Ridgeway Distributors: A Controller With Too Much Access

Segregation-of-duties conflicts (the root cause):

1. Custody + recordkeeping + authorization in one person. The controller can create a vendor, approve and release the payment, record the entry, and reconcile the bank account that would reveal it. No single control can catch an error the same person both makes and reviews.
2. The AP clerk reports to the controller, so there is no independent check on the person being controlled - a subordinate cannot effectively challenge her supervisor.
3. The owner signs checks from a summary listing - a signature is not a control when the signer does not see supporting documents (invoice, PO, receipt).
4. No mandatory vacation or rotation for someone with full payment and reconciliation access.

Symptoms mapped to hypotheses:

• Pinnacle Supply, no POs, PO box, verbal approvals, $412,000: classic fictitious vendor / shell company scheme. Test: is the address a mail drop or matched to an employee address? Are there duplicate bank details with an existing vendor?
• Margin down 5 points while sales rise: unrecorded liabilities and payments to a fictitious vendor flow through purchases, inflating cost of sales - or goods are being received and diverted.
• Inventory days 48 → 71: inflated inventory (fictitious purchases capitalized) or shrinkage being absorbed, either of which could also be covering the margin decline.
• 14 checks outstanding over 90 days: possible check kiting or payments recorded but never mailed, used to plug the reconciliation. Outstanding items that never clear are a red flag, not a timing difference.
• No vacation in four years: the single strongest behavioral indicator - the scheme requires her continuous presence to keep the reconciliation balanced.

Preventive controls that fit a small company's budget:

• Split the duties that are currently combined: the owner or an outside bookkeeper reconciles bank accounts; vendor master changes require a second approval; the AP clerk does not report to the person who approves payments.
• Three-way match (PO, receiving report, invoice) before payment, with a low dollar threshold above which the owner sees the actual documents, not a summary.
• Positive pay with the bank - the bank rejects any check not on the issued file, which kills check alteration and most kiting.
• Vendor master review quarterly: new vendors, changed addresses, changed bank accounts, and employees matched against the vendor file.
• Mandatory vacation (one continuous week) and rotation of reconciliation duties - cheap and highly effective against concealment schemes.
• Dual authorization on EFT/wire and a payment-approval limit for the controller far below $50,000.

Where analytics earns its keep - test 100% of transactions, not a sample:

• Duplicate-vendor test: fuzzy match vendor names, addresses, tax IDs and bank accounts against each other and against the employee file - would have surfaced the PO box instantly.
• Continuous monitoring of the vendor master: an exception report on every new vendor created by someone who can also pay.
• No-PO and after-the-fact-PO exception reports run monthly, routed to the owner.
• Benford's Law / round-dollar and threshold-hugging tests on payments just under $50,000.
• Aging of reconciling items: automated flag when an outstanding check exceeds 60 days or a reconciling item is re-dated.
• Journal-entry testing: entries posted by the same user who approves payments, and entries made on weekends or after close.

The key point: the fraud here is not a needle in a haystack; it is a pattern across a population. Sampling 30 payments could easily miss one vendor; a full-population test cannot.

First 48 hours:

1. Do not confront the controller or discuss suspicions with staff. Tipping off a person who controls the records invites destruction of evidence - emails, the vendor file, and the reconciliations themselves.
2. Preserve evidence: image the accounting system and email, secure the bank statements and cancelled-check images directly from the bank (not from the controller), and lock the vendor master history.
3. Escalate to the right people: the owner engages legal counsel and, through counsel, a forensic accountant or the company's fidelity-bond/ crime insurer. If the company has an audit committee or outside board member, inform them.
4. Take immediate control of cash: change bank signatories and online-banking credentials, put positive pay in place, and move payment approval to a second person. Consider administrative leave rather than an accusatory interview.

What not to do: do not let the suspect "explain" it before evidence is secured; do not alter the records to "clean up"; do not rely on the same person to produce the documents under review; do not promise confidentiality or leniency without counsel.

Investigation design:

• Obtain confirmations directly from third parties - bank statements, and confirmation of the Pinnacle Supply relationship with the stated address.
• Rebuild the payment trail for all vendors with no PO or PO-box addresses, using full-population data, and quantify the loss (including the effect on inventory and gross margin).
• Test the reconciliations independently and identify outstanding checks that were used to conceal.
• Interview the AP clerk and the owner's staff after the documentary work, not before.

Aftermath: assess whether the loss is recoverable (fidelity bond), restate prior-period financial statements if material, and redesign controls - the weakness is structural, so replacing the person without splitting the duties would leave the same exposure.