Asset Misappropriation: Cash, Inventory, and Payroll
Asset misappropriation is the most frequent fraud category and the lowest in median loss. CFBE tests whether you can classify a scheme correctly, because classification determines the evidence you gather and the control you recommend.
Cash schemes - order matters
- Skimming - cash stolen before it is recorded. The books balance and the theft is invisible in the ledger.
- Cash larceny - cash stolen after it is recorded, so a shortage appears.
- Register disbursement schemes - false refunds and voids at the point of sale.
- Check tampering - forged maker, forged endorser, altered payee, intercepted check.
- Billing schemes - shell company, pass-through, and overbilling through a colluding vendor.
- Expense reimbursement - mischaracterised, overstated, fictitious, and duplicate claims.
- Payroll - ghost employees, falsified hours, commission manipulation, pay-rate alteration.
Inventory and other assets
Misuse for personal benefit, larceny, false shipments recorded as sales, asset requisitions and transfers, and purchases made for personal use. Detection relies on physical counts, cycle counts, shrink analysis by location, and shipping and receiving reconciliations.
Worked example
A payroll audit finds an employee with no federal withholding, a PO box address, and a hire date after the last payroll system conversion. The supervisor who approved the hire shares the same home address on file in HR.
Reasoning: this is a classic ghost employee indicator set. The absence of any deduction is a strong signal, because genuine employees usually have at least one. Confirm by matching the payroll roster to HR records, badge logs, and email activity; check the SSN format; look for a direct-deposit account shared with another employee. Then establish who created the record and who approved it, since the approval is where the control failed.
Traps
- Confusing skimming with larceny; the test is whether cash was recorded before the theft.
- Calling a false refund a skimming scheme; it is a register disbursement.
- Treating shrinkage as a cause, when it is a measurement that must be decomposed.
- Forgetting that most asset misappropriation is surfaced by tips rather than by controls.
- Assuming small amounts are immaterial; frequency drives loss in this category.