The Managing Director Has a Secret

Catching a Fraud In Northern UK By Patrick Wellens, CFE, CIA, CRMA, with Shaun McMillan October 2014 Donovan, 48, from Scotland, was happily married with two children. He was tall and good looking, an extrovert whose outgoing personality helped him to do very well professionally. As a scientist, he built a successful research company that he sold for close to USD 70 million to a large pharmaceutical company that I’ll refer to by the pseudonym “Pharmatops.”

Catching a Fraud In Northern UK

By Patrick Wellens, CFE, CIA, CRMA, with Shaun McMillan

October 2014

 

Donovan, 48, from Scotland, was happily married with two children. He was tall and good looking, an extrovert whose outgoing personality helped him to do very well professionally. As a scientist, he built a successful research company that he sold for close to USD 70 million to a large pharmaceutical company that I’ll refer to by the pseudonym “Pharmatops.”

Pharmatops asked Donovan to stay on and run the new subsidiary in the Northern UK. The subsidiary consisted of about 40 people, nearly all scientists and a few administrative staff. 

One autumn day, while working as an internal audit manager for Pharmatops, I was asked to see one of the board members, who explained to me that allegations of misconduct had been reported anonymously at the Northern UK subsidiary. The board wanted me to find out whether these statements were true.

The managing director (Donovan) was contacted and informed that his subsidiary was on the audit plan this year and that a high-level review of operations (sales, procurement, research and development, accounting) would be conducted. Donovan told me that the subsidiary was very small in size, and given that just three years ago it was acquired by Pharmatops, an audit was not really necessary. He stated that surely there are larger and more riskier operations within Pharmatops to review. Also, during the time I wanted to carry out the audit, not all management staff would be around – so Donovan asked to postpone it. He must have known it was highly likely some of his fraud schemes would be discovered in the course of an audit.

Because of the allegations to be investigated, I could not accept his proposal.

The Audit Begins

After the initial internal audit opening presentation, Donovan explained the company strategy, the area of focus for researchers, the contracts with Big Pharma and related milestone payments. He also told us that in his role as managing director, almost all commercial, pricing, recruitment and promotion decisions were taken by him, he had single signing authority on bank accounts, and an external accountant came twice a week to take care of all accounting and management reporting.

 

To disguise the exact purpose of our audit, the team and myself started reviewing the research organization, the research project team meetings, research project status, milestones and actual/budgeted costs. We also reviewed whether milestones were correctly and completely accounted for.

 

We then selected for detailed testing a sample of employees (including Donovan) and reviewed whether salaries, bonus, long/short term incentives, pension plan and other remuneration components were paid in line with authorized amounts. For Donovan, it turned out that he sent to the external accountant an email saying that he obtained approval from his boss to have a salary increase of 3 percent and a bonus of USD 50,000, and the external accountant approved these payments. The original email from Donovan’s supervisor in the U.S. was not on file for various years, however.

 

We then started reviewing expense reports for a sample of employees (including Donovan). Here we found many anomalies. Firstly, Donovan made reservations on commercial flights, printed the itineraries and submitted these as the basis for reimbursements to the accounting department. When we reviewed the travel itineraries, car rental agreements and hotel invoices and receipts for meals, we found that the actual itineraries and flight details differed from those on the travel forms and itineraries submitted to accounting.

 

Many trips (mainly to the U.S.) had a business description such as “visit to HQ” or “visit to oncology congress,” but no detailed meeting agenda of congress and/or the persons met at U.S. headquarters was attached. Secondly, the initial flight destination was indeed to U.S. headquarters, however, then often additional airline tickets were bought – and by analyzing car rental invoices, fuel tickets and hotel bills we quickly came to the conclusion that private expenses were often charged to the company.

 

I made an Excel summary with dates, destination travelled and business purpose according to travel form, and then compared these with the actual dates/locations involved and persons visited. We concluded that in the last three years Donovan had charged approximately USD 100,000 on private travel to the company. This cost only includes airline tickets, car rental and hotels, and does not include the cost of professional time that was used for private purposes.

 

Many expense reports from Donovan contained line items called “advances of (USD) 1,000,” which he claimed to have been used for out of pocket expenses (toll, parking and coffee, as examples), however no receipts supporting the USD 1,000 disbursement were ever attached to the expense report.

 

Not all expenses related to the same trip were claimed on one and the same expense report – instead, parts were claimed over several trips. By comparing them we found credit card charges that had been charged already.

 

Looking Deeper at Donovan

I started asking myself whether Donovan could be defrauding the company in other ways, as well. I started wondering whether there would be billing schemes, conflicts of interest or other issues and decided to do a background search on him. From the personnel records in the human resource department, I was able to obtain personal information such as name, address, social security ID, date of birth and name of spouse. I used open source intelligence and paid subscriber databases and searched for convictions, hidden shareholder positions as well directorships in other companies. This analysis did not bring to light any criminal facts but highlighted some shareholding positions in another research company, for which he approved USD 200,000 in supplier invoices for dubious services rendered.

 

After being on site for almost three weeks, and based on the evidence gathered so far, it was communicated to Donovan that an investigation against him was ongoing and his labor contract would be suspended until the investigation was finalized. He was requested to hand over the company laptops he had in his possession and not to enter the company premises until further notice.

 

After taking a forensic copy of his laptop and running key search terms, I found further evidence of fraud. Several emails were found whereby Donovan, together with other Pharmatops researchers in Northern UK, exchanged information with other companies to sell confidential preclinical research study results.

 

When confronted with the facts, Donovan rationalized his behavior: He felt entitled to the money, he had some financial pressure and wanted to maintain the same lifestyle as when he still owned the company. He had every opportunity to commit fraud since there were no controls on his behavior – he had single signing authority, there was no management committee, financial information about the status of the company was not shared with any of the researchers, and the external accountant had a conflict of interest reporting unethical behavior lest he might lose his lucrative job.

 

Through various fraud schemes (mischaracterization of expenses, conflict of interest and payroll, billing fraud) an estimated USD 500,000 was siphoned off. The labor relationship was terminated and Pharmatops claimed back civil damages and lawyer fees. To avoid negative publicity, Pharmatops did not file criminal charges.

 

Lessons Learned

The expense reports from Donovan, the managing director, were never controlled or approved by an independent manager. Typically, the country CFO or his functional supervisor in the U.S. should sign off on his expense reports for compliance with the group’s travel and expense policies.

 

When claiming expenses related to the same trip over various expense reports and several months, there is an increased risk that travel expenses will be claimed multiple times. Best practices dictate that all expenses related to a given business trip should be claimed on one expense report within 30 days after the return date of the business trip.

 

Salary increases and bonuses were paid on the basis of an email from Donovan. Salary increases, bonus payments and other remuneration components should be confirmed in writing by the direct supervisor and/or in some companies by two levels up in the organization.

 

Donovan had single signing authority on bank accounts and took almost all commercial, pricing and research decisions by himself with little or no control by the country CFO. By contrast, signing authority on bank accounts should be given to a group of individuals whereby at least one person of each group needs to sign.

 

Pharmatops did not ask their management employees to sign a conflict of interest statement. Normally, all levels of management, sales and procurement staff should confirm in an annual (at least) conflict of interest statement that they do not have directorships or shareholdings in competitors.

 

The subsidiary did not have a proper country CFO, but relied on an external contractor whose consulting fees needed to be approved by Donovan. As such, the external contractor/CFO had a conflict of interest and could not challenge Donovan’s decisions due to the risk that he might lose his job as a consultant. Typically subsidiaries should have a strong country CFO who can challenge decisions taken by the country managing director.

 

Conclusion

What began with an anonymous tip to a Pharmatops board member resulted in a thorough audit that brought a fraudster’s schemes to light. In hindsight, it is not difficult to see how an employee like Donovan, with so much control over different aspects of the business, could get away with committing fraud for an extended length of time. While this case provides a study on how to successfully investigate fraud allegation, it also demonstrates how a lack of checks on one individual’s access and opportunity to steal can lead to a significant financial loss.

 

 

Patrick Wellens, CFE, CIA, CRMA, is a Switzerland-based internal audit and compliance professional with experience in more than 100 fraud cases. He is a member of the ACFE Switzerland Chapter. To contact Patrick, send him an email.