The man that killed company x
Chris Watson
Cyber Expert | Prevent Cyber Incidents | Detect Cyber Breaches | Respond to Cyber Attacks | Risk and Consulting | Forensics
How one phone call led to millions of dollars drained from the accounts of a successful Australian subsidiary of a multinational company.
I’d like to tell you a story. This story, like a Greek tragedy, has it all (with the possible exception of murder). It is a modern tragedy, a tale of how a successful Australian manufacturing business (company X) now ceases to exist due to a combination of a lack of control, oversight, poor management, incompetence and ego. A deadly mix indeed, as it so turned out for company X. Like the crime caper series of 1950’s American TV the names have been changed to protect the innocent. Some aspects have been combined for clarity sake but what you are about to read all actually happened.
******
It was one of those fabulous days in Brisbane that gave rise to the saying “beautiful one day, perfect the next”. I arrive a few minutes later than planned for my coffee with the Australian MD of company X, a very successful subsidiary of a US listed manufacturing company. Colin had been MD for 5 years now, ever since company X was bought outright by their now US parent, ACME. Colin had been pleased with how the deal had concluded. Company X would be left to their own devices -“why fix something that’s not broken”, Colin would later recount with the distant stare of the bewildered.
“Sorry I am late Colin, I have just finished with the lawyers and Head of Treasury in the US. It’s not good news I am afraid”. Colin’s hands tremble ever so slightly as he raises his cup to his lips, thinks, then lowers the cup again without drinking.
“How much?” Colin fixes me with a stare that betrays his fear of the worst.
“Mate, its $12 million.” Colin is about to let forth a number of expletives when his phone rings. With head in hand and an ever growing pallor he listens silently occasionally nodding his assent as if he was on a video call.
Colin hangs up and takes a lug of coffee. “Well, that’s that. Company X is no more and I am fired” As he slumps back into his chair he murmurs absentmindedly “why didn’t I just kick down his door and demand an answer”?
***********
Just as she is settling in for her first coffee of the morning Cara, the receptionist, takes a call at company X. The Chairman of ACME in the US was on the line for CFO. “Do you mean the MD?” Cara boldly asks.
“No, the CFO. What his name again?”
“Oh, you mean Tim Cross?”
“Yes, that’s him, please put me through”.
“Hi Tim, I have Dieter on the phone for you”.
“Dieter who?”
“Chairman Dieter.”
“Oh, ok put him through. Thanks.”
“Hi Tim, Dieter here how are you…?”
“I’m good how..”
“Good, good. Tim we have a problem.”
*********
The chain of events that ensues would fill a novel. A chain of ineptitude, control failures and a fear of being a trouble maker that led to the ultimate demise of company X. Company X and more importantly the CFO Tim fell foul of an age old scam. The so called “CEO Scam”, where a person purports to be in a position of responsibility and convinces the hapless mark to transfer significant funds out of the company accounts. Everything that could have gone wrong, went wrong for company X.
The CFO who was all powerful and rarely challenged within the organisation also had an ego the size of Neptune. Even during his subsequent interview to ascertain what had happened and despite being repeatedly told the whole saga was a scam he remained resolute that he was doing the right thing and was saving the company. Tim had been asked by the Global Chairman, a man he had never met nor spoken to, to transfer $1 or $2 million offshore to avoid an asset freezing order by law enforcement. Tim not only did this willingly and with a badge of honour, but could not accept that what he had done was, had it been real, illegal and totally in contravention of the expectation of a CFO.
On looking at the bank accounts Tim discovered he could lay his hand on not only the $2million but an additional $10million. He would be a hero. The man that saved ACME! In transferring the money, he became the man that killed company X.
During the interview of finance team members it became apparent that they had questioned the transactions with the CFO who had bluntly told them to do as they were told. This led one of the team to raise the issue with a senior member of company X who decided the best course of action was to say nothing. This troubled the finance team member but in fear for his job, he decided he would just keep quiet. If it really was nothing, then why make a fuss?
The MD, Colin, had been made aware that the Chairman had called Tim and that it was something to do with moving money out of the Company X accounts. However the CFO wasn’t returning Colin’s calls and when he did eventually speak to him, he was once again bluntly told Tim that he couldn’t talk about the matter with him but that “ it would be ok”. Colin was concerned and unhappy about the lack of information regarding the potential financial implications for his company, but again he remained quiet in fear of losing his job. If it really was nothing, then why make a fuss?
So, where did it all go wrong for company x? A catalogue of control failures are to blame, including the CFO having the ability to approve and release funds, the bank processing payments without appropriate signatures, payments made in an unauthorised currency and communications carried out via personal email to effect transactions. It’s difficult to pin point which failure was the worst, or most mind boggling. The fact that no critical assessment had been made about how likely it was for the Global Chairman to call someone in a small subsidiary on the other side of the world, or the fact that what was being requested was, all things being equal, illegal. The fact that a culture permeated where employees felt unable or unwilling to report potential misconduct or that senior management were unwilling to question questionable action for fear of repercussion.
ACME were far from blameless too. They had assumed all the appropriate policies and procedure were not only in place, but effective. Never once was this reviewed, audited or questioned. As long as the money kept coming in, no questions were ever asked. From a personal point of view, the fact that when interviewed, the CFO, even at the point of dismissal, could not comprehend his wrongdoing, was the most damning indictment of the whole incident.
Simple measures to ensure appropriate oversight and management alongside robust, regular anti-fraud training and a well communicated whistleblowing program would have gone a long way in preventing another slice of Australian manufacturing from disappearing.
Chris Watson, Partner at Grant Thornton “ For Frauds and issues of misconduct to occur poor culture and controls are significant contributory factors. Our Grant Thornton Australia forensic consulting team works with clients to ensure they are best prepared to identify and remediate these issues. Get in touch or stay across the news on our dedicated anti-fraud & corruption webpage.”
Further insights
Fraud in focus: ACFE findings – businesses affected, common causes and key learnings
Growth IQ: Why culture can make or break your company
Insights: Meet your hacker
National Head of Health and Aged Care
6ySounds like we need to keep the end in mind Chris Watson when it comes managing these issues