Fraud scenarios occur in payroll for a variety of reasons. First, employees are motivated to increase their net payroll. A supervisor is motivated to increase the net payroll of a good employee or the supervisor is motivated by receiving a kickback from the employee. Human resources payroll grades are unreasonable. Senior management is motivated for personal enrichment or to disguise a bribe, which is an FCPA issue. Whatever the internal person's motivation for committing the fraud scenario, payroll systems are vulnerable to internal employees committing fraud scenarios through the payroll system.

On first appearance, internal controls in most payroll systems seem sound. Separation of duties between payroll and human resources functions are deemed adequate. The company has a form for every step of the process. Approval controls are abundant throughout the entire system. However, fraud auditors should not be fooled by the evidence of an internal form, the appearance of separation of duties, and approval signatures in planning their fraud data analytics plan.

The predictability or vulnerability of the payroll system to a specific fraud scenario is how the internal control works in the real world. I refer to this as the difference between control theory and control reality.

In the legal system, there is a phrase, “form over substance or substance over form.” Payroll systems definitely have a “form over substance” from an internal control perspective. There is a form for every step. There is a form for new hires, a form to change your profile, and a form for termination. The question is, does our payroll process have “substance over form”? The key to understanding where payroll systems are vulnerable to fraud is by understanding how robust your internal controls are at each key control. The fraud auditor needs to understand the answers to who, what, where, how, and when the internal control is performed. The fraud auditor must understand the substance of the process over the form of the process.

The who question correlates to the trust factor of fraud opportunity. Supervisors and employees develop personal relationships. These relationships may cause a less robust approval process. Who relates to who actually causes the employee master file to be updated. Are human resources a true control function or an update function? Are human resources or payroll a “form” control or a “substance” control?

What is the span of internal control? How many employees does a supervisor monitor? Do employees work on staggered shifts? Does this work environment create opportunities for time reporting fraud?

Where does the hiring process occur? In a retail environment, hiring occurs at a store level. The manager interviews the employee and submits the necessary paperwork to human resources. The manager is perfectly situated to place a fictitious employee on the payroll. An employee quits work, but the supervisor continues to submit time sheets for the employee and diverts the employee's payroll check.

How is human resources notified of a change or an addition? Is the employee required to go to human resources, or does a supervisor forward the necessary paperwork?

When is the procedure performed? Is the procedure performed during normal business hours or after hours?

The intent of these questions or statements is not to suggest that internal controls are not operating as intended by management, but rather, the concept of understanding where your company is vulnerable to fraud.

Inherent Fraud Schemes for Payroll

The inherent fraud scheme structure is the starting point for fraud data analytics in payroll. The inherent scheme structure for entities is similar to vendors, except in payroll the entity structure is an employee. There are three entity structures in payroll fraud scenarios:

1. Fictitious employee occurs by creating the identity for a person that does not exist in real life. The person committing the scenario in essence creates an identity for the fictitious employee.
2. Assumed identity employee occurs by taking over the identity of a person either for a temporary time period or on a permanent time period. This entity structure is similar to the assumed identity for shell companies.
3. Real employee is complicit in the fraud action. In payroll, complicit is defined as the real employee receives the payroll payment.

The fraud action statements for payroll are:

1. Payment for services not performed; often called the ghost employee scheme. The entity structure of the inherent scheme for the ghost employee is a false entity (employee), a noncomplicit employee, or through a complicit employee.
2. Overtime fraud is payment for services not performed that are in excess of the standard hours.
3. False adjustment scheme occurs to the gross pay, deductions, or net payroll. A supervisor, the payroll function, or corporate controller is the typical perpetrator of the fraud scenario. The internal person creates and processes a payroll transaction that inflates gross or net payroll.
4. Manual payroll disbursements are payroll payments that are initiated, calculated external to the automated system, and the payroll data are manually entered into the automated system. Manual payroll payments occur for many reasons: final payroll payments, bonus payments, to correct an error, and to commit a fraud scenario.
5. Theft of stale payroll checks occurs when an employee does not receive their final paycheck, for whatever reason, and an internal person diverts and negotiates the check.
6. Inflated sales commissions or sales bonuses occur by intentionally manipulating performance statistics.
7. Disguised compensation occurs when management overrides human resource policies and provides am employee with additional compensation. While the employee is not complicit in the scheme, the employee benefits from the fraud scenario.
8. Payroll‐related expenditures are those expenditures that relate to employee benefits that are not considered wages in the traditional sense. That is, employees working in a foreign country are eligible for allowances such as tuition reimbursement plans. The fraud scenarios in these areas would depend on the nature of the benefit.
9. Employer fraud involves a company that intentionally is underpaying employees. These schemes require the fraud auditor to understand the labor law, which is beyond the scope of this book. However, with the frequency of these cases reported in the media, I would be remiss in not listing the scheme.

Planning Reports for Payroll Fraud

The first report that should be created is a gross payroll and net payroll by employee. The difference between net and gross should be calculated and percentage of employee net payroll to employee gross payroll. The informational items on the report should be the number of payroll payments, the employee number, the employee grade, employee title, and department number.

There should be summary reports on payroll information:

1. By payment code, the number of employees paid through direct deposit versus manual payroll check.
2. By earnings code, a summary of gross wages also includes the frequency of the earnings code occurring in the payroll registers.
3. By deduction code, a frequency count of employees using the deduction code.
4. By employee, the total number of automated payroll payments and the total number of manual payroll payments. The start date and termination date are critical to determine if the number of payroll payments is consistent with your expectation (payroll payment frequency report).
5. By employee, the total number of hours reported for hourly employees.

Each of these reports can be further refined based on what the reports reveal. Summarization and filtering routines are useful in allowing these reports to be user friendly. Using the payroll frequency report:

• Summarize the total number of automated payments and the total number of manual payments.
• Filter out all employees when the number of payroll payments is consistent with their employment period.

Remember, the planning reports are intended to assist the auditor in the likelihood analysis versus the sample selection process. Using the payroll frequency report, if no manual payroll payments were issued, then no fraud scenarios could occur through manual payments. Before you start creating fraud data analytics reports, study the planning reports to ensure you understand the data.

FDA for Ghost Employee Schemes

The term ghost employee is widely used throughout the audit profession. It generally is defined as payroll payments to a person who does not exist in real life. Using the inherent scheme approach, there are 11 ghost entity types. The fraud action statement is the same for each entity type: payment for services not performed.

FDA for Overtime Fraud

Overtime fraud is simple; an employee falsifies the number of hours the employee actually works. Most overtime schemes are not complicated; the employee determines that no one is monitoring the hours submitted on a time card. Overtime fraud is a crime of opportunity. To understand the concept of opportunity, the fraud auditor needs to understand the permutations associated with the person committing the fraud scenario:

• Employee alone overstates her hours worked and the supervisor unknowingly approves overtime. This opportunity can occur in a staggered work‐day or by the supervisor not carefully checking time cards or not being present during the overtime hours or just a general neglect of their duties. Remember, how robust are your internal controls?
• Employee operates in collusion with another employee to falsify their payroll hours. Once again, this will occur without the knowledge of the supervisor. In a manual card system, the employees enter arrival or departure information for each other. In an automated system, an administrative employee with access to the time reporting system changes the time record after supervisor approval.
• Employee and supervisor operate in collusion. The supervisor may be receiving a kickback from the employee or for some motivating reason, providing the employee disguised compensation.
• Employee and payroll employee operating in collusion. The payroll person may be receiving a kickback from the employee or providing the employee disguised compensation for whatever motivation. The payroll person overrides the properly reported hours. To conceal their actions, the time card is altered, destroyed, or a new version is created.
• Employee forges the approval of the supervisor. In an automated time card system, this would occur through a weak password control procedure.
• Employee working in payroll overstates his own hours worked.

FDA for Payroll Adjustments Schemes

There are three categories of payroll adjustment schemes: adjustments to gross pay; adjustments to deductions fields; or adjustments to net payroll. The key to understanding false adjustment schemes is to understand how payroll is calculated within your database system. In the database, there are a series of earning codes for gross payroll. The payroll system automatically calculates the “regular earnings” and the system automatically classifies payroll based on time and attendance records—that is, regular earnings or regular earnings classified as vacation wages for purposes of benefits. However, there are other earnings codes to increase an employee's wages (e.g., bonus payments) or to classify a wage as a benefit (e.g., vacation pay).

In the gross pay false adjustment scenario, an employee receives an adjustment to gross payroll. The employee supervisor may have initiated the adjustment as a form of disguised compensation or a payroll person may have recorded the adjustment to receive a kickback. Whatever the motivation for the scheme or internal control deficiency the adjustment is easy to find.

In the false adjustment deduction scenario, there are two methods. The first is to enter a contra number in the deduction field, which increases net payroll. The second false adjustment scheme is when a deduction does not occur within the payroll calculation but later is added to the employee's year‐to‐date earnings record through a false transaction. To illustrate, at the time of gross pay and net pay calculation, there are no taxes withheld from the employee's net payroll calculation. Later, an income tax adjustment transaction directly updates the employee's year‐to‐date table by increasing the employee's income tax withheld on the annual wage reporting statement to the government.

In the net payroll false adjustment scenario, the employee's net payroll is increased through an adjustment to net payroll. Many companies will reimburse employees for out‐of‐pocket expenses through payroll versus accounts payable. The indicator of this scheme is a journal posting to a non‐wage account or a reclassification entry transferring the payroll charge to a non‐wage account.

In one investigation, the controller gross payroll was $60,000 and his net payroll was $120,000. The documentation supporting the adjustment to net payroll was to reimburse the controller for out‐of‐pocket expenses ranging from office supplies to purchase of office equipment.

FDA for Manual Payroll Disbursements

There are many reasons why an employee may receive a manual payroll payment versus an automated payroll payment ranging from bonuses to final payment resulting from termination of employment. The planning report that counts the number of payments should highlight this fraud scenario. Care must be taken to ensure the summary report captures all payroll payments. Questions to ask are:

1. In what data tables are manual payroll payments stored?
2. Do manual payroll payments have a different sequence of control numbers from the automated payroll payments?
3. How are manual payroll payments recorded in the general ledger? Is the entry automated, or is the posting a manual entry?
4. What is the process for final payments to employees after their final workday?
5. What is the company policy on paying employees for unpaid vacation time, personal time, and sick time?

FDA for Performance Compensation

Employees paid based on performance can be motivated or can rationalize their behavior to falsely increase their performance. A manager may assist the employee through a disguised compensation scheme or to receive a kickback from the employee. The key to building a fraud data analytics plan is to first read and understand the performance criteria plan. The fraud auditor should then identify the methods that an employee could falsify their performance statistics. The most common techniques are to:

• Decrease the performance criteria during the year when it becomes evident that the employee cannot achieve the target. The fraud data analysis would create two files: the performance criteria at the beginning of the year and the performance criteria at the end of the year. The sample selection is based on a reduction of the performance criteria and the employee receives a performance bonus.
• Record false sales transactions at the end of the reporting period to achieve the performance level. There are two approaches, search for false sales recorded in the final quarter or search for reversal of false sales in the next quarter. The starting point is to identify all employees who achieved their performance bonus. The report should identify both the performance target and the total sales for the performance period. The analysis should identify total dollars the sales exceeded the target and a percentage calculation. The second file is sales returns and adjustments for all customers associated with the sales representatives. I would stratify the report by the week or month that the credit was posted. This can be tricky, because following the logic of the analysis, there will be types of credits, credits for real sales and credits for false sales. The low‐sophistication approach is to cause the credits immediately after the year end; the more sophisticated approach is to cause the credits to be posted later in the preceding quarter, but before an aging analysis would identify the false sales.

FDA for Theft of Payroll Payments

Believe it or not, sometimes employees do not pick up their final payroll check. The scenario occurs because the final payroll check is provided to someone, either human resources or an operations manager. At some point, the person holding the check falsely negotiates the check.

Employees are often entitled to final paycheck for reasons other than hours worked (i.e., unused vacation pay). Believe it or not, employees are not always aware they are entitled to a final payroll payment. How the scenario occurs in your company will depend on your organizational structure. The scenario can occur through a direct deposit, if payroll changes the bank account number either on a temporary basis or final basis. The scenario can occur through the theft of a manual check and false negotiation.

Using the speed of payment test, compare the payment date to the bank clearing date. Since payroll checks are usually negotiated quickly, the speed of payment testing is actually searching for checks that are not negotiated quickly.

Summary

Fraud in payroll happens in large companies and small companies. While the traditional ghost employee seems to be the popular fraud scenario to discuss, the ghost schemes involving noncomplicit real persons is a more likely scenario. Overtime fraud most likely occurs in companies that have a base of hourly employees. False adjustment schemes as a form of disguised compensation occur with a greater frequency than fraud statistics would suggest.

In one fraud data analytics project, we identified an employee who was receiving an additional $200 per week in net payroll. When the employee's supervisor was questioned, not only did he admit it was false but he justified his actions as the best way to keep a good employee. Rationalization of events in payroll fraud scenarios by employees and supervisors should be expected by the fraud auditor.

If you have a limited time budget, what are the three fraud data analytics tests the fraud auditor should perform, and why should the fraud auditor perform the analysis?

1. The gross‐to‐net payroll report will identify anomalies in the relationship of gross‐to‐net payroll. It may not tell the fraud auditor what scenario is occurring, but it will tell the fraud auditor where to look.
2. Summarize journal entries posting the payroll register to the general ledger searching for debits to nonwage accounts. Also look for reclassification journal entries. The person committing the scheme needs to hide the payroll scheme. Since comparison of wages to budget is a common management control, the perpetrator needs to hide the payroll scheme in a general ledger account that is not as visible as the salary account.
3. Search for the ghost employee that links to a bribe scheme. My recommendation is not based on the ease of locating but rather the impact that occurs if your company is investigated for violation of the bribery acts around the world (notably, the FCPA and the UK Bribery Act).