Cash Receipting: Internal Control Risks and Rewards WSACA 2019 Licensing Conference

2. The Center for Government Innovation Cash Receipting: Internal Control Risks and Rewards WSACA 2019 Licensing Conference September 12, 2019

3. “There is no kind of dishonesty into which otherwise good people more easily and frequently fall than that of defrauding government of its revenues...” Benjamin Franklin

4. What will you learn today? Importance of internal controls Internal control basics Designing cash handling internal controls Best practice tips What to do if fraud happens to you

5. Importance of internal controls

7. INTERNAL CONTROL WEAKNESSES were responsible for nearly HALF of frauds

8. Anti-fraud controls are associated with: Quicker detection MORE THAN 50% REDUUCTION • Reduced losses

9. Fraud detection LESS THAN 5% 40 percent Employees: 53 percent Customers: 21 percent Smaller organizations usually rely on external audits

10. 122 investigations in 2018 $416,880 misappropriated $747,595 in questionable transactions

11. Common control weaknesses/warning signs Trusted employee with limited oversight No segregation of duties Inadequate monitoring and review Lack of supporting records Deposit patterns that vary from normal High volume of voids/adjustments High volume of system deletions/modification Deposits not made daily or intact

12. It could happen to you! It could happen to you! • Fraudster holds deposits and uses cash for their personal needs and deposits the funds later Borrowing Scheme • Deposits that are not timely • Deposits that are not intact • Not following normal procedures • Lack of segregation of duties • Inadequate oversight and monitoring • Inadequate deposit review

13. Internal control basics

14. Who is responsible for internal controls? Management is in the best position to establish and maintain internal controls and is held primarily accountable for their proper functioning.

15. Internal controls: The big picture

16. Internal controls: The big picture WHY WHEN WHAT WHO WHERE

17. Internal controls: The big picture • Clearly define the cash-handling process and develop expectations • Develop forms and reports to validate and support transactions • Observe and monitor activities • Review documents

18. Effective internal controls enable you to: • Identify a loss promptly • Determine the entire amount lost • Identify responsibility for the loss • Protect employees • Safeguard resources • Help prevent fraud

19. Designing cash handling internal controls

20. Which type of control will work best? System Process segments Detective Corrective Locations Preventive

21. Internal controls: The big picture • Clearly define the cash-handling process and develop expectations • Develop forms and reports to validate and support transactions • Observe and monitor activities • Review documents

22. Preventative Controls • Written policies and procedures • Required training • Reasonable safeguards • Require proper recording • Require prompt/intact deposits

23. Safeguard and limitaccess to receipts

24. Segregate duties in the cash handling function

25. Segregate duties related to mail receipts

26. It could happen to you! • Fraudster takes cash receipts prior to being recorded Skimming Scheme • Unexpected non-standard activity • Deposits don’t meet composition expectations • Inadequate oversight and monitoring • Inadequate deposit review • Inadequate system report review

27. Detective Controls • Understanding typical revenue patterns • Standard forms • System report reviews • Internal audits

28. Revenue pattern expectations

29. Deposit composition expectations

30. Standardized forms and reports

31. Monitor/review non-standard transactions

32. Understand computer operations and review reports

33. It could happen to you! • Fraudster processes an unsupported void, reversal or refund Reversing Transaction Scheme • Unexpected non-standard activity • Subagent agreement not followed • Lack of training • Inadequate review of bank activity • Inadequate oversight and monitoring • Inadequate system report review

34. Corrective Controls • Enforce established policies and procedures • Standardized error reporting procedures • Communicate expectations • Take appropriate personnel actions

35. Common control weaknesses/warning signs Trusted employee with limited oversight No segregation of duties Inadequate monitoring and review Lack of supporting records Deposit patterns that vary from normal High volume of voids/adjustments High volume of system deletions/modification Deposits not made daily or intact

36. Internal controls: Be your own auditor PROCESS REVIEW OBSERVE REPORTS FORMS POLICIES SUPPORT TRAINING MONITOR EXPECTATIONS

37. It could happen to you! • Fraudster changes the transaction type or adjusts a customer’s account so the amount owed is reduced Write-Off Scheme • Unexpected non-standard activity • County policy not followed • Inadequate oversight and monitoring • System notes not documented/valid • Inadequate system report review

38. Cash handling controls ?

39. Best practice tips

40. NOT a best practice

41. Best practice tips Watch for behavioral red flags

42. Best practice tips Require employees to take time off

43. Best practice tips Have employees certify they read policies, understand them and were provided training

44. Best practice tips Be aware of known computer system vulnerabilities

45. Best practice tips System reports are generated by the person performing the review and monitoring

46. Best practice tips Spot check transaction postings for accuracy

47. Best practice tips Occasionally prepare a bank deposit or bank reconciliation

48. It could happen to you! • Fraudster diverts a payment from one customer and hides the fraud by applying another customer’s payment to the account Lapping Scheme • Deposits that are not timely • Deposits that are not intact • Missing deposit support • Not following normal procedures • Lack of segregation of duties • Inadequate oversight and monitoring • Bank-validated deposit slips not required

49. What to do if fraud happens to you

50. Fraud happens