Vonya Global

Here we go again. Another significant case is making headlines, this time involving a CFO who admitted to stealing more than $4.2 million from his employer over an eight-year period.

The theft allegedly involved:
• Unauthorized use of company fuel and fleet cards
• Issuing checks to himself from company accounts
• Use of the owner's personal information on fraudulent financial documents
• Creation of false ledgers and financial reports that were provided to the company's accounting firm

For boards and audit committees, this case highlights a critical governance lesson:

When a senior finance executive can both execute transactions and manipulate the accounting records used to report those transactions, the organization's control environment is at significant risk.

Based on the facts reported, several questions deserve attention:

1. Who reviews activity on company fuel and fleet cards?
Unauthorized transactions continued for years, suggesting monitoring and exception reporting may not have been effective.

2. What controls exist over payments to executives and finance personnel?
The ability to issue unauthorized checks to oneself points to potential weaknesses in disbursement approvals and independent review processes.

3. How are accounting records validated?
According to the article, false ledgers and financial reports were provided to the company's accounting firm, which then issued financial statements based on that information. Boards should ask what independent procedures exist to verify the completeness and accuracy of information provided by management.

4. Is there sufficient oversight of senior finance leadership?
Many organizations focus controls on operational employees while assuming finance executives are part of the control structure. Cases like this remind us that fraud risk can also originate from those responsible for financial oversight.

The governance takeaway is straightforward: Segregation of duties is not enough if a single executive can both initiate transactions and control the records used to explain them.

Boards should ensure that critical financial activities are subject to independent review, verification, and monitoring; especially when those activities involve senior members of the finance organization.

4 Million Dollars!!! Former CFO admits to stealing $4M from Albany electrical firm Facing up to 12 years in prison

Priest “Father Short Story” exploits deficient internal controls to embezzle from his faithful parishioners.

I did a bit more investigating this case, and found the church doesn’t employ a Treasurer, but they do have a Business Manager. And it has been the same Business Manager, who partly functions as a Treasurer, for the past 11 years. The Business Manager was not mentioned in the article, but she certainly bears some responsibility for not fulfilling her fiduciary duties.

Check out the article and determine for yourself. Here are 3 internal control areas where I think they failed:
1. Lack of independent review of credit card activity
Large personal expenditures, international travel, retail purchases, and cash withdrawals should have been identified through routine transaction reviews and supporting documentation requirements.
2. Weak documentation and expense accountability
Reports indicate that many expenditures lacked supporting records, making it difficult to determine whether charges were legitimate. Missing documentation should be treated as a control exception, not an administrative inconvenience.
3. Excessive authority concentrated in a trusted individual
Many long-term fraud schemes occur when organizations rely on trust rather than oversight. Strong governance requires independent review regardless of position, tenure, or reputation.

This serves as another lesson in “Could this happen to us?”

Trust is important. Verification is essential.

Priest allegedly embezzled $160K from church for cruises, casino Priest "Father Short Story" busted

Jesse Laseman was featured in Internal Auditor, sharing insights on how currency risk is increasingly impacting organizations. The article explores the role internal audit can play by integrating foreign exchange risk into existing audit activities such as improving visibility, strengthening controls and helping organizations better manage transactions, translation and economic risk.

Check it out!

Managing Currency Risk - Jesse Laseman featured in Internal Auditor Magazine IA Magazine Managing Currency Risk

Hey retailers, here is an upcoming webinar you may be interested in. Merchants across industries face ongoing challenges with PCI DSS compliance due to complex payment environments, multiple payment channels and reliance on third‑party service providers. Confusion around SAQs, qualifying criteria and shared responsibility often leads to misunderstood scope and misplaced compliance efforts.

This webinar will help cut through the noise by breaking down what “scope reduction” really means, and when it does (and does not) apply.

FREE WEBINAR June 16 : Cut the scope, not the corners: Merchant-friendly PCI DSS scope reduction PCI DSS Scope Reduction Webinar

Relief for some? Maybe, but definitely not all.

While the SEC has begun the process of rescinding its climate disclosure rule, California says "Hey SEC, Hold my beer!"

The SEC's decision signals a significant shift in the U.S. regulatory landscape and many companies welcome relief from a potentially burdensome federal reporting requirement. However, the broader reality is that climate and ESG disclosures are not going away.

Companies may still be subject to climate-related reporting requirements through California regulations, European Union standards, investor expectations, and existing SEC material disclosure requirements. In many cases, the reporting environment may become more fragmented and complex rather than simpler.

For Boards of Directors, this is an important reminder that oversight responsibilities extend beyond compliance with any single regulation. Boards should continue to ensure that management has appropriate governance, controls, risk assessment processes, and disclosure frameworks in place to support accurate and reliable ESG and GHG reporting wherever such obligations exist.

The regulatory landscape may change, but a board's responsibility to oversee material risks, transparency, and stakeholder trust remains unchanged.

The SEC Is Killing Its Climate Rule, but ESG Risk isn't Going Away Anytime Soon A roller coaster journey for the SEC

Hey Chicago, join fellow Internal Audit leaders for a dynamic, CPE-eligible discussion on AI governance and guardrails. We'll cover what's practical (and defensible): key AI controls to have in place, acceptable use policies that actually work, governance models Internal Audit can support and how to confidently explain AI risk to management and the audit committee. You’ll leave with clear frameworks, real-world perspectives and takeaways you can apply immediately.

Then, when the discussion wraps, so do your hands. Stick around for a boxing-for-beginners session led by a certified boxing coach at POW! Gym in Chicago’s West Loop. No experience needed. You'll pair up (gloves + pads), get hands-on instruction, a solid cardio workout and learn real defensive fundamentals in a safe, beginner-friendly environment (so, no you will not be getting punched). You'll also walk away with boxing gloves and wraps to keep.

Learn how to govern AI with confidence. Burn off stress. Learn to defend yourself. This isn’t another networking event, it’s an experience. Attendance is free but you must register.

One Night Only - Training on AI Defense and Self-Defense - June 11 - Chicago AI Guardrails + Boxing for Beginners

Here we go again... another alleged embezzlement case is making headlines; this time involving a finance executive accused of stealing $4.5 million from her employer over a six-year period through unauthorized corporate credit card charges.

According to reports, the alleged spending included:
• Luxury clothing and personal expenses
• Vacations and car payments
• Approximately $150,000 in gambling charges

The individual reportedly served as both Director of Finance and later Vice President of Finance.

For boards of directors, this case raises an important governance question:

How could unauthorized spending continue for six years without detection?

While the facts are still allegations, cases like this often point to breakdowns in fundamental financial oversight.

What should boards be asking management?

1. Who reviews executive and finance department credit card activity?
Corporate card charges, especially for finance leadership, should be independently reviewed with supporting documentation and clear business justification. Seniority should never exempt someone from scrutiny.

2. Are there meaningful controls over corporate card spend?
Boards should understand whether:
• Spending limits exist
• Merchant category restrictions are enabled
• Exception reporting flags unusual transactions
• Personal expenses are systematically identified and investigated

3. Is there sufficient segregation of duties within finance?
When finance leaders can initiate transactions, oversee reconciliations, and influence reporting, control gaps can emerge quickly. Independent oversight is essential.

4. Are expense and card reconciliations independently reviewed?
Unauthorized activity lasting years often suggests reconciliations became a routine exercise rather than a true detective control.

5. Is the audit committee receiving meaningful fraud-risk reporting?
Boards should expect visibility into high-risk areas such as executive expenses, procurement cards, cash disbursements, and unusual spending patterns.

The governance lesson here is simple: Fraud risk increases when oversight decreases, particularly around trusted finance leaders.

Strong organizations do not rely on trust alone. They rely on transparency, independent review, and controls that work regardless of title or tenure.

Woman accused of stealing $4.5M from employer indicted in Alexandria Woman faces decades behind bars

AI adoption is moving faster than most organizations’ ability to govern it; and that creates a significant opportunity (and responsibility) for Internal Audit.

Sikich published an important article written by Jesse Laseman on how Internal Audit can provide meaningful assurance over AI as organizations rapidly embed it into business processes. The message is clear: while AI may be new, the core principles of risk assessment, governance, controls, and independent assurance are not.

What stood out to me is the practical focus on:
• Understanding how AI is actually being used across the organization (including “ghost AI”)
• Performing risk-based assessments around bias, privacy, cybersecurity, and accountability
• Evaluating governance, data quality, model reliability, and compliance expectations

The gap between perceived control and actual AI oversight is widening in many organizations. Internal Audit is uniquely positioned to help close that gap before risks become more difficult to manage.

A worthwhile read for Internal Auditors, CAEs, and risk leaders thinking about how to evolve assurance strategies alongside emerging technology.

How internal audit professionals should be adapting to AI - Sikich IA teams must strengthen AI governance

"Whatcha gonna do, brother..."
Another alleged embezzlement case is making headlines, this time involving an accountant accused of diverting nearly $900,000 from a "high-profile individual" who may or may not be Hulk Hogan.

The allegations include:
• Misappropriation of funds through an accounting services business
• Authority to sign on behalf of the victim
• Activity occurring over multiple years before detection

For boards of directors, this case is a reminder of an uncomfortable truth:

Financial often starts with trusted access.

When one person has the authority to initiate, approve, and conceal transactions, the risk of fraud increases dramatically, especially when oversight becomes informal.

What should boards be asking ?

1. Who has signing authority and how is it monitored?
Authority over disbursements should never exist without oversight. Dual authorization thresholds, periodic reviews of authorized signers, and independent monitoring are foundational controls.

2. Are third-party accountants and bookkeepers subject to the same controls as employees?
Outsourced finance personnel often operate with significant system access and trust. Boards should understand how management validates their activities, access rights, and deliverables.

3. Are bank reconciliations truly independent?
An independent review of reconciliations is one of the simplest but most effective fraud detection controls, particularly when someone has payment authority.

4. Is there segregation of duties in cash disbursements?
No one person should be able to authorize payments, process transactions, reconcile accounts, and maintain accounting records.

5. What monitoring exists for unusual transactions?
Recurring payments to unfamiliar vendors, transfers to related accounts, or reimbursement anomalies should trigger scrutiny.

The lesson for boards is straightforward: trust is not a control. Strong means building financial processes that remain effective even when highly trusted individuals are involved.

Nearly 1 million Dollars! Hulk Hogan’s Ex-Accountant Indicted for Alleged Six-Figure Embezzlement Bookkeeper facing serious charges