Internal Audit Newswire - November 01, 2026

Construction Company Owner and Employees Indicted for Wide-Ranging Tax and Financial Fraud Schemes

Source: U.S. Department of Justice, Office of Public Affairs

Summary: A federal indictment unsealed Oct. 26, 2026 charges four individuals tied to a construction business with conspiring to defraud the IRS, tax evasion, willfully failing to withhold and pay employment taxes, filing false tax returns, conspiracy to commit wire fraud, failure to file FBARs, and obstruction of justice. From April 2017 to May 2024, employees were allegedly paid wages with no federal employment-tax withholdings totaling at least about $5 million, and gross receipts were allegedly underreported by about $13 million. The indictment also alleges false W‑2s and falsified financial documents used to obtain loans and bonds.

Internal Audit Implications: Internal audit should immediately pressure-test the control environment where these schemes typically take root. Prioritize: (1) Payroll tax withholding and remittance controls—verify system configuration, segregation of duties, Form 941 filing accuracy, and EFTPS remittances; reconcile payroll registers to GL, bank disbursements, and tax filings. Sample employees to confirm withholdings and test W-2 generation and filing integrity. (2) Revenue completeness—perform bank-to-GL reconciliations, test cash sales recording, review manual journal entries to revenue, and investigate unexplained variances between operational data and recorded gross receipts. (3) Vendor/contractor oversight—test vendor master data maintenance, TIN validation, beneficial ownership/conflict disclosures, and approval workflows to deter related-party or shell arrangements. (4) External-use financial packages (loans/bonds)—test the Document Integrity and External Reporting Review control: require independent tie-outs of package inputs to the GL and bank statements, with CFO/controller sub-certifications and evidence of review. (5) Treasury regulatory reporting—inventory foreign financial accounts and verify governance over required filings and retention. (6) Record preservation—assess legal hold and data-retention controls to reduce obstruction-of-justice risk. Questions your audit committee will ask: Are payroll tax controls operating effectively each pay cycle? How do we gain assurance over revenue completeness in cash-intensive jobs? Who independently validates figures in loan/bond submissions? What monitoring detects false W-2s or off‑payroll payments? Any FBAR or other regulatory reporting gaps? What are the SOX 404 implications if deficiencies are found, and what is the remediation plan and timeline?

11 Kansas City-Area Residents Indicted for $400,000 Covid Fraud Conspiracy

Source: U.S. Department of Justice, U.S. Attorney's Office for the Western District of Missouri

Summary: A 21‑count federal indictment alleges 11 Kansas City‑area residents conspired to obtain more than $400,000 in fraudulent Paycheck Protection Program loans. According to the filing, a preparer created and submitted false PPP applications, fabricated IRS forms for nonexistent businesses, inflated income, and received about $2,000 from loan proceeds. Most borrowers allegedly received two PPP loans of $20,833; one received loans of $20,833 and $29,166. Prosecutors seek a $41,666 money judgment against each defendant. The case spotlights documentation and approval weaknesses that can enable false claims.

Internal Audit Implications: If your organization processes, relies on, or reimburses government‑relief program claims—or accepts payment streams funded by them—tighten internal controls now. Actions for internal audit this quarter: (1) Applicant/Vendor Due Diligence: test controls that verify business existence (e.g., state registrations), ownership, and active operations before approval. Review samples for independent corroboration of identity and business activity. (2) Document Authenticity Verification: assess whether processes independently validate tax forms and income claims against authoritative evidence and detect fabricated forms. (3) Segregation of Duties and Approval Hierarchies: confirm no single preparer or relationship owner can originate and approve relief-related applications or disbursements. (4) Pattern and Threshold Monitoring: build analytics to flag risk indicators mirrored in the indictment—multiple loans at common maximums (e.g., $20,833), repeat addresses/bank accounts, and “assistance fee” payments resembling the noted ~$2,000 preparer cut. (5) Post‑Disbursement Monitoring and Clawback: test controls that track use-of-funds conditions and trigger investigations, holds, or recoupment when anomalies arise. (6) Third‑Party Risk: evaluate oversight of consultants or preparers who assemble application packages; require attestations and escalate exceptions. Audit committee questions to prepare for: How does management authenticate IRS‑related documents and income claims? What analytics detect duplicate or inflated applications? How are third‑party preparers controlled and compensated? What is our exposure to repayments or sanctions, and how robust is our control remediation plan? Align these steps with your risk assessment and operational risk monitoring cadence.

FTC, states sue Toast over fees, deceptive subscription practices

Source: Investing.com (Reuters)

Summary: Reuters reports the FTC, joined by multiple states and two California jurisdictions, sued Toast, Inc. on Oct. 29, 2026. The complaint alleges Toast charged hidden fees, enrolled customers in unwanted add‑ons, and made subscriptions hard to cancel, according to the FTC statement cited. For internal audit, a coordinated action over pricing, billing, and cancellation signals elevated enforcement risk around commercial terms, revenue practices, and customer disclosures—especially for subscription or add‑on models and point‑of‑sale ecosystems.

Internal Audit Implications: Pressure-test revenue and customer practice controls that intersect with the allegations. Focus on: (1) Pricing and Fee Transparency Governance—review how price and fee changes are approved, disclosed, and reflected on contracts, order forms, and invoices; test samples for clear, itemized fees and evidence customers received disclosures before billing. (2) Add‑On Enrollment Controls—verify explicit customer opt‑in, preserved consent artifacts, and prohibition of default enrollment; test sales flows and scripts for misrepresentation risks. (3) Cancellation and Offboarding—walk the cancellation path; measure steps, time, and channels; confirm functionality works and that proration/refund terms match contracts. (4) Billing System Configuration and Change Management—test maker‑checker, deployment approvals, and audit trails for pricing and subscription flags; reconcile billed fees to configured rates. (5) Complaint and Chargeback Monitoring—analyze trends for “hidden fees,” “unwanted add‑ons,” and “cannot cancel” indicators; ensure escalation and restitution controls exist. (6) Third‑Party/Reseller Oversight—where channels sell or service customers, assess training, contractual obligations, and monitoring. Prepare for audit committee questions: Where could hidden fees arise in our catalog and invoices, and how do we know? Can we evidence affirmative consent for every add‑on? How much friction is in the cancel journey, and is it necessary? What is our exposure if revenue from contested fees is material to ICFR? What control remediation is planned and by when? Strengthen risk governance to sustain compliant growth.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.