As Placentia city leaders reckon with the arrest of a high-level finance manager on charges that he embezzled $4.3 million from city coffers through a series of wire transfers spanning a year, they are struggling to come to terms with how such a thing could happen on their watch.
Ongoing investigations by the city and the Orange County District Attorney’s office should ultimately provide a detailed answer to that question. But early indications are that the city lacked a strong system of checks that could have stopped large amounts of money from being fraudulently wired out of city accounts, according to local finance and auditing experts.
Known in auditing parlance as “internal controls,” they’re key to preventing fraud at any organization. And chief among them are measures to ensure multiple officials are needed to approve wire transfers and independently reconcile them in the city’s ledgers – no one person should have total control over wire transfers and bank statements.
The accused – 34-year-old Michael M. Nguyen – was able to be both the “initiator and approver of wire transfers,” City Administrator Damien Arrula wrote in an email to Voice of OC. Then, to cover up the fraud, he doctored the city’s bank statements, Arrula said.
Other council members confirmed that the city either didn’t have any segregation of duties in place, or Nguyen was able to circumvent the minimal segregation that did exist.
Eric Woolery, Orange County’s elected auditor controller, said such a system makes Nguyen “judge, jury and executioner…that’s not a good system.”
Arrula contends that the city did in fact have a system of “dual controls” in place – multiple employees were required to “complete a wire transfer” – but that Nguyen used his insider knowledge to manipulate the system to become the initiator and approver of wire transfers.
Still, the fact that Nguyen could sign off on wire transfers and then alter financial statements to hide them before other officials could notice indicates a lack of adequate segregation, Woolery said.
“The person writing the check shouldn’t keep the books,” he said.
How exactly Nguyen became the “initiator and approver” of wire transfers is unclear. Arrula said investigations of the situation remain ongoing and declined to go into specifics.
Contradicting Arrula’s claims, Mayor Jeremy Yamaguchi said the city did not have dual controls in place, and that going forward at least two independent approvals will be required for wire transfers. He compared it to the multiple sign offs required under the nation’s “nuclear launch codes.”
Gerry Riss, a general auditor who has worked with public agencies in Southern California, said internal employees are more easily able to perpetrate fraud because they have a sophisticated understanding of their organization’s controls.
This can happen in a number of ways. For one, someone who has earned the trust of their colleagues – such as Nguyen, who was reportedly a rising star in the finance department – can circumvent the usual controls because other workers view them as inconvenient and not worth the effort.
Another way, according to Riss, is that the fraudster knows the system so well he can skirt internal controls at key moments. For example, say a financial system or a check is due at 3 p.m., the fraudster can try to get it through at 2:57 p.m. – and his colleagues might just feel rushed enough to skip the extra sign off.
“Employees know the system best, have a lot more information, and therefore they’re the biggest group for fraud,” Riss said.
While Arrula didn’t specify how Nguyen circumvented the city’s internal controls, he denied that any other city employees were involved.
Councilman Scott Nelson was astounded at how $4.3 million could have disappeared without anyone noticing.
According to a news release from the Orange County District Attorney’s office, Placentia officials discovered unauthorized wire transfers and reported them to authorities. But other sources close to the situation say the city was actually notified by the IRS after a suspicious wire transfer to someone at a Las Vegas casino.
Nelson placed blame for the fraud at the feet of elected City Treasurer Kevin Larson and other council members who are former elected city treasurers – including council members Chad Wanke and Craig Green. Placentia is one of only five cities in the county to elect their city treasurer.
“I don’t see how you miss that much money out of this small of a budget,” Nelson said. “The disappointment I have here is unbelievable.”
Green didn’t return a reporter’s phone call for comment, and Larson couldn’t be reached for comment.
But Wanke disputed Nelson’s comments, saying his colleague doesn’t understand the role of the treasurer in municipal affairs and is using the embezzlement case for his own political ends. The city treasurer, who is a part-timer and not involved in day-to-day operations, prepares financial statements, but depends on the accuracy of information provided by city staff, Wanke said.
Wanke pointed out that Bank of America (where the city keeps its accounts), two outside audits and city staff all missed the embezzlement. If the city didn’t have proper segregation of duties, that’s something the auditors should have caught but didn’t, Wanke said, adding that the city finances aren’t conducted under “fly-by-night operations.”
Going forward, the city has already further segregated the duties around financial transactions, Arrula said.
“There will be a new 2-stage password encrypted process for future wire transfers, which will require multiple signatures, including one by an elected official (city treasurer) to avoid internal manipulation by anyone,” Arrula wrote in his email. “In addition, instead of one employee receiving bank statements, two employees will receive them in real time and each employee will receive hardcopies.
“This new system will prevent manipulation and create redundancy of the bank statements as each employee will now have their own independent version from the bank.”
The city has also hired a forensic auditor to make recommendations on how the city can implement more internal controls, Arrula said. And he said a presentation at Tuesday night’s City Council meeting will elaborate more on the situation.
Correction: A previous version of this story misspelled Councilman Chad Wanke’s last name. We regret the error.