April 2007

Fraud Prevention in Your Law Office

by Trina Doty

Twice a month, on average, I receive some sort of communication from an attorney who has discovered fraud in his law practice. Sometimes the fraud is perpetrated by a total stranger, but often it’s done by someone the attorney knows and trusts. It’s never easy to hear an attorney discuss the betrayal of a trusted employee.

While it’s impossible to completely prevent fraud, there are things you can do to make perpetrating a fraud more difficult. If a fraud has already been committed, there are steps you can take to help discover it more quickly. Keep in mind that some fraud schemes can be extremely sophisticated. This column will focus on some easy things that you can do right now. Most of these items are geared toward solo practitioners or small-sized firms.

The most common fraud scheme is disbursement fraud. Although there are many different types of disbursements (e.g., wire transfers or ATM withdrawals), checks are the most common. Disbursement frauds almost always involve writing a check to or on behalf of the person committing the fraud. These checks are usually forged, but if the scheme is sophisticated enough, may not be. A common scenario involves writing checks to pay personal utilities or other bills. If your law firm has the same utility service as the fraudster, these types of payments can be difficult to detect.

The key to preventing these types of disbursement frauds is to have a separation of duties. For example, one person prepares the check, another signs and mails the check. The point of this is that once the check is signed, it isn’t returned to the preparer and thus cannot be altered. A separation of duties can be very difficult for law practices with only a few employees. Often it requires changing or shifting job duties between the employees.

Something else you can do is to be sure the check signer reviews the invoices that are being paid. Do you know the vendor? A common scheme is to create fictitious vendors who charge for “consulting services.” Is the amount being paid correct? An overpayment can be made on purpose in hope that the overpaid portion is returned to the fraudster, who then alters the payee and cashes the check. Is this invoice for the law firm? Many check signers give a cursory glance to common invoices such as utility payments, thus allowing personal bills to sneak through.

Simply following the steps above will not prevent someone from forging a check. The best way to detect forged or fraudulent checks is to review your bank statement every month. The bank statement should come to you unopened. Open the statement and review the transactions. You’re looking for unauthorized withdrawals or transactions that look strange. If you normally write five checks a month but your bank statement shows 20, further investigation is warranted.

It is not uncommon for thieves to steal blank checks or reproduce checks using your account number, so get in the habit of reviewing your bank statement each month. Most banks limit the amount of time you have to challenge fraudulent activity, so the sooner you review the better.

You should also review the cancelled checks each month. If someone else has already opened your bank statement, make sure all the checks have been included with the statement. Verify that the checks are legitimate. Be sure to look at the signature on the check, as most people can recognize a phony signature. Also look at the endorsements on the back of the checks. Were any checks endorsed over to a third party, like an employee?

Something else you might want to consider using is a budget. If you have a budget in place, you can often spot discrepancies. A budgeted amount may vary by a huge margin from an actual amount paid. If this is the case, you can research why these amounts are so different. A budget is especially helpful for tracking things like utility and rent payments.

The second most common type of fraud involves deposits and a process called “skimming.” Skimming happens when a business receives cash, but instead of recording the sale, the money is pocketed by an employee. This type of fraud is most common in retail businesses, but some law firms do a fair bit of business with cash. In any situation where cash is received, a receipt book should be used. It’s best to use a carbon-copy receipt book with pre-numbered receipts. A sign asking “Did you receive your receipt?” should be prominently displayed by the front desk. Be sure any missing receipts are explained.

For both disbursements and deposits, one of the best fraud prevention and detection techniques is to complete a monthly bank reconciliation. A reconciliation lists any differences between the bank statement and the deposits and withdrawals listed in your checkbook. Completing a bank reconciliation can help prevent fraud because if your employees know that you’re actively reviewing the bank transactions, this can discourage fraudulent activity.

Most attorneys rely on someone else to complete the bank reconciliation. While there’s nothing wrong with that, you should personally review the reconciliation in order to spot anything that looks suspicious. This is how a reconciliation can help you detect fraud. For example: If you’ve written down a $500 deposit in your checkbook, there should be a corresponding $500 deposit on your bank statement. If the deposit didn’t show on the bank statement, it would be listed on the reconciliation as an outstanding item. You’d want to investigate why the deposit didn’t make it to the bank. In general, there should not be any outstanding deposits on your bank reconciliation.

Another type of fraud deals with modifying invoices. If an employee is stealing payments that clients are sending in to pay their invoices, the client billing must be altered. If it’s not, clients will be calling and asking why their last payment was not credited to their account. To prevent that from happening, the person stealing the payment will often alter the invoices. They can do this in one of two common ways. The first way is to simply write off the amount owed as bad debt. This is usually the simplest way and is easy to do if an attorney doesn’t review invoices closely.

The second most common way is to apply a different client’s payment to the invoice, commonly called a “lapping” scheme. That scenario works like this: Client A sends in payment for an invoice. Payment is stolen. Client B sends in payment. Client B’s payment is applied to Client A’s invoice. Client C sends in payment. Client C’s payment is applied to Client B’s invoice, and so on. This type of scenario can go on for a long period of time but can become very confusing. Most people who do this type of fraud have some way of tracking the payments. As such, they rarely take vacations for fear that the invoice postings will not be properly handled while they are gone. The best way to find this type of fraud is to insist that your employees take regular vacations and have another staff person fill in.

These are just a few of the most common ways frauds are committed. While it’s impossible to prevent all types of fraud, if you take an active role in reviewing the financial transactions of your law practice, you can make perpetrating a fraud more difficult. 

Trina Doty is the WSBA audit manager and is a CPA and a certified fraud examiner. She oversees the random examination program, conducts “for cause” audits, and educates attorneys as to trust account rules and regulations.