Preventing and Detecting Cash Larceny

Why This Topic Matters

Cash larceny is a core topic within the Financial Transactions and Fraud Schemes section of the ACFE Certified Fraud Examiner (CFE) exam, specifically under Asset Misappropriation: Cash Receipts. The ACFE Report to the Nations consistently shows that asset misappropriation is the most common category of occupational fraud (occurring in roughly 86-89% of cases), and cash is the asset most frequently targeted. Although cash larceny is less common than skimming, it is important because it is detectable through the accounting records, which means a well-designed control environment can catch it. Exam questions test whether you understand the distinction between larceny and skimming, the specific larceny schemes, the controls that prevent them, and the audit and analytical procedures that detect them.

What Is Cash Larceny?

Cash larceny is the intentional taking of an employer's cash after it has been recorded in the organization's accounting system. This is the single most important definitional point: cash larceny is an on-book scheme. Because the cash was already recorded, its disappearance leaves an imbalance between the records and the actual cash on hand. Contrast this with skimming, which is an off-book scheme where cash is stolen before it is recorded, leaving no direct audit trail.

Memory aid: Larceny is Later; Skimming is Sooner. If the theft occurs after the sale is rung up or the receipt is entered, it is larceny. If it occurs before any entry is made, it is skimming.

Common Cash Larceny Schemes

The ACFE Fraud Examiners Manual groups cash larceny into three primary areas:

1. Larceny at the Point of Sale
The employee simply removes cash from the register or cash drawer after sales have been recorded. Because the register tape records the sales, the drawer will be short. Common methods include:
• Taking cash and hoping the shortage is overlooked or attributed to error.
• Blaming the shortage on another employee who shares the register (a reason shared drawers are a control weakness).
• Reversing transactions: processing false voids or refunds to make the register total match the cash remaining after theft. (Note: when false refunds or voids are used to take cash, the ACFE classifies this under fraudulent disbursements/register disbursements, but when used to conceal larceny, it is a concealment technique.)
• Altering register tapes or cash counts to hide shortages.
• Destroying records so the shortage cannot be traced.

2. Larceny of Receivables (Incoming Payments)
The employee steals customer payments after they have been posted to the customer's account. Concealment methods include:
• Force balancing: the employee posts the payment to the customer's account but does not deposit the cash, then makes an unsupported journal entry (often to a suspense or miscellaneous account) to force the cash account to agree with the records.
• Reversing entries: posting the payment, stealing the cash, then reversing the credit with a fictitious discount, write-off, or adjustment.
• Destroying records so that the payment trail disappears.

3. Larceny from the Deposit
The employee who takes the deposit to the bank removes cash before it is deposited. Red flags and techniques include:
• Deposit lapping: stealing from today's deposit and covering it with part of a later deposit, requiring continuous concealment.
• Deposits in transit: recording a deposit that never actually reaches the bank, then carrying it as "in transit" on the bank reconciliation month after month.
• Altering the deposit slip so the bank copy shows less than the book copy, or so a check-only deposit replaces a cash-and-check deposit.

How Prevention Works

Prevention centers on segregation of duties and controls over physical access. Key preventive measures:

• Segregate the functions of receiving cash, recording cash, depositing cash, and reconciling the bank statement. No single person should perform more than one of these.
• Assign individual cash drawers so that each employee is accountable for his or her own register; shared drawers obscure responsibility.
• Require independent cash counts at shift changes, performed or observed by a supervisor.
• Restrict access to cash registers, safes, and deposit bags; use locks and limit keys or codes.
• Prepare deposits promptly and deposit daily, ideally with two people involved (one prepares, another delivers or verifies).
• Reconcile bank statements independently by someone who does not handle cash or post receipts.
• Require supervisory approval for voids, refunds, and adjustments to customer accounts, with supporting documentation.
• Rotate duties and mandate vacations for employees in cash-handling roles; many lapping and force-balancing schemes collapse when the perpetrator is absent.
• Surprise cash counts to deter employees who rely on predictable audits.
• Use lockbox services so customer payments bypass employees entirely.
• Maintain physical security such as cameras over registers and limited after-hours access.

How Detection Works

Because larceny is on-book, detection relies on comparing records to actual cash and reviewing the reconciliation and journal entry process. Key detection procedures:

• Cash register analysis: compare register tapes to cash counted; investigate shortages by employee, shift, and register. Review patterns of voids, refunds, and no-sale transactions by employee.
• Review the deposit process: compare the authenticated (bank-stamped) deposit slip to the cash receipts journal and to the original receipt listing. Verify that total receipts for the day equal the deposit. Compare the composition of the deposit (cash vs. checks) to what was recorded.
• Bank reconciliation review: scrutinize deposits in transit that remain outstanding for more than one or two business days; investigate recurring or stale reconciling items.
• Journal entry review: look for unexplained adjustments to cash, suspense accounts, miscellaneous expense, or accounts receivable, especially entries without supporting documentation or made by someone with cash access.
• Customer account analysis: investigate customer complaints about payments not credited, unusual write-offs, discounts, or credits applied without authorization, and aging schedules that worsen without explanation.
• Analytical review: track the relationship of cash deposits to sales; a declining cash-to-total-receipts ratio while sales remain stable is a red flag. Compare current period deposits to prior periods and to budgets.
• Surprise counts and observation of the cash collection and deposit process.
• Tips and hotlines: as with all fraud, tips remain the single most common detection method per the Report to the Nations.

Red Flags of Cash Larceny

• Frequent or unexplained cash shortages or overages.
• Employees who refuse to take vacations or allow others to perform their duties.
• Deposits in transit that persist across reconciliations.
• Alterations or white-out on deposit slips or register tapes.
• Journal entries to cash made by employees who handle cash.
• Customer complaints about unposted payments.
• A sudden increase in write-offs, discounts, or adjustments to receivables.
• Employees living beyond their means or exhibiting other behavioral red flags.

Exam Tips: Answering Questions on Preventing and Detecting Cash Larceny

1. Nail the on-book vs. off-book distinction. The exam frequently presents a scenario and asks you to classify it. If the cash was recorded before being taken, it is larceny. If it was taken before being recorded, it is skimming. Read the scenario for words like "after ringing up the sale," "posted to the customer's account," or "recorded in the receipts journal" — these signal larceny.

2. Know the three locations. Expect questions to ask where cash larceny most commonly occurs or to describe a scheme and ask which type it is: point of sale, receivables, or deposit. Memorize the signature concealment technique for each: register reversals at point of sale, force balancing for receivables, and deposits in transit or deposit lapping for deposits.

3. When asked for the BEST control, choose segregation of duties. If an answer choice separates receiving, recording, depositing, and reconciling, it is almost always the correct preventive control. Other strong answers are independent bank reconciliation, individual cash drawers, and mandatory vacations.

4. Distinguish prevention from detection. Questions often ask specifically for a detective procedure. Segregation of duties and access restrictions are preventive; comparing deposit slips to receipts journals, reviewing deposits in transit, surprise cash counts, and analyzing shortage patterns are detective. Pick the answer that matches what the question asks.

5. Watch for force balancing questions. The exam likes to describe an employee who posts a payment, steals the cash, and makes an unsupported entry to make the books agree. Recognize this as force balancing, a receivables larceny concealment technique, and know that the detection method is review of journal entries, especially to suspense or miscellaneous accounts.

6. Understand deposit controls in detail. Know that the person preparing the deposit should not be the person who records receipts or reconciles the bank account, that the authenticated deposit slip should be matched to the receipts record, and that a persistent deposit in transit is a classic red flag. If a question asks about deposit lapping, remember it requires ongoing concealment and often unravels when the employee is absent.

7. Remember why larceny is riskier for the fraudster. Questions may ask why skimming is more common than larceny. The answer is that larceny leaves an audit trail because the cash was recorded, making it easier to detect; skimming leaves no direct evidence. Conversely, this is why larceny is more easily detected through standard reconciliation procedures.

8. Do not confuse concealment reversals with register disbursement schemes. If an employee processes a false refund to take cash out, the ACFE classifies it as a fraudulent disbursement (register disbursement). If an employee has already stolen cash and processes a void to hide the shortage, that is concealment of larceny. Read the question carefully for the purpose of the transaction.

9. Eliminate answers using the "who has access" test. Any control answer that allows a cash handler to also record, adjust, or reconcile cash is a weak control and is unlikely to be the correct answer.

10. Trust the Fraud Examiners Manual's terminology. The CFE exam uses specific ACFE language. Use terms like "larceny," "force balancing," "deposit lapping," "deposits in transit," and "segregation of duties" exactly as the manual does, and favor answer choices that use this terminology precisely.

Summary

Cash larceny is the theft of recorded cash, occurring at the point of sale, from incoming receivables, or from the bank deposit. Because it is on-book, it creates a mismatch between records and cash that well-designed controls can catch. Prevention rests on segregation of duties, individual accountability, restricted access, and independent reconciliation. Detection relies on comparing deposits to receipts records, scrutinizing deposits in transit and journal entries, analyzing shortage and void patterns, and conducting surprise counts. For the CFE exam, master the larceny-versus-skimming distinction, the three scheme locations with their signature concealment methods, and the difference between preventive and detective controls, and you will be well prepared for this topic.