Ed. note: We welcome back Greg Kyte after a brief post-April 15th vacation. He'll join us every month in his Accumulated Deprecation column. Go here to read more of Greg's posts.
Somebody stole $60 out of my desk drawer at work. Not my money. My company's money. You know, the stuff that, as an accountant, I'm supposed to make sure nobody fucking steals.
I'm the controller for a group of medical office buildings in Provo, Utah. Historically, we are a non-cash business, but two things changed recently.
First, we had to evict an occupant who owed us a metric shit-ton of past-due rent. So we seized their furniture and fixtures, and now when I'm not an accountant, I'm a used furniture salesman on Craigslist which is a cash-only endeavor that requires me to keep $125 on hand to make change.
Second, we started a self-storage business to generate income from otherwise unused basement space in one of our buildings. One of our customers happens to be a neo-hippy who wants to stay off the grid and, therefore, insists on paying his monthly storage fees in cash.
Our internal controls are pretty standard for a small business, meaning we have really shitty internal controls.
Now, that's not totally true. Our tone at the top is amazing. Our management team is the most ethical, guilt-prone group of Mormons and former Mormons and pre-Mormons around.
But besides that, we mostly get by with a separation of duties, specifically authorization for disbursements is separated from record keeping. But since banks accept cash without the signature of one of our owners, we were out of tricks. We didn't even have a place to lock up the cash. It was just sitting in a drawer. That being said, only four people had access to the room where the cash was sitting in an unlocked drawer. It's not like I left a pile of twenties on a table in the lobby with a sign that said "No Stealing."
My private lessons in internal controls started in March when I walked in on one of our owners taking $20 out of his wallet and putting it into the stack of furniture change. He matter-of-factly explained that a couple days ago he needed $20 cash for something, didn't have the time to swing by the bank, and pulled it out of the stack. He had since been able to go to the bank, and he was paying back his unwritten IOU.
And I didn't really care. For one, I trust him 100%. He is an unwaveringly ethical, trustworthy, and honest person. Also, it's his damn money anyway. Lastly, all $125 was accounted for – no harm, no foul.
Fast forward a few weeks. I counted up the money and found that it was $20 light again. My first thought was that the owner had dipped into the cash stash, but I checked, and he said he had not. I believed him, and my heart sank.
After spending way more than $20 worth of time fretting about the missing $20, I had a hypothesis as to what had happened. The hippy paid his $80 storage fees with a one-hundred-dollar bill. I gave him change with the furniture money. I took the $100 to the bank, deposited $80, and was pretty damn sure I put the $20 back in with the furniture change. BUT I also remembered going to 7-Eleven recently for a Diet Coke Double Gulp and being surprised at having more cash in my wallet than I remembered having.
I like to consider myself a thorough, detail-oriented person, and I had a hard time believing that I would inadvertently pocket $20 from work, but being a guilt-prone person who takes his responsibility seriously, I decided to replace the missing $20 with $20 of my own money.
However, a couple days later when I went to replace the $20, another $40 was missing. Again, I called the owner. He had not dipped into the cash. We had no other cash transactions since the hippy storage transaction, so the amount of cash should have been $105, but is was only $65. Now it was unquestionable that somebody was stealing.
But by this time it had become a convoluted mess. Somebody for sure stole $40; maybe I had replaced the $20 like I thought, and this son of a bitch stole all $60.
To top it all off, regardless of whether the amount of money stolen was $40 or $60, I know who stole it. Of the four people with access to the office where the cash was located, I trust three of them completely and unquestioningly. The fourth one not so much. I confronted him, he denied it, and I have no proof. So instead of firing a bad guy, we put a lock on a drawer and wrote off $60.
So what did I learn from all of this?
1. Internal controls do a great job of preventing and detecting fraud. They also do a great job of preventing controllers from eating shit sandwiches.
2. Emphatically blaming someone of fraud when you have no hard evidence makes you look either (a) guilty, (b) like an asshole, or (c) like a guilty asshole.
3. When an aspect of your business changes, you may need to modify your internal controls. Make the necessary modifications immediately.
4. If Jerry Garcia insists on staying off the grid, insist that he stay off the grid with exact change.
5. All fraud is material to an internal accountant.
Forensic accounting and fraud examination are the sexiest parts of our profession. But finding fraud in your own company is sexy like knowing that your mom and dad at one point had sex.
