The Spotlight : Fraud

Preventing Fraud, Part III (with free stuff!)

Nicholai Burton — Thu, 20 Mar 2008 18:16:00 GMT

At the last Blackbaud Conference, one client shared an experience where several cashiers had defrauded her organization via a pretty clever scheme. For cash transactions, the cashier would sell a Member or Child ticket in PE but charge the patron a Full Price admission and then pocket the difference. Once Jeff Heffner and I heard the story, we decided to come up with some reporting ideas to help catch a thief in the act.

After some brainstorming, we created the Cashier Audit Report. It displays a breakdown of price types sold by each user and their relative percent of total. See this screenshot for an example of the report. With it, you can look for trends and see if anything weird is going on with the distribution of price types. For example, you could see that four of your cashiers sell Student tickets as about 8% of their total sales, but the fifth cashier is selling 15% of his tickets as Student. It could be completely innocent, or it could be that he is letting his friends in at a discount or taking money. Either way, you now have the information you need to take action at your fingertips.

Alyssa Wigton, our report writer in Professional Services, provided a couple of great tips and helped us get it working in PECRViewer.exe so it can be run directly from Patron Edge. To use it:

Download this set of files: Cashier Audit.zip
Add the stored procedure to your PE database
Add the report into Patron Edge per Knowledgebase solution BB142029

As with any custom stuff I give out on the blog, this isn’t an official piece of Patron Edge. My analysts can’t take questions on it, and I can’t be responsible if it leaves the bathroom light on, tramples your flowers, or rearranges the numbers on your speed dial!

Did you find this report helpful for preventing fraud? Are there any other reports in the system that you use on a regular basis to look out for thieves? Leave a note in the comments.

Preventing Fraud, Part II

Nicholai Burton — Thu, 20 Mar 2008 18:14:00 GMT

So now that you have locked down the system appropriately per my previous post on the subject, it’s time to take advantage of one of the controls in PE regarding end-of-day procedures. I am referring to the Drawer Cash Out function. If you are not familiar with this feature, it allows your cashiers to enter their end of day cash drawer totals directly into PE, so that you can view their totals side-by-side with the system totals for that drawer. Using this method is easier on the cashier, more secure, and a lot harder to fudge than a paper count-out sheet. Here is how to set up the feature:

Enable the feature in Company and for each Cash Drawer:

Go to Administration, System Setup, Company and select the Close Drawer tab
Set Manage Floating Till to Yes and click OK
Now to to User Setup, Cash Drawers
Edit each drawer and set Display Actual Payment Done to Yes

Set up the payment methods to display on the Cash Out:

Go to Administration, System Setup, Cash Drawer Payment Methods
Create a new entry for each kind of bill or coin, where the Value is relative to a dollar. For example, you will make an entry called Quarters with a value of .25
Create an entry for Check, Clearing and Gift Certificate, if necessary. Feel free to break this down as much as you feel comfortable; some people have one Credit Card entry, some people use one for each card type, and some don’t record this pay type at all on the Cash Out. Just stay consistent with your business practices

Disable the Close Drawer function and enable the Drawer Cash Out function in Profiles:

Go to Administration, User Setup, Profiles
Edit the needed profiles by expanding the Main Menu section, checking Drawer Cash Out, and unchecking Close Drawer

Not too difficult, right? The reason we turn off the Close Drawer is because only managers should have the ability to do this (or even run draft reports). A cashier should always be reporting her drawer totals blind.

Are you currently using the Drawer Cash Out function? Do you feel it has helped in preventing fraud or streamlined your end of day process? Leave a note in the comments.

Preventing Fraud, Part I

Nicholai Burton — Wed, 19 Mar 2008 12:30:00 GMT

Fraud is a problem in all types of organizations, but it can be especially tough for performing arts organizations and museums since we’re frequently dealing with temps for most of the front desk work. As consultant Leslie Bradford discussed in her Blackbaud Conference session To Catch A Thief, there are a lot of ways you can get ripped off. Since not everyone was able to make the conference, I’ve decided to do a series of posts on some things you can do to prevent fraud at your organization.
Restrict Access to the system
Every user should not have a System Administrator profile, and every user should belong to a user group. If a cashier’s only function is selling tickets, he should not have access to Administration or reports at all. Think carefully about what users need what level of permissions.

Give everyone a unique login and cash drawer
Your login should be treated as your signature. I know logins like User1, User2, User3 are a lot easier to manage than dealing with creating new logins every few months. But it becomes a lot harder to track down where the money went at the end of the day when everyone is using the same generic login.

Use secure passwords
Require a password that’s different from the login (there is a setting in Administration>Company that can enforce this). Make it have at least eight characters and consist of both letters and numbers. Most importantly, never share your password. It does no good to give everyone their own login if they can all log in as Supervisor or as each other. Be sure to change passwords at least every 90 days.

Change the Supervisor password
There are two default login/pass combinations that come with PE, depending on how long you’ve had the program. I can’t tell you how many people my analysts get onto screenshare with and see the user enter pe/1 or Supervisor/admin. If your database still uses this default, change it immediately. Ideally, only one or two people at the organization should have access to this password and if the login is used frequently then the same 90-day password rotation applies here.

Next time I will discuss using the Drawer Cash Out feature and how it helps in combating fraud at your organization. How are you handling access to the system? Leave a note in the comments.