What is Occupational Fraud?
Occupational fraud is fraud committed by an employee on an employer in the course of their employment. They are more common and cause more financial loss to businesses than frauds committed by third parties. As employees will continue to work at the business, they will generally try to hide these frauds permanently, meaning that occupational fraud can be committed over an extended period of time.
What are ghost employee frauds?
A ghost employee is someone recorded on the payroll system, but who does not work for the business. The ghost can be a real person who knowingly or not is placed on the payroll, or a fictitious person invented by the dishonest employee. The fraud attacks the payroll system with false employees.
The aim of the fraud is to have a wage paid to the ghost and collected by the dishonest employee. This is done by entering the ghost employee into the payroll system. The fraud does not require an accomplice but, depending on how wages are paid, an accomplice may make the fraud easier to conduct as it will eliminate any need to convert the payment from the ghost to the dishonest employee.
Major Headings
Description of Ghost Employee Frauds
1. Creating the Ghost
2. Generating false time sheets
3. Collecting and converting paymentsFor example
Lessons to be Learned
Prevention and Detection
Description of Ghost Employee Frauds
The goal is for the employee to collect the wage paid to the ghost. This is theft of money. Given that total wages paid to any employee during the year can be high, the cumulative loss over a year of one or more ghost employees can be significant.
The fraud is usually done in businesses with large numbers of employees, particularly when employees are spread over a number of physical locations and where the payroll function is controlled centrally. But this is not necessary. Small businesses may be victims when the payroll process is managed by one person, and that person either is the fraudster or does not pay much attention to the payroll process.
The employee will usually need some access to the payroll system to add the ghost. The fraud may be done by any employee, but the fraud will be more difficult the more remote he or she is from the payroll process. One of the benefits of this fraud is that there is no need to hide the payment, as it is recorded as a normal payroll transaction.
Who does this fraud?
Commonly, the dishonest employee is the person that authorizes the payroll payments or has control over adding and deleting employees from the payroll register. Who can manipulate these processes will depend on the system in place and the number of people involved in the payroll process. It also depends on how the money is paid to the employees. System that have cash payments need to be manipulated differently to systems that pay by direct deposit.
The employee does not need to control the entire payroll system, or have any control over the system at all. Once the ghost is entered into the system, the system itself will generate the payments to the ghost without further action or review by payroll staff. As long as the method of payment has been considered, the employee may be able to just sit back and collect the payments.
How are these frauds done?
There are three basic steps to a ghost employee fraud. These are:
1. Creating the ghost;
2. Generating false time sheets; and
3. Collecting and converting the payments.
1. Creating the Ghost
The fist step is placing the ghost into the payroll system. If the dishonest employee has access to the system, this may be as easy as using the ‘Add Employee’ function in the payroll program bypassing any controls in place. If the fraudster does not have access to system, they may need to forge the necessary documents and authorizations to add an employee. In large businesses with a high staff turnover, the forged documents may not be noticed amongst the real documents, or there may be little or no checks performed on the information submitted.
Exactly how the ghost is entered into the payroll system will depend on the system in place.
One variation is to leave a past employee on the system after they have left and redirecting the wage payments. This may be preferable if the fraudster cannot gain access the add employee process but can manipulate the termination process.
The risk of a ghost being added increases when there is a high turnover of staff. It increases again when the business has part-time or casual employees and the payroll staff see a variety of names come and go from the wages list. This reduces the chance that a ghost will be recognized amongst the numerous changing names.
2. Generating false time sheets
The dishonest employee may not have to take any action to generate the payment if the ghost is paid a salary. The ghost will simply be paid the same amount every month. If the ghost is paid a wage or remuneration calculated on hours worked or the type of work done, the employee may need to forge that information to generate the payment. What action is necessary will depend on how wages are calculated.
If the employee has access to that part of the payroll system, they can enter any required information or bypass that function and generate the payment. If they do not have access, they will have to falsify the required information and have it processed by the payroll staff. Having to fill in time sheets or other information increases the risk of the fraud being found and the employee being identified. For this reason, employees normally prefer to have ghosts paid by salary.
3. Collecting and converting payments
The payment must be collected by the employee and, if necessary, converted into a useable form. What steps are necessary will depend on how employees are paid.
If wages are paid in cash: the employee needs to get their hands on the ghost’s pay packet. This is easy if the employee is the one preparing or handing them out. If they cannot get their hands on the pay packet without raising suspicion, the fraud will not work. One benefit to the employee is that cash does not need to be converted to be usable and is difficult to trace. Once it is in the employee’s pocket, the trail will end.
If wages are handed or mailed cheques: the employee will need to get the ghost’s cheque. This may be easy if they prepare or hand or mail the cheques out, but may be extremely difficult if they do not and the cheques need to be collected. The cheques may be mailed to any location listed on the ghost’s employee record, but that location will be known if the fraud is discovered. It will have to be remote from the dishonest employee. Also cheques need to be converted to be usable, so having the ghost in an accomplice’s name will provide a convenient bank account. But cheques can easily be traced to a bank account. Cheque cashing businesses may be used, but require identification. Converting the cheque is the biggest issue in this method.
If wages are paid by direct deposit: the employee does not need to do anything to get the payment and the payment does not need to be converted. But the employee requires a bank account to receive the money. An accomplice and their bank account is handy, but tracing the payment is easy should the fraud be discovered. Setting up a bank account in a false name is difficult without sufficient identification, and the records at the bank will lead to the employee.
Some difficulties for the employee
Two difficulties with this scheme are:
(1) The employee has to have access to a bank account or be willing to forge an endorsement on a payroll cheque to convert it to cash. An endorsement may leave a trial to the fraudster. The problem can be overcome if the ghost is an accomplice, but the accomplice will be identified if payments are traced and will have difficulty proving that they worked for the victim business. The employee will also have to split the stolen money with the accomplice.(2) Working around staff performance reviews and other staff functions may be difficult. A ghost cannot attend a performance review or be considered for promotion. This is overcome if the only place that the ghost is recorded is in the payroll system and not at any particular work area. An employee with access to the employee records can create and adjust the employee file to overcome these problems. This problem is also overcome if the ghost is a part-time or casual employee and only stays on the system for a limited time, before leaving and being replaced with another ghost.
For example
Company A was a road transport company that conducted a transportation business. There was no problem with the transportation side of the company.
Company B was an associated company. Company B employed the drivers and contracted them to Company A. Company B did all of the payroll functions for those employees and kept all employee records. Each month Company B would invoice Company A for all of the wages, payroll and group taxes, workers compensation insurance, etc. that was due. These amounts were all grouped in one invoice and not dissected by the separate drivers. The amount of the invoice varied from month to month as work fluctuated.
Company A would send one cheque to Company B covering all of these costs, who would then pay the drivers in cash and pay all other related expenses.
The directors of the the companies left the recording and making of all payments to one trusted employee. That employee added an extra part-time employee to the payroll system, a ghost. The monthly invoice was increased for this new driver. No one checked the system or noticed the extra name and the increased amount.
The wages were paid in cash by that trusted employee, after a total wages cheque was signed by a director. The employee pocketed the cash paid that was paid to the ghost. The directors did not realize that the listing that they authorized contained a ghost employee and the names on the list varied as different drivers were hired and left employment. There were no controls in place and no review process undertaken.
Lessons to be Learned
1. Ghost employee frauds have the same effect on businesses as theft of monies. Individually the amounts may appear small, but over time they may add up to a significant amount, particularly if a number of ghosts are added and retired over time.
2. Ghost employees may be hard to find once they have been added to the system. The larger and more diverse the business, the harder the task will be. Ghost employees must usually be actively sought out to be discovered.
3. These frauds work on weaknesses in controls over the payroll system.
Prevention and Detection
Some things to look for
(i) Employee files with missing information as the dishonest employee will want to place as little verifiable information on the file as possible. There may be no personnel file at all.(ii) A number of employees with the same mailing address or using post boxes as mailing addresses. Computerized payroll systems should be able to cross-check this information.
(iii) More than one employee using the same bank account for the deposit of wages. This can also be easily checked with computerized payroll systems.
(iv) An unexplained and regular turnover of staff, particularly in employees from one area of the business and especially if that area is remote.
(v) An employee name on the payroll list that do not have a clearly defined job description, or that no one (or only one person) can recognize.
Some Basic Controls
The following steps should reduce the likelihood of ghost employee frauds by reducing the opportunity for them to be started, and increasing the chance of detection.
1. Do not make cash wages payments. Cash is easily stolen and leaves no trail. If cash or cheque payments are made, rotate the people preparing and handing out the cash or cheques, have a non-payroll person present at the time, and have employees sign for their pay packet or cheque. The first two are prevention controls. If a ghost is found, the third will assist in detection of the fraudster.2. Have supervisors approve payroll payments to their direct employees on a random basis. This should highlight names on the payroll register that nobody recognizes.
3. Add and remove employees only with approval and verification by a number of people, or at least someone outside the payroll department. Ideally this person will be the manager under which that the employee will or did work. This adds a separation of duties control into this important function.
4. Organize performance reviews to occur personally with all employees on the payroll register, not organized by particular sites or groups. Ghost employees do not work on a site or for a group and therefore will be missed by a normal review process. Not all businesses conduct performance reviews but similar checks looking at all employees on the payroll list should be done.
5. Rotate the responsibility for individual payroll functions between a number of people. The entire function should not be in the hands of any one employee.
6. Have management check the payroll listing from time to time looking for suspicious names and addresses, and randomly meet employees on the payroll register. For businesses with manageable numbers of employees, have a non-payroll person randomly walk around with a payroll list and meet every employee on the list.