Forensic Accounting

It’s Friday afternoon, and you just got a call from your friend, Jane Winkler. She heads a Jewish community organization that is funded primarily by donations. Community members come to the center for services and are encouraged to provide donations in any amount they choose. Some
receive services and do not donate at all. In addition, the organization receives large donations from individuals who support the center and from other Jewish communal organizations. The center raises about a quarter of its annual revenues at its annual fundraising gala which will be
held 2 weeks from now. The organization has an annual budget of about $2.3 million, about 8 full-time employees and volunteers. The center is nationally known for its high quality programs and innovative approaches.

Jane tells you that she’s recently discovered that one of the employees has been skimming incoming donations. One of the people who donated called at recently to ask about a year end contribution letter for tax purposes. Jane could find no record of the person’s donation. She followed up with the donor, who provided the Paypal receipt. The donor said that the person at the desk, a nice lady, had swiped the credit card into an account using an iPad. The donor had the Paypal receipt, but was calling because she wanted to get an acknowledgment of her donation on the
organization’s letterhead in case the IRS audited her tax deduction for the charitable donation. Jane was shocked, because the Paypal receipt provided by the donor clearly indicated the name of center, but Jane knew that the center didn’t have a Paypal account. In fact, she didn’t think that they accepted credit card donations at all.

Jane started asking questions and one of the employees, Sheila Lody, abruptly resigned. Jane reached out to Paypal and learned that the Paypal account that had received the purported donation was linked to Sheila.

For this discussion, imagine that you are trying to help Jane. She has customers/donors coming in every day. She can’t stop the center’s activities while she figures this out. What controls should Jane put in place right away? Who needs to be informed of the issue? Should Jane let the community know what has happened or keep it quiet? What kind of expertise should Jane seek out? Assuming that the only issue is skimming of credit card donation skimming, what controls could have prevented or detected this issue? What should be Jane’s the first priority?