When it comes employee investigations, sometimes the “smell test” will not let you rest. You know, those situations when you listen to a story or a business practice, and something just plain stinks. On the surface, nothing appears to be wrong, but there is a smell just below the surface that makes you think, “This is spoiled milk.” We don’t have to taste it to know that it’s bad. A quick sniff, a glance at the label on the side of the bottle, the floating lumps, and our decision is made.
Certain cases have failed the smell test because there were so many red flags. There were problems and circumstances that should have been further explored, yet they were overlooked. Occasionally, the smell test is wrong. But over the years, we have seen that when the red flags appear, they consistently confirm that the milk is spoiled.
Let’s take a look at the red flags we have found to be most useful in ferreting out the dishonest employee.
When reflecting on our interview and interrogation techniques, we should note that there are great differences between an employee who is a thief, and one who is a fraudster or embezzler.
While both types may be stealing from the organization, their methods are often different, as are the red flags indicating dishonesty.
Lack of Internal Controls
Employee fraud can take many forms, from simple refund schemes to large-scale embezzlement to kickback cases. Fraud differs from simple theft in that it is intended to be an ongoing means to divert company money or assets. Fraud also tends to result in a larger dollar loss to the organization due to the duration of the activity.
A thief, on the other hand, often commits an impulsive act because circumstances allow him to do so.
Regardless of whether we are investigating a simple theft or a complex white-collar scheme, red flags will indicate that an investigator should take a closer look at the individual.
Large-scale frauds and embezzlements tend to be more costly to an organization because they remain in place, often diverting assets for years. Not surprisingly, we have found that some of the larger frauds occur in small businesses with fewer internal controls and audit structure. Those organizations that are in a growth mode where sales and expansion overwhelm the organization’s infrastructure are extremely susceptible to fraud. The seduction of increased sales often causes smaller organizations to leave behind infrastructure and controls during rapid growth, giving rise to the opportunity for fraud.
In many of the larger cases we have investigated, the fraudster was able to continue his scheme due to the lack of internal controls.
Sometimes this was as simple as having one person responsible for both accounts payable and accounts receivable, allowing that individual the means to embezzle significant amounts of money.
Another case involved a company that allowed a father to supervise the first shift and his son the second shift with no additional office oversight. Since many of the employees were Spanish-speaking, the office personnel could not effectively communicate with the employees and had no idea who was working on either shift. The father and son handed out payroll checks at the end of each week to their employees. Office personnel later discovered by accident that the father and son had failed to mention that an employee had quit, leaving the men with the ex-employee’s check. Rather than turn the check back in, they took the check to a local bar and cashed it. As the scheme escalated over years, we found that 10 percent of the company’s workforce was part of a ghost payroll operation benefiting the father-and-son team. It was surprising no one realized that labor costs had increased so dramatically over the past several years, but good sales can cover a variety of problems.
Characteristics of Fraudsters
For a fraud scheme to work, an individual has to be able to manipulate accounting data or make decisions about purchasing or operations. As a result, most fraud schemes are discovered in the accounting function with management personnel.
One consistent aspect we have discovered over the years is the fraudster typically does not have a criminal background and has not been terminated for cause. Unlike the thief, this generally results in a longer-term employee who has successfully moved up the ladder with successive promotions and increased responsibilities.
Interestingly, the majority of our large cases were detected through a tip or by accident, rather than through internal audit. Some of these cases resulted in tips from another vendor or more often, from employees who had become suspicious of their coworker.
Age. The individuals involved in fraud, embezzlement, and kickbacks generally tend to be older, ranging from their late 30s to mid-50s. Many have been in the workforce for 15 or more years, successfully moving to positions with increasing responsibility until they reached the point where they could manipulate the organizational controls.
Another common trait of these schemes is their duration. In most cases we have investigated over the years, the scheme lasted one to two years in duration before it was discovered.
Because the individual has successfully reached a position of authority, he (or, less often, she) Â is typically married with children. In several cases, a spouse actively participated in the fraud by operating a front company that was used as part of a phony billing scheme.
Personality. The fraudster’s management style is often autocratic, with an “It’s my way or the highway,” attitude. They bully, demand, and manipulate their way through the business. Rules and controls are made for others.
“I do what’s necessary to get the job done,” they say.
Many of these people are master manipulators, turning conversations around, spreading rumors, stealing credit for another’s work, and convincing others to break the rules so “business can get done.”
In this person’s world, they are the sun, and the rest of us are minor planets revolving around their grandeur. Psychologists refer to these types as narcissists–the ultimate manipulators. They lack empathy and are so self-centered they feel entitled to act as they choose. They may butter someone up to get their way or guilt others into doing their bidding. They may bully or repeat a request over and over to get another to do something and then later selectively forget doing so.
In one fraud case, the senior executive scored “off the scale” on persuasion in his personality profile. But when you add a lack of empathy to that, persuasion becomes manipulation. He had gotten away with his tactics for so long he would look people in the eye and fabricate lies, believing no one would ever check on the facts. After all, they never had before.
Motivated by Greed
What is the primary motivation to embezzle or commit a fraud? Most often, it is simple greed. The greed motivation may manifest itself with several red flags. Since most fraud and embezzlement cases generate substantial amounts of money over time, the investigation should follow the money.
The investigation generally begins by looking at a net-worth computation that estimates the individual’s salary against expenditures. When the expenditures outweigh the person’s salary, there is another source of income in play.
Generally, this means that the fraudster is living beyond his means—one of the most common red flags associated with embezzlements, frauds, and kickbacks. This may reveal itself through lavish dinners, fine wine, multiple properties, frequent trips, or other expensive purchases.
Sometimes the excessive spending will translate into financial difficulties that initiate the fraud or embezzlement. The person believes or has a perceived need for extravagant items, which push the employee’s financial situation into a difficult place that, in turn, motivates the establishment of the fraud scheme.
Added to the financial spending, many fraudsters have a wheeler-dealer mentality that encourages risk-taking behavior. Our investigations have revealed many instances where this wheeler-dealer personality manifested itself as a risk-taking gambler. While any gambler may have a string of wins, eventually the house recoups its losses, which contributes to the dire financial straits the fraudster has found himself in through his extravagant purchases.
In those instances where we have investigated collusion with an outside vendor or company, the losses have always been substantially higher. When collusion occurs, it is often the wheeler-dealer mentality playing loose and fast with the rules and internal controls that contributes to the decision to defraud the organization.
Fraud and long-term embezzlements often have a much higher loss than those caused by the simple thief. The red flags accompanying high-risk individuals have proved to be a good indicator whether to invest in what might prove to be a complex investigation. These individuals tend to be older, longer-tenured, possess a wheeler-dealer mentality, and a love for the good life even when they might not be able to afford the purchases. The first steps in developing our interview and interrogation techniques typically begin with the ability to conduct a solid investigation. Pay attention to the red flags, then have a good sniff at the business practices and decide whether the milk is spoiled.
Behavioral Indicators of a Thief at Work
While today’s analytics and data mining can quickly focus on anomalies in the numbers indicating probable theft, there was a time when investigators did not have this advantage. Some companies do not yet have these systems so it might be useful to go “old school” with our employee investigation and look for thieves by their behaviors.
Let’s take a look at the red flags we have found to be most useful in ferreting out the dishonest associate during employee investigations. There are great differences between an employee who is a thief and one who is a fraudster or embezzler. While at the end of the day both types are stealing from the organization, their methods are different, as are the red flags indicating dishonesty.
Age and Tenure
In general, the thief poses less of a threat to the organization than the fraudster. This is simply due to the level of access to the accounting function or ability to manipulate documents. This group as a whole also tends to be less tenured, resulting in a shorter length of time to steal from the company. While the fraudster tends to be a longer tenured employee, thieves tend to be newer to the organization. As a rough estimate, about 70 percent of employee theft is committed by associates who are with the company one year or less. Seventy percent of that 70 percent of theft activity is committed by employees having tenure of fewer than six months.
Not surprisingly, the age of the thief is also much younger than the fraudster. A thief by his or her nature is impulsive, and acts impulsively to exploit a situation for to their advantage.
If one was to examine arrest statistics from the 1800s to the present, it becomes apparent that 16- to 25-year-olds are arrested more than any other age group. These are the years in peoples’ lives where they are most impulsive, and their thoughts are focused on today rather than what tomorrow will bring. It’s not until the mid-to-late 20s that an individual’s perspective on life begins to focus on the future, and the impulsive nature begins to diminish. In the later 20s, people begin to focus on their career, families, and homes, making decisions for the long-term.
When we add the type of jobs available to those entering the workforce, it matches neatly with the lack of tenure associated with those who steal. To a large extent, this age group is working in part-time positions with no long-term career path evident. As a result, there tends to be a lack of commitment to the organization, which reduces both the employee’s length of tenure and his or her reluctance to steal from the company.
We now have the impulsiveness of the young person, and a lack of commitment to the organization, combined with minimum-wage positions and exposure to merchandise and money. This is an obvious combination that can be easily rationalized, releasing the impulsive nature of the part-time employee to commit a theft.
Personality
While the fraudster may exhibit a strong commitment to the organization and perhaps even excel at his position, thieves tend to behave just the opposite. Since there is no long-term commitment to the company, we will often find during the employee investigation that the thief is a disgruntled and lackadaisical employee. These characteristics, especially disgruntlement, make it easy for an individual to rationalize his theft since he believes that he is not being treated fairly or paid adequately by the company.
The thief’s disgruntlement is often characterized by his shoddy workmanship and lack of attention to detail. This may be seen in the cleanliness of the facility, a disorganized stock area, and the shoddy display of merchandise. A manager who allows his store to appear like this breeds theft in the same way a dirty food counter grows bacteria.
The disgruntled employee may have been disciplined by management for a variety of issues. Dr. Richard Hollinger and John Clark, in their seminal study of employee theft, point out that the thief participates in time deviance. In other words, they abuse time. The disgruntled employee is likely to come in late, leave early, take longer breaks, and have more missed shifts than the honest associate. These employees may spend time talking on their phones or visiting with friends who come to visit. Unless the manager is present, you will likely find them engaged in idly passing the time.
Considering their shoddy workmanship, time deviance, and lack of attention to detail as a group, you are likely to discover during the employee investigation that they have been disciplined or put on warning. This group typically does not pull its own weight, and they tend to flock together separate from the honest employees. Since the age group of the disgruntled employee is most often in the 16- to mid-20s age group, peers are  important. With a young person’s need to be in constant communication with and well liked by their friends, it is a simple step to engage in pass-offs or discount abuse.
An angry or disgruntled employee is also able to rationalize his dishonest behavior by blaming the company, high prices, his low pay, or the need to please friends to justify theft activities. Since the associate does not plan on a long tenure with the company, if he is fired or quits, it makes little difference to his long-term career path.
This behavior is considerably different from the fraudster, who uses being well liked and good at his job to conceal his fraudulent activities. The fraudster does not want to make waves or come to the attention of management since that might cause discovery of his activities.
Employee Theft Motivation
While the motivation for the fraudster revolves around greed, it may be much more complex for the thief. The fraudster turns on a consistent flow of money, perhaps using several schemes to live a lifestyle he otherwise could not afford. However, for the thief we might find a more erratic and impulsive flow of money and merchandise that is dependent on the opportunities available during any particular day. Employee investigations may reveal that there is a certain manager on duty who spends an inordinate amount of time off the sales floor, giving the thief an opportunity to create fraudulent refunds. Or it might simply be a purse left unprotected. The thief is opportunistic, seizing the moment and exploiting it for his own gain. The fraudster is more cerebral, turning on a continuous flow of money enriching him over time.
Sometimes the thief is not driven by greed, but rather the need to belong. This motivation encourages him to collude with his friends to steal from the organization. The gratitude of his friends provides a social reinforcement for his activities and endears them to him.
Clearly, the thief will not become rich waiting for an opportunity to steal. The theft may be a momentary solution to a personal financial need, but it is not a long-term solution to his cash problems. The thief’s impulsiveness is also often reflected in how he spends his money. One day he is destitute, and the next flush following his theft. He disposes of his proceeds impulsively and without a thought for the future. We have interviewed a number of drug dealers following employee investigations who talk about making thousands of dollars in a single day, only to wake the next morning totally broke.
There is a huge difference in the activities of the fraudster and the thief. The thief may choose to steal metal items to sell to scrap dealers, or break into a house to take a second-hand TV; but these provide only a pittance and are not capable of changing their lives. However, if we think of Bernie Madoff, the distinction is clear. It’s a scheme that is in place for a long period of time, providing a constant flow of money that is sufficient to change a person’s lifestyle. For example, in 2015, a city clerk in Illinois embezzled over $50 million from her community. She became a rich socialite with a stable of horses, fine jewelry, and was able to take expensive vacations, which she did for years.
Remember, when trying to ferret out thieves from honest employees, it will often be their traits that will help us identify them. Good employee investigations will then clearly establish their dishonest actions.
This article was first published in 2014 and updated December 19, 2018.