In this series of blogs, we are looking at the practice of using a fraud audit to detect shell company schemes occurring in an accounts payable file. Because the practice of effective fraud auditing is grounded in knowledge, we will start with a knowledge section and then demonstrate the fraud audit process.
Trivia Answers
Does law enforcement use shell companies? Yes
Do publicly traded companies use shell companies to commit crimes? Yes
Why is Upjohn v. United States, 449 U.S. 383 (1981) important to fraud auditors? It is the principal case defining the privilege in the context of corporate investigations. Source: Corporate Fraud Investigations and Compliance Programs, author is Eugene M Propper, published by Oceana Publications, Inc.
What is the difference between a shelf company and a shell company? A shelf corporation is a corporation that has been created but left dormant and put on the shelf. Since many companies will not contract with a company that has not been in business for at least two years, it provides the illusion of an ongoing company.
According to the Organized Crime and Corruption Reporting Project which country is at the top of the list for “financial secrecy index.”? United States of America.
Name three African tax havens? Liberia, Mauritius, and Seychelles. Yes, there are others, but these are my favorite.
Knowledge Section: What do you know about the LLC form of business?
Limited liability companies (LLC) are defined as a type of business structure where owners of the LLC are called “members” and are partners in a business entity. They have all the protection of a corporation plus the ability to pass through any business profits and losses to their personal income tax return.
The LLC name may not be the same as the business name. They serve different purposes. The LLC name, or legal name, is the official name of the entity and is used to sign documents, file tax returns, file lawsuits, or submit a loan application with a bank. In contrast, a business name, or trade name, is the name the public uses to identify the business. This can be on everything from business cards to websites to marketing pieces. If the LLC is operating under a business name, the entity should file a DBA certificate.
As a general rule, who can be a member will vary depending on the taxing authority. However, a member can be another LLC, a corporation, or an individual native to the country, or a foreign individual. In my opinion, the taxation issues and ownership issues associated with an LLC form of business are more conducive to passing profits onto a perpetrator of a crime. Therefore, we see an LLC as a red flag associated with a shell company.
It is important to note that LLCs go by different abbreviations throughout the world. A few examples:
- An LLC company, known in Spanish as a Sociedad de Responsabilidad Limitada (SRL)
- The SARL company structure is a French limited company - the equivalent of a Limited Liability Company
- GmbH is considered an equivalent of LLC (limited liability company), which is used in the United States, or Ltd. (limited), which is used in the United Kingdom and is the most usual form of incorporation in Germany.
A private limited company is a common business structure, usually recognized by having the designator “Limited” or “Ltd” at the end of a business name.
In Bahrain, a With Limited Liability Company (W.L.L.) is one of the most common business structures chosen by foreign investors.
So, if one of your vendors is operating as an LLC, or equivalent, is this a smart decision on their part or a fraud red? These are the types of issues you need to sort out.
Practical Application: Use of fraud data analytics to create a sample of vendors that meet the profile of a shell company scheme.
We start with the master file data. Within the master file data, determine for which permutation of shell company you are searching. i.e., fictitious, assumed, hidden or temporary. Within the master file, we will examine the following data fields. In this blog, I will focus on the fictitious shell company.
- Vendor name
- Vendor creation date in accounts payable.
- Vendor address
- Vendor identification number
- Vendor telephone #
- Vendor web site
- Vendor Email
Before you start, I must qualify, your red flags will differ depending on where you are around the globe. Remember fraud data analytics is about interpreting your red flags. The more you know about the data, the better you can perform your analysis. I will share with you some of the red flags we search for.
Vendor name: We search for LLC initial associated with the name or the equivalent of an LLC. We look for non-descript vendor names. This can be based on a visual examination or based on string length of the name. FYI, vendor name is my second favorite field in the master file data.
For visual examination we have noted the following:
- company name is based on initials i.e., A.B.C., ltd.
- Company name does not describe vendors business.
- Company name ends with the equivalent of LLC.
- String length: if the vendor name is less than 3 letters without spaces and business type. Be careful, many companies have two company name fields: Full name and short name
Vendor creation date: a vendor that was added to the master file within the last 48 months. The number is subjective. I use 48 months because that is the timeframe in which most fraud becomes known. Yes, you will need to make subjective decisions.
Vendor address: a vendor that appears to have the absence of an office facility. The clues are often in the street address field. I.e., Suite # is often associated with a mailbox address or a virtual address. FYI, street address is my favorite field in the master file data.
Vendor Identification number: the absence of a number may suggest the vendor is not a legal entity, simply does not exist, or is the vendor identification for an individual rather than a business.
Vendor telephone: The absence of a telephone number may suggest that the vendor is not a legal entity or simply does not exist.
Vendor Email: we are searching for non-business domain on the email address I.e., Hotmail.com. However, in less economically developed countries generic domains for emails are more common.
To reiterate, no red flag by itself is indicative of a shell company. It is the totality of the red flags. We also believe it is important to examine the financial activity associated with the vendor number. In our next blog we will discuss some of our strategies in examining the transactional data.
Trivia
- As an accountant, you must be familiar with the terms, debits, and credits, so here are a few questions to test your accounting knowledge.
- What is the word origin of debits and credits?
- Who created the phrase "debits and credits"?
- On which printing press was the first book on double-entry accounting printed?
- What is the definition of “debere.”
- What is the definition of “credre.”
