Last week, we discussed Vendor Information Change, a very specific element of your vendor relationships. Today we want to discuss Shell Company Fraud more broadly. If your organization works with different vendors, you need to have robust controls and procedures in place to prevent and quickly detect shell company fraud.
Shell Company
A shell company is a company or corporation that only exists on paper. Some exist for legitimate reasons like holding assets or protecting intellectual property. But for today’s purposes, let's focus on shell companies created by employees to receive payments from your organization without the organization’s knowledge.
Often employees will create shell companies with names similar named to actual vendors so that the name won’t seem out of place or suspicious in the disbursement list. Employees with too much control in the Accounts Payable process can create a company with no information but enact disbursements to themselves. In the last year we have seen vast changes to the way we do business, and therefore established processes have gone out the window. This has made companies more vulnerable to changes in vendor establishment procedures as employees working from home have more time and opportunity to create invoices and get them approved and paid without any oversight.
Case Study:
The victim was a billion-dollar construction and contracting corporation with offices all over the world. The attacker was a project manager that created six separate companies that all provided nebulous services related to construction – like scaffolding or parking control. The manager then subscribed to a mail drop for these companies and began sending invoices to the company. Due to the size of the project, the amount of invoices coming in, and a poor vendor establishment process, the company disbursed over 3.5 million dollars to the fraudster in a ten month time frame.
Millions of dollars in less than a year that could have been saved with basic controls and procedures. How do you begin this type of protection?
1) New Vendor Establishment Process
When establishing new vendors, be sure your procedures are thorough, documented, and taught to employees. DFG provides a complete New Vendor Establishment form that includes vetting and validation that extends far beyond simply accepting a W9. Consider making these quick checks part of your routine:
Verify that a business actually exists at the listed address
Evaluate the company’s online presence
Make some test phone calls and emails
Ask for references (and check them)
2) Conflict of Interest Form
The most useful useless form. Annually require your employees to fill out a form that lists any family, personal, business, and financial relationships they have that are affected by your company. This form might seem useless because a fraudster is not going to TELL you about their shell company. But when this becomes part of your procedures, it shows your employees that the company is validating vendors. It changes the environment and gets into the mind of a potential perpetrator and inspires the thought, “I might get caught – is this worth it?” This form has now been transformed from useless to one of the most useful forms in the internal control arsenal.
3) Master Vendor File Compliance Testing.
This can save you and your organization so much money, time, and frustration when done regularly and well. Establish a process that has your staff searching the master vendor file for these things:
Duplicate vendor information in connection to your employee database
Missing vendor information
Recent changes to dormant vendors
Competitive bidding manipulation through vendors with duplicate info appearing to be separate companies
Vendors with sequential invoice numbers or low starting invoice numbers
Periodically review amounts just below any sort of control thresholds in your company – think $4,900 if $5,000 requires review.
Not all of these mean fraud is occurring, but they can serve as red flags that signal further investigation.
Shell Company Fraud is easy to commit when there are no procedures or accountability in place. Help your organization build these controls one step at a time. Choose an element from today’s post to begin. Show your workforce our training video to raise awareness and begin education.
Empowering small businesses to develop strong Anti-Fraud Programs is our mission. We provide consultations to design, evaluate, and improve your anti-fraud program. You can also get a step-by-step guide to design a program that can be tailored for your specific needs by purchasing Steve Dawson’s book, Internal Control/Anti-Fraud Program Design for the Small Business.
If you think there may already be fraudulent activity in your company, contact us today through our website.