Help to track embezzlement

Hello everyone.  First post and I'm hoping that someone can help me.  My bookkeeper seems to have been embezzling from me.  Part of the claim is that work was being done from home on weekends.  Is there any way that someone can think of to track activity on Simply to prove or disprove that?

Thanks in advance!

  • 0

    Hi Catch-22,

    Since it looks like you are looking for a way to track activity specifically on Sage 50 CA (formerly Simply Accounting), I'm going to move this post to that Support Group so that other users of this program will see your question and be able to offer their thoughts and insight.

    Thanks,

    Derek

  • 0

    HI Catch-22,

    The best that Sage 50 can do is to track who makes the entry in the system by going to Reports, Transactions Details (or Journal Entries), All and put a check mark to User.  However, there is no feature in the software that can tell when the software is started, ended and how long it is being used.  Also, it does not have information about when an entry is entered into the system. 

    In your case, you may have to look for a 3rd party software usage tracking & reporting tool through Google.

    https://www.google.ca/#q=track+software+usage

  • 0

    There is definately a way to track activity, but not through Simply.  It would help if you know how they were accessing the work computer from home (but not necessary).  You need someone with in-depth knowledge to look for the various log files and interpret them (not a professional, just someone really computer saavy that can guide you).  

  • 0

    The working from home, if it didn't happen, is more fraud than embezzlement.  

    Every change that is stored in the database is date and time-stamped.  Some changes are over-written, but all transactions are stored permanently.

    The purpose of thse date (dtASDate) / time (tmASTime) stamps is likely to keep the data consistent in a multi-user system.  For instance, I used a negative item assembly to break out parts from a kit, at 2014-04-04 09:22.

    There are also timestamps in the database log file (errorlog.txt in the .SAJ data folder)

  • 0 in reply to RandyW

    Thanks everyone.  

    RandyW,

    I've opened Simply Accounting before and that is about my experience level.  Is there a cookbook answer I could follow to get to that material?  I have a book keeper coming in on Monday but the aggravation of the situation has me wanting to figure it out sooner if possible.  

  • 0 in reply to Catch-22

    One possibility is to track the journal entries. At end of day note the last JE nbr. Then next time after bookkeeper has done work on it pull up the journal entries and see what the last JE nbr is. Note the transactions that were made in between the 2 JE nbrs to determine the kind of transactions that were made. Keep this up for a period of time to see if there is any inconsistencies in the nbr and kind of transactions made along with the hours charged for doing the entries.

    Also ask bookkeeper what was accomplished that day or to start writing down a detailed description of what was done that day. If the bookkeeper is overcharging then that will likely put a damper on that.

    If you see bank interest charges as part of the journal numbers then likely there will be just a few transactions with majority of time used to just tick off all the outstanding bank transactions to reconcile to bank stmt. That can take some time. If a lot of vendor invoices and you are not tracking which job it goes to then that can be done in a relatively short period of time. I think after tracking the JEs you might be able to get a feeling of how much time some transactions take over other transactions.

  • 0

    There are a number of issues here.  You can see journal entry posting times.  Depending on how someone is logging in remotely the remote service may have time stamps.  That would actually be your best bet.  

    However, it will not tell you about off line work on spreadsheets or reports.  That is just because your bookkeeper isn't on line doesn't mean the bookkeeper isn't doing work for you.    

    This would have nothing to do with embezzlement.  That is stealing money from you.  What you are suggesting is that your bookkeeper is padding his time.  If you don't have a policy that any remote work has to be done on line with your machine I don't see how you could prove that.,  

    Here is an example for you to think about.  Your bookkeeper find several  electronic payments to Nigerian Fraud Company.  The bookkeeper  decides to google that company as he suspects something is not quite right.  The bookkeeper closes down the connection with your system while doing this.   It takes the bookkeeper an hour to determine that this is the new name for your favorite widget supplier.  Presumably nothing is wrong and these are good transactions.  

    Your real issue here is one of trust and comfort.  Do you trust the bookkeeper?  Is the reduction in control worth what ever savings you are getting by allowing work from home?

  • 0 in reply to sbtbill

    So far RandyW's method seems to give the information I need.   So thank you! I'm going to look into matters a bit more using that information.

    sbtbill,  I'm looking at more than an hour here and there.  I'm looking at a whole day of claimed work per week over months.  I've gotten an admission of sorts with certain dates already and am looking to the size of the amount..

  • 0 in reply to Catch-22

    Sounds like you know what is going on.  Then the only decision is new bookkeeper or watch the other one closer.  I suspect you need a new bookkeeper.  A day a week is a lot of padding.  That said I don't think you have much chance of recovery or prosecution.  

  • 0 in reply to sbtbill

    sbtbill,

    What do you think would hinder recovery?

  • 0 in reply to Catch-22

    I just can't see this as embezzlement.   You'd have to go to court and say you overpaid him because he padded his hours.  I don't think you could get DA help with that.  Never heard of anyone doing it.  It strikes me like trying to go after someone for a held or post dated check.  That becomes a civil mater and not a criminal mater because it becomes a promissory note and not a check.  That means lawyer fees and then you have to figure out how to collect.  

  • 0 in reply to Catch-22

    This is one way, to access data through an ODBC connection:

    *** Disclaimer ***  

    Do NOT change or add any data in any table, unless you are certain of what you are doing.  

    It's best that you use a login ID with 'read-only' rights to third-party products.

    0.  Open a copy of the company file, in multi-user mode.

    1.  Locate, Download, and Install LibreOffice.

    2.  Open LibreOffice BASE.

    3.  In the Database Wizard, select 'Connect to an existing database'.  Choose ODBC from the drop-down list.

    4.  Click 'Next', and then click 'Browse'

    5.  In the 'Data Source' window, you will have a list of all the 'company files' that have been opened.  There are three ODBC connections for each company filename you've ever opened.   Choose the 'Sage 50:' one, and click 'Next'.

    6.  Type in the user name that has at least 'third party, read-only' access, and check off the 'Password Required' checkbox.  click 'Test Connection'  If it's OK, click 'Next'.

    7.  Click on 'No, do not register the database', leave the checkbox in 'Open the database for editing, and leave unchecked 'Create tables using the table wizard.

    8.  Click 'Finish'

    You can now open any table and read the 'raw' data.   That's going to be the beginning of your journey, since there are 469 tables.  You can't open any of the ones that start with 'P' or 'simply' or tVerlog, but it's still over 450 tables.  

    Probably the easiest table to sort of figure out dates and times of actual entries, would be the table titled 'TiTREC.   (Table, Inventory Tracking RECords)   This will have invoice (both sales and purchase) entries in sSource1, the journal entry number in LJourID, the journal date in dtJournal, the 'Using' date in dtUsing, the logged in user in sASUserID, and the system date / time in tmASTime and sASUserid.

    All that being said, actually nailing someone for wasting your time and money, is itself likely to be a waste of time and money.  

    If you're dealing with a contractor for data entry, you may be able to negotiate for specific, measurable metrics such as number of invoices / number of detail lines, number of journal entries (excluding corrections), etc.

    Keep in mind that records may be 'stamped' by the last person who modified them, not necessarily the person who created them.   So if an invoice is adjusted after entry, it's data could be 'stamped' by the adjustment, and the original date / time of entry will be overwritten.

    I hope that helps,

    Randy

    *** more disclaimer ***

    I can't, and don't speak to whether the database data has any value as evidence, or proves any particular fact.

  • 0 in reply to RandyW

    Thanks Randy.  I'm not sure how this will play out.  This person was an office manager with the duty of bookkeeping.  Bills were not paid for supplies to keep the hours padded. The accountant wasn't given complete information.  There is more going on than just padding of book keeping hours. This person was the only one accessing the Sage program.  We had worked together for over 15 years.  :(

  • 0 in reply to Catch-22

    How accurate is the .SAJ file alone?  I am not finding any instances on any weekends except for one weekend that happened to match security entry logs.