Internal fraud. Two words that strike fear into the hearts of any agency owner. It’s not a subject that we want to talk about but it’s a real danger for agencies. And while most agency owners think that it could never happen to them, I know from my experience with hundreds of agencies that it can and does happen to the best of us.
But have no fear, by following some very simple best practices around your accounting systems and the people you trust with your money, you can take great strides in making sure the right checks and balances are in place inside your agency.
Take a listen to this solocast where I detail out:
- Common ways internal fraud is committed and ways to prevent it from happening
- How agencies are targeted with email scams
- The ways agency employees embezzle hundreds of thousands of dollars from agencies
- The systems you need to put in place to prevent fraud
Drew McLellan is the Top Dog at Agency Management Institute. He has also owned and operated his own agency over the last 20-years. And all through the year, he straddles the fence of working in his agency and working with 250+ small- to mid-size agencies in a variety of ways. He works with agency owners in peer network groups, teaches workshops for owners and their leadership teams, teaches AE bootcamps, and does a lot of consulting. Because he works with a lot of agencies every year — he has the unique opportunity to see the patterns and the habits (both good and bad) that happen over and over again. He has also written two books and been featured in The New York Times, Entrepreneur Magazine, and Fortune Small Business. The Wall Street Journal called his blog “One of 10 blogs every entrepreneur should read.”
To listen – you can visit the Build A Better Agency site (http://buildabetteragency.com/drew-mclellan-solocast-episode-6/) and grab either the iTunes or Stitcher files or just listen to it from the web.
If you’d rather just read the conversation, the transcript is below:
If you’re going to take the risk of running an agency, shouldn’t you get the benefits too? Welcome to Build a Better Agency where we show you how to build an agency that can scale and grow with better clients, invested employees and best of all, more money to the bottom line. Bringing his 25+ years of expertise as both an agency owner and agency consultant to you, please welcome your host, Drew McLellan.
Drew: Hey everybody, Drew McLellan here with another episode of Build a Better Agency. So today’s episode is a solocast. So if you remember, most of my episodes involve me having a guest on with me and we talk about some aspect of running an agency, but every fifth episode is a solocast. That is just where you and I can hang out for a little bit together, and I talk to you about something that I really think needs to be on your radar screen. And today’s topic is one that nobody is gonna be excited to talk about, but it’s absolutely vital to your business.
Remember when you were a kid and you had a sleepover or you were out camping, and as soon as it got dark, you wanted to gather around the campfire or you wanted to sit around the fireplace or wherever you were gathered, and everybody tried to tell the scariest story that they could come up with. And the whole goal was just to scare the bejesus out of everybody else at the party or who was camping to the point that nobody wanted to go to bed. Well, today’s solocast is sort of the adult agency owner version of those scary stories.
Today, I wanna talk to you about a problem, a real danger for agencies, and that danger is internal fraud. Unfortunately, I have seen more than one case of it through the lens of AMI as I work with agency owners. And I wanna talk to you about some of the most common ways that that fraud is committed. And I wanna talk about ways that you can prevent it from happening to you.
What put this on my radar screen to talk to you about right now is that for the last year, year and a half or so, a big email scam has been going around and for some reason, agencies seem to be one of the targeted businesses. So, the way the scam works is that whoever in your shop does your books – so accounting person, the CFO, whatever you call them, bookkeeper – they get an email from you, the agency owner, and in essence, it says, let’s say your accounting person’s name is Bob. “Hey Bob, can you please wire $50,000 or $100,000 or $20,000, whatever it is, to this bank account,” and gives all the wiring information. “It would be great if you could get that done today. Thanks, Drew.”
And these scammers have really brilliantly figured out how to mask an email, so it absolutely looks like it’s coming from your domain and from your personal email. Yes, sometimes they slip up a little bit. Sometimes the tone of the email is not quite right. We got one at my agency and my accounting person recognized right away because of the tone that I didn’t send it. But she wasn’t flagged by the way the email looked. It was really just the tone. But I’ve had two AMI agencies that were not so fortunate. Their accounting person received the email and immediately acted upon it thinking that it was from the agency owner. And in one case, over $50,000 got immediately wired out and then in another case about $30,000 got wired out. One of the agency owners was fortunate enough that they were able to get some of the money back, but the other one was completely out of luck. The minute that that money hit the bank account where it had been wired, it was immediately transferred to another bank account out of the country. And that was that.
So that’s a case of bad practice and someone not following probably processing procedures. It wasn’t intentional on the accounting person’s part, but the agencies to allow $30,000 or $50,000, and for many agencies, that is pretty tough to recover from. In most cases, the fraud and the danger to you is not some guy out there in a foreign land sending emails, but it’s actually much closer to home. It really is in most cases, someone who works for you, someone that you trust, someone that you have given a great deal of both responsibility and authority too. And they are abusing that.
So let me tell you some of the ways I have seen internal fraud be committed. So, the easiest way is an employee opens up a credit card in a company name that you, the owner, don’t know anything about, and just charges things personally and then uses funds from either client payments or money that was put aside for media to pay down that credit card every month. And after that it flies under the radar screen. And typically the way that that’s caught is when the agency owner gets a credit report or goes to buy a car or something happens, when all of a sudden they are alerted that there’s a credit card in their name that they didn’t know about. But all too often by then, hundreds of thousands of dollars have been run through that card and that employee is nowhere to be found.
Another way that’s pretty common is, there was an AMI agency where the accounting person created a bunch of phony vendors that didn’t really exist. And then was writing checks to those phony vendors which were actually DBAs of a company that he owned and then depositing the money into his own checking account. And that was really a case of the agency owner taking his eye off the ball. That he really trusted this guy and just really wasn’t paying a lot of attention and $400,000 later, let me repeat that for you, $400,000 later, he caught the problem when media vendors started calling and saying they weren’t getting paid. Because that is how the accounting person was funneling the money out. He was shorting vendors and putting in the books that they had been paid even though they had not been paid. And that guy again walked away with $400,000. And because the accounting practices in that agency were a little sloppy, the police really couldn’t do anything because there wasn’t a clear paper trail to be able to prove that this guy had done what he had done.
And interestingly, the way that that agency owner got some restitution, and by the way, the way that that accounting person ended up in jail, was not through the police department but actually through the IRS. The agency owner turned the guy into the IRS and they went after it in a much more diligent way than the local police did. But again, that agency owner got pennies on the dollar back, had to make good all of those media bills that hadn’t gotten paid. And several years later, he’s still digging out of that hole, all because he didn’t have best practices in place for his accounting.
And then another story is that an agency owner who had, again, an accounting person that they absolutely trusted and this person, as often happens had access to a lot of the owner’s personal information, like their social security number, because they were tax files and other things in the office. Anyway, what this person did was they opened up a bunch of credit cards in the owner’s name and just charged an ungodly amount of money on those credit cards, and then again was using company funds to pay for those credit cards to pay the minimum payments.
And when that accounting person sort of got the feeling that the owner was starting to catch on… What happened is the owner was financing something and pulled a credit report and all of a sudden was seeing credit cards that she had no idea that she had. And so not only did she and her agency have to deal with the huge hole of debt that this accounting person had dug for them by charging a bunch of stuff and then using money that should have been used to pay vendors to pay off the credit cards. Not only did she have that to deal with, but she had a whole identity theft issue and the bad credit, and it was really, really a disaster.
And again, in this case, they were able to prosecute and the person did a little bit of jail time and someday might do restitution. But again restitution just means they owe you the money and they’re supposed to pay you. That’s different than you having money in your bank account. So, this is a really big risk to you and I totally get. Right now in your head, you are saying, “That is awful that that happened to those people, but, you know what? Thank God I have…” And then fill in the blank of the name of whoever does your books.
And you know what? I get that because the person who does the books for me at my agency has been with me for over 15 years and I trust her completely. I would give her keys to my house. I would let her hang out with my daughter forever. I would hand her my wallet full of money and fully expect it to be handed back to me with just as much money. I totally trust her. But you know what? Here’s one of the reasons why I know I can trust her. Is because early on, she was the one who insisted that we put some practices in place so that I and the agency were absolutely protected, and as she pointed out to me, that meant she was protected as well. She would never be accused of something that I could or couldn’t prove she did because we have a system in place that doesn’t allow for fraud.
And really none of this stuff I’m gonna talk to you about is super complicated, and none of it is super expensive. It’s just a best practice. And it may take a little bit of time. It may be a little inconvenient, but compared to digging out of a $400,000 hole or having your identity stolen and having to sort of repair that over years and years and years, this stuff is a piece of cake.
So, here are some things that I think you should be doing to make sure that your accounting department is clean and that you are not at risk for internal fraud. And by the way, sometimes internal fraud happens in other departments of your company, but the reality is the people who control and touch and move your money around are the ones who are most likely to do something with that money. And they certainly have the access that no one else has. So, let’s focus today on really how you can put checks and balances in place inside your agency.
The first one is, before you hire anyone to work in your accounting department, you need to run a thorough criminal background check and a thorough credit check. That is just Best Practice 101. If anything on either of those reports gives you hesitation, if anything on either of those reports makes you go, “I wonder what’s that about.” Should you ask the question? Absolutely! But it’s got to be a huge red flag for you and should you think very, very carefully about bringing that person into your shop? Absolutely!
If you’ve already got people in your accounting department, obviously you can’t really do a background check. And part of the background check, by the way, for accounting people is you should talk to whoever they are leaving to come to your place, even if they ask you not to. And you can put them on probation for 90 days, don’t let them near your bank accounts and do it after you hire the person, if you want to. But you absolutely need to know that they are leaving for the reason that they stated and that they’re not trying to escape something like fraud or bad money management practices or all those things.
In terms of the credit check, even if you’ve got folks in your department now, I would suggest that you implement an annual credit check for anyone in your accounting department. So, it’s just a policy change. You would just put it in your employee manual and just say, “As of January 1st, 2017,” you would wanna give them plenty of notice, “But as of January 1st, 2017, we will be running a credit check on anyone who has anything to do with agency money.” And what you are looking for there is not that they have no debt or that they have 100% credit scores, it’s not about that. It’s about the fact that if they are gonna manage your money. Don’t you want them to be able manage their own money pretty well?
You know, of course, they’re probably going to have some credit card debt or they’re gonna have a mortgage or a car loan or whatever, that’s fine. But you also wanna know, you wanna look and make sure that they are making all their payments promptly and that they do have at least a decent credit score because good people when their backs are against the wall, can sometimes make really bad choices. And you don’t wanna open the door to that. So, I would highly suggest the annual credit checks for anyone who touches any aspect of your money.
And then if you can, really the cash management duties, the AP, accounts payable and accounts receivable should be divided. The same person shouldn’t do both. It’s a lot harder to hide fraud if you only handle half of the equations. So, if you can divide those up, it doesn’t necessarily mean that you have two people who are skilled in accounting. It may be that you have somebody who is plugging invoices into an accounting system and that could be more of an admin function, or you have somebody who is writing checks to vendors, and again, that could be an admin function. But if you can, and this is tough in a small shop, if you can, divide up those two duties.
One thing you absolutely should do is that all statements for your checking accounts and your credit cards should be sent to you, the agency owner, at home. You should open them every month. You should just kind of quickly glance through them, and what you’re looking for is something that looks out of place. So, flip through the canceled checks if you still get those and look at the monthly statements and look at the charges on your credit card, and then bring those statements back to the office and give them to your accountant and then he or she can put them into your accounting software.
If you’re not going to look at them, you still wanna have them sent to your house. The act of having them sent to your house and the person inside your shop knowing that you are gonna have access to them every month and in their mind, you are gonna look at them every month, probably eliminates 80% or 85% of all fraud just by doing that. So even if you’re not gonna look at them, have them mailed to your house. Don’t bring them in unopened, obviously. Make sure that you open them and rifle through them, and after that, it looks like you’re looking at them. And clearly what I’m telling you is actually look at them. But if you’re not gonna do that, you still should have them mailed to you.
Another best practice in terms of your accounting is that any check over X amount, depending on the size of your agency, that amount’s gonna vary, but set an amount. The threshold that is pretty low that it’s gonna be a fair amount of checks, require two signatures. Now here’s the deal, you don’t have to be the second signatory, it could be someone else in the agency. If you travel a lot or you’re not around or you just don’t want to do it, the whole point is that, again, that accounting person knows that someone else is looking over their shoulder at what they’re doing and is participating in the accounting activities. So in most cases, it is the agency owner, but if for some reason you don’t want it to be you, then make it your creative director or make it somebody else who is on a leadership team with you. But make sure that you at least have the double signatures and that that is never violated. In fact you need to call the bank and say, “If you ever cash a check over, again, X amount, that only has one signature, I am not gonna be responsible for it. You guys need to watch for this.” And they will watch for it. They absolutely will.
Another easy thing to do is to make sure that your mail is opened by someone other than your accounting person. So, in most cases, it’s somebody who is sitting at the front desk, or an intern, or kind of a junior woodchucker account person, whoever it is. But assign the task of picking up the mail every day and opening it to someone other than someone in the accounting department. And then any time they open up an envelope and there’s a check inside, they should immediately stamp it for deposit. So, you should have one of those, you know, 10-dollar deposit-only stamps that has your account number on it and the name of your bank, and you can get those anywhere. But you should have one of those, and as soon as they are opened, they’re stamping the backs of those checks with that deposit-only stamp. And again, just the little change, that little behavior will reduce the risk of fraud significantly inside your shop.
And the last thing you should do, the last but certainly not least is you should require, and I mean this, you should require that whoever is doing your books, and again, I’m talking about people inside your agency, not if you hire like an accounting firm. But whoever is doing your books inside your agency, they must take a week of vacation every year or they are away from their desks for five days. And you are gonna hire a temp, and in many cases, people will get someone from the accounting firm that does their taxes or you could hire a temp with accounting background. In most cases, agency accounting is not super complicated. If you use a certain kind of software like say a Workamajig or Advantage, you can find somebody who has skill in that and hire them for a week or two and have them come in and perform your accounting person’s job responsibilities for at least five days. I promise you, if they’re doing something weird, it will pop up in five days, and if they know that this is part of your policy, because the whole point of this is to prevent it, not to catch it after it happens. If they know that this is your policy, it is going to discourage this sort of behavior in a big, bad way.
So, you know again, internal fraud is not a sexy topic. This is not a fun topic, but this is a bread and butter critical topic. I wanna make sure that you are taking home the money that you’ve earned. I wanna make sure that you have money at the end of the month to pay your people. I wanna make sure that you have money to invest in your business. And it’s hard enough to do that in an agency with no one stealing from you, but it’s darn near impossible when somebody has their hand in your pocket and it’s heartbreaking when the person who has their hand in your pocket is one of your employees. It is absolutely heartbreaking. I will tell you in every case, the agency owner was sick to their stomach about the money, but they were heartbroken because of who had taken the money. So protect yourself, protect your agency, protect your family, and put these best practices into play.
That’s it for today. Thank you so much for spending time with me. If you have questions about what we talked about today or anything, you know how to reach me. I’m [email protected] and I hope that you will come back next week for another episode. I promise I will have a guest with me next time who will talk about some aspect of the business that will help you build a bigger, better, stronger agency and I would love it if you would scoot over to iTunes or Stitcher and leave us a rating. You know, that’s really how we’re gonna get found by other agency owners.
One of my goals in doing these podcast is just to make it a resource for agency owners of all sizes, but particularly small to mid-sized agencies. And the way they find us is the more ratings and reviews that we get, the more, iTunes in particular, promotes us on their pages. So, if you would go and do that, I would be most grateful. And don’t forget to subscribe so that you do not miss an episode. If you’re wondering what else is going on at Agency Management Institute in terms of our workshops or our owner networks, head over to agencymanagementinstitute.com and check it out there. And again, I’m around if you have questions.
Thanks, and I will see you next week.
