What it means
Unlike fraud that distorts the accounts to mislead investors, misappropriation is about taking something of value from the business for personal gain. The assets involved can be cash, stock, intellectual property, vehicles or even confidential data.
The person involved usually has legitimate access and often some control over how the transaction is recorded. Common schemes include skimming, where cash is taken before it is recorded, and cash larceny, where cash is stolen after it is recorded.
Others involve billing schemes with fake suppliers, payroll fraud with ghost employees, expense reimbursement fraud, and theft of inventory. Each leaves a different trail in the records.
Fraud researchers describe three conditions that tend to be present: pressure on the person, an opportunity created by weak controls, and a way to justify the act. The business can influence the second most easily.
Strong controls cut the opportunity by making theft harder to carry out and easier to detect. Key controls include separating duties so that no one person controls a whole transaction, requiring approvals for payments and changes to supplier details, reconciling bank accounts promptly and independently, counting inventory regularly and making staff take uninterrupted leave.
A confidential reporting line for staff is one of the most effective ways of finding problems early. Surprise checks and data analysis, such as looking for duplicate payments or unusual round-sum invoices, add further protection.
When misappropriation occurs, the business has to deal with the loss in its books, which usually means writing off the stolen asset and recording the expense. There may also be insurance claims, legal action, regulatory reporting and changes to controls.
The reputational cost and the effect on staff morale often outweigh the direct financial loss. For auditors and finance leaders, the key point is that fraud risk is assessed as part of every audit and risk review.
Management is responsible for designing and operating the controls, while auditors test whether they work. A risk assessment that lists the assets most exposed to theft, such as cash, inventory and payment systems, helps focus the effort where it matters.
In practice
Real-world examples
Example 1
A shop assistant takes $20 from the till at the end of each shift and does not ring up the sale. The takings agree with the till roll, so the theft is only discovered when stock counts show items missing. Over a year, the loss approaches $5,000.
Example 2
An accounts clerk sets up a fictitious supplier and approves invoices from it that stay just below the limit that needs a manager's sign-off. The payments go to her own bank account. A routine review of new supplier details by an independent colleague uncovers the scheme.
Example 3
A warehouse supervisor sells surplus electronic components to an outside buyer and keeps the money. The inventory records show the items as damaged and written off. An internal auditor notices that write-offs in his warehouse are three times the level of similar sites.
Think of it
Leaving your front door wide open and trusting that guests will only borrow what they need, rather than locking up your valuables and keeping a clear inventory of who enters your home.
Case study
Seen in the real world
Halcyon Distribution is an illustrative, fictional wholesaler with annual sales of $30,000,000. The finance team noticed that the bank balance was consistently a little lower than expected and that a single supplier, Greystone Supplies, had grown from $50,000 to $400,000 of annual payments. No one in purchasing could recall dealing with the company.
An internal review found that a purchasing officer had created Greystone as a false supplier and approved invoices below the $10,000 authorisation limit. Over two years the scheme took about $620,000. The company recovered part through insurance and dismissed the employee.
The finance director introduced independent approval of all new suppliers, regular matching of supplier addresses and bank details against employee records, and an anonymous reporting line. The illustrative lesson is that the weakness was a combination of one person having control of a process and no one independently checking it.
Watch out
Common mistakes
- Assuming that fraud only happens in organisations with dishonest people, when weak controls can tempt otherwise honest employees.
- Relying on trust instead of controls, which leaves no way to detect problems if trust is broken.
- Ignoring small amounts, which can add up to large losses over time and signal wider control weaknesses.
Questions
People also ask
How is misappropriation of assets different from financial statement fraud?
Misappropriation is theft from the organisation, while financial statement fraud involves misreporting results to mislead users of the accounts, although the two can occur together when theft is hidden by false entries.
Who usually commits it?
Studies of occupational fraud find that it is carried out by employees at all levels, and losses tend to be larger when more senior people are involved.
How do businesses detect it?
Tip-offs from staff are among the most common sources, followed by internal audit, management review and account reconciliations.