Fraud Auditing, Detection, and Prevention Blog

Fraud Auditing To Bust Ghost Employees

Oct 28, 2019 1:52:10 PM / by Leonard W. Vona

One of the most popular topics on this blog has been Ghost Employees. I recently sat down for an interview on how fraud auditing can be used to uncover Ghost Employee schemes that I wanted to share with you.

What is a Ghost Employee?

A ghost employee is someone who is being paid for services not performed. We do need to make a distinction, however. This isn’t an employee who goes to work and spends all their time on social media. That is a supervisor issue. We’re talking about someone who doesn’t go into work and still receives a paycheck. There are at 20 or so different permutations. The employee who receives the funds may be involved in the scheme, or it could be a supervisor using a real person’s information without their consent. It could also be an employee of the company using fake identity created for a person who doesn’t exist.

Setting up a Ghost Employee situation could also be a way to pay a bribe to someone. In this scenario, someone within the company who wants to bribe someone outside of the company puts that person’s wife, son, or cousin on the payroll. The “employee” doesn’t do any work and still gets paid.

How common are Ghost Employee Schemes?

I think many companies are at risk, but it’s difficult to say how often this happens. It probably occurs more than we know about because companies don’t report it.  If they uncover a situation, they just put a stop to the payroll. They may feel the cost of reporting it and having it investigated isn’t worth the effort or cost.

Are Ghost Employee Schemes usually widespread?

They tend to be more one-offs unless it’s being used to pay a bribe or part of deep corruption. Usually, it’s that someone sees an opportunity and takes advantage of it.

What companies are vulnerable to Ghost Employee Schemes?

This is an issue that almost any company could face. A lot depends on the structure of the company. Often with big companies, such as the fast food industry, the manager does the hiring, reports the hours and distributes the paychecks. This combination of duties creates fraud opportunities.

That set up is an opening for a Ghost Employee scheme called “non-complicit temporary ghosting.” In this scheme, an employee physically departs the workplace without HR being notified. The manager continues to report hours for the departed employee and collects the pay for a few weeks before notifying HR that the employee has terminated.

How do you uncover Ghost Employee Schemes with the Fraud Audit Process?

The first step is to look at the permutations that the company is at the greatest risk for. This involves looking at the policies and the procedures and determining what could be exploited. Then you need to write a specific fraud risk statement that will guide the audit.

What I do is look at how the company is structured including hiring, terminating and paying employees. I look at what fraud opportunities that creates and then I start to identify the fraud risk statements that are the most logical and then I build the audit around that.

Can you give an example?

Let’s take a situation in which someone decides to hire a significant other or relative. The Ghost Employee is a real person with a real social security number and bank account.

In this case, the risk statement would be: Manager causes a real complicit person to be added to the payroll without expectation that the person will perform work for the company.

For this risk statement, the auditor can look at factors such as health insurance or 401K participation.  A Ghost Employee is less likely to participate in company programs.  Through the audit, the auditor would identify who doesn’t have a 401K or is not enrolled in health insurance. It is important to note, however, that this is not proof of fraud. There are many reasons why a legitimate employee doesn’t use the company’s health insurance plan or 401K. Once employees that fit a certain profile have been identified, those employees are the sample for fraud testing procedures.

What are some other things you might look for?

With this fraud risk statement look for evidence of work, or rather lack of. Some offices have a key code and you can see when people come into or leave the building. Other times there are computer systems that people need to log in or out of. If someone never logs in, it’s a good indication they aren’t doing any work.

How would you identify a potential “Non-Complicit Temporary Ghosting Scheme”?

If this is a concern for a company, I would look at all of the employees who have terminated in a certain time period to see if there are any red flags. For instance, you could look at whether they changed banks shortly before being terminated or if there was a change in how they received their paycheck.

Does the audit identify the people who are committing fraud?

There is an important distinction to be made around this. The audit doesn’t identify the fraud, it identifies situations that fit the fraud risk statement. A follow up investigation is needed to determine if there is fraud.

What is your advice to company executives who are concerned about Ghost Employees?

Be aware of how your hiring and firing practices could create opportunities for Ghost Employee Schemes. Include this is part of your fraud audit.

Demystifying Fraud eBook CTA

Topics: Fraud Data Analytics, Fraud Auditing

Leonard W. Vona

Written by Leonard W. Vona

Leonard W. Vona has more than 40 years of diversified fraud auditing and forensic accounting experience. His firm, Fraud Auditing, Inc., advises clients in areas of fraud risk assessment, fraud data analytics, fraud auditing, fraud prevention and litigation support.