Who needs a nonprofit Enron?

Some believe that the nonprofit world is ripe for its own Enron-type disaster. While the size and political implications of Enron probably can't be relicated at a nonprofit, it is a point worth considering. The fact that nonprofits do good work is not enough to prevent people from doing bad things.

Brought together in this edition of Executive Session, held in New York City at the offices of accounting and management firm Eisner & Co., were experts in this field to talk about what nonprofit leaders can do to prevent wrongdoing in their organizations. They were: Julie Floch, CPA, partner and director of not-for-profit services at Eisner & Co.; Robert Roman, CPA, senior manager, business advisory services in Florham Park, N.J., for PricewaterhouseCoopers; Jeffrey Solomon, Ph.D., president of the Andrea and Charles Bronfman Philanthropies in New York City; and Mel Zachter, CPA, senior partner, of the accounting firm Loeb and Troper in New York City.

The session was moderated by Thomas A. McLaughlin, a senior manager in the Boston office of Grant Thornton and Paul Clolery, editor-in-chief of The NonProfit Times.

Thomas McLaughlin: To our panel, the first general question: What are some of the most individual examples of financial wrongdoing that you've encountered in your careers?

Julie Floch: I would place financial wrongdoing into two categories. Let's start with changing donor intent, choosing to use restricted funds for a purpose other than what the donor or contract intended.

Robert Roman: The use of donor-restricted funds for other than intended purposes, unfortunately, does occur. More broadly, financial wrong doing runs the gamut, from expense reporting, to doing business with related parties which might not be at arms' length, to something as basic as forging signatures on checks, to reporting of overtime that didn't occur.

Ms. Floch: The second category would be actual fraud, as in misappropriation of assets. Essentially, that breaks down to internal control difficulties. When you look into why this happens, you find out that nonprofits tend to run lean in their accounting and finance areas. If internal controls had been stronger, the opportunities to commit financial improprieties wouldn't be as available.

Mel Zachter: When you have a small nonprofit with one financial person, there is only so much that can be done with respect to internal controls. We all have our own war stories. One which comes to mind concerns a person who, as it turns out once she was uncovered, had a gambling habit. Whether it is gambling or buying luxury cars, there are certain things going on in people's lives that could give an indication of potential problems. In this particular case, she was committing petty theft; she was doing it through volume. Over six or seven years, she was getting away with a considerable amount of money.

Paul Clolery: How petty?

Mr. Zachter: She wrote out checks to a common vendor of the organization making them out for $60 or $100, and then having them approved. Sometimes she generated fictitious bills. Sometimes she used recurring bills. One might ask, who did the checks go through before they went out? They went to her for mailing. She took those checks and somehow changed the vendors' names to her own name or family members. She then cashed them or put them in her bank account.

Mr. Clolery: Nobody checked the cancelled checks?

Mr. Zachter: There was not sufficient control. No CFO. The CEO was too busy. There was a treasurer, but he didn't get into those details.
One of the recommendations we put forward to all of our smaller nonprofits is that bank statements should go unopened to someone other than the person who is directly involved with cash disbursements. In this case, if the executive director or treasurer had received these checks directly unopened and just skimmed through them, they would have seen white-outs or changes. There would have been a pattern. When we took over this client as auditors, we quickly moved to implement this recommendation.

Mr. McLaughlin: How was she found out?

Mr. Zachter: She was found out by somebody internally who decided to speak to management. I guess it got out of hand in the person's estimation. There were tens of thousands of dollars in total every year, each relatively small amounts. As auditors, we know that materiality counts. We even do substantiation tests, tests of transactions. When you choose an account to test, you pick the more material items within a specific expense account.

Ms. Floch: We had a new client with a great deal of turmoil because the CEO had been forced to resign. It turned out that he had sole authority to approve disbursements, including his own compensation, housing, travel and entertainment. The controls weren't in place so that somebody other than he was approving the requests.
Eventually, his subordinate, who was responsible for generating checks for the CEO's signature, went to the board and said, "I'm very uncomfortable. I've been wrestling with what to do. I feel like I'm squealing on my boss, but I know what he's doing is wrong." That's how the inappropriate disbursements were found out.

Mr. Clolery: What happened to the subordinate?

Ms. Floch: He stayed for about another two or three years. He eventually left the organization. The organization pressed charges against the head.

Mr. McLaughlin: Successfully?

Ms. Floch: No, they ended up settling. As a result, they restructured their controls so that expenses were reviewed by the board and disbursements required two signatures. The board got more involved than they had been. It was a real wake-up call to the responsibilities of being a board member.

Mr. Zachter: I think that's a path we see where there is really no active board, where the founder of the organization very often -- or the key executive, really -- is running the show and may pick board people.
Sometimes you have high turnover of other employees. That sometimes is a signal to what's going on, change-overs of auditors and legal firms as well. But when there's really no board, no committee that can ask the questions, that can review things and get answers, this unfortunately tends to occur and reoccur.

Mr. Roman: For organizations without a strong internal control environment and strong leadership, the need for effective oversight from the board is critical.

Dr. Jeffrey Solomon: I'm reminded of an agency where the board refused to believe in their role of oversight, a report about their financial stability and questions about the executive director and the way he was handling his financial responsibilities.
The executive director was finally terminated and the funding source, and some of us personally, were sued by the fired executive for tortious interference.

Mr. McLaughlin: How did that end up?

Dr. Solomon: He did not prevail. But it cost the insurance carrier $500,000 in defense costs. So, the issues are profound. I do believe when you were using the term "internal control," so often neither the professionals involved in the nonprofit, nor the boards providing the oversight, understand its meaning and implications.

Mr. Roman: One situation that I am aware of involved a foundation, which had given out a monetary grant. As is usually the case, the grantee was required to report back periodically. In this particular instance, the foundation began to become uncomfortable with the quality of the grantee's financial reporting. But beyond that, the foundation was also increasingly uncomfortable with the quality of the grant results. So, they decided to take a deeper look into the situation.
What they soon discovered was a grantee organization of limited size, with poor controls and weak leadership. The grant money was not wisely expended, and perhaps not surprisingly, the financial reporting of the activities relating to the grant was either inaccurate or incorrect. No real governing board appeared to exist as a monitoring function. Essentially, the grantee was of the mindset that, "We're small, we're based on the other side of the country from the grantor, and we didn't think that anyone would care enough to come out and see how we operate."

Mr. Clolery: Did you recover the money?

Mr. Roman: Our foundation client sought their counsel and went for a refund and eventually settled. That's the kind of trend we're seeing, where money is fraudulently misspent or improperly spent. You have an obligation to go back for the money.

Mr. McLaughlin: Is there a difference in the things that executive directors, CEOs do, versus the things which CFOs or financial people in the organizations do? Or, do they all look alike?

Mr. Zachter: Generally the CEOs have more flexibility on their travel and entertainment and conferences. I've seen more fraud or misuse of funds being handled by the CEO than a CFO or controller.

Mr. McLaughlin: Give us some examples.

Mr. Zachter: There is one thing that we've added to part of our audits. We select several of the top management people and look at their petty cash reimbursements or conference expenses and travel expenses. Sometimes we find that the documentation, the credit card bill is there. But, was that travel to Atlanta or the West Coast for purposes of the organization, or was it travel for possibly personal use? The credit card slip didn't differentiate.
What needs to be done, not only for us auditors but in general, with that petty cash reimbursement, with that credit slip, is the confirmation of seminar registration or other documentation -- that the person actually went there for a particular purpose.

Dr. Solomon: I think the role of the board is key. The president of the board of the agency with which I was affiliated asked our auditors to come in and do a special audit of the expenses of the top three executives.
As one of those executives, I was grateful. It was a pleasure. They went back three years, they looked at everything and made sure the purpose and documentation was there. That protected me as the employee, as well as the organization. It was a very healthy process.
But again, it was not something that came from staff. It was driven by the chief volunteer officer saying "it is my responsibility. Make sure things are in order."

Mr. Clolery: It is important to get the registration, obviously. It is important to have documentation of the dinner meeting. But there have been cases of board members who were dead. So, there was no oversight. How do you avoid the bigger frauds? I'm not talking about $1 million, but not an extra $5 on the expense report, either.

Mr. Roman: Some of the smallest frauds, if left undetected over time, can wind up as major events. Mel touched on a good point, which is the use of credit cards. This generally is a higher risk area.
Sometimes there seems to be almost two sets of controls. You have the lower-level employees who are subject to supervision and approvals for their expenditures and then you get to senior management like the CFO and CEO. Well, who is approving their expense reports? What policy do they follow? In those situations, there really needs to be board supervision.

Mr. McLaughlin: Before the transaction or after?

Mr. Roman: It could be either. Granted, access to the board might not be available on a continuous basis. But the whole notion of monitoring controls, the fact that the CEO and CFO know that somebody else is going to look, that's control in and of itself.
Many organizations have corporate cards that are consolidated into one statement which goes to accounts payable. Personnel in this function may not be in a position to know the validity of the expenditures. They're just paying them timely.

Mr. Zachter: We are requiring them to send it back, different sections for each executive, and have them sign off and attach the documentation and resubmit it to accounts payable.

Ms. Floch: Why would you have company credit cards, anyway? Why not use your own credit card? If you use your own credit card, you would request reimbursement and if there isn't proper documentation, you don't get reimbursed. With a company credit card, it can be harder to get documentation of expenses.

Dr. Solomon: As the non-accountant, I would argue the issue isn't credit cards, it's procedures and controls. The credit card is merely the vehicle.
When you talk about serious fraud, I'm reminded of the broken-windshield theory of crime in New York. When somebody breaks into a car with a broken windshield and other people see that, it leads to more and more crime. I think this is a nonprofit version of the theory if nobody is checking and you're able to -- "Well, I did 30 seconds' worth of the business at a dinner, so let me charge it off."

Mr. McLaughlin: Talk about that specifically.

Dr. Solomon: We in the nonprofit field have to accept that we're the "hired help." I use that term boldly, but it reflects that we have to be even purer than Caesar's wife. And yet, in every board that I've served with, the net worth of the board members is 10, 20, 30, 100, 200 times my net worth. I'm supposed to dress like them, look like they look, act like they act, be brought out to social occasions, know which fork to use, but I can't afford to buy those forks.
That's my life choice. It's fine. But part of the problem when we see fraud is that there's an assumption, a psychological jump that comes out of the arrogance of many of the CEOs and CFOs, especially in many cases where there's government funding. They feel they're delivering the revenues, not the board. There is an arrogance that is involved which places the organization at great risk, as well as themselves at great risk.

Mr. McLaughlin: Talk about financial broken windows. What are some
of those equivalents of financial broken windows that you or the others have seen in faulty controlled environments?

Dr. Solomon: One that comes to mind is an agency executive director who went to an expensive Chinese restaurant virtually every day and charged it as an agency expense. Then he had very expensive dinners. A forensic audit was done on his backup and the people he claimed to have dinner with were not in town on many of the dates. There was also the mix of social friends who were listed as business acquaintances. It began with an expensive Chinese lunch day after day. Then it became abusive travel and entertainment expenses.

Mr. McLaughlin: Over what period of time?

Dr. Solomon: We looked at a period of over 18 months.

Mr. Zachter: Another area we have encountered, unfortunately too often, is kickbacks. It could be office supplies, or possibly a contractor, where competitive bidding is not being done or not being done well enough. Usually one person has the authority to award the contract.
When you think in terms of office supplies, large sums do not come to mind. However, many organizations spend tens of thousands or hundreds of thousand of dollars on different types of office supplies. Another area we look out for involves transportation, contracts with bus companies.
We have submitted management letters over and over again indicating that there needs to be a policy regarding competitive bidding. The board must get involved; included in a procedure manual should be a policy that, over a certain dollar amount, competitive bidding must take place. We try to recommend that the purchasing agent should do the groundwork and get three or four bids for a comparison. It is important that this is not where it ends. It should go up one or two steps to the controller or CFO and, over a certain dollar amount, to the CEO.

Dr. Solomon: One of my favorite stories is in a hospital. There was a funny smell about the receiving department, so they put up a pinhole camera behind the wall. The CEO got a tape one day when a truck pulled in and obviously didn't deliver as much as it was supposed to deliver. There was an exchange of cash between the truck driver and the receiving agent. The truck pulled away and the receiving agent was standing literally in front of the camera, singing, "Only in America. Land of opportunity."

Mr. Roman: Competitive bids are a best practice. And Mel mentioned the areas of policies and procedures. You may have a policy in place, but unless the board is asking the right questions, and monitoring the situation then policies are not worth the paper they're written on.

Mr. McLaughlin: You've identified credit cards, purchasing and bidding practices. What other areas are there?

Ms. Floch: Some of the revenue streams. We had a client once where controls of collection of revenues was not very strong. This particular organization had a lot of cash coming in. They thought that they had set up a sophisticated process of reconciling the revenues that should be recorded with the cash coming in. But the reconciliation process was done by the same person who handled the cash.

Mr. Roman: What Julie is mentioning is segregating certain functions among employees.

Ms. Floch: In the commercial world, it's more likely that an experienced accountant has set up a system of controls. They understand internal controls and segregation of duties and all those basic things that are so important.
In the nonprofit world, especially in smaller organizations, the accounting function is less sophisticated. So as a result, some of the procedures that they've set up are amazingly inefficient and don't accomplish anything or don't have proper segregation or controls.
That doesn't mean that they are trying to commit improprieties. They just don't understand how to set procedures up without the necessary background to do it. The auditors come in and tell them to create better segregation and better internal controls. Those are great words, but it's hard for an unsophisticated organization to implement all of that.

Mr. McLaughlin: Where do you get traction in implementing these policies and procedures? I've heard repeatedly the board identified as an important source of oversight. But there was also the acknowledgment that in many nonprofits, you just don't have the ability to hire people, or enough of them, who have the experience setting up these kinds of systems. And, the outside auditors have a limited role in the organization.
So where do you get this oversight, knowledge and the savvy to do this day-to-day?

Ms. Floch: An audit committee plays a critical role here. All organizations should have a strongly functioning audit committee.

Dr. Solomon: The auditors are critical. Everybody must be clear that the auditors work for the board -- and excuse the impression -- this is Enron. It really is. It is very hard, because management often influences and often makes the decision relating to accountant retention. But, everybody must be clear from the beginning that the auditors are there reporting to the board.
Number two, when the auditing committee met with the auditors, no staff was present. No one was offended that you had to leave the room. It was an executive session where there was honest discussions. It is a terribly important component.

Mr. McLaughlin: As a funder, do you look for that?

Dr. Solomon: As a funder, in our major grants, we look for that. We play a very active role in assuring that the systems are in place, in some cases insisting on controls ourselves, insisting on charts of accounts, common charts of accounts, certain things that allow us to take a more serious look.
We shouldn't understate the tension between everybody wanting to achieve the mission. I remember getting a call for a reference from a president in another state for somebody who had been terminated for playing financial games. Not theft, but financial games. The question was, was he stealing for the organization or stealing for his pocket? It was perfectly fine that he was stealing for the organization. That's the kind of guy the president wanted. Well, therein lies a very difficult situation, because so often, you hear that the person wasn't gaining personally. It didn't matter. The whole credibility of the organization and field is at stake.

Ms. Floch: A similar story involved an executive director of an organization that received its support mostly from the government. The director was redirecting money to a different program that she felt was more worthy, and had her finance staff basically fudge the reporting back to the government.
If you have the power to redirect monies spent, then what else are you doing? In this case, the board knew about this and approved it because it was being spent on a program that they believed was very worthy. So, that's not an internal control breakdown. That is a deliberate redirection of restricted contributions.

Mr. Roman: Many organizations will allocate X amount of money to be used for overhead, and usually that's kept low as an indication of their efficiency. One commonly hears nonprofits saying, "I can't run my organization on that amount of overhead." This is why we're talking about the importance of internal controls, so you can operate efficiently and wisely under those types of overhead flow.

Mr. McLaughlin: Let me shift focus here. Increasingly nonprofits structurally are becoming more complex and sophisticated. Many now have subsidiaries, often nonprofit subsidiaries, and sometimes both. That opens up a another area of concern and potential leakage. Have you seen problems related to subsidiaries in any way?

Mr. Zachter: I think the nonprofit world is somewhat better organized in this regard than the commercial world. There are specific guidelines. There was a Statement of Position issued in 1994, which clearly laid out criteria stipulating whether they have to be consolidated or if they would require disclosure in the financial statements. Even the IRS has come to realize there are related entities within the nonprofit world.

Obviously, with the advent of the intermediate sanctions, there is now a higher level of reporting and guidance than there may be in the commercial world. I think the nonprofit may be better off having these guidelines, which have been in effect long before Enron.

The point is, will people adhere to the guidelines and make sure that the reporting is proper and in accordance with those guidelines?

Ms. Floch: With increased public disclosure, the heightened visibility has had perhaps a different consequence than what was originally intended. The IRS and the state attorneys general and watchdog agencies are supposedly monitoring nonprofits. But now the public itself has begun to make their own judgements, because the financial information is readily available.

Mr. Clolery: There are so many places when you're dealing with different entities and revenue streams passing between entities where there could be problems. Talk about the things that the public should be watching for.

Ms. Floch: The blending of the two. Moving the profit out of the for-profit entity into the nonprofit entity. Looking for arms-length transactions.

Mr. Zachter: Concerning investments in a new entity, new nonprofit or new for-profit, what is the nature of the underlying investments? Did the board approve it? Does the board believe the investments will enhance the parental organization as a total?

One area that we have not spoken about yet, but which certainly is vulnerable, is wire transfers.

More and more often, clients are starting to pay vendors with wire transfers. I think wire transfers should be limited and documented just like any other check-writing instrument.

Mr. Roman: You asked earlier, is the not-for-profit group watching? I think the answer is yes. Many foundations and other donors probably get 10 to 20 grant applications for every one that they fund. They need a way to identify which grantees are run efficiently. Internal controls goes to that end to help ensure they're being run efficiently.

Dr. Solomon: One of the struggles -- the greater the need of the organization, the more people who wanted to support it. But the need of the organization too often spoke to poor management and not to the need that was being served. There was always confusion between this.

If an organization is not financially healthy, then in giving them restricted funds, whether government money or any third-party source, the likelihood of 100 cents of that dollar going to that restricted purpose is significantly less. While some may feel put upon, three years of financial statements is terribly important. It really speaks to, can I as a funder believe the funds are going to the purpose that it speaks to? It is a critical issue.

I think also, and it comes back to the comments made earlier in terms of the board oversight role, the comfort with these conversations taking place internally is terribly important. Too often a CFO speaks in language that's designed to make sure nobody understands it. It is absolutely fascinating.
At one point, I did a study of seven failed nonprofit boards. What I discovered was the common theme: Board members knew something was wrong. They couldn't put their finger on what it was. They trusted the board officers because, after all, they were putting in more time as was the trustee. They trusted the executive, because look at that person working so hard for so little compensation.
Had those board members asked and pursued the questions that were troubling them, those organizations might not have failed. The role of due diligence on boards, the role of board members to really pursue these issues when they smell something, to feel comfortable is palpable.
A former president of the National Center for Nonprofit Boards (now called BoardSource) used to say: "A board is an incompetent group of competent individuals."

Ms. Floch: When the accounting rules changed during the mid-90s, we tried to use that as an opportunity to educate the boards in accounting principles and not-for-profit financial reporting. We saw this as a terrific opportunity for them to learn. It was a chance to look at the financial statements without embarrassment, without having to say, "I don't understand."
What was surprising to us was how many people were not truly interested.
And, you know, people on that finance board probably don't understand those financial statements.

Mr. Roman: I think it's a shame that it often takes a high-profile event, like fraud, to get people to step up and take interest. The time to take interest is now, before the fraud occurs. It's easier to put the internal controls in now than to try to put them in when your reputation is tarnished.

Mr. Zachter: One area we have discussed was the possibility of taking contributions, either restricted or unrestricted, or of some checks getting lost in the shuffle. We have recommended to our clients, mostly larger organizations, that they have a separate fundraising department which generates its own financial reports. This report indicates how much is raised, whether it is on a pledge basis or cash basis.
What is amazing to us is how few people in accounting or management have tried to match up the internal financial statements to those fundraising reports. We would strongly recommend that there be a monthly reconciliation of the two reports and make sure that they tie-in.

Mr. McLaughlin: Are there signs that donors, or donors who are not steeped in the technical aspects of internal control and management, could use to determine whether something is in disarray? You suggested that many had this suspicion. What are some signals or signs?

Dr. Solomon: I think one signal is the ability of the volunteer officers to be articulate about the organization. I recently saw a presentation by a university which involved their president and their development officer and the board chair. One could tell immediately that the board chair was intensely involved in running that place. You had a sense of confidence in him as the volunteer officer.
I think that one of the tests for a funder or for a donor is connecting back to the volunteer leadership. To what degree are they involved? To what degree do they know? To what degree are they "on the job?"
The issue, too often, is responsibilities get diffused when we're talking about volunteers. And, clarity around those issues is one of the measures.

Mr. Zachter: If the auditors are not presenting concerns in the management letter, I think questions have to be raised. Some questions may be: Are the bank reconciliations prepared on a timely basis?; If something goes wrong, is it caught quickly?; Are there reports being issued to management and to the board that compares actual versus budget?; Are the reports seasonally adjusted?; Are the checks being endorsed immediately?
These are fundamental problems because you are giving a message to management that you are concerned and interested. No one is accusing anyone of doing anything, but we are acknowledging our responsibility. Auditors have a responsibility. We have to work as a team to make sure we are avoiding problems.

Mr. McLaughlin: Are larger nonprofits more susceptible to financial wrongdoing or smaller ones or is size irrelevant?

Mr. Roman: I think size is irrelevant. We see more incidents of fraud in smaller organizations primarily due to the fact they don't have the ability to have segregated various functions. They may need to rely on the director of finance to wear a number of hats.

Mr. Clolery: Is it fraud or stupidity in some cases?

Mr. Roman: Both, sometimes. Fraud is not committed by the company, but individuals in that company. You mention stupidity. You could say the board and the finance committee is giving too much responsibility to one individual, that's a red flag in itself. They need to balance what they do.

Mr. McLaughlin: Are inside jobs, inside internal frauds, more work of the single individuals or conspiracies?

Ms. Floch: My experience, it has been single. I haven't seen many conspiracies.

Mr. McLaughlin: Do nonprofit internal fraud patterns differ from those that you find in for-profits?

Ms. Floch: Yes. I think for-profits are far more sophisticated and have greater pressures to inflate earnings.

Mr. Zachter: There is greater pressure for SEC entities to do well. Whether it is the bottom line or whether there are bonuses, the CEO and other top management are geared to the bottom line and how the stock is doing. Those factors are not existent to nonprofits. There are nonprofit CEOs who say, "We've done well this year, I think I should get an increase or bonus." However, in general, nonprofits are not as driven to a bottom line, or other things as in a commercial entity.

Ms. Floch: Until recently, when a fraud occurred in the commercial world, the public's perception was limited to that particular organization. However, when a charity is in the news, it affects public perceptions of other charities. You have an accountability not just for your own organization, but for the nonprofit world as a whole. I think that some of the alleged mismanagement that has been in the news over the past months has been detrimental to a lot of organizations that didn't fall in those categories.

Dr. Solomon: I would add one other thing. While the focus of today's discussion is fraud and mismanagement, I believe that the vast majority of the people who work in the nonprofit field are there for the right reasons. They're there to make a better world.
We shouldn't tolerate mismanagement and fraud, not only because it's wrong to tolerate it, but because it goes to the reputational damage to the broader field. It goes to the issue of mission. It goes to the issue of the vast majority of people who are working hard to try to make the world better and are so negatively impacted by the few rotten apples who should be discovered and exposed.

Mr. Roman: Quality organizations and funders and foundations want to do business with other quality organizations and nonprofits. One way to differentiate yourself is to demonstrate that not only are you focused on your mission, but you have internal controls in place.

Mr. Zachter: Whether it is a CEO or board, there is something extra that can be done when it comes to revenues or expenses, it is benchmarking. There are similar organizations out there. They have similar types of programs. Benchmark yourself against others. Are you spending considerably more on food? Why should that be? Raise questions.
These are things that are easy enough to do and could avoid the problems that have not yet surfaced. This should be discussed at audit committee meetingsn

© 2006 The NonProfit Times Privacy Policy