1. Internal Control and Fraud

Stephanie Baskill, an unemployed accounting clerk, lives one block from Cleaver Manufacturing Company. While walking her dog last year, she noticed some ERP manuals in the dumpsters. Curious, she took the manuals home with her. She found that the documentation in the manual was dated 2 months prior, so she thought that the information must be fairly current. Over the next month, Stephanie continued to collect all types of manuals from the dumpster during her dog-walking ex- cursions. Cleaver Manufacturing Company was appar- ently updating all of its documentation manuals and placing them online. Eventually, Stephanie found man- uals about critical inventory reorder formulas, the billing system, the sales order system, the payables system, and the operating system. Stephanie went to the local library and read as much as she could about this particular op- erating system.

To gain access to the organization, she took a low- profile position as a cleaning woman, giving her access to all areas in the building. While working, Stephanie snooped through offices, watched people who were working late type in their passwords, and guessed pass- words. She ultimately printed out lists of user IDs and passwords using a Trojan horse virus, thus obtaining all the necessary passwords to set herself up as a supplier, customer, systems operator, and systems librarian.

As a customer, she ordered enough goods to trigger the automatic inventory procurement system to pur- chase more raw materials. Then, as a supplier, Stephanie would deliver the goods at the specified price. She then adjusted the transaction logs once the bills were paid to cover her tracks. Stephanie was able to embezzle, on av- erage, $125,000 a month. About 16 months after she began working at Cleaver, the controller saw her at a very expensive French restaurant one evening, driving a Jaguar. He told the internal auditors to keep a close watch on her, and they were able to catch her in the act.

Required:

1. 1. What weaknesses in the organization's control structure must have existed to permit this type of embezzlement?

   2. What specific control techniques and procedures could have helped prevent or detect this fraud?