Shrinkage, Shared Logins, and a Premature Termination
At Lakeside Distribution, annual inventory shrinkage rose from 1.2% to 3.8% of $42 million inventory, a $1.1 million increase. The warehouse supervisor has authority to post cycle-count adjustments up to $75,000 per month without review; 11 adjustments this quarter totaled $640,000. Receiving clerks and inventory-control clerks share one login to the warehouse-management system. CCTV retains footage for only 72 hours. The supervisor approved the cycle-count schedule and also investigates discrepancies. Management wants to terminate a receiving clerk who was seen on camera moving boxes to a personal vehicle, but the footage is gone. HR asks internal audit to 'support the termination' by reviewing the clerk's transactions. The audit committee wants to know whether this is a control breakdown or a fraud and what to do next.
1. Assess the fraud risk factors and control gaps at Lakeside. Why would terminating the receiving clerk now be premature, and what should internal audit do first?
Read the worked answer
The control environment creates opportunity. The warehouse supervisor can post significant adjustments without independent review, approves the cycle-count schedule, and investigates discrepancies. That combination allows one person to create, conceal, and investigate an inventory difference. Shared logins between receiving and inventory control destroy accountability and make it impossible to attribute a transaction to an individual. CCTV retention of only 72 hours is too short for most investigations. The size and frequency of adjustments-$640,000 in one quarter-are inconsistent with a well-controlled process and warrant explanation.
Shrinkage is a symptom, not proof of employee theft. The increase from 1.2% to 3.8% could reflect theft, vendor fraud, receiving errors, unrecorded returns, process breakdowns, or accounting problems. The camera sighting is an indicator, but the footage is gone, and a single sighting does not establish the clerk's intent or the full scheme. The shared login means transaction records may not reliably identify the clerk.
Termination now would be premature and risky. It could be a wrongful dismissal, it could destroy cooperation from other employees, and it could end the investigation before the supervisor's role is examined. Internal audit should not 'support' a predetermined termination. It should first preserve evidence, secure system logs and access records, review adjustment patterns, and coordinate with legal and human resources. The audit committee should be told that internal audit is assessing controls and investigating indicators, not validating a termination decision.
2. Outline an investigation plan, including evidence preservation, interviewing, and coordination with HR, legal, and management. What role should internal audit play if it later must audit the same controls?
Read the worked answer
Define the scope and team. The investigation should cover the shrinkage increase, cycle-count adjustments, shared logins, receiving and put-away transactions, vendor activity, and physical access. The team should include someone with fraud investigation experience. Legal should advise on privilege, privacy, and employment law; HR should manage employment actions; management should provide access but not direct the outcome.
Preserve evidence first. Secure warehouse-management system logs, adjustment history, user login records, badge and access logs, receiving records, vendor master changes, email, and any remaining CCTV footage. Document chain of custody. Because the login is shared, the team should map physical presence, schedules, and transaction times to identify who could have performed each action. Do not rely on a single camera sighting.
Interview strategically. Start with control owners and peripheral witnesses, then move to the receiving clerks and the supervisor. Use non-accusatory, open questions. Do not promise confidentiality that cannot be kept. Conduct interviews with HR or legal present where appropriate, and document them contemporaneously.
Internal audit's role and objectivity. Internal audit may lead or support the investigation if it has the competence and independence to do so. If it investigates specific employees and later must provide assurance over the same warehouse controls, it should consider an independent review of its investigation work or assign future assurance to a separate team. The CAE should not become an advocate for a termination. The report should separate control deficiencies from unresolved fraud allegations.
3. Recommend controls and reporting to the audit committee. How should the CAE describe the situation without concluding fraud?
Read the worked answer
Recommended controls. Require unique user IDs and multifactor authentication; prohibit shared logins; segregate receiving, inventory adjustment, and discrepancy investigation; require independent approval and review of cycle-count adjustments above a defined threshold; rotate cycle-count schedules and counters; reconcile adjustments monthly to shrinkage trends; extend CCTV retention and restrict access; perform surprise counts and analytics on adjustment patterns; strengthen vendor master controls; and provide a confidential reporting channel. The supervisor should not both approve counts and investigate differences.
Reporting. The CAE should describe the facts: shrinkage increased from 1.2% to 3.8%; adjustments were large and approved within a weak control structure; logins were shared; CCTV retention was inadequate; an investigation is ongoing. The report should state that fraud is a possible explanation but has not been established, and that other causes are being examined. It should avoid naming the receiving clerk or implying guilt.
Audit committee message. The committee should hear the control deficiencies, the investigation status, the risks of premature employment action, and the actions management has agreed to take. If management wants to terminate before the investigation is complete, the CAE should explain the evidentiary and legal risks and recommend that HR and legal decide, not internal audit. The CAE should also report whether the supervisor's access and authority have been restricted during the investigation. Follow-up should verify that the new controls are operating, not merely designed.