Recovering Losses From Employee Theft and Embezzlement

By Stephen A. Pedneault, CPA/CFF, CFE, Forensic Accounting Services, LLC

Fraud War Stories

Padding Payroll. The CFO handled all financial aspects of the small company, with little independent oversight at the transactional level. His responsibilities included all facets of payroll; he utilized an outside payroll provider and reviewed charges on the corporate credit cards. Month after month, the CFO recorded transactions, reconciled financial activity, and, on a quarterly basis, was the sole contact with the outside accountant, facilitating financial reports for management and investors.

During a recent trip, the CEO needed to adjust an employee’s compensation and reviewed the company’s payroll reports. Horrified, he noted the CFO’s enormous year-to-date compensation, along with extra paychecks paid to the CFO. The preliminary results of a brief investigation identified nearly $1 million in unauthorized manual checks paid to the CFO, as well as the CFO’s personal use of the company’s credit card. The good news? The company had employee theft insurance coverage to recoup the diverted funds. The bad news? Recovery through the insurance policy was limited to $10,000.

Skimming Cash. After terminating the business manager, the physician and her staff were quite busy covering their additional responsibilities within the practice. One afternoon, after completing a scheduled visit, a returning patient asked the physician about receiving her discount for paying in cash. Confused, the physician told the patient that they didn’t offer discounts for paying cash. The patient revealed that, after prior appointments, the business manager always gave her a discount and collected a cash payment. Stunned, the physician requested the deposit detail images from her bank for the prior twelve months.

She was sickened to learn there had been no cash deposits within the last year. The physician worked with her staff to review patient charts, past appointments, and payment details, only to learn that the business manager, who had worked at the practice for nearly fifteen years, had been skimming cash payments received from patients. After contacting a number of patients, she learned that many of them had paid in cash, yet no cash deposits had been made into the practice’s bank account for the past five years. A lengthy, costly investigation led to a minimum loss of $275,000. The good news? The practice had theft coverage to recover the funds. The bad news? Their recovery will be minimal due to the $25,000 policy limit.

Size of the Problem

The examples above represent just a few of the employee fraud cases that have recently occurred. An online search of the term “embezzlement” results in pages of further stories – and additional employee frauds remain undetected. Individuals are stealing at an alarming rate, and the subsequent losses range from hundreds of thousands to millions of dollars. Over the past 10 years, the frequency of employee fraud has reached epidemic levels, yet only a fraction of these cases ever become public. Most are quietly resolved – for many reasons, but primarily to avoid negative publicity.

Segue to Past Articles – Preventing, Detecting, Investigating

Many articles have addressed employee theft and embezzlement, and detailed the importance of identifying risks and implementing better internal controls. Most articles focus on creating awareness, segregating duties, and preventing (as well as detecting) instances of employee theft and embezzlement. Some articles provide checklists for self-assessment and implementation, while others poll readers on their fraud awareness levels. However, few articles address strategies for recovering losses after a theft or embezzlement.

Recovering Funds 

In too many cases, by the time an organization discovers the theft or embezzlement, the responsible individual has spent or diverted the illicit income, and has little to no means of making meaningful restitution. Good intentions aside, the perpetrator rarely has liquid assets available to make repayment. Since travel and entertainment are common uses of stolen funds, which perpetrators use to support their lavish lifestyles, there are generally no means of recovery in these cases.

In some cases, dishonest employees purchase real estate, luxury automobiles, boats, aircraft, and other big-ticket items, while others invest in stocks, bonds, and other securities, held personally or within established accounts. In one case, an attorney who stole close to $6 million of his client’s funds invested the proceeds in bearer bonds. Purchasing assets seldom occurs in cases involving losses under $100,000.

Any items purchased by the individual are potential sources of recovery, if the assets can be identified and located. Often, fraudsters structure their use of the proceeds in ways that make them difficult to trace, by funneling funds into the accounts of relatives and friends, or by utilizing established businesses and shell companies. The thief’s goal is to retain as much of the money as possible by obstructing the path to its discovery.

When it comes to recovering funds, be skeptical. Even if the perpetrator’s assets are identified, that does not guarantee they will be a reliable source of recovery. Real estate is often encumbered with debt, and vehicles, boats, and aircraft are frequently laden with leases or loan balances, leaving little to no equity for recovery.

Civil Process

In order to establish and maintain privilege over the matter, every investigation should be conducted through counsel, with the attorney directly engaging each team member. Whether the organization utilizes in-house or outside counsel, the attorney must be the point person, establishing privilege and directing strategy. Since legal questions and sensitive issues are common encounters in these cases, having all the work performed directly for counsel is the best strategy for maintaining the client’s privilege over the team members under the attorney work-product doctrine.

Initializing a civil proceeding against the perpetrator and their assets is a common legal strategy once an employee theft or embezzlement has been detected and quantified. In many cases, counsel seeks a pre-judgement remedy (PJR) to freeze the perpetrator’s identified assets. An attorney’s PJR motion can fast-track the matter to a judge, and, if granted, can place a hold on the defendant’s assets until the civil process is completed – which could take years, depending on the court.

Prior to incurring the hefty legal and professional fees that accompany a civil complaint (lawsuit), the victim needs to discuss two key questions with counsel. First, what is the likelihood that the victim will prevail and receive a judgement in the lawsuit? Second (and arguably more important), what is the likelihood that the victim will actually collect on the judgment? If the cost of litigation outweighs the potential benefits, the victim often foregoes filing a suit against the perpetrator.

Criminal Proceedings

If there is sufficient evidence to support the conclusion that a crime has occurred, the victim should consider making a referral to law enforcement. The victim needs to identify the potential crimes that have occurred and discuss with counsel the risks and benefits of involving law enforcement in the matter. In some contexts, a referral to law enforcement is required – for example, under certain insurance policies, the victim must make a referral if he intends to make a claim on the policy.

As part of the strategy discussion with counsel, the victim needs to consider whether the matter will be referred to local or federal agencies. Some contexts dictate the type of agency required, but often, if there are potential state and federal violations, there may be strategies based on the victim’s location. Other referral considerations include: the amount of the loss, the time period in which the loss occurred, and the timing of the discovery of the loss. Statute of limitation restrictions may drive the strategy decisions, both criminally and civilly.

The central issue to remember is that the criminal process does not guarantee restitution to the victim. The main function of law enforcement is to enforce laws and make arrests, not recover stolen funds. In many cases, restitution plays a major role in the sentencing of the individual, but the sentencing does not guarantee that the perpetrator will make full restitution, even if ordered. Additionally, even if the perpetrator wants to make restitution to avoid jail time, he may not have the means to do so.

Parallel Tracks

The good news is that deciding to pursue civil or criminal remedies is not limited to an either/or situation. Actions can be initiated simultaneously – a strategy referred to as “parallel tracks.” In many instances, when a case is referred for criminal consideration, the victim initiates a civil case at the same time. If the victim has no means of recovery, through restitution or through insurance proceeds, the arrest simply provides a consequence to the individual.

Insurance Coverage

Insurance is often the only way a victim organization can recover funds. Apart from civil and criminal proceedings, an insurance claim arguably provides the best avenue for the victim organization to recover losses. However, the amount a victim can recover is limited, and the claim landscape is changing based on the sheer volume of claims.

Firstly, in order to make a claim, the victim must have incurred a quantifiable loss and also possess coverage for that loss. All too often, the victim assumes that coverage exists, only to learn that the perpetrator stopped paying the policy premiums. The insurance policy may also identify specific individuals who are not covered in the event of a theft.

Secondly, a victim organization can only recover losses up to the coverage amount. Time and again, as seen in the earlier examples, the victim maintained coverage, but at a level far less than the amount stolen or embezzled. Organizations must review their coverage amounts for employee theft and embezzlement (and all other risks) to ensure coverage can minimize the impact of a significant loss. Management needs to regularly review the organization’s coverage amounts, and practitioners should remind their clients to annually review and address coverage amounts.

Thirdly, filing an insurance claim does not guarantee that the victim organization will receive the coverage amount. Claims departments and adjusters use outside forensic accountants to review claims, and have recently started expanding their internal capabilities by bringing forensic accountants into their claims department. Often, adjusters want to learn as much as possible about the theft and, most significantly, how it was allowed to occur and remain undetected. The issue of contributory negligence has been raised in recent claims, in an attempt to shift the burden and blame back onto the victim and minimize the claim payment.

Not All Insurance Is the Same

If you are working in industry, review your policies and coverage amounts. If you are in practice, counsel your clients to regularly review their policies. Do not blindly rely on insurance agents, as it is the organization’s responsibility to assess adequacy of coverage. In addition, avoid becoming complacent; do not discover that your organization is under-insured only when it comes time to file a claim.

In addition to coverage for the loss itself, ensure the policy includes a coverage amount for the investigation and compilation of the claim. Often, victim organizations have little or no means of assembling a claim. Coverage that includes compiling a claim can help pay professionals to conduct an investigation to support the claim.

In Summary

When it comes to employee theft and embezzlement, be sure to implement sound controls, detect schemes as soon as possible, and maintain adequate insurance (see the three points of the triangle in Diagram 1). When it comes to recovering funds, consider civil remedies, contemplate involving law enforcement, and file an insurance claim (see the three points of the triangle in Diagram 2).
Above all, never get complacent, and remain vigilant.


Stephen Pedneault ( is the founder/owner of Forensic Accounting Services, LLC (, a fraud and forensic firm located in Glastonbury. He is also an adjunct professor of forensic accounting at the University of Connecticut in the Masters of Science in Accounting (MSA) Program.