* Businesses must clearly define the roles and responsibilities of employees who sign expense reports and those who process the reports. That should eliminate confusion about whether a manager's signature means that the individual is authorizing the expenses as reasonable business expenses or signifies that the manager reviewed the report and supporting detail and attests to the validity of the expenses.
* Travel and expense transactions should be reviewed randomly for evidence of compliance with corporate policy, proper authorization and approval and the overall reasonableness of expenses. Internal auditors should also conduct periodic reviews of the activities of employees with the highest expense reimbursement totals.
* Duties such as signing expense reports and monitoring /managing the budget should be segregated, A fraudster given both of those responsibilities can attempt to bury questionable expenses in under-budget categories.
This is the story of how a travel and expense report audit exposed a fraudster who siphoned money from the fashion company where she worked to fund her own lavish spending.
The fraudster, Bobbie Jean Donnelly, had taken advantage of a lack of adequate controls over her division's budget and a lax system for reviewing expenses. The company's internal audit team detected her crime by analyzing patterns in a year's worth of reports from employees with the highest travel and expense bills.
Donnelly was hired as an administrative assistant to the manager of a Los Angeles-based design division for a multibillion-dollar retail corporation. Based on her strong performance, she was quickly promoted to office manager for the division.
In addition to managing her boss's needs, she supervised support personnel and prepared and oversaw the design department's budget. Her manager gave her the responsibility to provide the first level of expense report review. He relied on her to ensure that the expenses were valid before he signed them. On a few occasions, he even asked her to sign the expense reports on his behalf.
As the business grew, management decided it was time to build a traditional internal audit department. That's where I came in. My internal audit team was conducting a routine travel and expense audit. We developed an audit program designed to ensure that employees were following the corporate travel and expense policy and that adequate internal controls for the processing and payment of expense reports were in place and operating effectively
The team assembled a sample of individuals and transactions to test. The individuals were selected from the population of employees who submitted the highest dollar amounts over the course of the year for reimbursement. The transactions were selected randomly across the total population of submitted expenses.
The approach and criteria used to audit the individuals differed significantly from the approach used to audit the transactions. The transactions were reviewed for compliance with the policy, proper authorization and approval, and overall reasonableness of the expense. That work yielded some audit exceptions--mostly small and isolated--but no major surprises.
The more interesting results of the work came from the review of individuals. We looked at the reasonableness of the expenses based on the employee's role in the company and searched for any patterns of activity that seemed unusual.
We quickly identified a group of individuals who routinely submitted their American Express bills for reimbursement instead of submitting detailed receipts of individual expenses. A closer look revealed that many employees were submitting expenses twice. The bills began to show a pattern--one month of charges, the next month a late fee with old charges and new charges combined. It didn't take long for us to determine that the activity was coming from one area of the business--the design department. …