Romney ch05

© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart 1 of 175
C HAPTER 5
Computer Fraud and Abuse

INTRODUCTION
• Questions to be addressed in this chapter:
– What is fraud, and how are frauds
perpetrated?
– Who perpetrates fraud and why?
– What is computer fraud, and what forms does
it take?
– What approaches and techniques are used to
commit computer fraud?

INTRODUCTION
• Information systems are becoming
increasingly more complex and society is
becoming increasingly more dependent on
these systems.
– Companies also face a growing risk of these
systems being compromised.
– Recent surveys indicate 67% of companies
suffered a security breach in the last year with
almost 60% reporting financial losses.

INTRODUCTION
• Companies face four types of threats to
their information systems:
– Natural and political disasters
• Include:
– Fire or excessive heat
– Floods
– Earthquakes
– High winds
– War and terrorist attack
• When a natural or political disaster
strikes, many companies can be
affected at the same time.
– Example: Bombing of the
World Trade Center in NY.
• The Defense Science Board has
predicted that attacks on
information systems by foreign
countries, espionage agents, and
terrorists will soon be widespread.

INTRODUCTION
– Software errors and equipment
malfunction
• Include:
– Hardware or software
failures
– Software errors or bugs
– Operating system
crashes
– Power outages and
fluctuations
– Undetected data
transmission errors
• Estimated annual economic
losses due to software
bugs = $60 billion.
• 60% of companies studied
had significant software
errors in previous year.

INTRODUCTION
– Software errors and equipment malfunction
– Unintentional acts
• Include
– Accidents caused by:
• Human carelessness
• Failure to follow established
procedures
• Poorly trained or supervised
personnel
– Innocent errors or omissions
– Lost, destroyed, or misplaced data
– Logic errors
– Systems that do not meet needs or
are incapable of performing intended
tasks
• Information Systems Security Assn.
estimates 65% of security problems are
caused by human error.

INTRODUCTION
– Software errors and equipment malfunction
– Unintentional acts
– Intentional acts (computer crime)
• Include:
– Sabotage
– Computer fraud
– Misrepresentation, false use, or
unauthorized disclosure of data
– Misappropriation of assets
– Financial statement fraud
• Information systems are increasingly
vulnerable to these malicious attacks.

INTRODUCTION
• In this chapter we’ll discuss:
– The fraud process
– Why fraud occurs
– Approaches to computer fraud
– Specific techniques used to commit computer
fraud
– Ways companies can deter and detect
computer fraud

INTRODUCTION
fraud
computer fraud

THE FRAUD PROCESS
• Fraud is any and all means a person uses to
gain an unfair advantage over another person.
• In most cases, to be considered fraudulent, an
act must involve:
– A false statement (oral or in writing)
– About a material fact
– Knowledge that the statement was false when it was
uttered (which implies an intent to deceive)
– A victim relies on the statement
– And suffers injury or loss as a result
• The definition is the same whether it is a
criminal or civil fraud case.
– The only difference is the burden of
proof required.
• Criminal case: beyond a
reasonable doubt.
• Civil case: preponderance of the
evidence OR clear and convincing
evidence.

THE FRAUD PROCESS
• Because fraudsters don’t make journal entries to
record their frauds, we can only estimate the
amount of losses caused by fraudulent acts:
– The Association of Certified Fraud Examiners (ACFE)
estimates that total fraud losses in the United States
run around 6% of annual revenues or approximately
$660 billion in 2004.
• More than we spend on education and roads in a year.
• Six times what we pay for the criminal justice system.
– Income tax fraud (the difference between what
taxpayers owe and what they pay to the government)
is estimated to be over $200 billion per year.
– Fraud in the healthcare industry is estimated to
exceed $100 billion a year.

THE FRAUD PROCESS
• Fraud against companies may be committed by
an employee or an external party.
– Former and current employees (called
knowledgeable insiders) are much more likely than
non-employees to perpetrate frauds (and big ones)
against companies.
• Largely owing to their understanding of the company’s
systems and its weaknesses, which enables them to commit
the fraud and cover their tracks.
– Organizations must utilize controls to make it difficult
for both insiders and outsiders to steal from the
company.

THE FRAUD PROCESS
• Fraud perpetrators are often referred to as
white-collar criminals.
– Distinguishes them from violent criminals,
although some white-collar crime can
ultimately have violent outcomes, such as:
• Perpetrators or their victims committing suicide.
• Healthcare patients killed because of alteration of
information, etc., that can result in their deaths.

THE FRAUD PROCESS
• Three types of occupational fraud:
• Involves theft, embezzlement, or misuse of
company assets for personal gain.
• Examples include billing schemes, check
tampering, skimming, and theft of inventory.
• In the 2004 Report to the Nation on Occupational
Fraud and Abuse, 92.7% of occupational frauds
involved asset misappropriation at a median cost
of $93,000.

THE FRAUD PROCESS
– Corruption
• Corruption involves the wrongful use of a
position, contrary to the responsibilities of
that position, to procure a benefit.
• Examples include kickback schemes and
conflict of interest schemes.
• About 30.1% of occupational frauds include
corruption schemes at a median cost of
$250,000.

THE FRAUD PROCESS
– Corruption
– Fraudulent statements
• Financial statement fraud involves misstating the financial condition of
an entity by intentionally misstating amounts or disclosures in order to
deceive users.
• Financial statements can be misstated as a result of intentional efforts
to deceive or as a result of undetected asset misappropriations that
are so large that they cause misstatement.
• About 7.9% of occupational frauds involve fraudulent statements at a
median cost of $1 million. (The median pales in comparison to the
maximum cost.)

THE FRAUD PROCESS
• A typical employee fraud has a number of important elements or
characteristics:
– The fraud perpetrator must gain the trust or confidence of the
person or company being defrauded in order to commit and
conceal the fraud.
– Instead of using a gun, knife, or physical force, fraudsters use
weapons of deceit and misinformation.
– Frauds tend to start as the result of a perceived need on the part
of the employee and then escalate from need to greed. Most
fraudsters can’t stop once they get started, and their frauds grow
in size.
– The fraudsters often grow careless or overconfident over time.
– Fraudsters tend to spend what they steal. Very few save it.
– In time, the sheer magnitude of the frauds may lead to detection.
– The most significant contributing factor in most employee frauds
is the absence of internal controls and/or the failure to enforce
existing controls.

THE FRAUD PROCESS
• The National Commission on Fraudulent
Financial Reporting (aka, the Treadway
Commission) defined fraudulent financial
reporting as intentional or reckless conduct,
whether by act or omission, that results in
materially misleading financial statements.
• Financial statements can be falsified to:
– Deceive investors and creditors
– Cause a company’s stock price to rise
– Meet cash flow needs
– Hide company losses and problems

THE FRAUD PROCESS
• Fraudulent financial reporting is of great
concern to independent auditors, because
undetected frauds lead to half of the
lawsuits against auditors.
• In the case of Enron, a financial statement
fraud led to the total elimination of Arthur
Andersen, a premiere international public
accounting firm.

THE FRAUD PROCESS
• Common approaches to “cooking the
books” include:
– Recording fictitious revenues
– Recording revenues prematurely
– Recording expenses in later periods
– Overstating inventories or fixed assets
(WorldCom)
– Concealing losses and liabilities

THE FRAUD PROCESS
• The Treadway Commission recommended four
actions to reduce the possibility of fraudulent
financial reporting:
– Establish an organizational environment that
contributes to the integrity of the financial reporting
process.
– Identify and understand the factors that lead to
fraudulent financial reporting.
– Assess the risk of fraudulent financial reporting within
the company.
– Design and implement internal controls to provide
reasonable assurance that fraudulent financial
reporting is prevented.

THE FRAUD PROCESS
• SAS 99: The Auditor’s Responsibility to
Detect Fraud
– In 1997, SAS-82, Consideration of Fraud in a
Financial Statement Audit, was issued to
clarify the auditor’s responsibility to detect
fraud.

THE FRAUD PROCESS
• A revision to SAS-82, SAS-99, was issued in
December 2002. SAS-99 requires auditors to:
– Understand fraud
• Auditors can’t effectively audit something they don’t
understand.
• SAS-99 also indicated that auditors are not lawyers and “do not
make legal determinations of whether fraud has occurred.”
• The external auditor’s interest specifically relates to acts that
result in a material misstatement of the financial statements.
• Note that SAS-99 relates to external auditors. Internal auditors
will have a more extensive interest in fraud than just those that
impact financial statements.

THE FRAUD PROCESS
– Discuss the risks of material fraudulent
misstatements
• While planning the audit, members of the audit team
should discuss how and where the company’s financial
statements might be susceptible to fraud.

THE FRAUD PROCESS
– Discuss the risks of material fraudulent misstatements
– Obtain information
• The audit team must gather evidence about the existence of fraud
by:
– Looking for fraud risk factors
– Testing company records
– Asking management, the audit committee, and others if they
know of any past or current fraud or of fraud risks the
organization faces.
• Special care needs to be exercised in examining revenue
accounts, since they are particularly popular fraud targets.

THE FRAUD PROCESS
– Identify, assess, and respond to risks
• Use the gathered information to identify, assess, and respond to
risks.
• Auditors can respond by varying the nature, timing, and extent
of auditing procedures they perform.
• They should also carefully evaluate risks related to management
override of controls.

THE FRAUD PROCESS
– Evaluate the results of their audit tests
• Auditors must assess the risk of fraud throughout the
audit.
• When the audit is complete, they must evaluate whether
any identified misstatements indicate the presence of
fraud.
• If so, they should determine the impact on the financial
statements and the audit.

THE FRAUD PROCESS
– Communicate findings
• Auditors communicate their fraud
findings to management, the audit
committee, and others.

THE FRAUD PROCESS
– Document their audit work
• Auditors must document their
compliance with SAS-99 requirements.

THE FRAUD PROCESS
– Document their audit work
– Incorporate a technology focus
• SAS-99 recognizes that technology impacts fraud
risks and notes opportunities that auditors have
to use technology-oriented tools and techniques
to design fraud auditing procedures.

INTRODUCTION
fraud
computer fraud

WHO COMMITS FRAUD AND WHY
• Researchers have compared the psychological and
demographic characteristics of three groups of people:
– White-collar criminals
– Violent criminals
– The general public
• They found:
– Significant differences between violent and white-collar
criminals.
– Few differences between white-collar criminals and the general
public.

• White-collar criminals tend to mirror the general
public in:
– Education
– Age
– Religion
– Marriage
– Length of employment
– Psychological makeup

• Perpetrators of computer fraud tend to be
younger and possess more computer
knowledge, experience, and skills.
• Hackers and computer fraud perps tend to be
more motivated by:
– Curiosity
– A quest for knowledge
– The desire to learn how things work
– The challenge of beating the system

• They may view their actions as a game rather than
dishonest behavior.
• Another motivation may be to gain stature in the hacking
community.
• Some see themselves as revolutionaries spreading a
message of anarchy and freedom.
• But a growing number want to profit financially. To do so,
they may sell data to:
– Spammers
– Organized crime
– Other hackers
– The intelligence community

• Some fraud perpetrators are disgruntled and
unhappy with their jobs and are seeking revenge
against their employers.
• Others are regarded as ideal, hard-working
employees in positions of trust.
• Most have no prior criminal record.
• So why are they willing to risk everything?

• Criminologist Donald Cressey, interviewed 200+
convicted white-collar criminals in an attempt to
determine the common threads in their crimes.
As a result of his research, he determined that
three factors were present in the commission of
each crime. These three factors have come to
be known as the fraud triangle.
– Pressure
– Opportunity
– Rationalization

The “Fraud Triangle”
Donald Cressey
Pressure
Opportunity
Rationalization

Donald Cressey
Pressure
Pressure
Opportunity
Rationalization

• Pressure
–Cressey referred to this pressure as a
“perceived non-shareable need.”
–The pressure could be related to
finances, emotions, lifestyle, or some
combination.

• The most common pressures were:
- Not being able to pay one’s debts, nor admit it to
one’s employer, family, or friends (which makes it
non-shareable).
• May be associated with vices, such
as drugs, gambling, mistresses, etc.

one’s employer, family, or friends (which makes in
non-shareable).
- Fear of loss of status because of a personal
failure • Example would be mismanagement of
a personal investment or retirement
fund.

non-shareable).
- Fear of loss of status because of a personal failure
- Business reversals
• Not many people can walk away from
a failing business.

non-shareable).
- Physical isolation
• When an individual is isolated,
physically or psychologically, almost
any pressure becomes non-
shareable.

non-shareable).
- Status gaining
• Many frauds are motivated by nothing
more than a perceived need to keep
up with the Joneses.
• The problem is that there is always a
richer “Jones” down the street and
the pressure continues to mount, as
do the resulting thefts.

non-shareable).
- Status gaining
- Difficulties in employer-employee relations
• May create pressure to get revenge,
take the money you feel is rightfully
owed to you, etc.

• What’s important here is the perception of the
pressure.
– There might be a number of people who could and would
help a tentative fraudster out of his financial woes.
– But as long as he perceives that he cannot share his
burden, the pressure is present.
– Research has also found that an individual’s propensity to
commit fraud is more related to how much he worries
about his financial position than his actual position.
– The millionaire who frets a lot about his financial condition
is more likely to commit fraud than the guy who doesn’t
have two dimes to rub together but isn’t worried about it.

• Financial statement fraud is distinct from other
types of fraud in that the individuals who commit
the fraud are not the direct beneficiaries.
– The company is the direct beneficiary.
– The perpetrators are typically indirect beneficiaries.

• In the case of financial statement frauds, common
pressures include:
– To prop up earnings or stock price so that management can:
• Receive performance-related compensation.
• Preserve or improve personal wealth held in company stock
or stock options.
• Keep their jobs.
– To cover the inability to generate cash flow.
– To obtain financing.
– To appear to comply with bond covenants or other agreements.
– May be opposite of propping up earnings in cases involving
income-tax motivations, government contracts, or regulation.
• Click here for a comprehensive list of pressures.
PressuresPressures

Donald Cressey
Pressure
Opportunity
Opportunity
Rationalization

• Opportunity is the opening or gateway that
allows an individual to:
– Commit the fraud
– Conceal the fraud
– Convert the proceeds

• Committing the fraud might involve acts
such as:
– Misappropriating assets.
– Issuing deceptive financial statements.
– Accepting a bribe in order to make an
arrangement that is not in the company’s best
interest.

• Concealing the fraud often takes more time and
effort and leaves more evidence than the actual
theft or misrepresentation.
• Examples of concealment efforts:
– Charge a stolen asset to an expense account or to
an account receivable that is about to be written
off.

– Charge a stolen asset to an expense account or to an
account receivable that is about to be written off.
– Create a ghost employee who receives an extra
paycheck.

paycheck.
– Lapping.
• Steal a payment from Customer A.
• Apply Customer B’s payment to Customer A’s account so
Customer A won’t get a late notice.
• Apply Customer C’s payment to Customer B’s account,
so Customer B won’t get a late notice, etc.

paycheck.
– Lapping.
– Kiting.
• Creates “cash” by transferring money between banks.
• Requires multiple bank accounts.
• Basic scheme:
– Write a check on the account of Bank A.
– Bank A doesn’t have sufficient funds to cover the
check, so write a check from an account in Bank B to
be deposited in Bank A.
– Bank B doesn’t have sufficient funds to cover the
check, so write a check from an account in Bank C to
be deposited in Bank B, etc.

• Unless the target of the theft is cash, then
the stolen goods must be converted to
cash or some form that is beneficial to the
perpetrator.
– Checks can be converted through alterations,
forged endorsements, check washing, etc.
– Non-cash assets can be sold (online auctions
are a favorite forum) or returned to the
company for cash.

• If the fraud is a financial statement fraud,
then the gains received may include:
– I have to keep my job.
– The value of my stock or stock options rose.
– I received a raise, promotion, or bonus.
– I have power.

• There are many opportunities that enable fraud.
Some of the most common are:
– Lack of internal controls
– Failure to enforce controls (the most prevalent
reason)
– Excessive trust in key employees
– Incompetent supervisory personnel
– Inattention to details
– Inadequate staff
• Click here for a comprehensive list of
opportunities.
OpportunitiesOpportunities

• Internal controls that may be lacking or un-
enforced include:
– Authorization procedures
– Clear lines of authority
– Adequate supervision
– Adequate documents and records
– A system to safeguard assets
– Independent checks on performance
– Separation of duties
• One control feature that many companies lack is
a background check on all potential employees.

• Management may allow fraud by:
– Not getting involved in the design or
enforcement of internal controls;
– Inattention or carelessness;
– Overriding controls; and/or
– Using their power to compel subordinates to
carry out the fraud.

Donald Cressey
Pressure
Opportunity
RationalizationRationalization

• How many people do you know who regard
themselves as being unprincipled or sleazy?
• It is important to understand that fraudsters do
not regard themselves as unprincipled.
– In general, they regard themselves as highly
principled individuals.
– That view of themselves is important to them.
– The only way they can commit their frauds and
maintain their self image as principled individuals is to
create rationalizations that recast their actions as
“morally acceptable” behaviors.

• These rationalizations take many forms,
including:
– I was just borrowing the money.
– It wasn’t really hurting anyone. (Corporations are
often seen as non-persons, therefore crimes against
them are not hurting “anyone.”)
– Everybody does it.
– I’ve worked for them for 35 years and been underpaid
all that time. I wasn’t stealing; I was only taking what
was owed to me.
– I didn’t take it for myself. I needed it to pay my child’s
medical bills.

• Creators of worms and viruses often use
rationalizations like:
– The malicious code helped expose security flaws, so I
did a good service.
– It was an accident.
– It was not my fault—just an experiment that went bad.
– It was the user’s fault because they didn’t keep their
security up to date.
– If the code didn’t alter or delete any of their files, then
what’s the problem?

• Fraud occurs when:
– People have perceived, non-shareable pressures;
– The opportunity gateway is left open; and
– They can rationalize their actions to reduce the moral impact in
their minds (i.e., they have low integrity).
• Fraud is much less likely to occur when:
– There is low pressure, low opportunity, and high integrity.
• Unfortunately, there is usually a mixture of these forces
in play, and it can be very difficult to determine the
pressures that may apply to an individual and the
rationalizations he/she may be able to produce.

INTRODUCTION
fraud
computer fraud

APPROACHES TO COMPUTER FRAUD
• The U.S. Department of Justice defines
computer fraud as any illegal act for
which knowledge of computer technology
is essential for its:
– Perpetration;
– Investigation; or
– Prosecution.

• Computer fraud includes the following:
– Unauthorized theft, use, access, modification,
copying, and destruction of software or data.
– Theft of money by altering computer records.
– Theft of computer time.
– Theft or destruction of computer hardware.
– Use or the conspiracy to use computer
resources to commit a felony.
– Intent to illegally obtain information or tangible
property through the use of computers.

• In using a computer, fraud perpetrators
can steal:
– More of something
– In less time
– With less effort
• They may also leave very little evidence,
which can make these crimes more
difficult to detect.

• Computer systems are particularly vulnerable to
computer crimes for several reasons:
– Company databases can be huge and access
privileges can be difficult to create and enforce.
Consequently, individuals can steal, destroy, or alter
massive amounts of data in very little time.
– Organizations often want employees, customers,
suppliers, and others to have access to their system
from inside the organization and without. This access
also creates vulnerability.
– Computer programs only need to be altered once,
and they will operate that way until:
• The system is no longer in use; or
• Someone notices.

– Modern systems are accessed by PCs, which
are inherently more vulnerable to security
risks and difficult to control.
• It is hard to control physical access to each PC.
• PCs are portable, and if they are stolen, the data
and access capabilities go with them.
• PCs tend to be located in user departments, where
one person may perform multiple functions that
should be segregated.
• PC users tend to be more oblivious to security
concerns.

– Computer systems face a number of unique
challenges:
• Reliability (accuracy and completeness)
• Equipment failure
• Environmental dependency (power, water damage,
fire)
• Vulnerability to electromagnetic interference and
interruption
• Eavesdropping
• Misrouting

• Organizations that track computer fraud
estimate that most U.S. businesses have
been victimized by at least one incident of
computer fraud.

• These frauds cost billions of dollars each
year, and their frequency is increasing
because:
– Not everyone agrees on what constitutes
computer fraud.
• Many don’t believe that taking an unlicensed copy
of software is computer fraud. (It is and can result
in prosecution.)
• Some don’t think it’s a crime to browse through
someone else’s computer if their intentions aren’t
malicious.

– Many computer frauds go undetected.
– An estimated 80–90% of frauds that are
uncovered are not reported because of fear
of:
• Adverse publicity
• Copycats
• Loss of customer confidence
– There are a growing number of competent
computer users, and they are aided by easier
access to remote computers through the
Internet and other data networks.

– Some folks believe “it can’t happen to us.”
– Many networks have a low level of security.
– Instructions on how to perpetrate computer
crimes and abuses are readily available on
the Internet.
– Law enforcement is unable to keep up with
the growing number of frauds.
– The total dollar value of losses is difficult to
calculate.

• Economic espionage, the theft of
information and intellectual property, is
growing especially fast.
• This growth has led to the need for
investigative specialists or cybersleuths.

• Computer fraud classification
– Frauds can be categorized according to the
data processing model:
• Input
• Processor
• Computer instructions
• Stored data
• Output

COMPUTER FRAUD CLASSIFICATIONS
Processor
Fraud
Input
Fraud
Output
Fraud
Data
Fraud
Computer
Instructions
Fraud