Question

Case 3-2 Rite Aid Inventory Surplus Fraud

Occupational fraud comes in many shapes and sizes. The fraud at Rite Aid is one such case. In February 2015, VP Jay Findling pleaded guilty to fraud. VP Timothy Foster pleaded guilty to making false statements to authorities. On November 16, 2016, Foster was sentenced to five years in prison and Findling, four years. Findling and Foster were ordered to jointly pay $8,034,183 in restitution. Findling also forfeited and turned over an additional $11.6 million to the government at the time he entered his guilty plea. In sentencing Foster, U.S. Middle District Judge John E. Jones III expressed his astonishment that in one instance at Rite-Aid headquarters, Foster took a multimillion dollar cash pay-off from Findling, then stuffed the money into a bag and flew home on Rite Aid’s corporate jet.¹

The charges relate to a nine-year conspiracy to defraud Rite Aid by lying to the company about the sale of surplus inventory to a company owned by Findling when it was sold to third parties for greater amounts. Findling would then kick back a portion of his profits to Foster. Foster’s lawyer told Justice Jones that, even though they conned the company, the efforts of Foster and Findling still earned Rite Aid over $100 million “instead of having warehouses filled with unwanted merchandise.” Assistant U.S. Attorney Kim Daniel focused on the abuse of trust by Foster and persistent lies to the feds. “The con didn’t affect some faceless corporation, Daniel said, “but harmed Rite Aid’s 89,000 employees and its stockholders.” Findling’s attorney, Kevin Buchan, characterized his client as “a good man who made a bad decision.” “He succumbed to the pressure. That’s why he did what he did and that’s why he’s here,” Buchan said during sentencing.

Findling admitted he established a bank account under the name “Rite Aid Salvage Liquidation” and used it to collect the payments from the real buyers of the surplus Rite Aid inventory. After the payments were received, Findling would send lesser amounts dictated by Foster to Rite Aid for the goods, thus inducing Rite Aid to believe the inventory had been purchased by J. Finn Industries, not the real buyers. The government alleged Findling received at least $127.7 million from the real buyers of the surplus inventory but, with Foster’s help, only provided $98.6 million of that amount to Rite Aid, leaving Findling approximately $29.1 million in profits from the scheme. The government also alleged that Findling kicked back approximately $5.7 million of the $29.1 million to Foster.

Assume you are the director of internal auditing at Rite Aid and discover the surplus inventory scheme. You know that Rite Aid has a comprehensive corporate governance system that complies with the requirements of Sarbanes-Oxley, and the company has a strong ethics foundation. Moreover, the internal controls are consistent with the COSO framework. Explain the steps you would take to determine whether you would blow the whistle on the scheme applying the requirements of AICPA Interpretation 102-4 that are depicted in Exhibit 3.11. In that regard, answer the following questions.

Questions

1. Explain the following concepts in the context of the case and how it relates to individual and organizational factors that contribute to fraud:

   • Rationalizations for unethical actions.

   • Stakeholder effects.

   • Ethical dissonance.

   • Sometimes good people do bad things.

2. Assume you are the director of internal auditing and have uncovered the fraud. What would you do and why?

3. Assume, instead, that you are the audit engagement partner of KPMG and are the first to uncover the fraud. You approach management of the firm and discuss making the necessary adjustments. Top management tells you not to press the issue because the firm doesn’t want to rock the boat with one of its biggest clients. What would you do and why?

Answer 1

1.

Rationalizations for unethical acts typically fall into one or more of the following categories: Loyalty to boss or company – it is in the best interest of the company or your boss; Expected or accepted Standard of Practice – everyone does it; Materiality – it does not really hurt anyone; Responsibility – its not your job don’t worry about it; and, it’s a one time thing.

As the director of internal audit, upon reporting the matter you might be told that the firm is choosing not to do anything about the matter because publicly disclosing the matter would embarrass the firm and negatively impact the share price: that such disclosure would harm the shareholders and other stakeholders of the firm. You might be told that while unethical, Rite Aid still made a profit on the items when they were sold and you should consider the money going to Findling and Foster as another form of compensation. They could argue that without the intervention of Findling and Foster that the Rite Aid might still be sitting on devaluing inventory. You might be thanked for the report and told to go back to work, that your responsibility ended with delivery of the report. These are all possible rationalizations you might hear for the firm not taking corrective action. You need to think about how you might respond to each of these rationalizations.

An individuals own values and beliefs are often challenged in an organizational environment. Research has shown that organizational factors often are given more weight than individual values in ethical decision making. This can lead to very poor decisions being made. People have a tendency to bow to authority and group/peer pressure suborning their values in the process leading to good people doing the bad things. It is important to consider the ethical culture of the entire organization you work in and whether or not your individual ethics are potentially in conflict with those of the organization.

According to Buchard’s Ethical Dissonance Model, ethical dissonance refers to a conflict between individual and organizational ethics: what is ethical may not be in the best interest of the company. In the case of Rite Aid, the director of internal audit needs to be aware that their integrity may be challenged in their attempt to do the right thing. The case indicates that Rite Aid has a strong ethical foundation. This is encouraging and can make the internal manager’s job a little easier to stand up for doing what is ethically correct.

2.

First, as Director of Internal Audit it is your responsibility to gather all the evidence and thoroughly document the facts. You should prepare a memo or report explaining how the inventory scheme does not comply with the professional standards and how it is creating a material misrepresentation of fact. You should then take your concerns to your supervisor, possibly the Audit Committee of the Board of Directors, the CEO, or general legal counsel for the firm (Dependent upon your positions reporting structure – who you report to can vary by firm).

As the concerns are discussed with the supervisor, you should ask that an adjustment be made to resolve the misrepresentation. If no adjustment is made, then you should take your concerns to a higher level (e.g., CEO, Audit Committee, or the Board of Directors). As a CPA you are required to continue up the reporting chain, up to and including the Audit Committee until the matter is resolved per Section 2.130.020 of the American Institute of Public Accountants (AICPA) code of professional conduct: Integrity and Objectivity - Subordination of Judgment by a Member in Business. This section “prohibits a member from knowingly misrepresenting facts or subordinating his or her judgment”.

After all internal channels are exhausted, you should ask yourself whether there is any responsibility or obligation to communicate with third parties like regulatory agencies or your employer’s external auditors, all the while seeking legal advice. You should document your understanding of the facts, accounting principles, auditing standards, and applicable laws and regulations.

If no safeguards exist to eliminate or reduce the threats to an acceptable level or appropriate action was not taken, then you should consider continuing with the firm, taking appropriate action to eliminate exposure to subordination of judgment, and consider resigning from your position. Resigning does not necessarily negate disclosure requirements to regulatory agencies or the external auditors. As Director of Internal Audit, you should consider whether the matter qualifies as a whistle-blowing matter under the Dodd-Frank Act.

Internal accountants are eligible to become Dodd-Frank whistleblowers in three situations: (1) Disclosure to the SEC is needed to prevent “substantial injury” to the financial interest of an entity or its investors; (2) the whistleblower “reasonably believes” the entity is impeding investigation of the misconduct (e.g., destroying documents or improperly influencing witnesses); or (3) the whistleblower has first reported the violation internally and at least 120 days have passed with no action.

3.

The Audit engagement partner has a professional and legal obligation to report the fraud to the SEC under certain circumstances. Assuming the partner reports this matter to the client’s audit committee and they take no action then the partner will have to report the matter to the SEC and/or resign the engagement and report the matter to the SEC. If upon notification, the client does not agree to report the matter serious consideration should be given to both resigning the engagement and reporting the matter. Auditors rely a great deal on the representations of management, the refusal to correct and or report a matter as serious as fraud brings the auditors ability to trust the representations of management into question.
Section 10A of the Securities Exchange Act sets out prescribed steps to take before deciding whether to inform the SEC of fraud.
1. Determine whether the violations have a material effect, quantitatively or qualitatively, on the financial statements.
2. If yes, has management, or the board of directors, caused management to take remedial action, including reporting externally if necessary?
3. If no, then the auditor must make a formal report of its conclusions and provide the report to the board. The board then has one business day to inform the SEC and provide a copy of the communication to the external auditor. If the auditing firm does not receive a copy within one business day, then it has two choices:
a. Provide a copy of its own report to the SEC within one business day, or
b. Resign from the engagement and provide a copy of the report to the SEC within one business day of resigning.