Payroll Fraud

The situation

The Association of Certified Fraud Examiners defines payroll fraud as “any scheme in which an employee causes an employer to issue a payment by making false claims for compensation”. Every organisation that pays employees can be a victim.

This case concerns itself mainly with fraudulent overtime claims, though employees find many other ways to claim more pay than they are owed: buddy punching, ghost workers, double transactions. It usually occurs in systems without true identity management, where dishonesty hides behind a password. Since passwords can be shared, guessed or stolen, it is difficult to assign blame for fraud committed with one.

The institution faced a growing student body, budgetary restraints from declining funding, and salaries fixed by collective bargaining agreement, where non-exempt overtime pay was contributing to a budget shortfall.

The challenge

• The overtime approval process for non-exempt administrative workers was flawed
• The organisation had experienced instances of extensive fraud in the approval of overtime pay
• Approval of overtime was typically delegated to administrative assistants, creating the opportunity
• SAP passwords were the only security mechanism before bioLock

What was implemented

• Individual biometric user profiles associated with specific SAP tasks in HR and payroll, defining any delegated tasks
• Biometric re-authentication enforced for every sensitive task
• Tamper-proof logging and an audit trail for each protected transaction
• Control of extended authorisations, where a user executed transactions under a supervisor’s profile
• Identification of transactions executed under delegated authority

The outcome

• Payroll overtime fraud has been eliminated
• Payroll budget control has been regained
• The employees responsible for the fraud were held accountable
• True segregation of duties in the approval of overtime pay