Wk 4 Discussion

1114237 - Wiley US ©

CHAPTER 7

Fraud, Internal Control, and Cash

Chapter Preview As the following Feature Story about recording cash sales at Barriques indicates, control of cash is important to ensure that fraud does not occur. Companies also need controls to safeguard other types of assets. For example, Barriques undoubtedly has controls to prevent the theft of food and supplies, and controls to prevent the theft of tableware and dishes from its kitchen.

In this chapter, we explain the essential features of an internal control system and how it prevents fraud. We also describe how those controls apply to a specific asset—cash. The

1114237 - Wiley US ©

applications include some controls with which you may be already familiar, such as the use of a bank.

Feature Story Minding the Money in Madison

For many years, Barriques in Madison, Wisconsin, has been named the city’s favorite coffeehouse. Barriques not only does a booming business in coffee but also has wonderful baked goods, delicious sandwiches, and a fine selection of wines.

“Our customer base ranges from college students to neighborhood residents as well as visitors to our capital city,” says bookkeeper Kerry Stoppleworth, who joined the company shortly after it was founded in 1998. “We are unique because we have customers who come in early on their way to work for a cup of coffee and then will stop back after work to pick up a bottle of wine for dinner. We stay very busy throughout all three parts of the day.”

Like most businesses where purchases are low-cost and high-volume, cash control has to be simple. “We use a computerized point-of-sale (POS) system to keep track of our inventory and allow us to efficiently ring through an order for a customer,” explains Stoppleworth. “You can either scan a barcode for an item or enter in a code for items that don’t have a barcode such as cups of coffee or bakery items.” The POS system also automatically tracks sales by department and maintains an electronic journal of all the sales transactions that occur during the day.

“There are two POS stations at each store, and throughout the day any of the staff may operate them,” says Stoppleworth. At the end of the day, each POS station is reconciled separately. The staff counts the cash in the drawer and enters this amount into the closing totals in the POS system. The POS system then compares the cash and credit amounts, less the cash being carried forward to the next day (the float), to the shift total in the electronic journal. If there are discrepancies, a recount is done and the journal is reviewed transaction by transaction to identify the problem. The staff then creates a deposit ticket for the cash less the float and puts this in a drop safe with the electronic journal summary report for the manager to review and take to the bank the next day. Ultimately, the bookkeeper reviews all of these documents as well as the deposit receipt that the bank produces to make sure they are all in agreement.

As Stoppleworth concludes, “We keep the closing process and accounting simple so that our staff can concentrate on taking care of our customers and making great coffee and food.”

1114237 - Wiley US ©

Chapter Outline LEARNING OBJECTIVES

LO 1 Define fraud and the principles of internal control.

Fraud

The Sarbanes- Oxley Act

Internal control

Principles of internal control activities

Data analytics and internal controls

Limitations of internal control

DO IT! 1 Control Activities

LO 2 Apply internal control principles to cash.

Cash receipts controls

Cash disbursements controls

Petty cash fund

DO IT! 2 Control over Cash Receipts

LO 3 Identify the control features of a bank account.

EFT system

Bank statements

Reconciling the bank account

DO IT! 3 Bank Reconciliation

LO 4 Explain the reporting of cash and the basic principles of cash management.

Reporting cash

Managing and monitoring cash

Cash budgeting

DO IT! 4a Reporting Cash

DO IT! 4b Cash Budget

Go to the Review and Practice section at the end of the chapter for a targeted summary and practice applications with solutions.

Visit WileyPLUS for additional tutorials and practice opportunities.

1114237 - Wiley US ©

Fraud and Internal Control

LEARNING OBJECTIVE 1

Define fraud and the principles of internal control.

The Feature Story describes many of the internal control procedures used by Barriques. These procedures are necessary to discourage employees from fraudulent activities.

Fraud A fraud is a dishonest act by an employee that results in personal benefit to the employee at a cost to the employer. Examples of fraud reported in the financial press include the following.

A bookkeeper in a small company diverted $750,000 of bill payments to a personal bank account over a three-year period.

A shipping clerk with 28 years of service shipped $125,000 of merchandise to himself.

A computer operator embezzled $21 million from Wells Fargo Bank over a two-year period.

A church treasurer “borrowed” $150,000 of church funds to finance a friend’s business dealings.

Why does fraud occur? The three main factors that contribute to fraudulent activity are depicted by the fraud triangle in Illustration 7.1.

ILLUSTRATION 7.1 Fraud triangle

The most important element of the fraud triangle is opportunity. For an employee to commit fraud, the workplace environment must provide opportunities that an employee can take advantage of. Opportunities occur when the workplace lacks sufficient controls to deter and detect fraud. For example, inadequate monitoring of employee actions can create opportunities for theft and can embolden employees because they believe they will not be caught.

1114237 - Wiley US ©

A second factor that contributes to fraud is financial pressure. Employees sometimes commit fraud because of personal financial problems caused by too much debt. Or, they might commit fraud because they want to lead a lifestyle that they cannot afford on their current salary.

The third factor that contributes to fraud is rationalization. In order to justify their fraud, employees rationalize their dishonest actions. For example, employees sometimes justify fraud because they believe they are underpaid while the employer is making lots of money. Employees feel justified in stealing because they believe they deserve to be paid more.

The Sarbanes-Oxley Act What can be done to prevent or to detect fraud? After numerous corporate scandals came to light in the early 2000s, Congress addressed this issue by passing the Sarbanes-Oxley Act (SOX). Under SOX, all publicly traded U.S. corporations are required to maintain an adequate system of internal control. Corporate executives and boards of directors must ensure that these controls are reliable and effective. In addition, independent outside auditors must attest to the adequacy of the internal control system. Companies that fail to comply are subject to fines, and company officers can be imprisoned. SOX also created the Public Company Accounting Oversight Board (PCAOB) to establish auditing standards and regulate auditor activity.

One poll found that 60% of investors believe that SOX helps safeguard their stock investments. Many say they would be unlikely to invest in a company that fails to follow SOX requirements. Although some corporate executives have criticized the time and expense involved in following SOX requirements, SOX appears to be working well. For example, the chief accounting officer of Eli Lily noted that SOX triggered a comprehensive review of how the company documents its controls. This review uncovered redundancies and pointed out controls that needed to be added. In short, it added up to time and money well spent.

Internal Control Internal control is a process designed to provide reasonable assurance regarding the achievement of company objectives related to operations, reporting, and compliance. In more detail, the purposes of internal control are to safeguard assets, enhance the reliability of accounting records, increase efficiency of operations, and ensure compliance with laws and regulations. Internal control systems have five primary components as listed below.1

A control environment. It is the responsibility of top management to make it clear that the organization values integrity and that unethical activity will not be tolerated. This component is often referred to as the “tone at the top.”

Risk assessment. Companies must identify and analyze the various factors that create risk for the business and must determine how to manage these risks.

Control activities. To reduce the occurrence of fraud, management must design policies and procedures to address the specific risks faced by the company.

Information and communication. The internal control system must capture and communicate all pertinent information both down and up the organization, as well as

1114237 - Wiley US ©

communicate information to appropriate external parties.

Monitoring. Internal control systems must be monitored periodically for their adequacy. Significant deficiencies need to be reported to top management and/or the board of directors.

1114237 - Wiley US ©

People, Planet, and Profit Insight

And the Controls Are . . .

Internal controls are important for an effective financial reporting system. The same is true for sustainability reporting. An effective system of internal controls for sustainability reporting will help in the following ways: (1) prevent the unauthorized use of data; (2) provide reasonable assurance that the information is accurate, valid, and complete; and (3) report information that is consistent with overall sustainability accounting policies. With these types of controls, users will have the confidence that they can use the sustainability information effectively.

Some regulators are calling for even more assurance through audits of this information. Companies that potentially can cause environmental damage through greenhouse gases, as well as companies in the mining and extractive industries, are subject to reporting requirements. And, as demand for more information in the sustainability area expands, the need for audits of this information will grow.

Why is sustainability information important to investors? (Go to WileyPLUS for this answer and additional questions.)

Principles of Internal Control Activities

1114237 - Wiley US ©

Each of the five components of an internal control system is important. Here, we will focus on one component, the control activities. The reason? These activities are the backbone of the company’s efforts to address the risks it faces, such as fraud. The specific control activities used by a company will vary, depending on management’s assessment of the risks faced. This assessment is heavily influenced by the size and nature of the company.

The six principles of control activities are as follows (see Decision Tools).

Establishment of responsibility

Segregation of duties

Documentation procedures

Physical controls

Independent internal verification

Human resource controls

We explain these principles in the following sections. You should recognize that they apply to most companies and are relevant to both manual and computerized accounting systems.

Decision Tools

The six principles of internal control activities help to ensure that a company’s financial statements are adequately supported by internal controls.

Establishment of Responsibility

An essential principle of internal control is to assign responsibility to specific employees. Control is most effective when only one person is responsible for a given task.

To illustrate, assume that the cash on hand at the end of the day in a Safeway supermarket is $10 short of the cash entered in the cash register. If only one person has operated the register, the shift manager can quickly determine responsibility for the shortage. If two or more individuals have worked the register, it may be impossible to determine who is responsible for the error.

Many retailers solve this problem by having registers with multiple drawers. This makes it possible for more than one person to operate a register but still allows identification of a particular employee with a specific drawer. Only the signed-in cashier has access to his or her drawer.

Establishing responsibility often requires limiting access only to authorized personnel, and then identifying those personnel. For example, the automated systems used by many companies have mechanisms such as identifying passcodes that keep track of who made a journal entry, who entered a sale, or who went into an inventory storeroom at a particular time. Use of identifying passcodes enables the company to establish responsibility by identifying the particular employee who carried out the activity.

1114237 - Wiley US ©

Anatomy of a Fraud

Maureen Frugali was a training supervisor for claims processing at Colossal Healthcare. As a standard part of the claims-processing training program, Maureen created fictitious claims for use by trainees. These fictitious claims were then sent to the accounts payable department. After the training claims had been processed, she was to notify Accounts Payable of all fictitious claims, so that they would not be paid. However, she did not inform Accounts Payable about every fictitious claim. She created some fictitious claims for entities that she controlled (that is, she would receive the payment), and she let Accounts Payable pay her.

Total take: $11 million

The Missing Control

Establishment of responsibility. The healthcare company did not adequately restrict the responsibility for authorizing and approving claims transactions. The training supervisor should not have been authorized to create claims in the company’s “live” system.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 61–70.

Segregation of Duties

1114237 - Wiley US ©

Segregation of duties is indispensable in an internal control system. There are two common applications of this principle:

1. Different individuals should be responsible for related activities.

2. The responsibility for recordkeeping for an asset should be separate from the physical custody of that asset.

The rationale for segregation of duties is this: The work of one employee should, without a duplication of effort, provide a reliable basis for evaluating the work of another employee. For example, the personnel that design and program computerized systems should not be assigned duties related to day-to-day use of the system. Otherwise, they could design the system to benefit them personally and conceal the fraud through day-to- day use.

Segregation of Related Activities

Making one individual responsible for related activities increases the potential for errors and irregularities.

Purchasing Activities

Companies should, for example, assign related purchasing activities to different individuals. Related purchasing activities include ordering merchandise, approving orders, receiving goods, authorizing payment, and paying for goods or services. Various frauds are possible when one person handles related purchasing activities:

If a purchasing agent is allowed to order goods without obtaining supervisory approval, the likelihood of the purchasing agent receiving kickbacks from suppliers increases.

If an employee who orders goods also handles the invoice and receipt of the goods, as well as payment authorization, he or she might authorize payment for a fictitious invoice.

These abuses are less likely to occur when companies divide the purchasing tasks.

1114237 - Wiley US ©

Sales Activities

Similarly, companies should assign related sales activities to different individuals. Related selling activities include making a sale, shipping (or delivering) the goods to the customer, billing the customer, and receiving payment. Various frauds are possible when one person handles related sales activities:

If a salesperson can make a sale without obtaining supervisory approval, he or she might make sales at unauthorized prices to increase sales commissions.

A shipping clerk who also has access to accounting records could ship goods to himself.

A billing clerk who handles billing and receipt could understate the amount billed for sales made to friends and relatives.

These abuses are less likely to occur when companies divide the sales tasks. The salespeople make the sale, the shipping department ships the goods on the basis of the sales order, and the billing department prepares the sales invoice after comparing the sales order with the report of goods shipped.

1114237 - Wiley US ©

Anatomy of a Fraud

Lawrence Fairbanks, the assistant vice-chancellor of communications at Aesop University, was allowed to make purchases of under $2,500 for his department without external approval. Unfortunately, he also sometimes bought items for himself, such as expensive antiques and other collectibles. How did he do it? He replaced the vendor invoices he received with fake vendor invoices that he created. The fake invoices had descriptions that were more consistent with the communications department’s purchases. He submitted these fake invoices to the accounting department as the basis for their journal entries and to the accounts payable department as the basis for payment.

Total take: $475,000

The Missing Control

Segregation of duties. The university had not properly segregated related purchasing activities. Lawrence was ordering items, receiving the items, and receiving the invoice. By receiving the invoice, he had control over the documents that were used to account for the purchase and thus was able to substitute a fake invoice.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 3–15.

Segregation of Recordkeeping from Physical Custody

The accountant should have neither physical custody of the asset nor access to it. Likewise, the custodian of the asset should not maintain or have access to the accounting records. The custodian of the asset is not likely to convert the asset to personal use when one employee maintains the record of the asset, and a different employee has physical custody of the asset. The separation of accounting responsibility from the custody of assets is especially important for cash and inventories because these assets are very vulnerable to fraud.

1114237 - Wiley US ©

Anatomy of a Fraud

Angela Bauer was an accounts payable clerk for Aggasiz Construction Company. Angela prepared and issued checks to vendors and reconciled bank statements. She perpetrated a fraud in this way: She wrote checks for costs that the company had not actually incurred (e.g., fake taxes). A supervisor then approved and signed the checks. Before issuing the check, though, Angela would “white-out” the payee line on the check and change it to personal accounts that she controlled. She was able to conceal the theft because she also reconciled the bank account. That is, nobody else ever saw that the checks had been altered.

Total take: $570,000

The Missing Control

Segregation of duties. Aggasiz Construction Company did not properly segregate recordkeeping from physical custody. Angela had physical custody of the checks, which essentially was control of the cash. She also had recordkeeping responsibility because she prepared the bank reconciliation.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 100–107.

Documentation Procedures

Documents provide evidence that transactions and events have occurred. For example, point-of-sale terminals are networked with a company’s computing and accounting records, which results in direct documentation.

Similarly, a shipping document indicates that the goods have been shipped, and a sales invoice indicates that the company has billed the customer for the goods. By requiring signatures (or initials) on the documents, the company can identify the individual(s) responsible for the transaction or event. Companies should document transactions when they occur.

Companies should establish procedures for documents. First, whenever possible, companies should use prenumbered documents, and all documents should be accounted for. Prenumbering helps to prevent a transaction from being recorded more than once, or conversely, from not being recorded at all. Second, the control system should require that employees promptly forward source documents for accounting entries to the accounting department. This control measure helps to ensure timely recording of the transaction and contributes directly to the accuracy and reliability of the accounting records.

1114237 - Wiley US ©

Anatomy of a Fraud

To support their reimbursement requests for travel costs incurred, employees at Mod Fashions Corporation’s design center were required to submit receipts. The receipts could include the detailed bill provided for a meal, the credit card receipt provided when the credit card payment is made, or a copy of the employee’s monthly credit card bill that listed the item. A number of the designers who frequently traveled together came up with a fraud scheme: They submitted claims for the same expenses. For example, if they had a meal together that cost $200, one person submitted the detailed meal bill, another submitted the credit card receipt, and a third submitted a monthly credit card bill showing the meal as a line item. Thus, all three received a $200 reimbursement.

Total take: $75,000

The Missing Control

Documentation procedures. Mod Fashions should require the original, detailed receipt. It should not accept photocopies, and it should not accept credit card statements. In addition, documentation procedures could be further improved by requiring the use of a corporate credit card (rather than a personal credit card) for all business expenses.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 79–90.

Physical Controls

1114237 - Wiley US ©

Use of physical controls is essential. Physical controls relate to the safeguarding of assets and enhance the accuracy and reliability of the accounting records. Illustration 7.2 shows examples of these controls.

ILLUSTRATION 7.2 Physical controls

1114237 - Wiley US ©

Anatomy of a Fraud

At Centerstone Health, a large insurance company, the mailroom each day received insurance applications from prospective customers. Mailroom employees scanned the applications into electronic documents before the applications were processed. Once the applications were scanned, they could be accessed online by authorized employees.

Insurance agents at Centerstone Health earn commissions based upon successful applications. The sales agent’s name is listed on the application. However, roughly 15% of the applications are from customers who did not work with a sales agent. Two friends—Alex, an employee in recordkeeping, and Parviz, a sales agent—thought up a way to perpetrate a fraud. Alex identified scanned applications that did not list a sales agent. After business hours, he entered the mailroom and found the hard-copy applications that did not show a sales agent. He wrote in Parviz’s name as the sales agent and then rescanned the application for processing. Parviz received the commission, which the friends then split.

Total take: $240,000

The Missing Control

Physical controls. Centerstone Health lacked two basic physical controls that could have prevented this fraud. First, the mailroom should have been locked during nonbusiness hours, and access during business hours should have been tightly controlled. Second, the scanned applications supposedly could be accessed only by authorized employees using their passwords. However, the password for each employee was the same as the employee’s user ID. Since employee user-ID numbers were available to all other employees, all employees knew each other’s passwords. Thus, Alex could enter the system using another employee’s password and access the scanned applications.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 316–326.

Independent Internal Verification

Most internal control systems provide for independent internal verification. This principle involves the review of data prepared by employees. To obtain maximum benefit from independent internal verification:

1. Companies should verify records periodically or on a surprise basis.

2. An employee who is independent of the personnel responsible for the information should make the verification.

3. Discrepancies and exceptions should be reported to a management level that can take appropriate corrective action.

Independent internal verification is especially useful in comparing recorded accountability with existing assets. The reconciliation of the electronic journal with the cash in the point-

1114237 - Wiley US ©

of-sale terminal at Barriques is an example of this internal control principle. Other common examples are the reconciliation of a company’s cash balance per books with the cash balance per bank, and the verification of the perpetual inventory records through a count of physical inventory. Illustration 7.3 shows the relationship between this principle and the segregation of duties principle.

ILLUSTRATION 7.3 Comparison of segregation of duties principle with independent internal verification principle

Large companies often assign independent internal verification to internal auditors. Internal auditors are company employees who continuously evaluate the effectiveness of the company’s internal control systems. They review the activities of departments and individuals to determine whether prescribed internal controls are being followed. They also recommend improvements when needed. For example, WorldCom was at one time the second largest U.S. telecommunications company. The fraud that caused its bankruptcy (the largest ever when it occurred) involved billions of dollars. It was uncovered by an internal auditor.

1114237 - Wiley US ©

Anatomy of a Fraud

Bobbi Jean Donnelly, the office manager for Mod Fashions Corporation’s design center, was responsible for preparing the design center budget and reviewing expense reports submitted by design center employees. Her desire to upgrade her wardrobe got the better of her, and she enacted a fraud that involved filing expense-reimbursement requests for her own personal clothing purchases. Bobbi Jean was able to conceal the fraud because she was responsible for reviewing all expense reports, including her own. In addition, she sometimes was given ultimate responsibility for signing off on the expense reports when her boss was “too busy.” Also, because she controlled the budget, when she submitted her expenses, she coded them to budget items that she knew were running under budget, so that they would not catch anyone’s attention.

Total take: $275,000

The Missing Control

Independent internal verification. Bobbi Jean’s boss should have verified her expense reports. When asked what he thought her expenses for a year were, the boss said about $10,000. At $115,000 per year, her actual expenses were more than 10 times what would have been expected. However, because he was “too busy” to verify her expense reports or to review the budget, he never noticed.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 79–90.

Human Resource Controls

Human resource control activities include the following.

1. Bond employees who handle cash. Bonding involves obtaining insurance protection against theft by employees. It contributes to the safeguarding of cash in two ways. First, the insurance company carefully screens all individuals before adding them to the policy and may reject risky applicants. Second, bonded employees know that the insurance company will vigorously prosecute all offenders.

2. Rotate employees’ duties and require employees to take vacations. These measures deter employees from attempting thefts since they will not be able to permanently conceal their improper actions. Many banks, for example, have discovered employee thefts when the employee was on vacation or assigned to a new position.

3. Conduct thorough background checks. Many believe that the most important and inexpensive measure any business can take to reduce employee theft and fraud is for the human resource department to conduct thorough background checks. Two tips: (1) Check to see whether job applicants actually graduated from the schools they list. (2) Never use telephone numbers for previous employers provided by the applicant. Always look them up yourself.

1114237 - Wiley US ©

Anatomy of a Fraud

Ellen Lowry was the desk manager and Josephine Rodriguez was the head of housekeeping at the Excelsior Inn, a luxury hotel. The two best friends were so dedicated to their jobs that they never took vacations, and they frequently filled in for other employees. In fact, Ms. Rodriguez, whose job as head of housekeeping did not include cleaning rooms, often cleaned rooms herself, “just to help the staff keep up.” These two “dedicated” employees, working as a team, found a way to earn a little more cash. Ellen, the desk manager, provided significant discounts to guests who paid with cash. She kept the cash and did not register the guests in the hotel’s computerized system. Instead, she took the room out of circulation “due to routine maintenance.” Because the room did not show up as being used, it did not receive a normal housekeeping assignment. Instead, Josephine, the head of housekeeping, cleaned the rooms during the guests’ stay.

Total take: $95,000

The Missing Control

Human resource controls. Ellen, the desk manager, had been fired by a previous employer after being accused of fraud. If the Excelsior Inn had conducted a thorough background check, it would not have hired her. The hotel fraud was detected when Ellen missed work for a few days due to illness. A system of mandatory vacations and rotating days off would have increased the chances of detecting the fraud before it became so large.

Source: Adapted from Wells, Fraud Casebook (2007), pp. 145–155.

1114237 - Wiley US ©

Accounting Across the Organization

SOX Boosts the Role of Human Resources

Under SOX, a company needs to keep track of employees’ degrees and certifications to ensure that employees continue to meet the specified requirements of a job. Also, to ensure proper employee supervision and proper separation of duties, companies must develop and monitor an organizational chart. When one corporation went through this exercise, it found that out of 17,000 employees, there were 400 people who did not report to anyone. The corporation also had 35 people who reported to each other. In addition, if an employee complains of an unfair firing and mentions financial issues at the company, the human resource department must refer the case to the company audit committee and possibly to its legal counsel.

Why would unsupervised employees or employees who report to each other represent potential internal control threats? (Go to WileyPLUS for this answer and additional questions.)

Data Analytics and Internal Controls Data analytics has dramatically changed many aspects of internal control practices. In the past, internal and external auditors tended to rely heavily on investigations of period-end samples of transactions to identify potential violations. Now, rather than wait for a period- end sample, many companies employ continuous monitoring of virtually every

1114237 - Wiley US ©

transaction. As a result, spikes in certain types of activity or developing trends are more quickly identified and investigated.

Many different aspects of journal entries can be monitored continuously. For example, systems can automatically identify who recorded a particular journal entry. This is important to ensure that segregation of duties is not violated, that is, that the entry is only made by a current (as opposed to recently terminated) employee and that the employee is authorized to make that type of entry.

Large dollar amounts in risky areas can also be flagged and investigated quickly. Recipients of payments can be easily screened to ensure, for example, that bonus amounts are correctly determined based on results and bonus formulas, and that bonuses are only paid to employees who are designated for bonus payments. Similarly, vendor payments can be easily screened to ensure that payments only go to authorized vendors and that amounts are within an anticipated range. Sophisticated models can be used to continually estimate critical measures, and those estimates are then compared to actual results to identify outliers.

Limitations of Internal Control Companies generally design their systems of internal control to provide reasonable assurance of proper safeguarding of assets and reliability of the accounting records. The concept of reasonable assurance rests on the premise that the costs of establishing control procedures should not exceed their expected benefit (see Helpful Hint).

HELPFUL HINT

Controls may vary with the risk level of the activity. For example, management may consider cash to be high risk and maintaining inventories in the stockroom as low risk. Thus, management would have stricter controls for cash.

To illustrate, consider shoplifting losses in retail stores. Stores could eliminate such losses by having a security guard stop and search customers as they leave the store. But store managers have concluded that the negative effects of such a procedure cannot be justified. Instead, they have attempted to control shoplifting losses by less costly procedures. They post signs saying, “We reserve the right to inspect all packages” and “All shoplifters will be prosecuted.” They use hidden cameras and store detectives to monitor customer activity, and they install sensor equipment at exits.

The human element is an important factor in every system of internal control. A good system can become ineffective as a result of employee fatigue, carelessness, or indifference. For example, a receiving clerk may not bother to count goods received and may just “fudge” the counts. Occasionally, two or more individuals may work together to get around prescribed controls. Such collusion can significantly reduce the effectiveness of a system, eliminating the protection offered by segregation of duties. No system of internal control is perfect.

The size of the business also may impose limitations on internal control. Small companies often find it difficult to segregate duties or to provide for independent internal

1114237 - Wiley US ©

verification. A study by the Association of Certified Fraud Examiners indicates that businesses with fewer than 100 employees are most at risk for employee theft. In fact, 29% of frauds occurred at companies with fewer than 100 employees. The median loss at small companies was $154,000, which was nearly as high as the median fraud at companies with more than 10,000 employees ($160,000). A $154,000 loss can threaten the very existence of a small company.

DO IT! 1 | Control Activities

Identify which control activity is violated in each of the following situations, and explain how the situation creates an opportunity for a fraud.

1. The person with primary responsibility for reconciling the bank account and making all bank deposits is also the company’s accountant.

2. Wellstone Company’s treasurer received an award for distinguished service because he had not taken a vacation in 30 years.

3. In order to save money spent on order slips and to reduce time spent keeping track of order slips, a local bar/restaurant does not buy prenumbered order slips.

ACTION PLAN

Familiarize yourself with each of the control activities discussed.

Understand the nature of the frauds that each control activity is intended to address.

Solution

1. Violates the control activity of segregation of duties. Recordkeeping should be separate from physical custody. As a consequence, the employee could embezzle cash and make journal entries to hide the theft.

2. Violates the control activity of human resource controls. Key employees must take vacations. Otherwise, the treasurer, who manages the company’s cash, might embezzle cash and use his position to conceal the theft.

3. Violates the control activity of documentation procedures. If prenumbered documents are not used, then it is virtually impossible to account for the documents. As a consequence, an employee could write up a dinner sale, receive the cash from the customer, and then throw away the order slip and keep the cash.

Related exercise material: BE7.1, BE7.2, BE7.3, BE7.4, DO IT! 7.1, E7.1, and E7.2.

1114237 - Wiley US ©

Cash Controls

LEARNING OBJECTIVE 2

Apply internal control principles to cash.

Cash is the one asset that is readily convertible into any other type of asset. It also is easily concealed and transported, and is highly desired. Because of these characteristics, cash is the asset most susceptible to fraudulent activities. In addition, because of the large volume of cash transactions, numerous errors may occur in executing and recording them. To safeguard cash and to ensure the accuracy of the accounting records for cash, effective internal control over cash is critical.

Cash Receipts Controls Illustration 7.4 shows how the internal control principles explained earlier apply to cash receipts transactions. As you might expect, companies vary considerably in how they apply these principles. To illustrate internal control over cash receipts, we will examine control activities for a retail store with both over-the-counter and mail receipts.

ILLUSTRATION 7.4 Application of internal control principles to cash receipts

Over-the-Counter Receipts

1114237 - Wiley US ©

In retail businesses, control of over-the-counter receipts centers on cash registers that are visible to customers. A cash sale is entered in a cash register (or point-of-sale terminal), with the amount clearly visible to the customer. This activity prevents the sales clerk from entering a lower amount and pocketing the difference. The customer receives an itemized cash register receipt and is expected to count the change received. (One weakness at Barriques in the Feature Story is that customers are only given a receipt if requested.) The cash register’s tape is locked in the register until a supervisor removes it. This tape accumulates the daily transactions and totals.

At the end of the clerk’s shift, the clerk counts the cash and sends the cash and the count to the cashier. The cashier (or manager) counts the cash, prepares a deposit slip, and deposits the cash at the bank. The cashier also sends a duplicate of the deposit slip to the accounting department to indicate cash received. The supervisor removes the cash register tape and sends it to the accounting department as the basis for a journal entry to record the cash received. (For point-of-sale systems, the accounting department receives information on daily transactions and totals through the computer network.) Illustration 7.5 summarizes this process (see Helpful Hint).

1114237 - Wiley US ©

ILLUSTRATION 7.5 Control of over-the-counter receipts

HELPFUL HINT

Flowcharts such as this one enhance the understanding of the flow of documents, the processing steps, and the internal control procedures.

This system for handling cash receipts uses an important internal control principle— segregation of recordkeeping from physical custody. The supervisor has access to the

1114237 - Wiley US ©

cash register tape but not to the cash. The clerk and the cashier have access to the cash but not to the register tape. In addition, the cash register tape provides documentation and enables independent internal verification. Use of these three principles of internal control (segregation of recordkeeping from physical custody, documentation, and independent internal verification) provides an effective system of internal control. Any attempt at fraudulent activity should be detected unless there is collusion among the employees.

In some instances, the amount deposited at the bank will not agree with the cash recorded in the accounting records based on the cash register tape. These differences often result because the clerk hands incorrect change back to the retail customer. In this case, the difference between the actual cash and the amount reported on the cash register tape is reported in a Cash Over and Short account. For example, suppose that the cash register tape indicated sales of $6,956.20 but the amount of cash was only $6,946.10. A cash shortfall of $10.10 exists. To account for this cash shortfall and related cash, the company makes the following entry.

Cash 6,946.10 Cash Over and Short 10.10  Sales Revenue  6,956.20   (To record cash shortfall)

Cash Over and Short is an income statement item. It is reported as miscellaneous expense when there is a cash shortfall, and as miscellaneous revenue when there is an overage. Clearly, the amount should be small. Any material amounts in this account should be investigated.

Mail Receipts

All mail receipts should be opened in the presence of at least two mail clerks. These receipts are generally in the form of checks. A mail clerk should endorse each check “For Deposit Only.” This restrictive endorsement reduces the likelihood that someone could divert the check to personal use. Banks will not give an individual cash when presented with a check that has this type of endorsement.

The mail clerks prepare, in triplicate, a list of the checks received each day. This list shows the name of the check issuer, the purpose of the payment, and the amount of the check. Each mail clerk signs the list to establish responsibility for the data. The original copy of

1114237 - Wiley US ©

the list, along with the checks, is then sent to the cashier’s department. A copy of the list is sent to the accounting department for recording in the accounting records. The clerks also keep a copy.

This process provides excellent internal control for the company. By employing at least two clerks, the chance of fraud is reduced. Each clerk knows he or she is being observed by the other clerk(s). To engage in fraud, they would have to collude. The customers who submit payments also provide control because they will contact the company with a complaint if they are not properly credited for payment. Because the cashier has access to the cash but not the records, and the accounting department has access to the records but not the cash, neither can engage in undetected fraud.

Cash Disbursements Controls Companies disburse cash for a variety of reasons, such as to pay expenses and liabilities or to purchase assets. Generally, internal control over cash disbursements is more effective when companies pay by check or electronic funds transfer (EFT) rather than by cash. One exception is payments for incidental amounts that are paid out of petty cash.2

Companies generally issue checks only after following specified control procedures. Illustration 7.6 shows how principles of internal control apply to cash disbursements.

1114237 - Wiley US ©

ILLUSTRATION 7.6 Application of internal control principles to cash disbursements

Voucher System Controls

Most medium and large companies use vouchers as part of their internal control over cash disbursements. A voucher system is a network of approvals by authorized individuals, acting independently, to ensure that all disbursements by check are proper.

The system begins with the authorization to incur a cost or expense. It ends with the issuance of a check for the liability incurred. A voucher is an authorization form prepared for each expenditure. Companies require vouchers for all types of cash disbursements except those from petty cash.

The starting point in preparing a voucher is to fill in the appropriate information about the liability on the face of the voucher. The vendor’s invoice provides most of the needed information. Then, an employee in the accounts payable department records the voucher (in a journal called a voucher register) and files it according to the date on which it is to be paid. The company issues and sends a check on that date, and stamps the voucher “paid.” The paid voucher is sent to the accounting department for recording (in a journal called the check register). A voucher system involves two journal entries, one to record the

1114237 - Wiley US ©

liability when the voucher is issued and a second to pay the liability that relates to the voucher.

The use of a voucher system, whether done manually or electronically, improves internal control over cash disbursements. First, the authorization process inherent in a voucher system establishes responsibility. Each individual has responsibility to review the underlying documentation to ensure that it is correct. In addition, the voucher system keeps track of the documents that back up each transaction. By keeping these documents in one place, a supervisor can independently verify the authenticity of each transaction. Consider, for example, the case of Aesop University presented earlier in the Anatomy of a Fraud box. Aesop did not use a voucher system for transactions under $2,500. As a consequence, there was no independent verification of the documents, which enabled the employee to submit fake invoices to hide his unauthorized purchases.

Petty Cash Fund As you just learned, better internal control over cash disbursements is possible when companies make payments by check. However, using checks to pay small amounts is both impractical and a nuisance. For instance, a company would not want to write checks to pay for postage due, working lunches, or taxi fares. A common way of handling such payments, while maintaining satisfactory control, is to use a petty cash fund to pay relatively small amounts (see Ethics Note). The operation of a petty cash fund, often called an imprest system, involves (1) establishing the fund, (2) making payments from the fund, and (3) replenishing the fund.3 We explain the operation of a petty cash fund in Appendix 7A.

ETHICS NOTE

Petty cash funds are authorized and legitimate. In contrast, “slush” funds are unauthorized and hidden (under the table).

1114237 - Wiley US ©

Ethics Insight

How Employees Steal

Occupational fraud is using your own occupation for personal gain through the misuse or misapplication of the company’s resources or assets. This type of fraud is one of three types:

1. Asset misappropriation, such as theft of cash on hand, fraudulent disbursements, false refunds, ghost employees, personal purchases, and fictitious employees. This fraud is the most common but the least costly.

2. Corruption, such as bribery, illegal gratuities, and economic extortion. This fraud generally falls in the middle between asset misappropriation and financial statement fraud as regards frequency and cost.

3. Financial statement fraud, such as fictitious revenues, concealed liabilities and expenses, improper disclosures, and improper asset values. This fraud occurs less frequently than other types of fraud but it is the most costly.

1114237 - Wiley US ©

The graph below shows the frequency and the median loss for each type of occupational fraud. (Note that the sum of percentages exceeds 100% because some cases of fraud involved more than one type.)

Source: 2016 Report to the Nations on Occupational Fraud and Abuse, Association of Certified Fraud Examiners, p. 12.

How can companies reduce the likelihood of occupational fraud? (Go to WileyPLUS for this answer and additional questions.)

1114237 - Wiley US ©

DO IT! 2 | Control over Cash Receipts

L. R. Cortez is concerned about the control over cash receipts in his fast-food restaurant, Big Cheese. The restaurant has two cash registers. At no time do more than two employees take customer orders and enter sales. Work shifts for employees range from 4 to 8 hours. Cortez asks your help in installing a good system of internal control over cash receipts.

ACTION PLAN

Differentiate among the internal control principles of (1) establishing responsibility, (2) physical controls, and (3) independent internal verification.

Design an effective system of internal control over cash receipts.

Solution

Cortez should assign a separate cash register drawer to each employee at the start of each work shift, with register totals set at zero. Each employee should have access to only the assigned register drawer to enter all sales. Each customer should be given a receipt. At the end of the shift, the employee should do a cash count. A separate employee should compare the cash count with the register tape (or point-of-sale records) to be sure they agree. In addition, Cortez should install an automated point- of-sale system that would enable the company to compare orders entered in the register to orders processed by the kitchen.

Related exercise material: BE7.5, BE7.6, BE7.7, BE7.8, DO IT! 7.2, E7.3, E7.4, E7.5, E7.6, and E7.7.

Control Features of a Bank Account

LEARNING OBJECTIVE 3

Identify the control features of a bank account.

The use of a bank contributes significantly to good internal control over cash. A company safeguards its cash by using a bank as a depository and clearinghouse for checks received and checks written. The use of a bank checking account minimizes the amount of currency that must be kept on hand. It also facilitates control of cash because a double record is maintained of all bank transactions—one by the business and the other

1114237 - Wiley US ©

by the bank. The asset account Cash maintained by the company is the “flipside” of the bank’s liability account for that company. A bank reconciliation is the process of comparing the bank’s balance with the company’s balance, and explaining the differences to make them agree.

Many companies have more than one bank account. For efficiency of operations and better control, national retailers like Wal-Mart and Target often have regional bank accounts. Similarly, a company such as ExxonMobil with more than 100,000 employees may have a payroll bank account as well as one or more general bank accounts. In addition, a company may maintain several bank accounts in order to have more than one source for short-term loans.

Electronic Funds Transfer (EFT) System It is not surprising that companies and banks have developed approaches to transfer funds among parties without the use of paper (deposit tickets, checks, etc.). Such procedures, called electronic funds transfers (EFTs), are disbursement systems that use wire, telephone, or computers to transfer cash from one location to another. Use of EFT is quite common. For example, many employees receive no formal payroll checks from their employers. Instead, employers send electronic payroll data to the appropriate banks. Also, companies now frequently make regular payments such as those for utilities, rent, and insurance by EFT.

EFT transactions normally result in better internal control since no cash or checks are handled by company employees. This does not mean that opportunities for fraud are eliminated. In fact, the same basic principles related to internal control apply to EFT transactions. For example, without proper segregation of duties and authorizations, an employee might be able to redirect electronic payments into a personal bank account and conceal the theft with fraudulent accounting entries.

Bank Statements Each month, the company receives from the bank a bank statement showing its bank transactions and balances.

4 For example, the statement for Laird Company in Illustration

7.7 shows the following: (1) checks paid and other debits (such as debit card transactions or electronic funds transfers for bill payments) that reduce the balance in the depositor’s account, (2) deposits (by direct deposit, automated teller machine, or electronic funds transfer) and other credits that increase the balance in the depositor’s account, and (3) the account balance after each day’s transactions (see Helpful Hint).

1114237 - Wiley US ©

ILLUSTRATION 7.7 Bank statement

HELPFUL HINT

Essentially, the bank statement is a copy of the bank’s records sent to the customer or made available online for review.

Remember that bank statements are prepared from the bank’s perspective. For example, every deposit the bank receives is an increase in the bank’s liabilities (an account

1114237 - Wiley US ©

payable to the depositor). Therefore, in Illustration 7.7, National Bank and Trust credits to Laird Company every deposit it received from Laird. The reverse occurs when the bank “pays” a check issued by Laird Company on its checking account balance: Payment reduces the bank’s liability and is therefore debited to Laird’s account with the bank.

The bank statement lists in numerical sequence all paid checks along with the date the check was paid and its amount. Upon paying a check, the bank stamps the check “paid”; a paid check is sometimes referred to as a canceled check. In addition, the bank includes with the bank statement memoranda explaining other debits and credits it made to the depositor’s account.

A check that is not paid by a bank because of insufficient funds in a bank account is called an NSF check (not sufficient funds). The bank uses a debit memorandum when a previously deposited customer’s check “bounces” because of insufficient funds. In such a case, the customer’s bank marks the check NSF (not sufficient funds) and returns it to the depositor’s bank. The bank then debits (decreases) the depositor’s account, as shown by the symbol NSF in Illustration 7.7, and sends the NSF check and debit memorandum to the depositor as notification of the charge. The NSF check creates an account receivable for the depositor and reduces cash in the bank account.

Reconciling the Bank Account Because the bank and the company maintain independent records of the company’s checking account, you might assume that the respective balances will always agree. In fact, the two balances are seldom the same at any given time, and both balances differ from the “correct or true” balance. Therefore, it is necessary to make the balance per books and the balance per bank agree with the correct or true amount—a process called reconciling the bank account. The need for reconciliation has two causes:

1. Time lags that prevent one of the parties from recording the transaction in the same period.

2. Errors by either party in recording transactions.

Time lags occur frequently. For example, several days may elapse between the time a company pays by check and the date the bank pays the check. Similarly, when a company uses the bank’s night depository to make its deposits, there will be a difference of one day between the time the company records the receipts and the time the bank does so. A time lag also occurs whenever the bank mails a debit or credit memorandum to the company.

You might think that if a company never writes checks (for example, if a small company uses only a debit card or electronic bill funds transfers), it does not need to reconcile its account. However, the possibility of errors or fraud still necessitates periodic reconciliation. The incidence of errors or fraud depends on the effectiveness of the internal controls maintained by the company and the bank. Bank errors are infrequent. However, either party could accidentally record a $450 check as $45 or $540. In addition, the bank might mistakenly charge a check drawn by C. D. Berg to the account of C. D. Burg.

Reconciliation Procedure

1114237 - Wiley US ©

In reconciling the bank account, it is customary to reconcile the balance per books and balance per bank to their adjusted (correct or true) cash balances. To obtain maximum benefit from a bank reconciliation, an employee who has no other responsibilities related to cash should prepare the reconciliation. When companies do not follow the internal control principle of independent internal verification in preparing the reconciliation, cash embezzlements may escape unnoticed. For example, in the Anatomy of a Fraud box presented earlier, a bank reconciliation by someone other than Angela Bauer might have exposed her embezzlement.

Illustration 7.8 shows the reconciliation process (see Helpful Hint). The starting point in preparing the reconciliation is to enter the balance per bank statement and balance per books on a schedule. The following steps should reveal all the reconciling items that cause the difference between the two balances.

1114237 - Wiley US ©

ILLUSTRATION 7.8 Bank reconciliation adjustments

HELPFUL HINT

Deposits in transit and outstanding checks are reconciling items because of time lags.

Reconciling Items per Bank

1114237 - Wiley US ©

On the bank side of the reconciliation, the items to reconcile are deposits in transit (amounts added), outstanding checks (amounts deducted), and bank errors (if any). By adjusting the bank balance for these items, a company brings that balance up to date.

Step 1 Deposits in transit (+). Compare the individual deposits on the bank statement with the deposits in transit from the preceding bank reconciliation and with the deposits per company records or copies of duplicate deposit slips. Deposits recorded by the depositor that have not been recorded by the bank represent deposits in transit. Add these deposits to the balance per bank.

Step 2 Outstanding checks (−). Compare the paid checks shown on the bank statement or the paid checks returned with the bank statement with (a) checks outstanding from the preceding bank reconciliation, and (b) checks issued by the company as recorded in the cash payments journal. Issued checks recorded by the company that have not been paid by the bank represent outstanding checks. Deduct outstanding checks from the balance per bank.

Step 3 Bank errors (+/−). Note any errors made by the bank that were discovered in the previous steps. For example, if the bank processed a deposit of $1,693 as $1,639 in error, the difference of $54 ($1,693 − $1,639) is added to the balance per bank on the bank reconciliation. All errors made by the bank are reconciling items in determining the adjusted cash balance per the bank.

Reconciling Items per Books

Reconciling items on the book side relate to amounts not yet recorded on the company’s books and include adjustments from deposits and other amounts added, payments and other amounts deducted, and company errors (if any).

Step 1 Other deposits (+). Compare the other deposits on the bank statement with the company records. Any unrecorded amounts should be added to the balance per books. For example, if the bank statement shows electronic funds transfers from customers paying their accounts online, these amounts should be added to the balance per books on the bank reconciliation to update the company’s records unless they had previously been recorded by the company.

Step 2 Other payments (−). Similarly, any unrecorded other payments should be deducted from the balance per books. For example, if the bank statement shows service charges (such as debit and credit card fees and other bank service charges), this amount is deducted from the balance per books on the bank reconciliation to make the company’s records agree with the bank’s records. Normally, the company will already have recorded electronic payments. However, if this has not been the case then these payments must be deducted from the balance per books on the bank reconciliation to make the company’s records agree with the bank’s records.

Step 3 Book errors (+/−). Note any errors made by the depositor that have been discovered in the previous steps. For example, say a company wrote check No. 443 to a supplier in the amount of $1,226 on April 12, but the accounting clerk recorded the check amount as $1,262. The error of $36 ($1,262 − $1,226) is added to the balance per books because the company reduced the balance per books by $36 too much when it recorded

1114237 - Wiley US ©

the check as $1,262 instead of $1,226. Only errors made by the company, not the bank, are included as reconciling items in determining the adjusted cash balance per books.

Bank Reconciliation Illustrated

Illustration 7.7 presented the bank statement for Laird Company which the company accessed online (see Helpful Hint). It shows a balance per bank of $15,907.45 on April 30, 2022. On this date the balance of cash per books is $11,709.45.

HELPFUL HINT

Note in the bank statement in Illustration 7.7 that the bank has paid checks No. 459 and 461, but check No. 460 is not listed. Thus, this check is outstanding. If a complete bank statement were provided, checks No. 453 and 457 also would not be listed. Laird obtains the amounts for these three checks from its cash payments records.

From the foregoing steps, Laird determines the following reconciling items for the bank.

Step 1 Deposits in transit (+): April 30 deposit (received by bank on May 1). $2,201.40 Step 2 Outstanding checks (−): No. 453, $3,000.00; No. 457, $1,401.30; No. 460, $1,502.70. 5,904.00 Step 3 Bank errors (+/−): None.

Reconciling items per books are as follows.

Step 1 Other deposits (+): Unrecorded electronic receipt from customer on account on April 9 determined from the bank statement. $1,035.00 Step 2 Other payments (−): The electronic payments on April 3 and 7 were previously recorded by the company when they were initiated. Unrecorded charges determined from the bank statement are as follows:  Returned NSF check on April 29 425.60  Debit and credit card fees on April 30 120.00  Bank service charges on April 30 30.00 Step 3 Company errors (+): Check No. 443 was correctly written by Laird for $1,226 and was correctly paid by the bank on April 12. However, it was recorded as $1,262 on Laird’s books. 36.00

Illustration 7.9 shows Laird’s bank reconciliation (see Alternative Terminology).

1114237 - Wiley US ©

ILLUSTRATION 7.9 Bank reconciliation

ALTERNATIVE TERMINOLOGY

The terms adjusted cash balance, true cash balance, and correct cash balance are used interchangeably.

Entries from Bank Reconciliation

The depositor (that is, the company) next must record each reconciling item used to determine the adjusted cash balance per books. If the company does not journalize and post these items, the Cash account will not show the correct balance. The adjusting entries for the Laird Company bank reconciliation on April 30 are as follows (see Helpful Hint).

HELPFUL HINT

These entries are adjusting entries. In prior chapters, we considered Cash an account that did not require adjustment because we had not yet explained a bank reconciliation.

1114237 - Wiley US ©

Collection of Electronic Funds Transfer

A payment of an account by a customer is recorded in the same way, whether the cash is received through the mail or electronically. The entry by Laird to record the EFT collection (which it learned of from the bank statement) is as follows.

Apr. 30 Cash 1,035  Accounts Receivable  1,035   (To record receipt of electronic funds transfer)

Book Error

An examination of the cash disbursements journal shows that check No. 443 was a payment on account to Andrea Company, a supplier. The correcting entry is as follows.

Apr. 30 Cash 36  Accounts Payable—Andrea Company  36   (To correct error in recording check No. 443)

NSF Check

As indicated earlier, an NSF check becomes an accounts receivable to the depositor. The entry is as follows.

1114237 - Wiley US ©

Apr. 30 Accounts Receivable—J. R. Baron 425.60  Cash  425.60   (To record NSF check)

Bank Charges Expense

Fees for processing debit and credit card transactions are normally debited to the Bank Charges Expense account, as are bank service charges. We have chosen to combine and record these in one journal entry, as the following shows, although they also could be journalized separately.

Apr. 30

Bank Charges Expense 150

 Cash   150

  (To record charges for debit and credit card fees of $120 and bank service charges of $30)

After Laird posts the entries, the Cash account will appear as in Illustration 7.10. The adjusted cash balance in the ledger should agree with the adjusted cash balance per books in the bank reconciliation in Illustration 7.9.

1114237 - Wiley US ©

ILLUSTRATION 7.10 Adjusted balance in Cash account

Cash Apr. 30  Bal.  11,709.45 Apr. 30  425.60

30 1,035.00 30 150.00 30 36.00

Apr. 30 Bal. 12,204.85

What entries does the bank make? If the company discovers any bank errors in preparing the reconciliation, it should notify the bank so the bank can make the necessary corrections on its records. The bank does not make any entries for deposits in transit or outstanding checks. Only when these items reach the bank will the bank record these items.

1114237 - Wiley US ©

Investor Insight

Madoff’s Ponzi Scheme

No recent fraud has generated more interest and rage than the one perpetrated by Bernard Madoff. Madoff was an elite New York investment fund manager who was highly regarded by securities regulators. Investors flocked to him because he delivered steady returns of between 10% and 15%, no matter whether the market was going up or going down. However, for many years, Madoff did not actually invest the cash that people gave to him. Instead, he was running a Ponzi scheme: He paid returns to existing investors