How to catch a thief!

BY Catherine Lightfoot, CPA, CHBC, Director of Healthcare at EEPB

Your busy medical practice is an easy target for embezzlers. According to the Association of Certified Fraud Examiners, approximately $25 billion annually is lost in medical practice offices from employee theft and fraud. Unfortunately, it is difficult to detect these in-house crimes, as they typically occur across several areas of the practice over several years—potentially adding up to huge amounts. Such behaviors can be categorized by a variety of illegal schemes you need to defend against, including the three main ones described below.

Schemes to defend against

Expense Fraud

This type of fraud involves the creation of fake vendors and invoices, against which the criminal secretly banks the payment received as their own. It sometimes extends to using the company credit card for personal expenses.

 

Theft of Cash and Inventory

This type of theft is where an employee regularly removes small amounts of cash or inventory under the radar. While the amount is not noticeable on a weekly or even monthly basis, it could become a significant loss over a long period.

 

Fraudulent Payroll Practices

These practices relate to padding payroll via scams like adding fake workers, reporting ‘unworked’ overtime hours, or issuing unauthorized bonuses. They are common ways of moving money from the company account into a personal account.

Controls to implement

So, how do you take away the opportunity for an employee to steal hundreds of thousands of dollars? You need to implement and monitor a system of internal controls to protect your business assets. I recommend implementing these eight controls to proactively spot red flags—hopefully before fraud occurs:

1. Separation of Duties – Functions such as bookkeeping, deposits, and financial reporting should be performed by different employees. This makes embezzlement harder but not impossible. An owner still needs to have some financial oversight to watch for outliers.
2. Controlled Access – It is critical to restrict company access to funds, data, computers, and inventory. If someone does not need access, do not give it to them; end of story. Those that need access should be supervised in some way.
3. Procedures and Processes – Create a set of standard procedures and processes, insisting everyone follows them. If you have systems in place and employees see that you regularly track compliance, they will be likelier to toe the line for fear of being caught during an inspection.
4. Regular Audits – Audits should be carried out randomly and without notice. You also want to utilize employees who do not normally perform those functions. In-person site visits to observe office operations or an unannounced review of specific account details are some examples of surprise audits.
5. Payroll Review – Payroll should have at least one, if not two, reviews before it is released. Every time! This allows you to keep a close watch on employee count and work hours posted and ensure pay rates are the same (unless approved by owners). A good exercise is to check the current payroll against prior pay periods and be able to explain the differences.
6. Expense Policies – Every expense must have a receipt to be reimbursed. Repeat expenses should be questioned further. Expense reimbursements over a certain threshold should require prior authorization.
7. Cash Flow Projections – A key defense is to predict your expected earnings and compare them to what you actually receive. If revenue does not match your prediction, investigate the cause immediately.
8. Employee Checks – Insist on employees taking their allotted vacation time off. The thief has a schedule and will not like any interruption. It is also good practice to consistently perform background checks on all new hires. Then, keep an eye on their daily routine during initial onboarding. This is tricky since they might look like a model employee, coming in early, and staying late; but remember, the criminal mind is known for being a perpetual liar.

Summary

Embezzlers are experts at fooling your business. All it takes is a tiny crack in the system and an employee who feels deserving to set the stage for theft or fraud. If there is a loophole to steal, they will find a way. Your only defense is consistent pressure by monitoring and exploring red flags as soon as they are spotted. If a business procedure is not followed or monetary figures are out of the normal range, track it down and correct it. You just might be saving your practice a serious financial loss.