Tony Rader calls it “peeling back the onion”—the slow, methodical process of uncovering the full extent of an embezzlement scam that eventually totaled more than $1 million. What National Roofing Partners (NRP) first discovered was bad enough. The Coppell, Texas–headquartered company, which oversees a nationwide network of nearly 250 commercial roofing contractors, learned in 2018 that a South Texas firm called Statewide Texas Roofing was billing clients for work on behalf of NRP and pocketing all the money. It turned out to be a scheme masterminded by NRP’s then-president, who created Statewide, staffed the company with his kids and used phony work orders to steal hundreds of thousands of dollars in client fees from NRP. He’d been president for six years and with the company since it was created in 2007. It was a huge betrayal—and still just the tip of the iceberg.

“Initially, we thought it was only half a million [dollars] or so,” says Tony Rader, NRP’s chief operating officer. “But I’ll never forget, [Chief Executive Officer] Steve [Little] and I were talking over a bourbon one night, and that’s when I told him, ‘I’ve seen this once before, and this is like an onion. You’ve only peeled off the outer layers. We’re going to be finding stuff for a year, and it’s just going to get bigger and bigger and bigger.’ He said, ‘You think?’ And I said, ‘Oh, I’m pretty sure.’” Rader was all too correct. Working with a third-party forensic accountant, NRP found that not only were its then-chief financial officer and several other employees involved in the scheme, but the president had also abused his corporate credit card, racking up personal charges going back to 2013—on luxury vacations, expensive dinners, clothes, jewelry, even his daughter’s destination wedding in Jamaica. The final tally on his scams: $1.4 million.

GETTING AWAY WITH IT

NRP thought it had the necessary safeguards in place to prevent this sort of thing, but obviously didn’t. While the FBI is reviewing the case for possible criminal prosecution, NRP recently secured civil judgements against the president and his daughter in Denton County, Texas, District Court—and now the company is speaking out about its experience.

“We felt it was important to take a stand,” says NRP Chief Financial Officer Kyrah Coker. “There are many people that we’ve come across since this happened that have had the same thing happen to them and just didn’t want to experience that vulnerability of people knowing. We made a collective decision as a company that we wanted the people and other companies in our industry to know that it’s okay to raise your hand and say this happened to you.”

In some ways, this type of crime—committed by a group of trusted colleagues with close knowledge of a company’s internal procedures— is hard to prevent. Rader and Little considered the president one of their best friends. “We welcomed him to be part of our personal lives, including joint vacations and even to the point of contributing to his daughter’s wedding. It was that close of a relationship,” Rader says. “Then, during the investigation, we discovered his use of the company credit card to offset the cost of the wedding.” Adds Coker: “It’s really hard as a company to protect yourself against a collusion.”

But still, the group was able to take advantage of blind spots in NRP’s processes, such as giving positions like the president and the CFO wide latitude when it came to authorizing expenditures—including signing off on expense reports. The president even signed off on his own. “I would say in terms of a dollar figure, the biggest impact came from the credit-card transactions,” says Coker, who was hired as NRP’s controller not long before everything
unraveled and soon found herself elbows deep in the investigation. “But there were also transactions that were phony invoices, checks and wires that were processed to non-company expenses that weren’t recorded anywhere, and bonuses that were paid and not taxed properly through payroll.”

None of it was rocket science. “[The president] would tell a project manager, ‘Give me a bill for project management services from Statewide’—for managing this project that they’ve never had anything to do with,” Rader says, “so that he could pay his kids a salary.” The project manager, being none the wiser, would do what the president asked.

And, like a lot of illicit enterprises, it started small. Rader and Coker spent months going over years’ worth of credit-card statements and expense reports line by line. “You can see on the statements how it started small,” Rader says, “and then every month it would kick up a little bit more, until finally it got to the point where it was just unlimited usage. The fox watching the chicken coop, is what it basically boiled down to.”

CHECKS, MEET BALANCES

Once NRP understood the full scope of its losses, fired the president and his accomplices and began exploring its legal options, the only thing left was to fix the chicken coop. Realizing that its existing checks and balances clearly needed some work, the company instituted a more rigorous set of financial safeguards, including:

• Checked mail: “Accounting doesn’t open the mail,” Rader says, “because let’s say the CFO is wanting to hide something and all the mail comes to them. If it’s a bill or a check and they want to do something that’s not for the company but for them personally—they can hide it, pay it, deposit it or whatever.” Adds Coker: “When a check comes in, our office manager actually receives the check, puts the check in the system and then it goes to our assistant accounting manager to do the cash receipt.”
• Double-checked contracts: “There’s a two-step process for contracts, referral agreements or consulting agreements to be approved,” Rader says. “And anything over a 12-month contract has to be signed by [Little]; anything 12 months or less, I can sign.”
• Triple-checked expenses: “We now require a three-step process for company expenses,” Coker says. “We use software to process all credit-card transactions, which is linked to the credit-card company. All transactions go in there and have to be accounted for—and they’re entered by the employee, they go to a manager and then they go to accounting to process as well. We’ve also eliminated certain retail locations—SIC codes—from being able to charge transactions on the company credit card.”
• Quadruple-checked checks: “Each week we have an assistant accounting manager who sets everything up to pay,” Coker says. “She doesn’t have access to set up vendors or clients; that’s another person that’s able to set that up. Then payments go to myself and our CEO, and we both have to sign anything that’s over $5,000—and we both put our eyes on every single transaction.”

NRP’s message to the rest of the industry is simple: If you aren’t taking these types of simple steps to protect yourself against an inside job, start today. And if you suspect something is wrong, don’t hold off on investigating because you’re afraid of what you’ll find or concerned about what your clients might think. “You’ll find that a lot of companies don’t want to put this out there because they’re embarrassed by it and they figure it will hurt them,” Rader says. “We’ve found just the opposite, where people come up and say, ‘I really appreciate you telling us the story here.'"