In 2008, the employee was hired by a DoD subcontractor to perform work on a specific contract. She was required to submit timesheets to both her employer and the prime contractor. The prime contractor paid the subcontractor a fixed amount for every hour this employee worked.
Beginning in 2010, this employee began working full time for another contractor while, at the same time, continued to submit timecards as if she were still working full time for her previous employer. The Government's investigation revealed that she was working full time for her new employer yet at the same time, continued to submit timecards to her previous employer. Her former employer continued to bill the prime contractor who in turn, billed the Government. Before the scheme was halted nine months later, the Government had been overbilled by $65 thousand.
There are so many internal control deficiencies in this story that we don't know where to begin is describing them or ranking them in importance. First of all, where was the supervisor? One of the elements of an adequate timekeeping system is that after employees submit their timecards, the supervisor, with first-hand knowledge of what the employee was working on, reviews and approves the timecard. Secondly, the same question. Where was the supervisor? How can this fraud go on for nine months before someone wises up and notices that the employee is not performing her assigned tasks. This is one reason why contract auditors sometimes asks whether supervisors observe the comings and goings of their subordinates. Thirdly, this illustrates one of the big problems with cost-reimbursable contracts. Everyone, the employee, her employer and the prime contractor have no real incentive to control costs. Those costs are just passed along to the Government and everyone goes home happy and rich. Fourthly, was this job even necessary in the first place? If you can go on for nine months and not even notice that a position was not producing any output or deliverable, you have to question the necessity of that job in the first place.
Contractors (and subcontractors) really need to beef up their timekeeping procedures when they have employees assigned to remote sites or to a Government facility. "Trust" is not an internal control.