Journal of Financial Crime Vol. 11 No.

Exotic Embezzling: Investigating O-Book Fraud Schemes

Thomas Buckho and James Clifton

INTRODUCTION

For obvious reasons, cash is the asset most often stolen by dishonest employees. Fraudsters will steal either the incoming cash1 receipts via various theft schemes or the outgoing cash disbursements via a variety of fraudulent disbursement schemes. When conducting a fraud examination, a thorough understanding of the controls and/or procedures in place for processing cash owing through a business must be gained rst. If controls over incoming cash receipts are inadequate and those incoming cash ows are substantial, then dishonest employees will attempt to divert some of that cash ow into their own pockets. If controls over outgoing cash disbursements are inadequate, then dishonest employees will attempt to divert some of those cash disbursements into their own pockets. A thorough understanding of the controls over cash ows allows investigators to generate ideas concerning how someone could steal cash from the organisation and not get caught. These ideas, called fraud theories, can be categorised as either on-book or o-book fraud schemes.

OFF-BOOK FRAUD SCHEMES

Skimming, an o-book fraud scheme, involves the theft of incoming cash before its entry into the accounting records. Skimming typically occurs when an employee sells goods or services to a customer, collects the customer's payment, but makes no record of the sale. For example, a plastic surgeon pocketed patients' payments for surgeries performed, thereby cheating his employer out of $200,000 in revenues. Such schemes are called `o-book' frauds since no record of the fraud exists on the victim company's books. In these cases, the victim company generally does not know that a theft has occurred. O-book frauds cannot be detected by examining the books and records of the company and generally fall into one of the following categories:     skimming unrecorded sales understated sales and receivables theft of cheques through the mail

Cash larceny, an on-book fraud scheme, involves the theft of cash after it has appeared on the victim company's books. For example, a teller stole $15,000 from the night vault at the bank where she worked. Such schemes are called `on-book' frauds since an examination of the victim company's records could easily reveal the cash shortage. In these cases, the victim company typically knows that a theft has occurred. On-book frauds can usually be detected by a thorough examination of the books and underlying source documents of the company and can be categorised as follows:      billing schemes payroll schemes expense reimbursement schemes cheque tampering schemes register disbursement schemes

ON-BOOK FRAUD SCHEMES

INVESTIGATING OFF-BOOK FRAUD SCHEMES

Historically, law enforcement and nancial investigators have been reluctant to investigate o-book fraud schemes due to the lack of direct, documentary evidence. The purpose of this paper is to describe and illustrate various investigative methods that can be used to eectively detect and investigate o-book fraud schemes. Indirect investigative methods that have proven to be eective in investigating o-book fraud schemes include:     nancial statement analysis undercover surveillance invigilation admission seeking interviews
Journal of Financial Crime Vol. 11, No. 3, 2004, pp. 000000 # Henry Stewart Publications ISSN 1359-0790

The following case study will be used to explain and illustrate the various indirect methods of investigating o-book fraud schemes.

4381-03-Buckho
Page 1

Buckho and Clifton

CASE STUDY: NORTHERN EXPOSURE

Northern Exposure2 was a gentleman's club featuring exotic dancers. The primary sources of revenue for this club were from a cover charge and from the sale of food, beer and alcohol. A recently passed local city ordinance outlawed the type of entertainment oered by Northern Exposure. However, the manager of the club petitioned the city council to exempt any existing businesses3 from the ordinance. The city council granted the exemption and Northern Exposure was allowed to continue to operate in a `competition-free' environment.4 Consequently, the prot potential for the club was enormous. A cost-volume-prot analysis indicated that the club should generate at least a 35 per cent after-tax prot margin. Northern Exposure generated huge amounts of incoming cash, no credit cards or cheques were accepted and an ATM was on site for any customer who needed more cash. Consequently, a huge risk existed that employees would gure out a way to divert some of the incoming cash ows into their own pockets. Larry Swenson, the owner of Northern Exposure, was not satised with the 10 per cent after-tax prot margins being generated by his business. Consequently, Larry engaged Tom Buckley and Jim O'Connor, both certied fraud examiners, to determine why the club was not generating the expected 35 per cent after-tax prot margins. At this point, the proper sequence of events which should be followed in a typical fraud examination include: (1) Develop a thorough understanding of the controls and/or procedures in place for monitoring cash owing through a business. (2) Generate fraud theories based on existing controls for monitoring cash ows (i.e. brainstorm ideas regarding how someone could steal cash and not get caught). (3) Collect and evaluate evidence for testing the fraud theories. (4) Estimate losses being incurred from the fraud schemes uncovered. (5) Assist in ling employee dishonesty insurance claims, criminal, and/or civil charges. (6) Make recommendations for preventing future fraudulent activity.

incoming cash owed through the business as follows: Customers rst paid a $6 cover charge to gain entrance into the club. No receipt was given for the cover charge nor was a count made of the number of customers entering the club. Customers then placed orders for food and/or beverages with the servers. The servers started out with $40 cash in a pouch tied around their waist. If a customer ordered a beer for $3, the server went to the bartender and paid him/her using $3 from the pouch who then `rung' the $3 into the cash register. The server then had $37 in the pouch. After receiving the beer from the bartender, the server then delivered the beer to the customer who paid the server $4 ($3 for the beer plus $1 tip). The server then had $41. At the end of the server's shift, the server gave $40 back to the manager and kept the extra, which should equal the amount of tips received. If it became really busy, which happened often, servers were allowed to get the drinks themselves and `ring' them into the cash register. At the end of the night, the manager counted the cash, closed out the cash registers, and deposited the cash in the bank the next morning. The change in beer and liquor inventory was not reconciled to the drinks rung into the cash register. The cash register tapes were not reconciled to deposits listed on the bank statements.

Generate fraud theories

Based on the controls (or lack thereof) in place for monitoring incoming cash ows, Tom and Jim determined that it would be relatively easy for dishonest employees to divert some of the incoming cash ow into their own pockets and not be caught. Accordingly, they generated the following fraud theories. (1) The employee collecting the $6 cover charges could either pocket some of the money or allow free admission to friends or acquaintances. (2) Servers and bartenders could get drinks for customers, not ring them into the cash registers, and pocket the entire amount received from customers. (3) The manager could perpetrate any of the schemes available to the employees and could steal part of the deposit.

Understand cash ows

By interviewing the owner and other operating personnel Tom and Jim were able to learn that

Page 2

Exotic Embezzling: Investigating O-Book Fraud Schemes

(4) Anyone with access to the cash registers (i.e. servers, bartenders, and the manager) could simply take cash directly from the registers. O-book frauds such as theories one and two above are typically called `skimming' schemes and are essentially unrecorded sales. The manager stealing part of the deposit or others taking cash from the cash register would be considered on-book frauds (i.e. cash larceny) since the cash stolen had been rung into the cash register. Consequently, the fraud could be detected by reconciling the cash register tapes to deposits listed on the bank statements. However, in this particular case, cash register printing ribbons were not replaced on a timely basis resulting in illegible cash register tapes.

Collect and evaluate evidence

Since the fraud theories generated in this case involve o-book frauds, indirect investigative methods must be used to test the fraud theories. Financial statement analysis is an indirect method that can be eectively and eciently used to test all four of the fraud theories. If employees are indeed diverting some of the club's cash sales into their own pockets, then the sales markup over cost ratios will be aected. Accordingly, Tom and Jim determined the actual sales markup over cost ratios for beer and food sales (see Table 1). Interviews with the owner and other operating personnel indicated that beer was purchased for $.60 per bottle and then sold to customers for $3 per bottle, a markup of 500 per cent. Food items that cost $5

Table 1
Cost of Sales ($) 228,972 51,726 228,972 51,726 Sales mark up over cost (%) 373 79 500 250 291,4121 88,5622 379,974 Estimated fraud loss ($)

Sales ($) Actual Beer Food Budget Beer Food

1

were then sold to customers for $12.50, a markup of 250 per cent. The budgeted revenue for one year was calculated, based on cost of sales and expected markup ratios, and then compared to the actual revenue for one year (see Table 1). If employees were indeed stealing cash sales, then the actual markup ratios could be expected to be less than the budgeted ratios. The signicant dierences in ratios clearly supported the fraud theories. Notice that food sales were in fact less than the cost of sales! Using this indirect investigative method, the total estimated annual fraud loss due to skimming and/or cash larceny was $379,974 (see Table 1). Tom and Jim then knew that the club had a big problem with fraud. The next step was to determine which of the club's employees were responsible for the fraud losses. Undercover surveillance can be used eectively for identifying dishonest employees. Posing as customers, a team of six trained fraud investigators5 spent a collective 40-hour week at the club observing the activities and behaviours of the manager, servers and bartenders. At least two undercover investigators were in the club at all times during the week. The undercover surveillance revealed that 90 per cent of the employees, including the manager, regularly stole cash from the club. Apparently, the club's employees subscribed to the `all-you-can-make-and-all-you-can-take' philosophy of employment. It became crystal clear why employees never complained about salary levels even though they had not received raises in years and their base wages were much lower than what they could get elsewhere. In fact, some of the servers and bartenders had been there for years, which is highly unusual for a club of this type. Tom and Jim communicated their ndings to Larry who was concerned but reluctant to `turn the place upside down' without more compelling evidence substantiating the losses caused by employee theft.

853,448 40,753 1,144,860 129,315

Estimate losses incurred

Total estimated fraud loss

Budgeted beer sales of $1,144,860 minus actual beer sales of $853,448. 2 Budgeted food sales of $129,315 minus actual food sales of $40,753.

To further substantiate the fraud losses and estimate their amount, Tom suggested they conduct a weeklong invigilation. The purpose of an invigilation is to create a strict internal control environment so that opportunities to commit fraud are virtually eliminated and a fraud-free prole can be established. The cash received and deposited during the invigilation period is then compared to cash received and deposited both before and after the invigilation period. This indirect investigative method can be very eective in

Page 3

Buckho and Clifton

estimating fraud losses. The key to a successful invigilation is to make the employees think that if they steal during the invigilation period they will be caught. Instilling the perception of detection in this case was accomplished by sending in the same team of six investigators to do essentially what they did during the undercover surveillance, which was to watch the employees for one week. This time, however, the employees knew they were being watched by experienced fraud investigators. The club's employees and manager were informed that the investigators were there to make sure that every dollar collected from customers made it into the bank at the end of the day and that changes in food and liquor inventories were properly accounted for. During the invigilation week, the investigators conspicuously watched employees handling cash, conducted surprise cash counts, reconciled changes in inventory to cash register tapes, monitored end-of-night cash counts, and witnessed the daily cash deposits. An incident occurred on the rst day of the invigilation that greatly enhanced the perception of detection, thus making the invigilation more eective. Meals were served downstairs, separate from the live entertainment area. Suspecting that the single server working downstairs was skimming money from food sales to customers,6 Jim conducted a surprise cash count and reconciled the cash rung into the register to the meals prepared by the cooks. Consequently, Jim determined that the server had pocketed exactly $25 in the rst hour she had worked! After being confronted with the evidence, the server confessed and was immediately terminated. News of this incident Figure 1 Results of investigation

quickly spread to the other employees who realised that their activities were indeed under close surveillance. Apparently, the incident helped to reinforce the perception of detection as no other employees were caught skimming during the remainder of the invigilation. During the rst night of the invigilation, a Friday, several employees complained about how slow a night it was compared to the previous week, during which several `featured' performers had attracted near record numbers of customers. At the end of this `slow' night, the cash registers were closed and $8,300 cash was deposited into the bank; thereby setting a record for the most cash deposited for one night in the entire 15-year history of the club! The employees along with the manager soon realised that setting such a record on a slow night did not reect favourably on them. Now completely convinced that his employees were stealing from him, the owner was furious and wanted to re everyone on the spot. However, Tom and Jim persuaded him to allow the invigilation to continue for the entire week as planned. The results of the week-long invigilation are summarised in Figure 1 below. The revenue during the week of invigilation exceeded the 2001 average weekly revenue by $8,954 and the previous week's revenue by $5,185, despite being a slow week. The above dierences implied that at least $259,250 ($5,185 50 weeks) and as much as $447,700 ($8,954 50 weeks) was skimmed per year.7 The simple, comprehensible nature of the bar-graph evidence from the invigilation greatly impressed Larry Swenson, the owner. Larry

Page 4

Exotic Embezzling: Investigating O-Book Fraud Schemes

knew that the prior week had been a busy week and the week of the invigilation had been a slow week. Larry no longer questioned whether or not his employees were stealing from him.8 During the week of the invigilation, interviews were held with the employees. The purpose of these interviews was twofold: (1) to further enhance the perception of detection during the invigilation period and (2) to provide employees with an opportunity to report any fraudulent activities of which they had knowledge. During the interviews, information from the prior undercover surveillance and the ongoing invigilation was used to ask some very specic questions of the employees. However, while none of the employees admitted to stealing they did implicate fellow employees. Numerous employees claimed that the manager, Betsy Smith, was the primary thief.

serious negative consequence. Accordingly, the most eective way to deter fraudulent activity is to instil this `perception of detection' in employees' minds. In Northern Exposure's case, the two assets most susceptible to fraud were cash and inventory, especially the beer and other alcohol inventories. Consequently, better internal controls were needed to safeguard those assets. The following internal controls were implemented:  Access to the alcohol and beer inventories was restricted to one person, the head bartender. Thus, facilitating the establishment of responsibility for any inventory shortages. A meticulous physical count of inventory9 was taken both before and after each night's shift. The change in inventory was reconciled to what was rung into the cash registers for the night; thus providing for an independent check on how much cash should be deposited for any given night. The cash registers were closed out by the night manager who had no access to the registers during the night. The cash deposits were also made by the night manager. The next day the general manager would reconcile copies of the cash registers' tapes to the deposit slips. The general manager also performed bank to book reconciliations at the end of the month. The nancial statements were analysed monthly to determine if the sales markup over cost ratios were consistent with pricing policies. Employees were encouraged to call a fraud `hotline' if they had knowledge of fraudulent activity being perpetrated by any of the employees. Such tipsters, if their information was proven to be accurate, were rewarded with a cash bonus. Surveillance cameras10 were installed directly over each of the cash registers to ensure that the cashiers correctly ring sales into the cash registers. Such surveillance controls strengthen the perception of detection and help deter two common ways bartenders steal: (1) leaving the cash drawer open between sales, and (2) hitting `no sale' or `void' on the cash register to get the cash drawer to open. In both cases, since no record of the sale is made on the cash register tape, the bartender can pocket the money from such sales. Ideally, the cash register tape should capture `no sales' and `voids' and bartenders should have to explain them at the end of their shift.

Assist in ling employee dishonesty claims, criminal, and/or civil charges

The evidence from the undercover surveillance, invigilation and employee interviews was used to confront Betsy in an admission-seeking interview. After 2.5 hours, she broke down and admitted she had stolen almost $100,000 over three years. The content of her admission was converted to a written statement, which Betsy ultimately signed (see Appendix 1). Since evidence collected in resolving o-book fraud schemes is mostly indirect and circumstantial, obtaining a signed statement of admission greatly facilitates the ling of an employee dishonesty insurance claim and/or criminal charges. In this case, an employee dishonesty insurance claim was led by Buckley & O'Connor, LLP on behalf of Northern Exposure (see Appendix 2). The insurance company restituted Northern Exposure for the maximum coverage amount provided for in their policy, which in this case was $50,000. Clearly, the amount of employee dishonesty insurance coverage was inadequate given the risk exposure for a cash-intensive business in this industry. As required by the insurance provider, the evidence collected during the fraud examination was turned over to local law enforcement for prosecution.

 

Make fraud prevention recommendations

Any cash-intensive business is vulnerable to o-book fraud schemes (eg bars, restaurants, casinos, convenience stores, movie theatres etc). Few people will steal if they think they will be caught and suer a

Page 5

Buckho and Clifton

To further enhance the perception of detection, employees were informed that the following would be conducted on a surprise basis during the month: (1) undercover surveillance, (2) audits of inventory and cash registers, (3) review of disbursements along with supporting documentation, and (4) fraud assessment interviews with employees.

(5) (6)

(7)

SUMMARY

Businesses are especially vulnerable to fraud at the points where cash enters or leaves the business. Dishonest employees will seek out and exploit weaknesses in internal controls over cash and divert some of that cash ow into their own pockets. Cash intensive businesses can take measures to both detect and prevent fraud schemes involving cash. Despite a lack of direct evidence, o-book fraud schemes such as the skimming prevalent at Northern Exposure can be detected and thwarted through indirect investigative techniques and careful control over the cash ow a business generates. The principles and concepts discussed herein apply to a variety of dierent types of both on-book and o-book fraud schemes. REFERENCES
(1) In this paper cash includes any medium of exchange that a bank will accept at face value, including currency and coins, company cheques, customers' personal cheques, cashier's cheques, money orders, and/or bank drafts. It is not dicult for experienced fraudsters to convert cheques to cash. The names of the victim company, the investigators, perpetrators, and others involved in this case have been changed pursuant to the recommendation of legal counsel. Northern Exposure was the only existing business in the city providing `exotic' entertainment. Because of the club manager's substantial eorts to acquire the

(8)

(9) (10)

exemption, the club's owner considered her to be very loyal and trustworthy. In our initial interview with the owner, he informed us that anyone in the club could be a suspect except for the manager. Four of the six had bartending experience, the remaining two had experience working as servers. It will be recalled from Table 1 that actual food sales were less than the cost of sales. How is this possible? The servers were diverting money collected from food sales into their own pockets. After the examination was concluded and the recommended changes were implemented the sales for the remaining nine months of the year were $300,000 higher than for the same period in the prior year. Larry had a hard time believing the manager was stealing because she was the one who spearheaded the petition to exempt existing businesses from the new city ordinance outlawing `exotic entertainment'. However, rather than being altruistic, her eorts were motivated by a desire to protect the cash ow she was shamelessly diverting into her own pockets. Liquor bottles were weighed both before and after each night's shift. Northern Exposure spent $25,000 on surveillance equipment. That $25,000 was recovered in less than one month through the prevention of skimming. Once installed, employees tested the surveillance to see if anyone really was watching. For example, a female bartender ashed her breasts at the camera to see if she got a reaction. Fortunately, someone was watching who then thanked her for the `free show'. Surveillance equipment is useless in preventing fraud if the employees discover no one is really watching.

Thomas Buckho, PhD, CFE, CPA, Manager/ Senior Forensic Accountant, Eide Bailly, LLP Fraudwise Division, Fargo, ND, USA; TBuckho@fraud-wise.com. James Clifton, M.Acc., CPA, Senior Lecturer of Accounting, Department of Accounting & Information Systems, Minard Hall 403H, North Dakota State University, Fargo, ND, USA; James.Clifton@ndsu.nodak.edu.

(2) (3) (4)

APPENDIX 1 Statement
I, Betsy Smith, make the following free and voluntary statement to Thomas Buckley and Jim O'Connor, certied fraud examiners. I have been advised that I don't have to make a statement and that if I so chose to make a statement, it may not be used against me in any court of law or other legal proceedings unless I refuse to take a polygraph examination that would be requested by Larry Swenson, fail that requested polygraph examination, or any part of this statement is found to be false or inaccurate. No threats, force or promises have been used to obtain this statement. I am freely giving this statement in an eort to demonstrate my complete cooperation in this matter for any consideration it might bring me in the future. For the last eight years, I have been an employee of Northern Exposure and for the last three of those years I have been the general manager for operations. Some of my duties and responsibilities as the general manager include but are not limited to the following: ordering food, liquor and beer; answering the phone; writing checks for accounts payable; cooking for the buet on Fridays; hiring and ring employees; bartending on Mondays; general bookkeeping duties and answering to the owner, Larry Swenson. During 1999 I was given 10% ownership in Northern Exposure by Larry Swenson as a reward for my assistance in getting legislation passed in favor of Northern Exposure.

Page 6

Exotic Embezzling: Investigating O-Book Fraud Schemes

Starting in 1999 and continuing until March 2001 I skimmed an average of $400 per week from Northern Exposure's gross receipts. This was accomplished mostly while I was bartending on Mondays by not ringing up sales from liquor and beer sold to customers. The money either went directly to my tip jar, taken from the cash register after my shift was over or taken from the total night's receipts when I prepared the deposit. I also kept any amount that was `long' for the night's receipts. Sometimes the `long' amount included the skimmed funds that I purposely left in the cash register. After March 2001, I limited my skimming to about $100 per week and towards the end of the year (October/November) I didn't skim any funds. During 2002 I did not take any money from liquor or beer sales but did keep a small amount of money from video sales. Other funds that I kept for myself that were intended for Northern Exposure came in the form of food rebates from Grand Forks Grocery, Hillshire Foods and Excel. Grand Forks Grocery paid rebates twice a year April and September, starting in the fall of 1999. The rebates were usually $200 to $300 in cash each time but I remember one time it was $400 in cash. For the last two years Hillshire Foods paid $800 per year in a check that was made payable to me. The amount from Excel was for potato purchases and the rebates were between $20 and $27. Starting in early 1999 to the present Northern Exposure's average monthly sales from cigarettes, cigars, candy and snacks was $800 to $1,000 of which I kept half for myself. Of the items purchased from Sam's Club, Menards and Fleet Farm, approximately 20% was for my personal use. I did not reimburse Northern Exposure for these amounts. I did not take any other funds belonging to Northern Exposure other than those mentioned. I did not have any agreements with the liquor or beer distributors for kickbacks; there were no false vendors; no ghost employees; there were no checks for personal expenditures unless authorised by Larry Swenson. These expenses would include my auto lease payment, an allowance for vehicle gasoline and some purchases for my personal residence. I am not aware of any other employee who was stealing from Northern Exposure other than those individuals I have personally red. There is no conspiracy between any of the current or recently departed employees and myself to steal from Northern Exposure.

I, Betsy Smith, have read the foregoing statement consisting of two (2) pages, I have initialed each page and all corrections, the statement is true and correct to the best of my knowledge and belief, and I am giving this statement freely and voluntarily, without threats, coercion or promises.

NORTHERN EXPOSURE SUMMARY OF THEFT ADMITTED TO BY BETSY SMITH IN STATEMENT PREPARED BY: THOMAS BUCKLEY, CFE Skimming ($400/week 52 weeks 3.25 years) Skimming ($100/week 30 weeks) Misappropriated rebates: Grand Forks Grocery ($250 4 rebates) Hillshire Foods ($800 2 years) Excel (potato purchases) Money from tobacco and candy sales ($900 36 months 50%) Purchases from 19992002: Sam's Club $37,044.09 Menard's 3,210.36 Fleet Farm 2,176.23 Total Purchases $42,430.68 Total misappropriated purchases ($42,430.68 20%) Total Theft Admitted to by Betsy Smith in Statement $67,600.00 3,000.00 1,000.00 1,600.00 47.00 16,200.00

8,486.14 $97,933.14

APPENDIX 2
I, Thomas Buckley, hereby certify that Plaza Six Ten Liquors, Inc. dba Northern Exposure suered loss through the dishonesty of Betsy Smith employed as general manager of Northern Exposure and that the amount of money, securities or other covered property dishonestly misappropriated, amounts to $97,933.14; herein is a detailed statement of said loss, and all sums due or owing said employee, and all other credits, and the balance stated is the true net loss from January 1999 to March 2002. I further certify that this loss was discovered on March 31, 2002 by Buckley, O'Connor & Associates, LLP and that the manner in which the loss occurred is as follows: During March 2002, our rm conducted a forensic audit and internal control review of Northern Exposure from January1999 through March 2002. Our investigation included an extensive review of books, records, nancial statements, canceled cheques, and bank statements; voluntary interviews of appropriate personnel; undercover surveillance; and a one week oversight (a.k.a. invigilation) of the entire cash-handling and record-keeping process. The results of the undercover surveillance indicated that multiple employees of Northern Exposure were `skimming' cash received from customers. [Skimming is a scheme whereby an employee `pockets' a portion of the cash received from customers which should have been rung into the cash register. Skimming is not authorised by the owner and, accordingly, constitutes employee

Material from the insurance form concerning Betsy Smith

Page 7

Buckho and Clifton

theft.] The objective of an invigilation is to instill the `perception of detection' in the minds of all employees and then observe what happens to cash ows during the invigilation period. The invigilation allows us to estimate the amount of loss due to internal theft. During the invigilation period from March 10 through March 16, 2002, the cash taken in for the week ($30,960) set a record for the most cash ever received in a week at Northern Exposure. The results of the invigilation indicate that multiple employees working for Northern Exposure have skimmed at least 20% of the Gross Sales resulting in a total estimated loss of $871,564 from 1999 through 2002. Betsy Smith, the general manager of Northern Exposure, provided a voluntary statement (see attached Statement) admitting that she had skimmed and/or embezzled $97,933.14. Following Ms. Smith's example, other employees also stole substantial amounts of money ultimately resulting in the $871,564 total loss due to employee theft. I further certify that nothing has been suppressed, withheld or misrepresented by me material to a knowledge of the facts of said loss, and that this statement, including accompanying pages and any attachments, is a complete and truthful recital of the facts. Thomas Buckley, Ph.D., CFE, CPA Sworn to and subscribed before me this 12th day of July 2002. Notary Public My commission expires:

Employee Dishonesty Form (Form FC-345, rev. 2/02) Description of Item(s) Involved in Loss:
The results of our investigation indicate that multiple employees working for Northern Exposure have skimmed at least 20% of the Gross Sales. Losses from this fraudulent activity over the last three years are estimated as follows: Estimated Losses Due to Internal Theft Description Actual Gross Sales As Reported Adjusted Gross Sales (assuming 20% skim) Estimated Losses Due to Employee Theft 1999 $1,166,872 1,458,590 $291,718 2000 $1,111,801 1,389,751 $277,950 2001 $1,207,582 1,509,478 $301,896 Total $3,486,255 4,357,819 $871,564

We believe that Betsy Smith is primarily responsible for the losses due to internal theft as she was the general manager and ultimately responsible for all cash handling and record-keeping. On April 3, 2002, we confronted Ms. Smith in an admission-seeking interview and obtained a signed statement of admission from her (see attached Statement). In the Statement, Ms. Smith admits to stealing an estimated $97,933.14 from Northern Exposure during her tenure as general manager (see Exhibit 2). We believe several other employees following Ms. Smith's example also stole substantial amounts of money ultimately resulting in the $871,564 loss due to internal theft explained above and in Exhibit 1. As a result of our investigation, ten employees including Ms. Smith have either quit or been terminated. The evidence, along with the Statement from Ms. Smith, was turned over to Detective James LeDoux of the Fargo Police Department (Case : 025753) for prosecution. In addition, Northern Exposure has retained our services to develop, implement, maintain, and monitor a system of internal controls that will help prevent future instances of employee theft. Total Loss Amount: Loss due to theft from several employees Admitted to by Betsy Smith Total Loss Amount Less Credits Net Loss Amount $773,631 97,933 $871,564 0 $871,564

There is no other, indemnity or insurance under which the above claim, or any portion thereof, is claimable. I Thomas Buckley, Certied Fraud Examiner hereby certify that the above is a true and correct statement of the loss to Plaza Six Ten Liquors, Inc. dba Northern Exposure.

We unsuccessfully attempted to obtain a copy of Betsy Smith's personnel le. Apparently, such le either never existed or has been removed from Northern Exposure's premises by an unknown person. The evidence collected has been turned over to the Fargo Police Department for prosecution (Case #: 025753). A copy of the letter sent to Detective James LeDoux has been attached to this claim. X The primary target, Betsy Smith, was confronted with evidence collected and did admit to a theft of $97,933.14. A copy of the Statement taken from Betsy Smith has been attached along with Exhibit 2, which summarises the amount of theft admitted to by Ms. Smith. Should you have further questions or require additional documentation to substantiate the loss amount, please feel free to contact me by phone or e-mail.

Other pertinent information signed by Thomas Buckley

Page 8