This is #10 in our series of #TIPS intended to help you manage fraud, embezzlement, waste, abuse; and help keep your practice safe.

This post discusses embezzlement “red-flags” and how to properly respond to a red flag if it is observed.

Let’s start with a summary of the key points:

  • A “red-flag” is an indicator of a circumstance that varies from “normal”.  It shows that something is out of the ordinary and may need to be investigated further.
  • Many embezzlement red-flags are common to all types of business, while others are specific to dentistry.
  • An embezzlement red-flag is simply a warning sign. A probability that the red flag being observed is the result of employee dishonesty.
  • Red-flags are NOT EVIDENCE that theft has occurred.

Most red flag assessment have questions that require a Yes or No response.

For example:

  • Does your employee have a wheeler-dealer attitude?
  • Does your employee appear to have financial difficulties?
  • Is your employee resistant to change or territorial?

Every dentist will have a different “decision threshold” when responding yes or no to each of these questions.

Therefore it’s important to understand that a red flag assessment should not be relied upon as predictive model to determine whether embezzlement is most likely or certainly happening.

Consider this statement:

Fraud experts say that in 40% of embezzlement cases reported, the person stealing displayed a living standard disproportionate to their income.

I think of it this way.  If you observe your employee living beyond their means, and see no reasonable explanation for it, then there is a 40% chance the employee is stealing from you, and a 60% chance they are not.

Here’s another.

Fraud experts say that in 20% of embezzlement cases, the perpetrator displayed “control issues”, or a willingness to share duties.

If you have an employee like this, there is a 20% chance that the behavior is a result the employee’s strong desire to “keep control” (of things like the practice software and practice accounting)  for fear that you will uncover the theft.

Conversely, there’s an 80% chance that the employee’s behavior is linked to something else.  Maybe the employee is OCD, or trying to conceal sloppy work, or hiding an unfavorable practice statistic that will reflect poorly on their performance.

Common red-flags

Some of the most commonly reported red-flags reported are listed below.

The “Top 6” red flags are shown in red.

As a group these red-flags are present in 85% of embezzlement cases.

Does that mean if you have these SIX red flags in your practice, there is an 85% chance you are being stolen from?

Sounds about right, but it doesn’t work this way. Red flags are not additive. The sum will be less than the whole and everyone’s situation is will be different different.

Red flags listed by order of magnitude of reported observation AFTER embezzlement was found.

  • Living beyond means – 39% of cases
  • Financial difficulties  – 34%
  • Wheeler-dealer attitude  – 20%
  • Control issues, unwillingness to share duties  – 19%
  • Divorce/family problems  – 17%
  • Unusually close association with vendor/customer (patients) – 15%
  • Irritability, suspiciousness, or defensiveness  – 14%
  • Addiction problems  – 13%
  • Past legal problems  – 9%
  • Past employment-related problems  – 8%
  • Complaining about inadequate pay  – 7%
  • Refusal to take vacations  – 7%
  • Instability in life circumstances  – 5%

What to do when you have red-flags in your practice.

The image below is process I use when assessing a red-flag, and each of the other steps taken up to a forensic audit.

Steps from a Red-Flag to an Audit

When you identify one or more red flags in your practice, the first step is skepticism.

Step 1: Skepticism

This is where you apply reason, logic and common sense. Don’t jump to conclusions.  It is best to respond than to react.

For every red flag that you observe, consider alternate explanations and the likelihood of each explanation.

If your employee is clearly living beyond their means and the alternative explanation is they had a “big win” at the casino – consider the extreme odds.

However, if the explanation is a modest inheritance or a second family income, then the odds are more realistic that this happened, and likely can be verified.

When you assess each red-flag, consider the “weight” of your response.

Consider these two dentists who answered YES to this common red-flag question:

Question:Does your employee have financial pressures at home?

Dentist A answered yes based on the fact that the employee’s wages were recently garnished (or creditors were calling the practice, or practice loans were not repaid, etc.)

Dentist B answered yes based on a conversation overheard 4 months ago where the employee was complaining to a co-worker about being late with her last car payment.

Both dentists subjectively answered YES, however intuition tells us that Dentist A should be more concerned than Dentist B.

Step 2: Inquiry

If skeptical and careful reasoning cannot explain the red-flags you have observed, the next step is inquiry.

For each red-flag, ask yourself what other identifiable sources of information can be used to corroborate what was observed?

For example: If you are concerned because your employee is the first to arrive and last to leave the each day (or comes in after hours to do work),  then you can inquire further by checking your building alarm system and computer audit logs.

Most practices have an alarm system to that must be disabled when you enter, and enabled when you leave. Therefore, checking your building alarm log  may tell you “how early” and “how late” your employees was coming and going.

Some employees will have a legitimate reason for coming early or staying late. They may rely on public transportation, or get a ride to work with a friend who has to be at their job earlier. In situations like this, the employee will have a predictable pattern.

For example, an employee relying on public transportation or someone else to get the work, may arrive between 7:10 AM and 7:20 AM every workday. It’s going to be predictable because your employee is relying on someone else’s schedule.

If an employee is coming in early because they need to do things in order to conceal embezzlement, the pattern will vary. Some days they may not need come in early, other days will require them to come in very early.

The alarm logs will also show the comings and goings after hours and on weekends.

If your alarm logs shows that your employee came in on a Saturday night; check to see how long the employee stayed in the practice. If the employee stayed only for a few minutes, then it’s more likely they came by the office to pick something up that they left behind. If the employee stayed for an extended period of time than it is more likely that they may be up to no good.

You can also run an “audit report” from your practice management software to look for events that occur outside normal business hours. Most practice management software audit reports will show the date and time of events. Using those timestamps, look to see if things were happening when the office should have been closed.

If your own inquiry does not remove your concerns, or serves to bolster them, move to the examination step.

If you have observed a red flag in your practice and need some direction, contact me for some free advice using this link: https://bcb.hiltzandassociates.com/ask-a-question

Step 3: Examination

A fraud and embezzlement examination is performed by a specialist and comprises of a targeted and exploratory analysis of the practice’s computer data and business records to look for and identify evidence of fraud or embezzlement.

If theft is uncovered, the examination will confirm, verify and estimate its scope. As well,  the examination will provide the dentist or practice owner with evidence of theft, and an estimate of its impact and duration.

This evidence can be used to terminate the perpetrator’s employment on a “for cause” basis, if they are still employed by the practice, and so the dentists can make an informed choice regarding the next step.

In many cases, an examination will provide sufficient evidence to support a claim against the practice’s employee dishonesty insurance policy.

Step 4: Forensic Audit

A forensic audit is a comprehensive reconstruction of the events leading up to and resulting in theft.  This level of work is generally recommended for civil and criminal prosecution and recovery.

Digital Forensics