Fictitious Vendor and Ghost Employee at a Medical Practice
Valley Medical Associates (VMA) is a four-physician practice with annual revenue of $6.2 million. An anonymous tip alleged that the office manager, Linda R., had been diverting funds for six years. VMA's CPA performed a preliminary review. The vendor master file includes 'MedSupply Solutions' with a UPS-store address and no tax ID; 47 checks totaling $382,000 were issued to that vendor over four years. No purchase orders or receiving records exist for those payments. Linda was the sole person who added vendors, approved invoices, prepared checks, and reconciled the bank account. Payroll records show 12 checks totaling $64,000 issued to a terminated employee, all endorsed by Linda. Linda's annual salary is $65,000, but she recently purchased a boat for $80,000 and renovated her home. The practice has no segregation of duties, no mandatory vacations, and no anonymous hotline. The owners want to know the minimum known loss and how to proceed.
1. Identify the fraud schemes indicated and calculate the minimum known loss. Explain what additional amounts may exist.
Read the worked answer
Two schemes are evident. First, fictitious vendor/check tampering: 47 checks totaling $382,000 to MedSupply Solutions, a vendor with a UPS-store address, no tax ID, and no purchase orders or receiving records. Second, ghost employee payroll: 12 checks totaling $64,000 to a terminated employee, all endorsed by Linda. The minimum known loss is $446,000 ($382,000 + $64,000).
That figure is a floor, not a ceiling. The investigator should determine whether Linda endorsed or deposited the MedSupply checks, whether she had access to the terminated employee's payroll record, and whether other vendors, credit cards, cash receipts, or expense reimbursements were used. The boat and home renovation are red flags but are not proof; they should be compared with Linda's known income and assets.
2. Outline the investigative steps you would take to determine the full scope and preserve evidence.
Read the worked answer
Preserve evidence first: image Linda's computer and email, secure vendor master and payroll files, obtain bank statements and canceled checks with endorsements, and review access logs. Under privilege with counsel, interview non-suspect staff and the bank. Perform a full disbursement review for duplicate vendors, employee addresses, sequential check numbers, after-hours vendor changes, and payments without purchase orders. Reconcile payroll to active employees and compare terminated-employee records. Quantify losses by year and scheme, and consider tax and benefits effects. Do not confront Linda before evidence is secured. Coordinate with the insurer and law enforcement.
3. Evaluate the control deficiencies that allowed the scheme and recommend specific remediation.
Read the worked answer
Critical deficiencies: one person controlled vendor setup, invoice approval, check preparation, and bank reconciliation; no purchase-order matching; no mandatory vacations; no hotline. Remediation: segregate custody, authorization, and recordkeeping; require dual approval for new vendors and wires; independently verify vendor addresses and tax IDs; have an owner review bank reconciliations and canceled checks; use positive pay; enforce mandatory vacations and surprise audits; and maintain an anonymous reporting channel. The judgment call is that controls are not just policy documents-they must be tested.