Articles Grant Wahlstrom, CIA, CPA, CFE Jun 12, 2023
While investigating almost-free lunches at a hospital cafeteria, an internal auditor discovers that the cafeteria supervisor was committing a more costly and long-running fraud.
Chef Tony Disalvo stared at his quarterly profit and loss statement with a confused expression — the hospital cafeteria was deep in the red. He searched for clues as to why he was losing so much money.
When the chef compared the ratio of his revenue to his expenses, he noticed that the expenses were unusually high. This is not how he wanted to start his new role as cafeteria manager at Phoenix Pho Hospital, one of the largest hospitals in the U.S.
Disalvo suspected that the cafeteria was the victim of theft. To test his hypothesis, he prepared 10 prepackaged sandwich lunch specials and placed them in the cafeteria for the lunch rush. After lunch, he reconciled the number of meals that were sold.
Disalvo’s suspicions were correct. He could only account for six lunch specials. He noticed four lunch specials remaining, but only two were sold. Where did the other four go? Disalvo was now concerned about widespread theft in the cafeteria, so he scheduled a meeting with the hospital’s chief financial officer (CFO) Calvin Hope.
Steve Kelly, the hospital’s CAE, was completing his quarterly meeting with Hope when Disalvo arrived. Because Hope knew that the chef was worried about theft, he asked Kelly to stay for their meeting.
After Disalvo explained his concern, Kelly agreed to conduct a review. Kelly requested the register reports of every cashier from the last six months, the daily cash reconciliation, and deposit reports. The chef quickly gathered the requested documentation and delivered it to Kelly.
The next morning before he began his audit, Kelly stopped at the cafeteria to purchase a cup of coffee, which only cost 32 cents with his employee discount. Like other hospital employees, Kelly received a discount on food in the cafeteria. The hospital’s doctors and members of the clergy received an even better deal, their meals were free.
As he reviewed the cashier register reports, Kelly immediately knew he had a problem: A cashier had rung up more than 1,000 transactions in one day for exactly 32 cents each. Based on this evidence, Kelly and Disalvo met with Doug Draper, head of security, to review security camera video from the previous day’s lunch rush.
Specifically, they observed the cashier Kelly had identified from the register reports. As they suspected, the cashier was ringing up every food item purchased, but she was charging it as a discounted cup of coffee.
That afternoon, Kelly and Disalvo interviewed Penny Smith, the cashier under review, and verified that she was ringing up all sales as a discounted cup of coffee. To their surprise, Smith stated that she had been doing so for over two years and that many of her co-workers were giving similar discounts to employees.
Smith said she was trying to help her fellow employees make ends meet by further discounting their meals. She pointed out that it was unfair that doctors and clergy received a free lunch while employees who made much less money did not.
After getting the truth from Smith, Kelly was not convinced that all of the losses could be explained by the deeply discounted lunches. He continued his review by going through the daily cash reconciliation and deposit process. He wanted to determine how the cafeteria recorded the free lunches received by physicians and clergy members.
Kelly discovered that when a physician or clergy member obtained a meal, the cashier would record the sale but would press a discount button on the cash register that recorded the sale as $0 charged to the customer. The cashier’s register tape would record the total number of free meals.
The cafeteria prepared deposit reconciliations daily for the cash collected by the cashiers. Payments were in the form of cash or credit card, or recorded as free.
Continuing his review, Kelly recalculated a week’s worth of cash deposits. Much to his confusion, he noticed that on four days, the cash reconciliation matched the cash deposit but did not match the cash collected according to the cashier register reports. On all four days, the cashiers collected more cash than was being deposited.
Kelly reperformed the cash reconciliation process for the entire week and discovered that on the four days in question, the discounts for physicians and clergy had increased by the same amount as the cash missing from the deposits. He noticed that the four reconciliations where the cash had been understated were all prepared by Jennifer Sunshine, the cafeteria supervisor.
Kelly suspected Sunshine was manipulating the daily reconciliation by increasing the number of physician/clergy discounts, reducing cash collections, and embezzling the cash. In reviewing the process, he noticed that the shift supervisor would complete the cash reconciliation and deposit ticket and deliver the deposit to the finance department, which collected all daily cash deposits. However, no one in the finance department reviewed or signed off on the accuracy of the deposits before delivering them to the bank.
Kelly took his evidence to Sally McCormick, the director of human resources. After walking McCormick through the scheme, they met with Sunshine, who quickly confessed to stealing the missing cash. However, Sunshine did not disclose how long the scheme had gone on or how much she had stolen.
When Kelly returned to Disalvo to obtain additional cash reconciliation documentation to help identify when the scheme began and quantify the loss, he learned that the hospital only maintained the documentation for six months.
After reviewing existing documents, Kelly determined that Sunshine had been embezzling cash for at least six months and had taken approximately $26,000. Furthermore, he noticed a discrepancy on the cash deposit for the oldest reconciliation available, which led him to suspect the fraud had been going on for longer.
After Kelly reported his findings, Hope committed to redesigning the cash reconciliation and deposit process for the hospital. Eight months after the audit concluded, Disalvo reported that the cafeteria’s revenues had increased by more than $200,000.
Phoenix Pho Hospital reported Sunshine’s scheme to law enforcement and brought criminal charges against her. She is awaiting trial.
The organization’s control environment should require two employees to perform a daily, independent reconciliation of cash collection and bank deposits.
The organization should have fidelity bond insurance covering all employees. Fidelity bond insurance protects the organization from theft and fraud, including embezzlement.
The finance department should design and deliver routine exception reports to the process owners and senior leadership. Chef Disalvo now receives weekly reports with a summary of each cashier’s activity. These reports allow him to monitor and verify that the cashiers are charging customers the correct amount for their meals.
The organization should implement and enforce record retention policies. The type of records that should be retained and the length of retention will depend on the organization’s industry and applicable government guidelines. In this case, the retention of cash reconciliation documents would have allowed the investigators to quantify the total loss and potentially recover some of the losses from their fidelity bond policy.