EXPERIENTIAL METHODS FOR IDENTIFYING AND REDUCING POINT OF SALE RETAIL FRAUD

Abstract

This paper is aimed at management, accountants, auditors and loss prevention officers responsible for assuring the existence and effectiveness of internal controls to minimise fraud in retail business environments. Retail is defined to include the wide array of retailers serving consumers across shopping malls and on the high street as well as organisations that have retail operations supporting their main non-retail business activities, such as book stores in universities and souvenir shops in museums. Whether cash or cashless, retail point-of-sale (POS) transactions present multiple fraud opportunities despite the existence of internal controls. Based on experiential observations at clients in the UK, US and Australia, approximately 3% of staff entrusted to process customer payments at the POS create inventive ways to steal cash, credit card data and stock during routine POS till operation. Anonymised fraud schemes from real client situations are provided in this short paper. To help combat these kinds of fraud, POS systems have inbuilt transaction summaries and audit trails useful to management, loss prevention officers and auditors. But these inbuilt system controls are insufficient on their own and therefore must be augmented by human behavioural controls such as policies, management procedures and CCTV. This paper summarises how an array of controls can work together to reduce, if not entirely eliminate, potential fraud scenarios by POS operators.

Notes

1. The competitive pressure on brick and mortar retailers from online retailers is widely reported in the press. One example: https://www.floship.com/amazon-killing-traditional-retail/.

2. Three percent is an approximation based on Kelly & Yang’s observations over several years of client work across different geographies.

3. The POS system processes and terminology as described in this article have been observed by us as consistent across different retail client systems.

4. 0.2% is based on a $10 difference from $5,000 average daily takings from a single POS till. In most cases, differences should be smaller than this. But differences more than 0.2% should concern management.

5. Payment card industry data security standards are promulgated by the PCI Security Standards Council https://www.pcisecuritystandards.org/.

6. Stock keeping unit (SKU) or sometimes inventory product number (IPN) is the unique code assigned by an organisation to each product in its catalogue. These are developed in-house for inventory management purposes and are therefore non-standard from retailer to retailer.

7. The technique of pocketing surplus cash after X-reads was recently reported in the Daily Telegraph (Sydney, Australia) “Manager stole $50k from bar” (19 April 2019, page 8).

Additional information

Notes on contributors

Christopher Kelly

Christopher Kelly After 11 years as a tax consultant and auditor with Ernst & Young in the UK and Middle East, Chris switched into industry as head of internal audit for several UK and Australian companies. While in industry he pioneered audit and risk management techniques utilizing mathematical data analytics resulting in numerous fraud discoveries, material treasury savings and process efficiencies. Since the 1990s Chris progressively disseminated the intellectual property arising from these achievements in US and UK professional journals and went on to do a finance doctorate at Middlesex University in London, UK. This career-long build-up of experience and intellectual property allowed him to found Kelly & Yang which today provides risk management, internal audit and data analytics services to corporate and government clients.