In our previous blog post regarding the QuickBooks Audit Trail, we discussed what the tool is, what it captures and how to use the tool.
To recap, the QuickBooks Audit Trail (or Audit Log, depending on the version) provides a log of each accounting transaction and denotes any additions, deletions or modifications affecting the integrity of the transaction. The tool captures every transaction from the time it is initially entered into QuickBooks, and tracks changes to the original entry, including transaction type, date, account, vendor/customer name, transaction amount, quantity, and price. The Audit Trail also reveals the User ID under which the entry, deletion or modification was made. The Audit Trail is a report built in the QuickBooks ReportCenter– all you have to do is click a button to generate the report.
One question posed in the blog was, “So, I can use QuickBooks to prevent and detect fraud?” The answer is a definitive yes. Employers can use the audit log to detect warning signs of fraud, waste and abuse.
What are the footprints that could reveal fraud?
– Transactions with more than one entry in the audit log, which indicate that a change has been made to the transaction after it was originally entered in the system.
– Name or description changes.
– Dates that have been changed from the original entry to the last modified date.
– Changes in check number.
– Changes in the amount of transaction.
How do we detect fraud with the audit log?
The indicators of fraud, waste and abuse can be identified through the audit log in numerous ways, including:
1. Export the audit log to Excel.
2. Search for the words “deleted” or “void.” If a check was created and then deleted or voided, it will show the transaction as it originally appeared, including the general ledger accounts the transaction was originally charged against. By searching for “deleted” or “void,” we can identify checks that may have been created, deleted or voided from the system but still cleared the bank. After isolating the deleted and voided checks, search the bank statements to verify if the checks cleared and if so, to determine the payee.
3. Use the Same, Same, Different methodology to search for a change to the payee name. Data analytics allows us to identify all checks that have the same check number but have a different payee. After isolating these checks, we can search the bank statements to verify if the checks cleared and who the payee was on the check that cleared.
4. Identify changes to a record outside an expected period of time. The audit log includes fields for enter date, last modified date, and the latest and prior dates. By calculating the difference between the enter date and the last modified date we can determine if changes were made outside of a reasonable time period.
For example, a company may have an expectation that no changes be made to a disbursement transaction more than 60 days after a transaction was prepared. By calculating the difference between the enter date and the last modified date, we can isolate all disbursements with changes greater than 60 days.
5. Look for a changed check number. When a check number is changed in QuickBooks, there are multiple entries in the audit log under the final check number. Each entry in an audit log has a “header record” – typically the check number. We can create a calculated field to find where the check number in the header record is different from the check number in the “NUM” field. Search the audit log to determine if either the original check number or the new check number have other entries in the audit log. After isolating these differences, we can search the bank statements to determine if both checks cleared and who the payee was on the check that cleared.
6. Isolate transactions to determine which amounts have been changed. We can use a simple calculation to determine changes in amounts. After we isolate those transactions in which the amounts have been changed, we can verify the amounts against supporting documentation and cancelled checks. If a check was issued for more than an invoice, contact the vendor to determine if a refund was issued for the difference. If a refund was issued, request a copy of the cancelled check issued and attempt to follow this transaction through the company’s books and records to determine if the company received the benefit of the refund issued.
Similar to many other red flags of fraud, the footprints of fraudulent behavior found in the audit log of QuickBooks require additional analysis of supporting documentation and corroboration with independent records, such as cancelled checks from the bank and confirmation with vendors. If you are interested in learning more about how our firm can assist you with financial investigations, please contact us.