose of the second company is to create the illusion of a second company for whatever purpose.
   5. Hidden entity using a variation of a real company's name; however, unlike the other hidden entity schemes there is only one entity in your master file; the real entity is not involved and the duplicate test will not reveal the permutation.
   6. Real vendor with multivendor numbers. For some reason, it is very common to find the same vendor or customer in your database two or more times. When a real company has two or more numbers it creates opportunities that should not exist with good master file internal controls.
4. Category four: The limited‐use shell company
   1. The limited‐use shell company is a subset of categories one, two, and three. The only difference is the frequency that the shell company is used in the fraud scenario.
   2. One‐time use of a shell company. Many companies' procedures for one‐time payments are not as robust as the internal control procedures for a permanent company.
   3. Temporary use of a shell company. The perpetrator processes a few transactions through the entity to stay below the control radar before moving on to a different entity. In one fraud audit project, the perpetrator using the one‐time payment procedure would submit one invoice under a company name, then another company name,when in fact the companies did not legally exist. The fraud scenario was committed over a two‐year period.

What Is a Shell Company?

A shell corporation is a legally created entity that has no active business or is to conceal the true identity of the real company operating through a shell company. In essence, a shell corporation exists mainly on paper, has no physical presence, employs no one, and produces nothing. Within more sophisticated concealment strategies the perpetrators may employ the use of an office or employees to provide the illusion of a legitimate business entity. Shell corporations are frequently used to shield identities and/or to hide money in cases of money laundering, bankruptcy, bribery, and fraudulent conveyances. Scandals range from thousands to millions of dollars and always result in embarrassing moments for the corporation and management. Shell companies are called different names in different industries and different continents. Common names are paper company, fictitious company, nominee company, front company, dummy corporations, and numbered companies. Shell companies can also occur in nonlegally created companies, meaning in name only.

From an internal perspective of asset misappropriation in category one, the shell company is used for false billing schemes or a pass‐through scheme, which is discussed in Chapter 7. In category two, the assumed identity shell companies are also used for false billing and pass‐through schemes. Category three shell companies are used to circumvent payment internal controls and procurement internal controls. Category four shell companies are used in asset misappropriation schemes and internal control avoidance. All four categories are also associated with corruption schemes.

Shell companies are also used in financial statement fraud scheme where management is recording false revenue or transferring liabilities. The data analytics for shell customer is the same as the data analytics for shell vendor, except the data profile would need to be tailored for attributes associated with a customer versus a vendor.

What Is a Conflict‐of‐Interest Company?

The conflict‐of‐interest entity is a legally created company and provides the services or goods as described on the invoice. The conflict of interest is based on an undisclosed legal or beneficial ownership of the company. In Chapter 8, we will discuss conflict of interest in the purchase decision. The conflict‐of‐interest entity may operate as a shell company or as a real company with an undisclosed legal or beneficial ownership conflict‐of‐interest company. In first situation, the conflict of interest may have only one customer. In the second situation, the conflict‐of‐interest entity is in the business of providing services to the entire business community.

What Is a Real Company?

I know this sounds silly, but there are two types of real companies. The first type is a real company that is complicit with the fraud action statement. The second type is a real company that processed the transaction through their books and records but was not complicit with the fraud action statement.

Fraud Data Analytics Plan for Shell Companies

The plan starts with recognizing the homogeneous grouping of companies in the vendor master file or the customer master file. Using disaggregated analysis the fraud data analytics plan recognizes the subcategories within the homogeneous group of shell companies. The fraud sophistication concealment theory understands that at the low level the analysis of the master file should disclose the false entity, whereas, as the sophistication rises to medium to high, the ability to identify shell companies diminishes. The medium to high levels require the analysis of the transactions that link to the entity structure. At the high level, the search will start with the transactions and link back to the entities that have the transaction anomaly.

Fraud Data Analytics for the Traditional Shell Company

The search for the shell company starts with the specific identification strategy. We use the matching search routines, missing search routines, and the data anomaly testing. The matching test is comparison of two databases for a match. The most common test is the vendor database to the employee database. However, the same test should be performed for employee and customer database.

The matching test is highly effective because the match provides direct evidence of the linkage between the two entities. The matching should focus on address, bank account, telephone number, government identification number, and email address. The matching test is effective for low‐sophistication concealment but loses its effectiveness when the perpetrator ensures that the two entities have different identities. Figure 6.2 illustrates the impact that concealment theory has on the address field when using the matching test.

The missing analysis is an inference analysis that suggests that missing information is an indicator of someone with something to hide. The missing analysis should focus on address, bank account, telephone number, government identification number, and email address. It is the weight of all the missing information versus the lack of one element.

The anomaly testing uses the data in the master file to identify attributes associated with a shell company (e.g., P.O. box) or compares data for illogical data patterns (e.g., vendor has no address or bank account in the master file). The types of anomalies are:

• Addresses that match to mailbox service companies or mailbox forwarding companies.
• Email addresses that use public email addresses—such as Gmail or Hotmail.
• Time and date the entity was added to the master file.
• Lacks both an address and a bank account number.
• Company names that only contain initials.

The person committing the scenario must be considered in designing the data interrogation routine for traditional shell companies. When the person creating the shell company has direct access to the master file, then the internal control avoidance strategy of searching for off‐period updates is a critical test. If the fraud scenario involves a department manager, then the off‐period analysis is not a valid routine. Unless the fraud scenario involves collusion with the direct input function, then the off‐period analysis should also be considered.

Fraud Data Analytics for the Assumed Entity Shell Company

The assumed entity shell focuses on the change analysis. The key fields for vendors are address or bank account, because your company either electronically transfers the payment or mails the payment. For customer shell companies, the address tends to be critical due to the shipment of inventory. Other fields may also be changed to control the flow of information: telephone number, email address, and contact person name.

In change analysis we must consider both temporary and permanent change analysis. In the temporary change, someone is taking over the identity and processing one transaction and then changing the identity information back to the original data. The key is to search for a frequency of change by the internal person who has the ability to change the data. In permanent change, the first step is to identify entities with a change to address or bank account. Then attach the transactional history for anomalies in the transactional history.

If the company maintains a change file, the fraud data analysis is a matter of summarizing the change file by type of change for the permanent changes. If the change is a temporary change, then there should be two changes for the entity number. If no change file is maintained, then the analysis must compare two master files. The comparisons should be the first master file at the beginning of the scope period and the last master file at the end of the scope period. This analysis is not effective for the temporary change. In that case, the analysis would need to focus on the transaction file. To illustrate the concept of using the transaction file:

Using false customer refunds for dormant customers with a credit balance, the fraud data analytics plan would search the payment table for duplicate addresses with different customer names.

In the vendor file involving false invoices, the fraud data analytics plan would search the payment table for a vendor number having payments going to two or more addresses or bank accounts. The key in both data elements is using the payment table.

In the rare cases where a perpetrator takes over the identity of a real company that is not on the master file and is not complicit in the fraud scheme, the data interrogation would use the missing or data anomaly testing. The key difference would be in the audit testing. The address in the master file would not match the address of the real not‐complicit vendor.

Fraud Data Analytics for the Hidden Entity Shell Company

The hidden entity focuses on the duplicate test because the shell company is operating under two or more different names or operating under the same name but different vendor or customer numbers. The hidden entity shell company might be two or more legal entities or one legal entity operating under different names. The duplicate analysis would first focus on address, bank account number, telephone number, government issued number, contact person, or email address. The hidden entity typically correlates to the same general ledger accounts or the same budget owner.

The use of fuzzy logic on name fields is also useful. Once the fuzzy logic identifies a match on names, the second analysis should use the duplicate testing or go directly to the transaction testing.

Fraud Data Analytics for the Limited‐Use Shell Company

Typically, companies have codes or numbers to tag one‐time vendors. In one company, all one‐time payment vendors had the same vendor number. In another company, the company assigned all temporary vendors with a vendor number starting with nine. The key is to understand how your company tags one‐time vendors. The first report for one‐time vendors is an aggregate dollar and a record count analysis to determine the dollar materiality and frequency of use. The second level of analysis is anomalies in the transactional data.

Linkage of Identified Entities to Transactional Data File

Within the shell company fraud data analytics an exact match to the payroll database or an exact duplicate match by itself is sufficient to cause the auditor to select the entity for fraud testing. However, linking the transactions to the entity number is the convincing piece of information.

Let's assume we perform a duplicate address test in the vendor master file. We identify two vendors with a duplicate address and two different names. As a general rule, once your shell company testing has identified an entity of interest, attach the transactional history to the vendor or customer number and summarize the activity by dollar and record count. Let's look at two different situations:

1. Vendor one has a spend level of $1 million and vendor two has a zero spend level. Obviously, there is no current fraud risk when the vendor spend level is zero.
2. Vendor one has a spend level of $1 million and vendor two has a spend level of $750,000. The transactional history should be analyzed for duplicate transaction history or transactional anomalies—that is, the $750,000 invoice number pattern is a sequential pattern.

Fraud Data Analytics Scoring Sheet

The scoring sheet is a valuable tool in analyzing entities or transactions for the red flags associated with the fraud scenario. It is based on the totality of the red flags associated with the fraud data analytics plan versus one red flag. Seldom is there one red flag which is strong enough to suggest that a fraud scenario is occurring in a core business system.

The scoring sheet should weight each red flag on a score of one, two, and three. The evidence of the red flag would cause a score for the red flag. The scoring sheet would then total all of the red flags. The higher the score, the more persuasive the evidence is for sample selection purposes.

Impact of Fraud Concealment Sophistication Shell Companies

In Chapter 3, we discussed the three levels of concealment. The level of sophistication has a direct impact on the type of data interrogation routine, as described in this section.

The exception to the rule is the assumed entity shell company. Impact of fraud concealment sophistication shell companies operating as an assumed identity is not critical on the fraud data analysis routine. In the permanent takeover, the change to the critical field causes the sample selection. In the temporary takeover, it is the pattern and frequency of the event linked to a person that should cause the sample selection. Yes, the data field can have the same sophistication in hiding the entity, but the change to the critical field causes the sample selection.

Building the Fraud Data Profile for a Shell Company

The process of building a fraud data profile starts with identifying the data that links to the fraud scenario. Typically, this is the easy part of the process. The second step is to identify how the data element links to the fraud scenario. The third step is to describe the characteristics of the data in a manner that allows a fraud data interrogation routine to be developed. The last step is to program the search routine. I want to stress that step three is critical to designing the search routine.

My goal in this section is to illustrate the types of data red flags that the auditor could search for. In reality, the profile must be built for the company and country where the business is located. With a red flag test, there are always going to be exceptions. This is why the weight of all the red flags is more indicative of a fraud scenario versus one red flag. This is why the scoring sheet concept is so important.

To illustrate, in the email field, we will indicate that email addresses using a public email service versus a company designation is a red flag. Just before I started writing this book, I received an email from a prominent attorney who was using AOL as his email address. Hey, you never know.

Fraud Audit Procedures to Identify the Shell Corporation

The primary purpose of this book is to explain a fraud data analytics methodology for fraud scenarios versus fraud auditing procedures to examine documents. However, understanding how the fraud links to the fraud data analytics is also critical. In this chapter, we will illustrate the type of evidence gathering procedures necessary to link to your fraud data analytics program.

Before reading, some will believe the procedures are audit related and some will believe the procedures are investigative. Just ask yourself the following question: Would your test of the new vendor procedures reveal a shell company? If not, continue reading. For those still undecided, consider the rules of audit evidence as it relates to qualitative evidence. The highest form of qualitative evidence is externally created and externally stored. The steps described in entity, legal, physical, business capacity, and reference checking fit that bill. One more example: In a financial audit of accounts receivable, auditors send confirmations, which is externally created and externally stored evidence. Remember, it makes no sense to identify a fraudulent transaction in your sample if your audit procedure cannot identify the fraud scenario.

The four entity verification procedures are: legal creation, physical location, business capacity, and reference checking. The first step in entity verification is to determine that the control procedures were adhered to in recording the entity into the business system. Identification of the people associated with establishing an entity structure must be performed for comparison purposes in future fraud audit procedures. The intent is not control testing, but the gathering of information to establish a basis for entity verification.

Summary

Shell companies are widely used by people who want to steal company assets, ranging from internal persons to organized crime groups. Management may create a shell company as a way to disguise bribe payments. Banks search for shell companies in their AML programs. From a fraud data analytics perspective, once a shell company is found, there is no question that someone is committing a fraudulent act. As a personal recommendation, I suggest starting your fraud data analytics journey with the search for shell companies. By using the fraud data analytics methodology on something as simple to understand as shell companies, the fraud auditor will improve the art form of the methodology.