Aaron Beam, former CFO of HealthSouth Corp., is interviewed in June’s CFO magazine in an article titled “I Should Have Said No.” Mr. Beam pleaded guilty to criminal charges regarding his participation in that $2.7 billion fraud. When asked “How did the fraud begin?,” Mr. Beam responded “… We committed fraud in the summer of ‘96, when we could no longer change estimates to make earnings. We thought we could make a lot of entries small enough that the auditors wouldn’t detect them. So one night, during the second quarter of ‘96, I said, ‘OK, let’s do it,’ and we credited revenue that did not exist and we debited assets that did not exist.”

The flight path was set … and it was set to fly “under the radar”!

HealthSouth is just one example of how frauds can be perpetrated using the “low flying” tactics of transactions that are below the parameters that might trigger “unwanted attention.” In one of my prior roles, we uncovered a similar approach employed in the disbursement process that resulted in a much lower loss (we are talking only about $115,000). Nevertheless, it was a pretty big deal to our company — mostly because it shook our trust in people.

Recently, I have been doing some exploration in the area of continuous control monitoring (CCM). Some of this is due to my ongoing curiosity about how to really implement cost-effective internal controls. But I also developed this interest during my early career roots in public accounting and then internal auditing. Then, in Controller and CFO roles, I wanted to help the organization best protect itself without spending inordinate time and resources.

Among other things, I have learned that — depending on your organization’s accounting systems structure and the volume of your transactions — CCM technologies could be a cost-effective way to strengthen your internal control environment. Some of the possible benefits range from improved SOX compliance to possible reduction in audit fees to quicker fraud detection to continuous validation of transactions to identifying potential areas for cost reductions in your business processes. The list could go on!

And the big question is, Might an effective CCM program have identified the pattern of small entries at HealthSouth … and saved everyone a lot of trouble?!?!

If you have any experience or thoughts on using CCM in your organization, please share. Are you using or considering implementing CCM? Do you have any tips and tricks that you can share with others on the topic? Are the possible benefits of CCM turning into a reality for you? ###