$151m of costs hidden at Macy's: one person, bypassed controls

On 25 November 2024 Macy's, the department-store group listed on the New York Stock Exchange, delayed its third-quarter results to wait for an independent investigation into delivery expenses (Macy's, Inc., 2024). Sixteen days later its 8-K to the SEC said what the investigation had found. If you are a finance director or SME owner who sleeps well because the accounts team reconciles balances every month, this one is worth reading closely: the case file shows that controls designed without a determined insider in mind can let errors run for 12 quarters. The filings do not name the employee, and neither does this post.

What did Macy's disclose, and which figure should you use?

Use about $151m, the figure in the 8-K of 11 December 2024. The $132m to $154m range in the 25 November release was an estimate made while the investigation was still running (Macy's, Inc., 2024, Other Corporate Developments; Macy's, Inc., 2024, Item 2.02).

According to the 8-K, a single employee with responsibility for small-package delivery expense accounting deliberately made erroneous accrual entries and falsified underlying documentation, hiding about $151m of cumulative delivery expenses from Q4 2021 to Q3 2024 (Macy's, Inc., 2024, Item 2.02). By my count that is 12 fiscal quarters. Delivery expense is a component of cost of sales, and the problem surfaced as the company prepared its unaudited third-quarter statements, in one accrual account (Macy's, Inc., 2024, Item 2.02). Over the same period Macy's recognised about $4.36bn of delivery expenses (Macy's, Inc., 2024, Other Corporate Developments). By my division, $151m is about 3.5 per cent of that; the filings I read do not say whether that total already includes the hidden amount.

The filings describe concealed costs, not stolen money. The release says there was no indication that the erroneous entries affected cash management or vendor payments, that the person is no longer employed, and that the investigation had not identified involvement by any other employee (Macy's, Inc., 2024, Other Corporate Developments).

Which controls does the company say failed?

Two: manual journal entries over delivery expenses and certain other non-merchandise expenses, and the reconciliation of the related accrued liabilities. The fault is in design: according to the 8-K, the controls were designed without considering that an employee might circumvent them (Macy's, Inc., 2024, Item 8.01). The filing adds a second fault, about information: the controls failed to obtain, or to generate and use, relevant, quality information, including validation of its reliability (Macy's, Inc., 2024, Item 8.01).

In my reading, that fits falsified source documents. A reconciliation compares a ledger balance with a document; if the person who books the entry also supplies the document, the two can agree. The filing does not say how the documents were falsified, who reviewed the entries or why review did not catch them, so this is my inference, not the company's statement.

One consequence is already on the record. On 10 December 2024 the Audit Committee of the Board determined, on management's recommendation after consulting its independent auditor KPMG, that management's report on internal control as at 3 February 2024, filed with the 10-K of 22 March 2024, should no longer be relied upon, nor should KPMG's opinion on the effectiveness of internal control at that date (Macy's, Inc., 2024, Item 8.01). Beyond saying it came to light while preparing the third-quarter statements, the company, according to NBC, did not disclose how the conduct was discovered (Wile et al., 2024).

A word on vocabulary. The site's framework table says "override"; the 8-K says "employee circumvention" and gives no job title (Macy's, Inc., 2024, Item 8.01). I use "override" for one person getting round a control, without implying a manager.

What did Macy's commit to fix?

Three things, according to the 8-K, which says the company has begun to implement them: re-evaluate the risk of employee circumvention, redesign process-level control activities to respond to it, and evaluate the information that supports the controls, including validating its reliability. The company said it might add further measures (Macy's, Inc., 2024, Item 8.01).

As I sort them, the three fall under three of the five components of the COSO internal control framework: risk assessment, control activities, and information and communication. COSO is a committee of the Treadway Commission's sponsoring organisations; its framework was issued in 1992 and refreshed in 2013 (Committee of Sponsoring Organizations of the Treadway Commission, 2013). The filing does not say how far these have got or how well they work, and I have read no Macy's filing after 11 December 2024.

Why do accruals and reconciliations not stop a determined insider?

Because each type of control has its own weak spot, and a determined person works on exactly that spot. The site's framework summary, based on COSO, says preventive controls such as segregation of duties and approvals can be bypassed by override or collusion; detective controls such as reconciliations and management review come late; corrective controls depend on follow-through Preventive, detective and corrective controls.

Applied to Macy's, as I read it: an accrual is an estimate booked by one person, so it needs a preventive layer; reconciling accrued liabilities is the detective layer, and it only works if the documents it compares against were not produced by the person who booked the entry. Restating prior-period figures and redesigning the process are the corrective layer, arriving after 12 quarters. The filing does not say whether approval or segregation of duties was present or absent, so I do not conclude which control failed.

What should an SME finance lead check?

Five things, each answering one question: if one person wanted to hide an expense, which step would let them? The checklist is my own reasoning, untested on Vietnamese firms; the middle column says which items have a root in the filing.

An invented example shows the third check. A drinks distributor with 80 staff, unnamed and made up by me, makes about 1,000 deliveries a month at VND 0.6m each. Carriers invoice about a month late, so the correct month-end accrual is roughly the cost of deliveries not yet invoiced. This is one way an estimate could drift low, not how Macy's did it.

On its own the balance looks steady, down only 5 per cent from 600 to 570, while deliveries rose 14 per cent. After six months the gap is VND 114m, about 17 per cent of a month's cost.

This suits you if the accounts team has two or more people, or the owner is willing to approve large manual entries personally. It does not suit you if you have one bookkeeper and an owner who does not read the reports: the first check cannot be done and the rest are weaker.

Going deeper: what did I read, and what could I not check?

On 3 November 2026 I read in full the release of 25 November 2024 (Exhibit 99.1 to a filing on SEC EDGAR) and the main text of the 8-K of 11 December 2024. The case figures come from those two documents, except details found only in NBC: net profit of $105m, the chief executive's words, the unnamed sources, and the company's silence on how the conduct was found. I read the NBC piece, which is short, in full.

I did not read Exhibits 99.1 and 99.2 attached to the 8-K (the results release and the revised financial statements), so I do not know how the $151m splits by quarter. Nor have I read any 10-K, so I do not know how far remediation has got. On COSO I read only the landing page, not the framework itself, which is sold; the five components and the three-type table come from the site's framework summaries.

This post does not show that weak segregation of duties caused the case, because the filings say nothing about that. It shows one documented case in which the company itself says its controls were designed without the people who might circumvent them in mind.