Finding FCPA Violations in Employee Expense Reports

Travel and entertainment expenses have long been a haven for fraud and abuse. Lately, however, companies have shifted their worries to whether there may be evidence of bribery or corruption hiding in employee expense reports.

As the crackdown by U.S. officials on compliance with the Foreign Corrupt Practices Act continues to intensify, companies have started paying more attention to weaknesses in their T&E processes that might allow violations to slip through unnoticed. “T&E is the key mechanism by which FCPA violations can occur,” says Todd Marlin, an Ernst & Young principal who focuses on forensic technology and discovery.

With Walmart now facing steep consequences for alleged FCPA violations that went unchecked for years, companies are sure to take closer notice of where they may have vulnerabilities, says Andrew Levi, a former assistant U.S. attorney and head of the Miami office for investigative firm Nardello & Co. “Walmart is certainly an example of how an FCPA problem can get much larger for a company if it is ignored. If T&E goes unchecked, it can make a company susceptible to allegations of corruption.”

One of the reasons T&E expense provides a breeding ground for FCPA violations is that, while it is a common trouble spot for fraud, the dollar amounts are usually not substantial, meaning that companies don't always pay close attention to it.  In 2010, for example, asset misappropriation, which includes T&E abuse, represented 86 percent of all frauds, yet each case represented an average loss of $135,000, according to data from the Association of Certified Fraud Examiners. Financial reporting fraud, by comparison, represented 10.3 percent of all fraud cases, but losses for each instance averaged $4.1 million.

Accounting experts are now advising companies to pay closer attention to T&E expenses and to look there for potential bribery or corruption payments. Mitigating risks for T&E abuse starts with a clear, effective policy that is implemented and enforced, says Jonathan Marks, a partner with Crowe Horwath in fraud, ethics, and anti-corruption services. Too many companies are operating under policies that are vaguely written and loosely enforced, leaving employees free to flex them to the point of abuse, he says.

At other companies the policies are in place, but they're outdated. Peter Brady, principal with McGladrey & Pullen, says he sees plenty of cases where companies have adopted T&E expense policies, but they haven't been updated to address recent concerns about bribery and corruption. “There's no substitute in my mind for clear policies regarding expenses,” he says. “So many companies have policies, but they're not clear, they're not up to date, or they don't cover everything the company needs to cover.”

“There may be more than 40 different codes or ways to spend money. That makes it a lot easier to hide and misuse funds.”

—Debi Scholar,

Independent Consultant, Blogger,

T&E Issues

The areas of meetings and event planning have become bigger risks for T&E abuse, including FCPA infractions, in recent years, says Debi Scholar, an independent T&E consultant. When an individual travels for business, they may have expenses tied to four or five areas, she says, such as hotel, transportation, and meals. But individuals who host corporate events spend far more and those costs fall in to far more categories. “There may be more than 40 different codes or ways to spend money,” she says. “That makes it a lot easier to hide and misuse funds.” She tells companies to use the strategic meeting management process endorsed by the Global Business Travel Association as a way to better track meeting spending and spot potential abuse.

Another way to prevent T&E expense from becoming a conduit for FCPA violations is to get a better handle on expense reports in general. Experts put T&E controls into two categories -- preventive and detective. Preventive controls include preapprovals for expenses over a certain threshold, preapproved vendors, corporate purchasing cards that may have dollar limits or merchant restrictions, and other restrictions on spending. Detective controls involve various methods to review and analyze expense reports after they are submitted and expense report data to spot problems. Some companies are adding a preliminary step to the reimbursement process—requiring employees to submit their expense reports to their immediate supervisors for review and approval before they can be submitted for payment.

MITIGATING T&E RISK

Below is an excerpt from Deloitte's Whitepaper on mitigating T&E fraud, which examines significant issues that can lead to corruption:

The impact of recent U.S. regulations

The Dodd-Frank Wall Street Reform and Consumer Protection Act (the Act), signed into law on July 21, 2010, should contribute to an increase in the number of internal corporate investigations. Since “whistleblowers” can now receive higher bounties than previous legislation allowed, they may be more attuned to potential areas of risk which could result in judicial or administrative enforcement actions at major corporations. The whistleblower provision states:

“Under the Act, the SEC's authority to award bounties to whistleblowers extends to all judicial and administrative enforcement actions resulting in monetary sanctions (defined to include penalties, disgorgement and interest) of more than $1 million. Whistleblowers are entitled to payments equivalent to between 10 percent and 30 percent of the total amount of monetary sanctions assessed by the SEC, or by the DOJ or other regulatory authorities in related actions. Whistleblowers may be represented by counsel, and award determinations are subject to limited abuse-of-discretion review in an appropriate federal court of appeals.”

Since T&E expenses are submitted by or approved by large numbers of employees it can be the “tipping point” of increased investigations and/or larger, more important issues if individuals become overzealous in their efforts to identify wrongdoing in their organizations.

Exposure to global anti-corruption regulations

One considerable potential risk associated with T&E fraud is lack of compliance with the Foreign Corrupt Practices Act (FCPA), the Organization for Economic Co-operation and Development (OECD), the UK Bribery Act and other anti-corruption regimes. Especially if the reimbursement pertains to entertainment expenses for international companies that interact with foreign government officials. The aggressive expansion of U.S. and U.K. companies in the B.R.I.C. markets of Brazil, Russia, India and China can also create increased T&E fraud risks. The use of credit cards in these particular markets may be limited and, therefore, it is not unusual for handwritten receipts to be submitted for reimbursement. Credit card transactions are easier to audit as they provide a secondary level of review as the receipt can be compared to the credit card data.

Potential issues can range from a simple lack of supporting documentation for appropriate business charges to employees submitting false or altered receipts for personal gain or using substandard receipts to cover up improper gifts or payments to government officials. This activity can create specific issues under the books and records provision of the FCPA.

Source: Deloitte.

Companies are also on the lookout for inappropriate expenses, including the latest technology gizmos, which can be used for improper gifts to government officials. One of the emerging risks that comes to mind for Pam Verick, director and solution leader for fraud and corruption risk management for Protiviti, is “i-anything,” she says. “iPads, iPhones—any i-things.” Employees may expense them for their own use or to give as corporate gifts, she says. “Employees try to sneak them through as a gateway test to see what they can get away with.” Companies also find employees charging gift cards to their corporate credit cards as a way to circumvent controls on what they can buy with their corporate cards. It's a way to expense a trip to the spa or electronic gadgets for the kids, for example, says Verick.

Advanced Analytics

Technology is also playing a larger role in detecting T&E abuse, Marlin says. Advanced analytics begins by picking apart what employees report in the expense description fields of their expense reports. By applying text analytics and keyword searches, even “fuzzy” matching of keywords, companies can glean a lot of information about what employees are expensing, and who they are paying or entertaining. “It can yield powerful results,” he says.

Many companies rely on some of the advanced features in standard spreadsheet technology—like pivot tables, filtering, or macros—to sort data and spot outliers, Brady says. But they need to employ visualization software to take it to the next level, he says. Visualization can show where particular items are clustered, to further isolate outlying data. In addition to visualization software, another emerging tool, says Marlin, is link analysis. It enables a company to trace payments and data across various sources, from financial information to social media, to see information in a new way.

Web-based tools that extract data from the accounts payable system and identify patterns that merit scrutiny are also more common, Scholar says, since they can identify payments that did not go through the proper reimbursement process. If a company is still managing its T&E expenses through a manual, non-automated process that relies on paper checks rather than corporate cards, it is easy prey for fraudsters, she says.