Employee Benefit Plan Audit Quality Center

1. Employee Benefit Plan Audit Quality Center EBPAQC Live Forum Fraud Risks in Employee Benefit Plans February 17, 2010

2. CPE Credit For Participating Must have registered for CPE credit prior to this live forum CPE Credit Approval Form emailed to you Listen for announcement of 4 CPE codes (7 digits: ALL_ _ _ _ ) and 4 polling questions during the live forum Record CPE Codes on CPE Credit Approval Form (no need to record polling questions) Return completed form (by fax or mail) to AICPA Service Center for record of attendance Keep a copy of completed CPE Credit Approval Form for your records 2

3. Today’s Presenters and Objectives Marilee Lau, CPA Chair Executive Committee AICPA Employee Benefit Plan Audit Quality Center

4. Presenters Marilee Lau, Chair, EBPAQC Executive Committee Tim Desmond, O’Connor Davies Munns & Dobbins, LLP Ian Dingwall, Chief Accountant, DOL Employee Benefit Security Administration Jim Merklin, Partner, Bober Markey Fedorovich Debbie Smith, Partner, Grant Thornton LLP

5. Today’s Objectives • Understand increased fraud risks in the current EBP environment • Discuss EBP fraud risk factors • Conducting fraud brainstorming sessions and fraud interviews • Auditor’s response to fraud • DOL criminal enforcement activities • Actual EBP fraud cases- panel discussion • Q & A session

6. Fraud Risk Factors and Conditions Debbie Smith Partner Grant Thornton LLP

7. Increased Fraud Risks in the Current EBP Environment • Current economic conditions • Unexpected losses • Employee furloughs and layoffs (plan sponsors and administrators) • Financing and liquidity difficulties • Curtailed or suspended benefits • Opportunities and incentives to commit fraud

8. Types of Fraud • Types of fraud: • Fraudulent financial reporting • Misappropriation of assets Source: AICPA Fraud Risk Factors Specific to Employee Benefit Plans

9. EBP Fraud Conditions Three conditions generally present when fraud exists: • Incentive/pressure to perpetrate fraud • Opportunity to carry out the fraud • Attitude/rationalization to justify the fraudulent action Source: AICPA Fraud Risk Factors Specific to Employee Benefit Plans

10. Fraud Brainstorm Sessions and Interviewing Skills James E. Merklin, CPA, CFF, CFE Partner Bober Markey Fedorovich

11. Conducting Fraud Brainstorming Sessions Discuss how and where the plan’s financial statements might be susceptible to material misstatement due to fraud Who should participate? When should the brainstorm be conducted? Who to ask in “plan management”? 6

12. Brainstorming Do’s and Don'ts Don’t • Only have a mass brainstorming session • Conduct session without partner involvement • Get input from only the audit partner and manager • Come into the meeting without current year planning information • Let past experience with client sway you to overlooking risks Do • Conduct a session customized to each specific engagement • Use all audit team members and invite new ideas from all • Have examples of what could go wrong and discuss what we know or don’t know • As about the impact of current economy on this specific client • Be professionally skeptical

13. EBP Fraud Interviewing Skills

14. Basic Audit Procedure - Interviews • SAS 99 requires interviews be conducted • Make inquiries of management and others within the plan to obtain their views about the risks of fraud and how they are addressed • Interviews help in assessing risks of fraud, but can also serve as specific audit procedures to detect fraud if a risk is identified to the team • An interview of this nature should be conducted by an experienced auditor, not a newer staff accountant • If interviewing someone where you really suspect they might have done something, the interview should be conducted by someone experienced in fraud or forensic investigations or in confession-seeking interviews Source: AICPA Employee Benefit Audit Quality Center, http://ebpaqc.aicpa.org/

15. EBP Fraud Interviewing Skills • Preparing for the Interview • Thinking on your feet • Observing body language • Setting the tone • Interview flow • Listening skills Source: Journal of Accountancy, November 2002

16. EBP Fraud Interviewing Skills • Be honest and forthright • Don’t rush the interview • Double-check / Re-confirm • Use of leading questions to get a confession • What is a confession • Written confessions v. Oral confessions Source: Journal of Accountancy, November 2002

17. EBP Fraud Interviewing Skills • Guess what? Criminals lie! • Watch out for false confessions • Confession where the statement of responsibility received is not correct • Try to obtain corroboration during the interview that is supportive • If part of a confession is later proven to be false, it can put at risk the entire confession. Use caution.

18. DOL Criminal Cases Ian Dingwall Chief Accountant Department of Labor Employee Benefits Security Administration

19. DOL Criminal Cases DOL perspectives on EBP frauds Prohibited transactions “Knowing participants” in a fiduciary breach Voluntary Fiduciary Corrections Program (VFCP)

20. DOL Criminal Cases • EBPAQC summary analysis of DOL EBSA criminal enforcement actions • Categorizes the cases into the following plan types. • Pension/401(k) Plans • Multi-employer Plans • Medical, Health and Death Benefit Plans • Other Helpful Tip!- Tool is useful in conducting SAS 99 fraud brainstorming sessions

21. DOL Criminal Cases- Pension/401(k) Plan Fraud • Theft and embezzlement of plan assets using wire transfers, forged checks and other means • Failure to deposit employee contributions into the plan • Funneling contributions into a secret account • Transfer of funds from the plan to an outside account in the plan's name • Unauthorized withdrawals • Unauthorized use of plan assets to invest in other business interests • Issuing fraudulent statements and dividend checks to clients

22. DOL Criminal Cases- Pension/401(k) Plan Fraud • (Continued) • Making materially false statements in the plan's annual report and fraudulent annual reports • Defrauding the company by issuing duplicate paychecks • Failure to pay pension benefits due to employees • Kickbacks • Failure to deposit checks to be rolled over from a predecessor's plan into a new plan • Defrauding a lending company • Fraudulently obtaining funds from outside sources

23. DOL Criminal Cases- Multiemployer Plans • False claim for benefits • Unauthorized application for benefits • Check forgery • Forged reimbursement claims • Improper issuance of checks to plan administration employee • Filing false financial reports • Embezzling  of remittance checks received from employers having collective bargaining agreements with the local union • Kickbacks • Bribery in exchange for permitting the contractors to avoid employing  and paying union members • Rehiring locked-out workers under false identities during a labor dispute

24. DOL Criminal Cases- Medical, Health and Death Benefit Plans • Embezzling health care premiums from payroll withholdings • Misappropriating client-provided funds from the company's claims account • Failing to pay health claims • Failing to forward insurance commissions due to the plan under an arrangement with an insurance company • Falsely purporting to provide health care coverage by misrepresenting that its plans were insured by legitimate insurance providers • Defrauding insurance companies by submitting fraudulent insurance claims and doctor's notes to insurance companies • Defrauding individuals and insurance companies by offering illegitimate services

25. DOL Criminal Cases- Medical, Health and Death Benefit Plans (Continued) • Paying claims to fictitious individuals for services that were never rendered • Obtaining discounted group insurance premium rates for a fictitious company • Engaging in fraudulent activity involve the sale of insurance policies • Fraudulently obtaining  bank loans by submitting false statements • Unlawfully interfering with the exercise of rights of participants • Using incorrect social security numbers • Submitting fraudulent information for a loan application • Defrauding participants by misrepresenting insurance coverage

26. Tim Desmond, Partner O’Connor Davies Munns & Dobbins Auditor’s Response to Fraud

27. Auditor's response to the risks of material misstatement due to fraud involves the application of professional skepticism when gathering and evaluating audit evidence. Two types auditors of EBPs should consider Fraudulent financial reporting Misappropriation of assets Auditor’s Response to Fraud

28. SAS 99 requires the auditor to respond to the results of the fraud risk assessment in three ways: Has an overall effect on how the audit is conducted-- a response involving more general considerations apart from the specific procedures otherwise planned. Identify risks that involves the nature, timing, and extent of the auditing procedures to be performed. Perform certain procedures to further address the risk of material misstatement due to fraud involving management override of controls. Auditor’s Response to Fraud

29. How the audit is conducted-- general considerations Assignment of personnel and supervision. Knowledge, skill, andability of personnel assigned significant engagement responsibilities should be commensurate with the auditor's assessment of the risks Accounting principles - Consider management's selection and application of significant accounting principles, particularly those related to subjective measurements and complex transactions. Predictability of auditing procedures -Incorporate an element of unpredictability Perform substantive tests of selected account balances and assertions not otherwise tested due to their materiality or risk, Adjust the timing of testing from that otherwise expected, Use differing sampling methods, and Perform procedures at different locations or at locations on an unannounced basis. Auditor’s Response to Fraud

30. Identify risks that involves the nature, timing, and extent of the auditing procedures to be performed. These procedures involve both substantive tests and tests of the operating effectiveness of the entity's programs and controls. Examples: Interviewing personnel involved in activities in areas where a risk of material misstatement due to fraud has been identified to obtain their insights about the risk and how controls address the risk Reviewing SAS 70 reports with plan management Gain understanding of financial stability of plan sponsor Testing related party transactions and expenses Ascertain whether the plan administrator lacks understanding of major regulations that govern the plan Auditor’s Response to Fraud

31. Perform certain procedures to further address the risk of material misstatement due to fraud involving management override of controls. Examining journal entries and other adjustments for evidence of possible material misstatement due to fraud. Reviewing accounting estimates for biases that could result in material misstatement due to fraud. Evaluating the business rationale for significant unusual transactions. Auditor’s Response to Fraud

32. Fraud Cases Panel discussion of actual EBP fraud cases

33. EBP Fraud Case #1 (Debbie) Fraud: Without the knowledge of the employer or plan administrator, a secretary who worked in Plan sponsor’s payroll department was able to convince the outside payroll service that she was allowed to suspend her 401(k) loan repayments. Fraud triangle conditions: Incentives/pressures: Employee needs cash to pay bill collectors Opportunities: Lack of appropriate system of authorization and approval of transactions Attitudes/rationalization: The employee needs the cash and nobody else was being hurt Sample audit procedures that might detect fraud: Compare loan balances to amortization schedules Inquire as to why certain active participants have delinquent participant loans 33 33

34. EBP Fraud Case #2 (Jim) Fraud: 401(k) Plan Sponsor did not allocated plan expenses to all participants. Highly compensated participants were left off the allocation schedule on purpose. Fraud triangle conditions: Incentives/pressures: Incentive to maximize personal account balance Opportunities: Ability to exclude from allocation (since internally generated and not from a system subjected to a SAS 70 review), Attitudes/rationalization: Would not be caught Sample audit procedures that might detect fraud: Recognize the risk of fraud in the planning process (gaining an understanding of internal controls) and design steps to address the risk; Reconcile base for allocation of expenses to payroll contribution records for consistency; Test representative sample of participants (key and non-key) to validate fair allocation if expenses. 34 34

35. EBP Fraud Case #3 (Tim) Fraud: A pensioner’s benefit checks were fraudulently endorsed and cashed by a relative for several months after pensioner had died. Fraud triangle conditions: Incentives/pressures: The relative was already being supported by pensioner Opportunities: Relative had been endorsing checks while pensioner was alive and “assisting” with all financial affairs Attitudes/rationalization: Needed to hold onto Grandma’s rent controlled apartment. Sample audit procedures that might detect fraud: Reviewing endorsement against original employee records Testing plans internal controls over distributions (death audits) 35

36. EBP Fraud Case #4 (Debbie) Fraud: Trustee of small plan created a fictitious employee in the census data and made employer contributions then took out loans against the balance. Fraud triangle conditions: Incentives/pressures: Recent bonus was insufficient to cover personal cash flow needs Opportunities: Complete lack of segregation of duties Attitudes/rationalization: Didn’t feel he was treated fairly in incentive pay allocations, so this compensates for that Sample audit procedures that might detect fraud: Test eligibility of new participants (birth date, date of hire and other demographic data that determine eligibility and vesting) When designing audit approach, recognize that plan management is dominated by a single person without compensating controls 36 36

37. EBP Fraud Case #5 (Jim) Fraud: A DB plan TPA paid himself by setting fake “doing business as” (DBAs) and approving the invoices. The Plan sponsor was in bankruptcy. There was no sponsor oversight of expense payments from Plan assets. Fraud triangle conditions: Incentives/pressures: His employer didn’t give him a raise this year Opportunities: Lack of TPA segregation of duties. Knew no one was watching and he had approval authority without anyone else’s oversight. Presuming Plan sponsor personnel have better things to do than worry about the Plan. Attitudes/rationalization: They’re going under, may as well get what he can while he can. Sample audit procedures that might detect fraud: Analytical review of expenses paid compared to prior year, in total and by vendor Inquiry of Plan sponsor about individual vendors paid by Plan and nature of costs Review of SAS 70 should have identified a lack of segregation of duties 37 37

38. EBP Fraud Case #6 (Tim) Fraud: The plan was charged and paid for the FAS 87/132/158 calculations in addition to the FAS 35 calculations on several occasions for a number of different plans. Fraud triangle conditions: Incentives/pressures: Plan sponsor was experiencing cash flow problems Opportunities: HR Manager was able to convince TPA that it was OK Attitudes/rationalization: Plan sponsor stated they were funding in the longterm anyway Sample audit procedures that might detect fraud: Audit of expenses (even if immaterial) Inquiry of key personnel regarding their knowledge of plan provisions and ERISA 38

39. EBP Fraud Case #7 (Debbie) Fraud: Plan administrator overrode the system to redirect all investment earnings for Company Fund X into their account balance. Fraud triangle conditions: Incentives/pressures: Plan administrator is retiring next year and has sufficiently saved for retirement Opportunities: No formal oversight committee Attitudes/rationalization: Has worked for the Company for over 25 years yet just had his post retirement health benefits cut back Sample audit procedures that might detect fraud: Compare ROR for plan management to those of other participants Review participant listing for anomalies Review the account activity for participants who have access to plan assets or assist in administering the plan 39 39

40. EBP Fraud Case #8 (Jim) Fraud: HR manager requested distributions for persons who left Company 2+ years ago. She had been successful 3 times for over $10,000. Discovered when bank refused to direct the deposit since deposit name differed from account holder’s name. Fraud triangle conditions: Incentives/pressures: Her husband got laid off and money is really tight Opportunities: Knew that Company and TPA had lost track of individuals and figured that they probably didn’t know they had balances due to them anyway. Knew it wasn’t material so the auditors wouldn’t see it. Attitudes/rationalization: If she doesn’t take the money, someone else will Sample audit procedures that might detect fraud: Direct confirmation directly with participants of sample of distributions paid Compare signature on withdrawal request to employment application or W-4 form 40 40

41. EBP Fraud Case #9 (Tim) Fraud: A plan paid for recordkeeper services and the custodian also paid for the recordkeeper services as an indirect payment. No disclosure was made by the custodian who saw both payments being made. The trustees sued both the recordkeeper and the custodian. Fraud triangle conditions: Incentives/pressures: Incentives for recordkeeper profits, pressure for custodian to blow whistle, ongoing business relationship Opportunities: Plan sponsor relied on recordkeeper 100% Attitudes/rationalization: Recordkeeper believed indirect payment would not come to light Sample audit procedures that might detect fraud: Audit of recordkeeper fees and contracts between parties Review of related party disclosure requirements 41

42. EBP Fraud Case #10 (Debbie) Fraud: Plan investments managed in house. Company controller is also plan administrator. Controller borrowed funds from the plan to cover cash flow needs of the Company. Fraud triangle conditions: Incentives/pressures: Financial stability of plan sponsor is threatened by economic conditions Opportunities: Lack of review of plan investment transactions (e.g., by the trustee, sponsor or the plan’s investment committee) Attitudes/rationalization: If he doesn’t borrow from the plan, they can’t pay invenetory vendors who have them on credit hold Sample audit procedures that might detect fraud: Analyze changes in investments and investment income during the period Obtain evidence regarding the existence and ownership of investments and information about any liens, pledges, etc. Test investment transactions 42 42

43. EBP Fraud Case #11 (Jim) Fraud: An HR employee, who also assisted with payroll, diverted both payroll taxes and plan contributions into his personal account for six months, then left the country. This employee also had responsibility for reconciling payroll bank accounts. Fraud triangle conditions: Incentives/pressures: Find a way to pay for villa in the South of France Opportunities: Lack of appropriate segregation of duties Attitudes/rationalization: She was tired of working all the overtime that was required, felt the company had abused her long enough Sample audit procedures that might detect fraud: Comparing amounts of withheld contributions to deposits to plan for a sample of periods throughout the year Confirmations directly with sample of participant asking them about their contribution levels 43 43

44. EBP Fraud Case #12 (Tim) Fraud: A person was offered a job but never actually started the job. The plan sponsor entered the person as an employee into the HR system and enrolled the person in the plan and then started issuing paychecks with deductions for contributions to the plan. This went on for three years until the employee running the scam requested a distribution at which time the fraud was discovered. Fraud triangle conditions: Incentives/pressures: Personal gain Opportunities: No segregation of duties at plan sponsor Attitudes/rationalization: Controlled whole process, would be able to cover her tracks Sample audit procedure(s) that might detect fraud: New hire payroll test Coordination of EBP and regular plan sponsor audit (detail payroll test) Reporting to those in charge of governance, management letter, opportunities for strengthening internal control 44

45. EBP Fraud Case #13 (Jim) Fraud: Controller wrote bogus loan checks on behalf of employees, completed bogus promissory notes, and cashed checks personally. Controller handled all plan administration personally and didn’t report loans on participant statements. Fraud triangle conditions: Incentives/pressures: Employer doesn’t provide good health insurance and his wife’s medical bills from her bout with cancer is overwhelming him Opportunities: Complete lack of segregation of duties, with no oversight at all Attitudes/rationalization: He deserves good health coverage Sample audit procedures that might detect fraud: Confirm loan balances directly with participants Validate signed loan documents and endorsed loan check back to other participant signatures in personnel file In fraud inquiries, recognize pressure on controller and lack of controls 45 45

46. EBP Fraud Case #14 (Tim) Fraud: A company failed to remit all employee deferrals ($350,000) for a period of time. The company was having financial difficulties and ultimately went bankrupt. Fraud triangle conditions: Incentives/pressures: Company was barely making payroll Opportunities: Employees only received quarterly statements of their 401(k) Attitudes/rationalization: The CEO believed it was better then firing employees Sample audit procedures that might detect fraud: Contribution timeliness test Audit of reconciliation of salary deferrals from payroll to trustee records 46

47. EBP Fraud Case #15 (Marilee) Example: Trustee of an ESOP plan who was also the major stockholder of the company was planning on retiring. He deliberately changed the appraisal firm that had valued the company stock to a relative and instructed them to use a different methodology in order to inflate the stock price so that he would receive a much higher distribution upon his retirement. Fraud Triangle Conditions: Incentive: Maximize the value of his distribution upon retirement Opportunity: His authority was never questioned and weak internal controls. Attitude/rationalization: It was “his” company and the company owed him more for building the organization. Sample audit procedures that might detect: Recognize the risk of fraud in the planning process (gaining an understanding of internal controls and overbearing management style) and design steps to address the risk; Verify the credentials of the appraisal firm including independence Determine the reason for the change in valuation methodologies and if they were appropriate 47

48. Question & Answer Session Submit questions to the EBPAQC mailbox at ebpaqc@aicpa.org

49. Wrap Up Thanks for joining us today for this live forum We welcome any additional feedback on today’s live forum. Send comments to the Center mailbox at ebpaqc@aicpa.org. Consider using the Center online forum to further discuss issues addressed on today’s call – http://ebpaqc.aicpa.org/Community/Member+Discussion+Forum.htm

50. Upcoming EBPAQC Live Forums • March 3 - Electronic Processing for 2009 Form 5500, 1:00 – 3:00 p.m. Eastern Time • March 23 - 11-K Audit, 1:00 – 3:00 p.m. Eastern Time • April 20 - ESOP Plans, 1:00 – 3:00 p.m. Eastern Time