As noted in Chapter 3 of this book, the September/October 2017 issue of Fraud Magazine, contained an article by John Gill titled, “The Fraud Triangle on Trial.” In his commentary and analysis, Gill presented a perspective of the fraud triangle that has the potential to rock the foundations of the antifraud profession—at least when it comes to forensic accountants and antifraud professionals testifying in court. Gill found that three U.S. court opinions related to the fraud triangle denied the admissibility of expert testimony based on the fraud triangle because it was deemed to be “unreliable” theory.
Going back as far as 2006, Steve Albrecht (see a 2012 summary in Albrecht, Albrecht and Albrecht, “Fraud Examination”), who in 1991 crafted Cressey’s concepts into the fraud triangle, offered a solution in the form of “the elements of fraud” or “the triangle of fraud action:” the act, the concealment, and the conversion.
As described by Dorminey, Fleming, Kranacher, and Riley in 2012 (see “The Evolution of Fraud Theory” in Issues in Accounting Education):
While the Fraud Triangle identifies the conditions under which fraud may occur, the triangle of fraud action describes the activities an individual must perform to perpetrate the fraud. The act represents the execution and methodology of the fraud, such as asset misappropriation, corruption, or financial statement fraud. Concealment represents deliberate effort to hide the fraud act; examples of concealment include creating fake invoices, false journal entries, falsifying reconciliations, or destroying records. Conversion is the process of transferring the benefits of asset ownership and control from the victim to the perpetrator; examples include laundered money, cash deposited in perpetrator bank accounts, purchased personal cars or homes.
As Gill noted, the antifraud professional needs to “stick to the facts when you testify,” which are provided by the triangle of fraud action. From this structure the professional can identify evidence that supports hypotheses (a.k.a. fraud theories) and answer the important questions of “who, what, when, where, and how” (who had access, how was it committed and concealed, where did the money go, etc.). This approach does not require that the professional answer the question of “why” that are associated with pressure and rationalization.
The primary lesson: Ensure that your work is grounded in the evidence. This means that reported findings are supported by facts, data, or information that you independently verify to the extent possible. This approach ensures relevant, reliable conclusions that can be presented with a reasonable degree of scientific certainty. Without the proper credentials and experience (e.g., psychologist), professionals should avoid commenting on motives associated with the perpetrators pressure or rationalization.
In essence, even though many antifraud and forensic accounting professionals have years of experience in dealing with fraudulent behavior and understand the profile of the fraudster, the antifraud professional should avoid commenting on the “why” behind the fraudster’s alleged crime.
As an expert witness, ground your examination in objective, reliable, relevant, and valid evidence, and as John Gill contends, “your time on the witness stand will be much more comfortable.”
In the following modules of this chapter, the authors examine various tools and techniques for fraud detection and risk assessment. Those modules, along with the learning objectives include the following:
To complete an examination, the fraud examiner or forensic accountant needs to answer the essential questions of who, what, where, when, how, and why—with evidence. Even in litigation support situations, the answers to these questions are required to convince a jury that you can explain each aspect of a case. In addition, the answers need to be woven into a coherent story. Critical thinking and analytical reasoning suggest that the fraud examiner or forensic accountant will have to make some intellectual connections to pull the various pieces of evidence and the answers to those questions into a compelling case. However, evidence-based decision making suggests that examiners need to ground their storyline in the evidence. A storyline grounded in the evidence is much more convincing to prosecutors, attorneys, judges, and juries.
Incomplete evidence is a fact of life and an on-going challenge to examiners. Another fact is that fraud examiners typically prefer more evidentiary material. How does the fraud examiner deal with situations where the evidence is less than perfect? The answer is that fraud and forensic professionals always face the prospect of less-than-perfect evidence, and they address potential evidentiary shortcomings or holes in the storyline through their consideration of the alternative hypotheses (alternative fraud theories). In Chapter 1, this approach is referred to as the analysis of competing hypotheses and the specific tool is the Hypothesis-Evidence Matrix. A detailed application example is provided for readers in that chapter. Using a commitment to critical thinking and analytical reasoning, professionals attempt to identify all other hypotheses or theories that might fit at least some of the key pieces of evidence. Then the fraud or forensic professional identifies flaws in each alterative hypothesis by examining and focusing on the evidence. When the examiner identifies evidence that suggests that the alternative hypothesis does not withstand the scrutiny of the evidence, that hypothesis is disqualified as a possible explanation. The last remaining hypothesis that has not been disqualified is the most likely explanation of the case under examination. As long as more than one hypotheses are not disqualified, the identification and examination of evidence continue until only one hypothesis remains—the hypothesis most consistent with the evidence.
Professionals in this field need to understand that no one is better at generating alternative theories of the case than opposing attorneys. The question isn’t whether opposing attorneys will develop alternative theories of the case; rather, it’s what theories they are likely to propose. Often, if a forensic accountant is deposed as part of the civil litigation process, the opposing attorney will develop new and novel theories for trial, especially if the fraud or forensic professional has cast significant doubt on some of this attorney’s alternative theories during the deposition.
What tools are available to analyze evidence and develop a compelling storyline? First, the hypothesis–evidence matrix (analysis of competing hypotheses) should be used for considering alternative fraud theories in light of the evidence. By aligning alternative theories across the top of the matrix and by listing and considering each piece of evidence down the left-hand side of the matrix, the fraud examiner or forensic professional can highlight flaws in the various alternative theories.
With regard to suspected fraud, corruption or financial malfeasance, fraud examiners and forensic accountants need to develop evidence, to the extent possible, around the elements of fraud: the act, concealment, and conversion; the fraud triangle (particularly, opportunity). With regard to the fraud triangle, professionals know that, other than opportunity, they may never have compelling evidence of the other two aspects—perceived pressure and rationalization.
The following is an example Hypothesis Matrix. Assume that the matrix has evidence underlying the evaluation. Readers should note the following:
Hypothesis Matrix | Key: | o | Evidence has no diagnostic value | |
Financial Statement Fraud | + | Consistent with the hypothesis | ||
− | Disqualifies the hypothesis | |||
H1: Books are Not Materially Misstated | H4: Bad A/R Clerk with poor collection skills | |||
H2: Fictitious Revenues (Fake Customer Invoices) | H5: Customer Complaint/Pay Problem: | |||
H3: Channel Stuffing | (Quality, Service, Shipping, etc) |
Evidence: | H1: | H2: | H3: | H4: | H5: | Source | Reliability | Validity |
Review of F/S (Act): | ||||||||
EPS steady despite M&A and other business activities | + | + | + | + | + | Audited F/S | A | 1 |
Sales increasing, marketing, adv. Flat to decreasing | + | + | + | + | + | Audited F/S | A | 1 |
Organization Chart (Opportunity): | ||||||||
Internal audit reporting to the CEO | o | o | o | o | o | Internal | A | 1 |
Family members (related parties) in leadership positions | o | o | o | o | o | Internal | A | 1 |
(Audit W/Ps) | ||||||||
Ratio Analysis (Act): | ||||||||
A/R growth significantly > Sales % growth | o | + | + | + | + | Audited F/S | D | 1 |
Cash drain, operating cash flows: | ||||||||
Flat, despite revenue and income growth | o | o | + | + | + | Audited F/S | D | 1 |
Operating Cash Flows < Net Income | o | o | + | + | + | Audited F/S | D | 1 |
Industry/Financial Press (Possible Pressure): | o | o | + | o | + | Independent | B | 2 |
Industry declining | ||||||||
Analysts expectations increasing | ||||||||
Financial Press − Expectation of company success | ||||||||
Financial Press − Noted company failures | ||||||||
Compensation Contract (Conversion): | ||||||||
Salary and bonus only | o | + | + | o | o | Internal | A | 1 |
(Audit W/Ps) | ||||||||
Sales Journal: | ||||||||
Trends are not across all quarters | o | + | + | + | o | Internal | B | 2 |
A/R: Journal (Act): | ||||||||
Collection problems only for a few, large customers | − | o | + | − | − | Internal | B | 1 |
Examination of large customer documents: | ||||||||
Sales contract—collection terms require 30 days or less | − | − | + | − | − | Customers | B | 1 |
Invoices details require payments in 30 days or less | − | − | + | − | − | Customers | B | 1 |
Email (Concealment/Indirect Admission) | − | − | + | − | − | Data Anaytics | A | 1 |
Financial Statement Disclosure: Item #1 − Sales (Concealment) | − | − | + | − | − | Audited F/S | A | 2 |
Prior to starting a fraud or forensic accounting examination, the professional needs predication. Predication is defined as the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe that a fraud has occurred, is occurring, or is about to occur. Essentially, predication is the starting point for a formal fraud examination. Suspicion in the absence of any corroborating circumstantial evidence is not a sufficient basis for conducting a fraud examination. Something as innocuous as an anonymous tip or complaint, with some supporting evidence to substantiate it, may be enough to meet the predication threshold. In other cases, discovery of missing cash or other assets is usually sufficient grounds for launching an examination.
What about red flags? Do red flags meet the requirement of predication? Typically, a few red flags are not in themselves sufficient as a basis for a fraud examination. Especially when dealing with financial statement fraud, where a materiality threshold is required, red flags require additional audit work. A major obstacle is that many red flags have reasonable explanations and do not result in the discovery of asset misappropriation, corruption, or attempted fraudulent financial reporting. The approach to red flags is that they should be investigated to their logical conclusion, at which point the fraud examiner or forensic accountant can base a conclusion on evidentiary material. When verbal explanations are provided by employees, managers, and executives, such explanations need to be corroborated by supporting evidence.
The profile of the typical fraudster is basically that of the average citizen. Notwithstanding predatory fraudsters, most are not habitual criminals, and very few have any criminal history. Fraudsters do not usually fit the characteristics of street criminals. Further, common fraud perpetrators often are well-educated and respected members of their community, regularly attend community events, are often married, and have children. Thus, the critical question remains: what causes good people to turn bad?
The three key characteristics that enable any fraud are captured by the fraud triangle shown in Figure 9-1: opportunity, perceived pressure, and rationalization. The first predicate is opportunity—or, at least, the perceived opportunity—to commit and conceal the fraud. Opportunity usually includes a position of trust within an organization, and the skill set required to carry out the fraud. Whether the issue is management override, collusion or a breakdown in internal controls, a fraudster requires opportunity. Without opportunity, fraud is highly improbable. Auditors and accountants often direct their fraud prevention and deterrence efforts toward using internal controls to minimize opportunity. Evidence of opportunity also encompasses training of clerical and supervisory personnel, supervision, executive-level management, monitoring by auditors, audit committees and boards of directors, assessment of the effectiveness of proactive antifraud programs, the ethical culture of the organization, results of fraud discovery audits, and tips from hotlines and whistleblowers. Many employees, with or without collusion, have the opportunity to take cash, checks, or other assets; yet, the majority of those individuals never commit fraud.
Perceived pressure is necessary to supplement internal control weaknesses and other opportunities that enable fraud. The challenge here is that pressure, at least to some extent, is unique to the individual. The pressure that might push one employee “over the edge” to commit fraud may not be enough for someone else in similar circumstances. Nevertheless, to the extent possible, fraud examiners and forensic accountants should gather various types of evidence:
It is important to understand that because pressure is fundamentally a factor unique to the individual, only indirect evidence can be gathered, and even that evidence is generally circumstantial. Thus, fraud examiners and forensic accountants must not only keep their eyes open for symptoms but also keep their minds open as well.
The last condition facilitating fraud is rationalization. Because most fraudsters have no criminal history and do not think of themselves as criminals, fraud perpetrators typically have to develop some rationalization for their actions, at least initially. Like pressure, rationalization is an attribute unique to the individual. Rationalization is a manufactured, somewhat arbitrary justification for otherwise unethical or illegal behavior. In some cases, the fraud examiner or forensic accountant may be able to develop evidence of an employee’s feelings of job dissatisfaction, frustration with job recognition, low salary and other perquisites, and attitudes such as “they owe me,” “I am only borrowing the money,” “nobody will get hurt,” “they would understand if they only knew my situation,” “it’s for a good purpose,” and “I just need the money to get over this hump.”
Another approach to capturing the motivation of the typical fraudster is encapsulated in the acronym M.I.C.E.:
Money and ego are self-explanatory and are the two most commonly observed motivations. The roots of most fraud are greed (money) and power (ego). Less frequently, employees and others are victimized and unwillingly made part of a fraud scheme (coercion). Ideology is often an observed characteristic associated with taxpayer evasion schemes. In addition, ideology is often behind various kinds of terrorism—even terrorists require money to further their causes. The M.I.C.E. heuristic complements the fraud triangle and expands upon the element of pressure. Like pressure and rationalization, motivation is a personal attribute, but in some cases, evidence of M.I.C.E. can be documented during fraud and forensic accounting examinations.
The fraud triangle provides the necessary conditions for fraud to occur. However, the examiner has to provide evidence of intent. Intent, like all aspects of the examination, must be grounded in the evidence. Short of a confession by the fraudster or a coconspirator, evidence of intent is circumstantial. But intent is a legal attribute to proving fraud. The difference between a mistake and a fraud is intent. If the fraud examiner or forensic accountant cannot prove intent, a civil or criminal conviction for fraud most likely cannot be sustained.
The elements of fraud as shown in Figure 9-2 include the act (e.g., fraud act, tort, and breach of contract), the concealment (i.e., hiding the act, or masking it to look like something different), and the conversion (i.e., the benefit to the perpetrator). The main benefit of using the elements of fraud in an investigation is that in virtually every fraud or financial crime, the evidence of each element can be developed.
More importantly, once the fraud examiner or forensic accountant has evidence that the alleged perpetrator (1) committed the act, (2) benefited from that act (conversion), and (3) concealed his or her activities, it becomes difficult for the alleged perpetrator to make the case that he or she did not intend to do something that would cause harm or injury. In particular, evidence of concealment provides some of the best circumstantial evidence that the act and conversion (benefits) were intentional. An important element of intent can be inferred from repetitive similar acts. In the simplest example, an employee may be able to explain how one check from an employer might have “accidently” ended up in a suspect’s personal bank account. It becomes much more difficult, though, to explain away multiple similar transactions. In civil litigation, especially damage claims based on torts and breach of contract, the elements of fraud remain integral to any examination. Reasoned evaluation of the evidentiary material often suggests that a tort or breach of contract occurred (the “act”), the tortuous actors benefited from the act (conversion), and the tortuous actors concealed the activities. Below, we discuss the various methodologies used to answer the questions who, what, when, where, how, and why. Although these are centered on the elements of fraud—the act, concealment, and conversion—the same evidence may also shed light on the attributes of the fraud triangle and M.I.C.E.
Related to conversion, there is a debate in the profession about whether tracing money to a perpetrator’s bank account is sufficient evidence of conversion, or whether the fraud examiner or forensic accountant needs to show how the ill-begotten money was used. Legal precedent indicates that tracing the money into the hands of the perpetrator or his or her bank account is sufficient. However, showing how the money was used and how the perpetrator benefited from the act and concealment provides a more powerful case and can provide evidence of attributes of the fraud triangle, such as pressure and rationalization, and other motivations included in M.I.C.E. Generally, fraud examiners should take the examination as far as the evidence leads.
Examples of circumstantial evidence that may indicate the act, concealment, or conversion include the timing of key transactions or activities, altered documents, concealed documents, destroyed evidence, missing documents, false statements, patterns of suspicious activity, and breaks in patterns of expected activity.
To be successful, the investigator must be able to explain to prosecutors, attorneys, juries, judges, and other actors in the investigative process, the outcome of the investigation: who, what, when, where, and how—a complete story. Investigations centered on the triangle of fraud action, also known as the elements of fraud (the act, concealment, and conversion), have the greatest chances of being successful (assuming that these investigative outcomes are grounded in the evidence). Although fraud examination and forensic accounting use evidence-based decision making, critical thinking skills and careful analysis are essential to understanding what the numbers mean. The ability to use nonfinancial information, nonaccounting numbers, as well as financial data gathered from the books and records to tell a compelling story, is crucial to success. As fraud examiners or forensic accounting professionals move forward in their examinations, they shift from a world grounded in numbers and analysis to one where words carry the day (i.e., the courtroom). As such, when fraud examiners or forensic accountants reach the point of drawing conclusions, they must be able to tell a complete story that explains who, what, where, when, and how.
A data collection listing is offered as a resource in an appendix to this chapter. That material can be adjusted and supplemented as needed.
Without evidence, there is no proof, and neither criminal convictions nor civil verdicts are possible.
Evidence is defined as anything perceivable by the five senses, and any proof, such as testimony of witnesses, records, documents, facts, data, and tangible objects, legally presented at trial to prove a contention and to induce a belief in the minds of the jury.1
Working definition:
Anything legally admitted at trial that is relevant to the case.
Thus, just about anything may qualify as evidence, depending on the circumstances and what it is introduced to prove. Generally, evidence is admitted at trial provided that: it is relevant to the issue at hand, any probative effect outweighs any prejudicial effect, and the evidence is trustworthy—meaning that it can withstand the scrutiny of examination and cross-examination.
The rules of evidence have been developed and refined over hundreds of years and are captured in the Federal Rules of Evidence, as well as by the States (where laws generally model those at the federal level). These intricate rules have the objective of ensuring that only relevant and probative evidence is admitted in court. Perhaps even more important, the rules of evidence seek to ensure that irrelevant, unreliable, and prejudicial evidence is excluded from the courtroom. The objective is to handle court cases (1) fairly and (2) expeditiously.
The rules of evidence not only qualify items as evidence but also govern how evidence is gathered and presented, as well as the chain of custody and other rules for handling evidence. Most law schools have entire courses on evidence, so although fraud examiners and forensic accountants need to be familiar with the rules of evidence; ultimately, lawyers and judges will make decisions about what constitutes evidence and what is admissible in legal actions.
Three types of evidence may be offered at trial:
Another way to categorize evidence is whether it is direct or circumstantial. Direct evidence includes direct testimony, an eyewitness, or a confession. Circumstantial evidence “tends to prove or disprove facts” and requires inference, judgment, and interpretation to draw meaning from the evidence. Most fraud and forensic accounting cases are proved with circumstantial evidence. For example, if admitted, pressure, rationalization, M.I.C.E., and intent are almost always circumstantial. Absent a confession or the testimony of a coconspirator, most frauds are resolved with the aid of circumstantial evidence.
As noted above, the rules of evidence are designed to minimize irrelevant, immaterial, and incompetent evidence in the courtroom. First, the evidence must be relevant, meaning that it has a tendency to make the existence of any fact more or less probable than it would be without the evidence. Relevance tends to prove or disprove an assertion that is a matter of concern to the court, such as an action, motive, opportunity, identity, and credibility. Not surprisingly, evidence that is judged relevant in one case may be irrelevant in another. Furthermore, evidence must be material—that is, important (of consequence) to determining the fact at issue. Finally, evidence must be competent: it must be able to withstand the scrutiny of examination and cross-examination.
To be admitted at trial, evidence must be authenticated—the evidence must be shown to have unique identifiers (preferable), or that the chain of evidence has been followed. Once authenticated, the evidence must be shown to have been unaltered since it was originally collected. For example, the act of turning a computer ON changes the hard drive. This simple, yet inappropriate, act by an examiner would prohibit the use of any evidence found on the computer. To maintain the chain of custody, evidence collected must be tagged with the date and time of collection, the location of where the article was found, the name of the person collecting the evidence, and the person(s) with custody of the evidence at all “hand-off” points. To maintain the integrity of evidence, it should generally be
Examiners should always assume that the engagement will eventually go to trial. With such an assumption, the collection and preservation rules noted above are very important considerations. Furthermore, the amount of data collected can be quite large, so the examiner needs be very organized so that he or she can access data and review the types of data collected in summary fashion. In some civil litigation cases, Bates numbering will be used to ensure that paper documents are organized and inventoried. Bates numbering is a method of indexing legal documents for easy identification and retrieval. Bates numbers should only be applied to copies of originals.
When one interprets evidence, it may not be what it initially seems. As noted earlier in the chapter, documents may be altered. Furthermore, witnesses, informants, and confidential sources may not always tell the truth. E-mail addresses made be faked or masked through programming tools and techniques. As such, all evidence must be evaluated for its information content. For example, what is the source of the information? Is the face value of the information reasonable or believable? Can the information be verified from another source? Is the other source independent of the organization or person under scrutiny?
The axiom of data evaluation is that data must be relevant, reliable, and valid. Before information goes into an evidence gathering system, it should be reviewed for specific relevancy to the examination and the issue at hand. Relevance means that the information will make a difference to a decision maker. Data must be relevant to constitute evidence. Reliability refers to the source providing the information. The following scale can be used to evaluate the reliability of information collected during an examination.
Source | Rating |
Reliable: Source’s reliability is unquestioned | A |
Usually reliable: The majority of past information has proven to be reliable | B |
Unreliable: Source’s reliability has been sporadic | C |
Unknown: Reliability of source unknown | D |
Validity refers to the underlying accuracy and integrity of the information. Interviewees may lie; documents may be altered; and general ledgers and other financial data may be manipulated. Depending on the importance to the examination, the fraud examiner or forensic accounting professional needs to take the necessary steps to ensure that the information, on its face, is what it seems. Similar to reliability, a four-category rating system is used to rate the validity or truthfulness of the information:
Validity | Rating |
Confirmed: The information has been corroborated | 1 |
Probable: The information is consistent with past accounts | 2 |
Doubtful: The information is inconsistent with past accounts | 3 |
Cannot be judged: The information cannot be evaluated | 4 |
Gathering, documenting, organizing, retaining, and retrieving data, information, and evidence are an important part of the examination process. As one lawyer stated, “If it isn’t written down, it didn’t happen.” The fraud examiner and forensic accounting professional should always “begin with the end in mind.” The professional should always begin with the assumption that his or her work, report, and conclusions, as well as all other aspects of his or her examination, will be presented and scrutinized in a court of law. Thus, careful attention to work paper detail and the gathering, documenting, organizing, and retention of work product is of critical importance. In that regard, the following outlines the requirements for gathering and organizing evidence:
Other considerations related to gathering, organizing, and retaining evidence may include:
Work papers are the interface between the raw evidence and the examiner’s conclusions, expert opinions, and testimony. As such, all analyses and databases should be referenced and cross-referenced to ensure that the underlying evidence for the fraud examiner’s or forensic accountant’s work can be entered into evidence, because it is the foundation upon which the case is built. Work papers may include analyses in detailed and summary formats, accounting records, documents, public records searches, electronic files, correspondence, logs and other chain-of-custody proof, notes and summaries of interviews and inquiries, and court documents, such as complaints, pleadings, and depositions.
Dr. Scott Fleming was working with a group of students at West Virginia University, trying to convey the challenges of completing a forensic accounting and fraud examination and he described it in a most compelling fashion. He stated that
Solving a forensic accounting or fraud case is like trying to solve a puzzle where some of the inside pieces are missing, most of the outside pieces are missing and there’s no box with a picture to guide you.
Dr. Fleming makes a great point: only the participants to a civil litigation or perpetrators in a fraud case know the entire story. As examiners, we have the evidence and we work with, organize, and analyze that evidence to put together the pieces of the puzzle to explain to a jury the story of what happened in the context of the books, records, and other evidence.
Forensic accounting and fraud examinations are iterative processes. First, a red flag, an anomaly or tip, is observed. Given a commitment to evidence-based decision making, the professional does a little digging and observes additional red flags, some related, some seemingly unrelated to the original concern. The professional digs deeper, and rather than the evidence pointing to a logical explanation for the anomaly, concerns continue to grow. At some point, the predication threshold has been met or in the civil litigation context, the story of either the plaintiff or defendant just isn’t consistent with the evidence. At that point, an “examination” occurs. Some might call this the investigation phase.
Similarly, let’s consider fraud risk assessment. Assume that the process yields several high-risk issues based on the totality of the evidence and the lack of preventive controls (either the controls don’t exist or the implementation is flawed). The professional increases their assurance activities and discovers anomalies, red flags, or troubling inconsistencies between management assertions and the audit evidence. Again, the examination escalates.
Examinations, in essence, are where evidence intersects with the tool and techniques of the antifraud and forensic accounting profession. During any given examination, the professional will select those tools and techniques most applicable, accurate, and effective to resolve the allegations, assertions, and issues. From an examination perspective, tools discussed in prior chapters related to targeted risk assessment, fraud detection, and the basics of forensic accounting and fraud examination are also important tools in the examination process. In this chapter, we take a deep dive into tools and techniques commonly used in examinations. At the same time, we offer the following chart to review common examination tools and techniques with a reference to their coverage in prior chapters and suggest that readers revisit that material because each may play a critical role in the examination, even though the techniques are not discussed in detail in this chapter.
FAFE Tool/Technique | Chapters |
Analysis of cash flows | 7 |
Analysis of competing hypotheses (fraud theory approach) | 1 |
Consideration of analytical and accounting anomalies | 8 |
Big data and data analytics | 1, 4, 5, 6, 7, 8 |
Consideration of the fraud triangle | 2, 3 |
Use of graphical tools for analysis and communication | 1 |
Internal controls, the control environment, and opportunity | 1, 8 |
Interviewing for information and admissions | 1, 3 |
Analysis of nonaccounting and nonfinancial numbers and metrics | 1, 3, 7, 8 |
Financial statement and ratio analysis | 3, 7 |
Consideration of red flags | 1, 2, 7, 8 |
Analysis of related parties | 7 |
These tools and techniques discussed in prior chapters, in the right circumstances, will be applied to evidence potentially associated with asset misappropriation, corruption, financial reporting malfeasance, and other financial crimes. They may also be used in civil litigation—cases centered on operational and financial performance, valuation, and employment. Some tools and techniques will be revisited in more detail in this chapter, but space limitations prevent repetitive coverage of material covered in other sections of the textbook. Other tools and techniques, for example interviewing, will be touched upon in this chapter and presented in greater detail in Chapter 10 as well.
Documentary evidence is the backbone of most financial forensic examinations. Even examinations conducted using digital databases will need to be grounded in documentary and other physical evidence before the examination concludes. At trial, documents can sometimes be more reliable and dependable than eyewitnesses. Documents do not forget, cannot be cross-examined, cannot commit perjury, and—assuming the antifraud professional correctly interprets the meaning of the document’s content—tell the same story every time. In addition, documents provide the potential for fingerprints and other physical evidence.
Documentary evidence includes that gathered in both paper and electronic forms and includes invoices, contracts, deeds, titles, birth certificates, agreements, receipts, and forms. Documents may be collected from client company records, litigants, public records, and Internet searches, among many other sources. These records can become part of the evidentiary material or may become inputs for demonstrative evidence such as link charts, timelines, and flow diagrams. Documentary evidence also may become inputs for direct and indirect financial analysis discussed later in the chapter. Once obtained, the document is not only examined for content but also evaluated for authentication. Some items for which a document should be examined include:
Documents can provide evidence related to the act, concealment, or conversion. Related to the act, bank statements can show that checks written to the company were in fact deposited into the perpetrator’s or an accomplice’s bank account. Bank statements can also be altered, for example, by applying correction fluid to balances or adjusting amounts, thereby providing evidence of concealment. Finally, documents from public records, the Internet, and other sources may be included as part of an indirect financial profile method, such as the net worth method, to demonstrate that the person has income from unknown sources and thus has benefited from the act (conversion).
Bank, credit card, and investment statements can be integral evidence in fraud and forensic accounting cases. One would think that smart fraudsters would be unlikely to run their ill-gotten gains through their checking account, but examination of monthly financial information for known bank accounts, credit cards, and investment accounts may provide clues and other examination leads. For example, checking account activity may show deposits from sources other than known places of employment. Such deposits should be traced to determine whether additional, previously unknown, sources of income exist.
In addition, bank account disbursements may be made to previously unknown credit cards, installment accounts, and investment accounts. These disbursements may become leads that the fraud or forensic professional can follow as they continue to follow the money. Credit card statements may demonstrate that amounts spent far exceed the suspect’s known sources of income, and that those credit card payments must be made from a previously unknown source.
Investment accounts need to be scrutinized for transactions, for money flows to other accounts (e.g., credit cards, checking accounts, other investment accounts), for new leads, and also to ensure that money that appears to be coming from unknown sources is not coming from the person’s previously accumulated investment holdings. Thus, bank, credit card, investment, and other similar financial statements can provide evidence of the act, concealment, and conversion and can provide additional clues regarding lifestyle and where the missing money may have flowed.
Generally, obtaining victim company bank statements and other pertinent documentary records is a basic requirement for initiating an examination and providing evidence of a fraud act. Evidence of concealment and conversion related to a fraud, financial crime, or civil matter is more difficult, because they require financial documents of the alleged perpetrator. In such cases, a subpoena or search warrant is often necessary, and that requires probable cause. While the probable cause threshold is not overly burdensome, it prevents examiners from going on fishing expeditions in an attempt to identify the perpetrator.
In addition to bank statements, deposit tickets, and canceled checks, other items may be sources of potentially useful examination information:
Applications, in particular, provide useful information, including addresses, phone numbers, assets, liabilities, and associated persons, such as spouses, parents, siblings, children, and other cosignatories.
Invigilation is an examination technique that considers periods before, during, and after a suspected fraud has occurred. This method looks for changes in patterns of performance during the time that the suspicious activity occurred. It provides evidence of the act by helping to calculate how much money may be missing and provides powerful visual evidence that a fraud has occurred.
In Table 9-1, consider the following example of an invigilation. Jim is suspected of stealing money from a group of vending machines. Notice that the deposits from the vending machine revenue decline during the period of Jim’s employment until his termination at the end of 20x6. In 20x7, deposit levels rise almost to the level immediately prior to Jim’s pre-employment period. This pattern is clear and distinct, and it suggests a correlation between the pattern of deposits and the period of Jim’s employment. This is a compelling piece of evidence.
The three years when Jim was not employed—20x1, 20x2, and 20x7—can be used to estimate the amount of losses during Jim’s watch over the vending machines. The expected annual deposits, assuming no increase in vending prices, is about $51,401 ([53, 064 + 49, 511 + 51, 630]/3). Next, expected deposits are compared to those actually made into the bank account. Based on this analysis, it appears that Jim did not steal any money during 20x3, his first year on the job. However, more than $4,000 appears to be missing in 20x4. Furthermore, the estimated amount of losses due to Jim’s fraud rises to more than $22,000 in 20x6. The total estimated amount of losses for the four-year period is approximately $38,800. Of course, additional evidence would need to be gathered. For example, who had keys and other access to the vending machines besides Jim? Were any of the deposit tickets altered? Were the same number of vending machines in use during all seven years? Were there periods when a large number of machines were not available for use?
Invigilation becomes one piece of evidence that, when combined with additional evidence, can be presented as a compelling case. This technique can be used in a variety of situations where evidence exists to contrast periods during a suspected act versus periods before and after, including civil litigation cases where both the plaintiff and defendant explain the situation from their perspective. Those explanations have a beginning and an end, and the evidence can be examined before, during, and after to examine the assertions of both parties in a civil case.
TABLE 9.1 Example of Invigilation
Prior to Hiring Jim | Period of Jim’s Employment | After Jim | |||||
Month | 20x1 | 20x2 | 20x3 | 20x4 | 20x5 | 20x6 | 20x7 |
JAN | 4,240 | 3,850 | 4,143 | 4,333 | 3,371 | 2,089 | 4,460 |
FEB | 4,050 | 3,978 | 3,790 | 3,856 | 3,680 | 2,689 | 4,672 |
MAR | 4,270 | 3,208 | 4,615 | 4,363 | 3,183 | 2,371 | 3,869 |
APRIL | 4,481 | 3,751 | 4,049 | 3,585 | 3,316 | 2,331 | 3,989 |
MAY | 4,462 | 4,291 | 4,209 | 3,230 | 2,497 | 2,174 | 4,131 |
JUNE | 4,212 | 3,042 | 3,887 | 3,903 | 3,516 | 2,287 | 3,790 |
JULY | 4,973 | 4,737 | 4,402 | 3,554 | 2,912 | 2,410 | 4,300 |
AUG | 5,286 | 4,100 | 4,934 | 3,413 | 3,271 | 2,672 | 4,515 |
SEP | 4,336 | 3,551 | 3,528 | 3,469 | 2,865 | 2,434 | 4,930 |
OCT | 3,075 | 4,355 | 3,924 | 3,994 | 2,838 | 2,185 | 3,690 |
NOV | 4,599 | 4,791 | 4,473 | 4,231 | 3,153 | 2,567 | 4,763 |
DEC | 5,082 | 5,859 | 6,005 | 5,219 | 4,555 | 2,927 | 4,521 |
Actual | 53,064 | 49,511 | 51,958 | 47,150 | 39,156 | 29,136 | 51,630 |
Expected | 51,401 | 51,401 | 51,401 | 51,401 | 51,401 | ||
Estimated Overage (Shortage) Estimated Loss Dollars |
556 | −4,252 | −12,245 | −22,226 −38,763 |
229 |
Witness interviewing and interrogation can be integral aspects of a fraud and forensic accounting investigation. In a civil case, interviews are most often carried out in the form of depositions. This activity is used to find information and discover evidence in a case.
Although the common perception of an interrogation may conjure up images of bright lights and rubber hoses, an interrogation simply refers to an admission-seeking interview where the interviewer believes he or she has identified the perpetrator and is now attempting to get the subject to confess to the illegal activity.
Witness interviewing and interrogation skills are not normally developed in traditional accounting curricula. Because these skills are so important to fraud and forensic examinations, witness interviewing and interrogation are both covered in detail in Chapter 10. Note that interviewing can be used to gather evidence pertinent to the act, concealment, and conversion.
As financial crimes have become more sophisticated and many nonfinancial crimes are investigated by following the money flow, examiners have adopted and adapted techniques, traditionally associated with the pursuit of organized crime and drug trafficking, to pursue white-collar criminals. Such techniques include electronic surveillance, search warrants, and undercover operations. Thus, surveillance and covert operations are used as part of the examination process for fraud and financial forensic examinations; although, these methods tend to be reserved for more sophisticated frauds with law enforcement involvement. Some of the objectives of this type of work are to gather evidence, identify those engaged in illegal activities, identify co-conspirators, recover money, and determine how an operation is conducted.
Generally, these techniques are not conducted by fraud examiners and financial forensic professionals, because they do not have the required training and skill set. Furthermore, such operations are more common when the activity is more complicated—involving multiple individuals, organizations, and jurisdictions. In these types of cases, surveillance and covert operations may be necessary to fully develop the case and identify all individuals involved. Many examination operations are conducted by “private investigators” or law enforcement officers who have the necessary training, experience, and legal authority (e.g., license or sworn oath) to engage in this type of activity. In fact, we recommend that the traditional fraud examiner and forensic accountant not perform these types of activities without proper training due to the dangers to both the professional and the outcome of the examination.
Several types of surveillance are possible. First, fixed-point surveillance (e.g., stakeout) involves observing activity from a stationary, discreet location. These types of observation activities are relatively simple and require the use of detailed activity logs, photographs, and videos. A more difficult surveillance approach is to track people and goods using mobile surveillance. Mobile surveillance requires considerably more skill than fixed-point surveillance, and the risk of examiner discovery by the perpetrators is real, especially when the target is suspicious of those around him or her. Although the risks could be higher, the potential rewards might also be greater, because the examiner may discover how goods are transported, as well as learning about previously unknown linkages between people, places, and things.
Videography during surveillance provides a visible evidence log that can be shared with other investigators, as well as with prosecutors, defense attorneys, judges, and juries. Keep in mind that if videos are used to document activity and linkages, in general, audio features should be disabled. Generally, as long as an individual’s reasonable expectation of privacy has not been violated, videography is legal. The theory is that what people do in public has the possibility of being observed by others, and thus, people acting in public have a lowered expectation of privacy. However, if audio is also captured during the surveillance, different state laws, rules, and regulations may apply—audio surveillance has more stringent requirements.
Most people typically think of wiretapping in connection with audio or electronic surveillance. Generally, unless an individual is speaking loudly in public, most conversations are considered private. While electronic surveillance is permissible in fraud and forensic examinations, the examiner must obtain court permission before such activities are carried out. Under federal law, individuals are allowed to video- or audio-tape conversations in which they are a part without telling the other party. State laws vary, however, so before recording your own conversations, check with counsel. Under no circumstances, is it legal to tape-record a conversation between two or more people if you are not a party to the conversation. Due to a person’s reasonable expectation of privacy, the ability to convince a judge that electronic surveillance other than previously described can be quite challenging. If successful, the examination technique can provide valuable information, because people are generally more willing to discuss sensitive information in private conversations.
The most extreme level of surveillance is the undercover operation. These operations are very costly due to the time commitment required, and they may put the examiner at personal risk. Generally, undercover operations are permissible as long as they are based on some reasonable level of probable cause and do not induce someone to commit a crime he or she would not otherwise commit (such an inducement, which is illegal, is called “entrapment”). Undercover operations are most effective with large-scale incidents, and when other methods fail to develop the case and the necessary evidence. Such operations should not be conducted unless the undercover work can be carefully monitored, the examination can remain secret, and the undercover operative safe, until the examination is completed. Typically, the undercover officer will face a variety of challenges related to legal and ethical conduct. The examination should end when sufficient evidence has been collected.
Confidential sources and informants can be used to gather information and evidence about a case. Generally, sources have no criminal involvement in the case and are good citizens who are providing information. Informants are more culpable and typically have a direct or indirect role in the criminal activity. Sources and informants are usually considered confidential, so efforts should be made to maintain their confidentiality. Their information is independently verified, and documentary evidence and other witnesses are developed based on their leads. Good examiners evaluate the motives of their confidential sources and informants, as well as the reliability and validity of their information.
Currency Transaction Reports (CTRs), Suspicious Activity Reports (SARs), and FinCen Form 8300 are excellent sources of information for law enforcement officers trying to identify and follow the flow of money from illegal and illicit sources. The CTR, FinCen Form 104, was a direct result of the 1970 Bank Secrecy Act. CTRs must be filed by financial institutions when transactions include $10,000 or more in currency in a single banking day.
Financial institutions are broadly defined as banks, other depository institutions, brokers and dealers in securities, money transmitters, currency exchangers, check-cashing organizations, issuers and sellers of money orders, and traveler’s checks. Casinos must file a form 103, rather than the normal CTR. Qualifying transactions include deposits, withdrawal, and currency exchange and wire transfers over the $10,000 limit.
Although privacy concerns were an issue for banks, this concern was alleviated in 1986 when the Money Laundering Control Act prevented banks from being held liable for releasing transaction information to law enforcement. In 2008, more than 15 million (15,449,549) CTRs were reviewed and posted into the Currency Banking and Retrieval System, as well as 733,543 SARs.2
SARs are used by financial institutions to report any suspicious activity or potentially suspicious activity to the Financial Crimes Enforcement Network (FinCen). If the suspected person is known and can be identified, the threshold to file a SAR is $5,000. If the suspicious activity is not associated with a known individual, the limit is raised to $25,000 of suspicious activity. SARs are particularly effective and are often used when currency transactions appear to be structured so that they fall just below the $10,000 reporting limit threshold for CTR reporting. The purpose of the SAR report is to help law enforcement identify individuals and organizations involved in money laundering, fraud, organized crime, drug trafficking, and terrorist financing. In order to protect themselves and limit liability, financial institutions often conduct due diligence work before filing a SAR to ensure that the transactions appear to be generated from illegal or illicit sources.
Form 8300 picks up where CTRs leave off, requiring any business receiving a cash payment in excess of $10,000 to report the transaction to FinCen using IRS Form 8300. Automobile dealers are one example of a business where a customer may pay for an expensive vehicle in cash, triggering the Form 8300 requirement. The Form 8300 instructions require businesses to accumulate multiple payments if in total the payments exceed the $10,000 threshold within a twenty-four-hour period.
The term “cash” means U.S. or foreign currency received in any transaction. Cash also includes a cashier’s check, money order, bank draft, or traveler’s check with a face amount of $10,000 or less and received in a designated reporting transaction, or any transaction in which the payer is attempting to avoid the filing of Form 8300. A cashier’s check, money order, bank draft, or traveler’s check with a face amount of more than $10,000 is not considered cash, since the bank or financial institute that issued such monetary instruments is required to file a Currency Transaction Report (CTR). A personal check is not considered cash, regardless of the amount.
Individuals will make statements, give instructions, and discuss many topics in electronic format, such as email, text messages and via various forms of social media that they would never memorialize in written documents. As a result, the value of email to include “smoking gun” evidence of financial crimes, fraud, motivations for activity, and other information cannot be overstated. In general, external to an organization, email is accessible only if the organization volunteers the information or it is gathered from a resulting subpoena or court authorized warrant. However, U.S. courts have generally held that emails within an organization that are generated by employees are not private, and that employees should have no reasonable expectation of privacy with regard to emails generated or received on an employer’s computer. However, there are exceptions. For example, some courts have held that it is illegal to intercept email “in transit” to the recipient. Accordingly, it is best to review your procedures for accessing emails with legal counsel.
Email, text messages and social media accounts provide useful content, and evidence of linkages among people, transactions, or other activity. For example, an email with the extension “.edu” implies that the person has some association with an educational institution. In addition, email headers contain information about the servers that have processed and transported the email and can often be traced to the source. More sophisticated criminals can use anonymous re-mailers that prevent the source of the email from being discovered.
The world in which we live is impacted by digital information every day. Our names, addresses, phone numbers, and other personal information are captured in numerous databases around the world. In addition, cheap electronic storage has made the ability to capture more and more information less costly. This information, when sorted and analyzed in different ways, often has numerous uses. As a result, the amount of information captured electronically has ballooned to staggering levels.
This same phenomenon has also occurred in transaction detail captured by various organizations, whether for-profit or not-for-profit. Transactions that are coded for the general ledger for accounting purposes also often have additional coding for costs centers and projects that allow the data to be pulled and analyzed, after-the-fact. Large American corporations process billions of transactions annually. As a result, only through the use of effective and efficient digital tools and techniques can fraud examiners and forensic professionals complete their work.
Some of these tools include big data, data analytics, and data mining software; software that looks for hidden patterns in data that can be used to predict future behavior. For example, data mining software can help retail companies find customers with common interests. The term is commonly misused to describe software that presents data in new ways. True big data, data analytics, and data mining software doesn’t just change the presentation, but actually discovers previously unknown relationships among the data. An important field of computer science concerns recognizing patterns. Such software is central to optical character recognition (OCR), voice recognition, and handwriting recognition but can also be applied to financial data to look for unusual and nonfinancial (e.g., text data) activity that is suggestive of fraud.
In this regard, the results of pattern recognition searches and data analytics provide evidence of who, what, where, when, how, and why. Like most evidence, individually, the data simply provide information, but in the context of other evidence gathered as part of the examination process, the results of digital analysis might provide compelling and powerful insight into the act, as well as how it was perpetrated, concealed, and who benefited. In organizations with large financial transaction databases, one way to analyze data is with sophisticated pattern recognition and big data software. These application programs can “see” things in the data that the average examiner couldn’t without extensive amounts of examination time.
Although the bulk of the fraud examiner’s and forensic accountant’s work is usually completed using physical and electronic documents and electronic data, other physical evidence is also important. For example, forensic auditors from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) regularly work crime scenes along with nonfinancial investigators. Although ATF forensic audit personnel are not normally the first responders, they are knowledgeable about what financial documents should be bagged and tagged. ATF training for financial personnel includes crime scene examination tools and techniques.
Other physical evidence may include fingerprints on documents to establish that a person has had contact with the document, and possibly even reviewed it. This would demonstrate that the individual has knowledge of the document’s existence, and perhaps its content. Charred and partially burned financial books and records can provide valuable clues during an examination. Phony documents, forgeries (including signatures), a typewriter’s unique identifiers, photocopies, indentations, and paper age are some examples of physical evidence that may become part of a financial examination.
Further, nonfinancial information can provide invaluable clues. Addresses and phone numbers can provide proof of linkages between people and organizations. For example, two businesses using the same phone number suggest some association between those organizations. Dates and times can provide important evidence about who, when, where, what, why, and how. This sequencing of events is not financial evidence but can help put the financial examination into context. For example, a timeline may show that an individual had nonsharable financial burdens from severe and costly health problems of a family member prior to a fraud. The existence of the medical condition is not financial evidence but could provide some insight into the financial pressure on the alleged perpetrator.
For the first time, in 2016, the ACFE Report to the Nations included findings related to concealment in the following chart is shown in Figure 9-3. Interestingly, the frequency of various concealment methods did not vary much based on the type of fraud perpetrated. Creating and altering physical documents were the most common concealment methods for all three categories: asset misappropriation, corruption, and financial reporting fraud, though the creation of fraudulent documents was slightly more common in corruption cases. Additionally, the ACFE found that the vast majority of fraudsters proactively attempted to conceal their schemes; only 5.5% of respondents noted that the perpetrator did not take any steps to hide the fraud.
Probably the most interesting observation is that the most common concealment schemes were “manual,” physically created, and altered documents, followed by manipulations in the accounting systems. Although computers are an integral part of the business work, electronic manipulation was a relatively less frequent concealment technique. This information will be interesting to track over time. Keep in mind that if electronic records have not been manipulated, then analysis of data (big data and data analytics) can be used to help identify anomalous symptoms of fraud.
Concealment is the activity that is most closely associated with intent. Concealment can occur through the negligence of others or by direct intervention of the fraud perpetrator. When investigating an asset misappropriation, the examination should be conducted in a way that does not arouse suspicion. The examiner should start as far from the suspected target as possible and get closer as the examination proceeds.
The examination may start with public records searches. Once background data have been collected, the examiner should review the documents, including company personnel records and other company books and records. As evidence trails are developed and the examiner gathers clues, former employees may be interviewed. Based on the evidence, internal witnesses may also be interviewed. Finally, when all possible evidence has been collected, all alternative hypotheses have been eliminated, and the evidence pointing to the suspect is seemingly conclusive, the examiner will interview the suspect and other examination targets.
In contrast, with regard to financial statement fraud and tax fraud, the person responsible for the financial statements or tax return has already made a representation—that the financial statements are a reasonable reflection of the entity’s underlying economic performance, or that the tax return presents a reasonable reflection of taxable income and taxes owed. In those situations, the financial statements or tax returns are part of the concealment activity.
In fact, the person responsible has gambled that (1) the auditor, examiner, or forensic accountant is not going to identify red flags associated with his or her fraudulent representations and that (2) even if the red flags are identified, the auditor, examiner, or forensic accountant will not be able to ascertain what has happened. In such situations, the examiner should get the responsible person to verify his or her agreement with the accuracy of the financial statements and tax returns and then test those assertions. The representations made are an integral part of the fraud, particularly the concealment portion. In such cases, carefully document such statements (assertions) and then test the veracity of the assertions using documentary and other physical evidence.
Accounting books and records that are found during the course of an examination to have been altered provide compelling evidence of concealment. The methods by which documents can be altered are almost limitless, but include:
Although fraud examiners and forensic accountants are not experts in these areas, they provide a first line of defense in an effort to identify possible alterations. If there is any indication that the books and records have been altered, antifraud professionals and forensic accountants should take steps to verify the alteration by having a qualified professional examine the documents in question.
The general ledger is an excellent resource for fraud examiners and forensic accountants, assuming that the transactions associated with the fraud have been processed through the entity’s books and records. For example, disbursements must pass through the general ledger, so a money trail exists. Assuming that the fraudster wants to conceal his or her activity, he or she needs to post a debit to some account while the reduction in cash is posted via a credit to cash. Because stockholders’ equity accounts typically have very little activity, most fraud perpetrators would avoid these. However, no stone should be left unturned; balances and activity levels should be checked for all accounts, because even stockholders’ equity accounts can be used as a temporary hiding place.
Assuming that stockholders’ equity is unlikely to be used to conceal fraudulent transactions that leaves assets, liabilities, revenues, and expenses. Revenue accounts, other than returns and allowances, typically would not have debit entries. Thus, debits to revenues would likely draw a great deal of attention. This being the case, any debit to revenues would and should be carefully scrutinized.
Debits to liabilities are a stronger possibility than to revenue or stockholders’ equity, and the effect would be an understatement of liabilities. Debits to specific liabilities may be caught through the audit confirmation process and by examining reconciliations of vendor subsidiary account balances to vendor statements. Journal entry debits to liability general ledger accounts should be examined for appropriate backup and approval to ensure that the transactions are legitimate.
Debits to assets and expense accounts are the most common places for concealment. Debits to assets create an overstatement of assets. Assuming that the victim company takes reasonable steps to verify and reconcile assets balances, this approach to conceal a fraud creates irreconcilable balances. Thus, to catch concealment on the asset side, the antifraud professional or forensic accountant needs to reconcile asset details to the general ledger balance. If reconciliations are prepared as part of the company’s normal accounting procedures, reconciling items should be carefully scrutinized for appropriate backup, appropriate review and approval by management, and the age and size of the reconciling items.
Debits to expense accounts are the most common method of concealment. Assuming that expense account balances do not exceed budgeted amounts or exceed budgets by only a relatively small amount, the activity is not likely to raise red flags. Then, once expenses are closed into retained earnings as part of the annual closing process, the chance that the overstated expense balance will be caught decreases substantially. Whereas assets present an ongoing concealment problem for the fraud perpetrator, expenses are problematic for only one period. Some of the items that the antifraud professional and forensic accountant need to scrutinize are the existence of reconciliations and reconciling items for source, backup, and approval.
Closely related to the general ledger, journal entries are a potential source of fraud concealment. Journal entries can be used to eliminate unreconciled balances and to hide inappropriate removal of cash and other entity resources. Thus, period-end and year-end journal entries also need to be examined. The review of journal entries includes looking for too many journal entries, as well as too few—and for missing journal entries. Journal entries need to be scrutinized as to source, backup, and approval.
Examination of the general ledgers, account balances, account activities, reconciliations, reconciling items, and journal entries are also often relevant in forensic accounting examinations. These items need to be evaluated in the context of the written complaints and relevant deposition testimony.
Tax returns are an important source of information for fraud and forensic accounting engagements. Personal and business tax filings contain representations put forth by the taxpayer related to their taxable income. This information can be correlated with activity in bank accounts and corporate books and records and used as a source of examination leads. Schedule M in corporate tax returns requires reconciliation between book income and taxable income. Then, book income on the tax return can be reconciled to financial statement income. Furthermore, the new M-3 reconciliation for larger public companies provides a detailed reconciliation between book income and taxes. Schedule M-3 is required for corporations and partnerships with $10 million or more in assets. According to Deborah M. Nolan, IRS Large and Mid-Size Business Division Commissioner, “Schedule M-3 will enable the IRS to focus more quickly on high risk issues and taxpayers requiring our attention, and reduce our time spent with compliant taxpayers.”
Tax returns may provide evidence of involvement in businesses not previous known or disclosed by the target. In addition, interest and dividend income may suggest investment, banking, hidden CDs, and other income-generating accounts of which the examiner was not aware. Deductions can also be a source of information. For example, deductions for real estate taxes may reveal ownership interests in property that were not previously disclosed. Furthermore, the amounts and types of deductions might raise questions about whether that particular business operation should need that level of support, a possible indicator of illegal or illicit payments. For example, a small laundry business paying large consulting fees does not make sense and serves as a clue that requires additional examination. If warranted, in some cases, the tax preparer can be interviewed, and his or her work papers subpoenaed.
Jimmy Vaughn, retired forensic auditor for the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), asks West Virginia University students, “How can you tell the difference between a legitimate mistake and fraud? For example, if the evidence suggests that a person cheated on their taxes for three years, what does it mean? How do you interpret it?” His suggestion to the students, “If you do it once, it’s a mistake. If you do it twice, you might be a little sloppy or careless. Three times, we have a pattern. A pattern is pretty indicative that the act was probably deliberate and less likely to be a mistake.”
Assets can be hidden through several methods: hidden bank accounts, hidden investment accounts, purchasing of assets through straw men or front organizations, and transferring assets to individuals or accounts where detection can be difficult. The most common means for hiding real estate and business ownership are to transfer those assets to another party over which the person holding the assets has some element of control. Family members, such as a child or spouse, are a common technique used for hiding such ownership. Wives in particular make a good haven for hidden asset ownership, because they bring a maiden name to the marriage that has a complete history. Thus, examiners need to search for hidden assets using not only family members’ names but also the spouse’s maiden name. Identification of the spouse’s maiden name can be made using voter registration and marriage records filed at the state and local levels.
To identify assets that may have been transferred, the examiner needs to carefully examine tax returns and business and personal financial records to look for transfer activity. When assets from one period disappear in the next period’s records, the examiners have a clue that assets may have been transferred.
Another problem may be income that is diverted away from known accounts to unknown accounts. The examiner needs to search for transactions between the target’s known accounts and accounts not previously identified by going through check registers, canceled checks, account statements, and other records obtained during the examination to identify suspicious activity that may suggest hidden assets or income diversion.
Other places where assets can be directed include children’s trusts, mortgage payments, insurance policies, prepaid credit cards, savings bonds, traveler’s checks, and money orders. Money transferred directly into a child or family trust without passing through known bank accounts can be an effective tool for hiding income and assets, provided the examiner does not discover the existence of the trust. Another mechanism for hiding assets is to pay down mortgages without running the payments through known bank accounts. If the examiner does not inquire about the existence of mortgages or examine mortgage statements to tie the payment of interest and principal to known accounts, an important clue suggesting unknown income sources or hidden assets may be missed.
Insurance policies can be used to accumulate wealth that does not show up on most financial statements. An individual trying to hide income may make payments to insurance policies from unknown accounts and obtain good investment returns, and the examiner would be none the wiser. Prepaid credit cards, savings bonds, cashier’s checks, traveler’s checks, and money orders are assets that do not show up on traditional account statements, take up little space, and can be securely held in a safe deposit box. Without appropriate inquiry and search for the existence of safe deposit boxes, the examiner may come up empty when it comes to hidden assets and concealed sources of income. Clues about the existence of safe deposit boxes can come from bank statements where annual fees may appear.
More sophisticated individuals or organizations with significant hoards of ill-gotten gains often use offshore bank accounts to hide assets and conceal sources of income. Typically, offshore financial institutions are chosen for their favorable tax treatment and commitment to secrecy. For example, Nevis and its sister country St. Kitts form the Independent Federation of St. Kitts and Nevis. They are located in the Leeward Islands, approximately 1,200 miles southeast of Miami, Florida. St. Kitts–Nevis offer complete confidentiality if foreign authorities seek private banking and financial records. Prison terms are mandatory for violation of the statute. As another example, www.henleyglobal.com provides information on the best jurisdictions for companies, trusts, foundations, and private residences. This website reviews information on these types of services for more than thirty countries. Favorite offshore countries change from time to time, so it is prudent for the examiner who needs such information to keep current.
Hiding assets isn’t isolated to criminal organizations and other bad actors. In a bitter divorce, a spouse may want to minimize the portion of assets and income a court gives to his or her soon-to-be ex-spouse. A scenario that may be used to accomplish this is if he or she has a small business and “hires a consultant.” She or he disburses a large amount of money to the consultant at an offshore address, to provide services for the business (assume that the consultant or consulting firm doesn’t exist). She or he has just moved money offshore and out of the jurisdiction of the court, while reducing the value of the business. Hiding assets is a common ploy in marital disputes and may be relevant in many other forensic accounting engagements and fraud examinations.
Using indirect methods to estimate assets controlled by an entity, or income to an entity, is referred to as “financial profiling.” These analyses are methods for developing indicators of concealed income and hidden assets. In many cases, fraudsters or individuals subject to civil litigation, such as divorce, may not run all of their cash income through bank accounts or the books and records of companies. As such, indirect financial profiling may be the only means to establish illegal sources of income or the existence of hidden assets. Furthermore, prior court decisions have concluded that establishing illegal or illicit sources of income and hidden assets through the use of indirect methods can be admissible as evidence in court. Indirect approaches often provide circumstantial evidence.
Legitimate individuals generally run their income through one or more known bank accounts. Similarly, legitimate businesses utilize known bank accounts, and they also track financial transactions using detailed books and records and maintain backup documentation to support posted transactions. In many fraud and forensic accounting cases, the books and records are incomplete or otherwise inadequate. In such cases, the examiner must resort to other methods to establish estimated income levels and the existence of hidden assets.
An indirect method is generally used when
Other clues that may arise during an examination that suggest further work and the need to use the indirect method include:
The primary challenge related to using the financial profiling methods is the amount of legwork involved in developing sources of information. The examiner is likely to start with a tour of any known businesses, drive-bys of the home and other known real estate locations, and a review of any books and records that are available (e.g., tax returns). From there, the examiner can get an idea of income levels.
For example, suppose that a person of interest has reported taxable income of $50,000 and has corresponding bank account activity to support that income amount, but when the examiner drives by the person’s home, he sees a Mercedes in the driveway of a $500,000 home. The examiner would appropriately conclude that something doesn’t make sense. The examiner would likely go to the county courthouse to look for deeds of ownership, titles, liens, and UCC filings and could also visit the secretary of state’s office to determine business ownership. Some of the sources for determining the inputs for the indirect methods include4:
Most simplistically, assets are resources owned or controlled by an organization, a business, or an individual. Liabilities are obligations owed to others by that organization, business, or individual. Owner’s equity—sometimes referred to as stockholders’ equity—is the difference between the two and consists of contributions made by the owner(s) and their accumulated but undistributed profits. The relationship between assets, liabilities, and owner’s equity is expressed in the accounting equation—assets equal liabilities plus owner’s equity. This fundamental relationship implies that assets are provided by one of two sources: creditors (liabilities) or owners (owner’s equity or stockholders’ equity).
The easiest way to approach an analysis of net worth is to identify assets and the amounts paid for those assets and subtract obligations to creditors; whatever is left over is the owner’s portion (also referred to as net worth). The accounting equation applies not only to corporations, but to individuals as well. The net worth method works by examining the change in net worth from one year to the next. Changes in net worth come from owners’ or individuals’ income sources that are used to purchase assets.
See Table 9-2 for examples of assets and Table 9-3 for examples of liabilities or obligations.
TABLE 9-2 Examples of Assets
Net Worth: Assets | |
Resources or things of value owned (including cash) | |
Individual | Organization |
|
|
TABLE 9-3 Examples of Liabilities/Obligations
Net Worth: Liabilities | |
Financial obligations (debts) and claims on assets (liens) | |
Individual | Organization |
|
|
In this manner, the net worth method provides circumstantial evidence that amounts paid for assets and expenditures exceed income from known sources for a given period of time. Assuming that the examiner has made a thorough search for documentation, the net worth method provides a basis for estimating a person’s income and cash flow from illicit, illegal, or unknown sources.
The steps for computing net worth are as follows:
Assume the following facts and circumstances, and the goal is to calculate the change in net worth for 2007, 2008, and 2009:
Financial Profile Worksheet Net Worth Analysis | ||||
Year | ||||
Assets | 2007 | 2008 | 2009 | Source |
Home | 250,000 | 250,000 | 250,000 | County Records |
Comptech Wesleyan | 15,000 | 90,000 | 90,000 | Broker Records Broker Records |
WJU Chevy Truck |
32,000 | 32,000 | 125,000 | Broker Records CC Application |
Toyota Camry | 10,000 | 10,000 | CC Application | |
Ski Boat | 52,500 | 52,500 | 52,500 | Loan |
Savings Account Jaguar | 7,500 | 12,500 | 072,000 | Divorce Testimony DMV/County Records |
Contributed Capital | 20,000 | 20,000 | 20,000 | Secretary of State/F/S |
Total | 387,000 | 467,000 | 609,500 | |
Liabilities | ||||
Home Mortgage | 152,000 | 140,000 | 128,000 | Calculation/CR |
Car Loan—Chevy Truck | 24,000 | 22,800 | CC Application | |
Home Equity Loan—incl. Toyota Camry | 13,500 | 12,300 | CC Application | |
Boat Loan | 21,000 | 18,600 | 16,200 | Loan |
Car Loan—Jaguar | 50,000 | Creditor | ||
Total | 210,500 | 193,700 | 194,200 | |
Net Worth (Assets–Liabilities) | 176,500 | 273,300 | 415,300 | |
Change in Net Worth | 96,800 | 142,000 | ||
Identified Expenses | 40,000 | 50,000 | Divorce Testimony | |
Estimated Total Income | 136,800 | 192,000 | ||
Income from Known Sources | 62,500 | 65,625 | Divorce Testimony/Tax Return | |
Income from Unidentified Sources | $ 74,300 | $126,375 |
Notice that the identified expenses are added to the change in net worth to estimate total income. Based on this analysis, the subject has income from unidentified sources of almost $75,000 in 2008 and more than $126,000 in 2009. Preparers of net worth analyses should know that the calculation of net worth for the base year is very important. Further, this method works best when suspected income from unidentified sources is large. For a given period, the net worth analysis summarizes evidence of liabilities, ownership of assets, and expenditures and also provides additional leads on beneficial ownership of assets held by others for the subject, and expenditures made by others for the subject. As discussed in the evidence section, each source should be evaluated for reliability and each number for validity. Such additional steps help the examiner to rate the relative contribution of this work in the context of the greater case examination.
The lifestyle probe, also called the sources and application of funds analysis, addresses the flow of funds for a given period. If more known expenditures exist than known sources of income and other known cash flow, there must be unknown sources of funds. Thus, the lifestyle of a subject of interest (e.g., a suspect employee) may give clues to the possibility of unreported income. Obvious lifestyle changes that may indicate fraud and unreported income include:
The calculation of unknown income using the lifestyle probe is as follows:
Assume the following facts and circumstances. The goal is to estimate income from unknown sources for 2008 and 2009.
Financial Profile Worksheet Sources and Application of Funds | |||
Year | |||
Application of Funds | 2008 | 2009 | Source |
Home Mortgage Payments | 40,000 | 65,000 | CTRs/SARs |
Savings Account Deposits Savings Account Deposits Stock Watch Purchase Cabin Remodel Cabin |
12,000 18,000 65,000 |
20,000 13,500 35,000 |
Savings Account Savings Account Brokerage Ex-Husband County Records Building Permits |
Florida Home BMW 700 Series | 35,000 | 155,500 | County Records Dealership |
BMW Loan Payments | 13,530 | 14,760 | Dealership |
Ocean Pacer Sailboat | 21,000 | Salesman | |
Annual Expenses | 60,000 | 65,000 | Ex-Husband |
Total Known Expenditures | 243,530 | 389,760 | |
Known Sources of Funds
Employment Income |
65,000 | 125,000 | Tax Return |
Gift from Parents | 12,000 | Ex-Husband | |
Downpayment on BMW Loan from Ex-Husband | 25,000 | 25,000 | Dealership Ex-Husband |
Total Known Inflows | 102,000 | 150,000 | |
Funds from Unknown Sources | 141,530 | 239,760 |
Based on the above information and analysis, the target has unknown sources of income totaling $141,530 in 2008 and $239,760 in 2009. Notice that the analysis is not concerned about balances, but rather cash flows or information that suggest cash flows were exchanged. Also notice that the sources and application of funds—the lifestyle analysis—made little use of bank statements or disbursement and deposit information. This method works best when the target operates mostly on a cash basis. In addition, the lifestyle analysis can be used to verify the accuracy of other techniques. It is useful when the target has little or no net worth but seemingly large cash expenditures. Also, it is easiest to use when there is little or no change in assets or liabilities. Like the net worth method, this approach is most useful when looking for large unknown sources of income.
The lifestyle analysis has some advantages over the net worth method:
The bank records method is a hybrid between directly analyzing bank, savings, credit card, and brokerage account records and the net worth and sources and application of funds methods that rely very little on bank records. The bank deposit method assumes that when cash is received, it can be either deposited in the bank or spent. The basic formula for the bank records analysis is as follows:
Assume the following facts and circumstances, and that the goal is to estimate income from unknown sources for 2008 and 2009:
According to CTRs filed with FinCen, the target purchased a Lexus in 2008 for $75,000 cash.
Tax returns, W-2s, and consumer loan records found in the target’s home office suggest that the target had income from known sources in 2008 of $95,000, income in 2009 of $115,000, and a consumer loan of $15,000.
Financial Profile Worksheet Bank Deposits Method | |||
Year | |||
2008 | 2009 | Source | |
Statement Period/Deposit Date
January |
8,012 | 8,902 | |
February | 6,097 | 6,774 | |
March | 10,733 | 11,926 | |
April | 3,803 | 4,226 | |
May | 10,028 | 11,142 | |
June | 12,705 | 14,117 | |
July | 10,551 | 11,723 | |
August | 12,491 | 13,879 | |
September | 12,957 | 14,397 | |
October | 11,647 | 12,941 | |
November | 4,629 | 5,143 | |
December | 11,347 | 12,830 | |
115,000 | 128,000 | Bank Statements | |
Known Savings and Loan Deposits | 5,000 | 2,000 | Bank Statement |
Known Deposits to IRA Accounts | 3,000 | 4,000 | Brokerage |
Total | 123,000 | 134,000 | |
Cash Expenditures
Lexus |
75,000 | CTR | |
Deposit on Purchase of Home | 25,000 | County Records | |
Purchase of Condo for Mistress | 80,000 | Interview | |
Total | 75,000 | 105,000 | |
Total Cash Spent | $ 198,000 | $ 239,000 | |
Known Sources of Income | |||
Consumer Loan | 15,000 | Loan Documents | |
Consulting Income | 95,000 | 115,000 | Tax Returns/W-2 |
Total | 110,000 | 115,000 | |
Income from Unidentified Sources | 88,000 | 124,000 |
Based on the above information and analysis, the target has unknown sources of income totaling $88,000 in 2008 and $124,000 in 2009. Even though cash disbursements from the checking account and other known financial resources are effectively ignored for this analysis, the examiner should review this activity for additional leads and to better understand the buying habits and lifestyle of the target.
Upon completion, the results of financial profiling (i.e., net worth, sources and application of funds, and bank records analysis) can be used as follows:
As discussed in the evidence section, each source should be evaluated for reliability and each number for validity. Such additional steps help the examiner to rate the relative contribution of this work in the context of the greater case examination.
When the examination requires evidence of the cash balances and activity, seemingly from unknown sources—money spent, or money unaccounted for—another technique is to analyze the tax returns.
The purpose of the “Cash T” account analysis is to determine if the money spent by an individual is more than what is reasonable based on the tax returns; in a similar manner, the Cash T can determine funds available to a stockholder of a corporation based on the corporate tax return. This technique called the “Cash T” account method, is sometimes referred to as “available cash.”
The technique uses numbers from a taxpayer’s tax return to demonstrate that money held or controlled by the taxpayer came from an unknown source. In the following example, the examiner suspects that $50,000 came from moonshine rather than legitimate sources. The analysis was developed from a (simulated) tax return from a woman, who was depositing about $50,000 a year through her bank account. At the same time, she had W-2 income of $3,314.
Before considering her regular spending, such as phone, rent, gas, or the cost of her car, she had available cash of $2,997 to spend. After prosecutor and defense counsel negotiations, the woman pleads guilty to a charge of tax evasion.
The following is a more complicated example, based on the tax return presented in the appendix to this chapter. In this example, the taxpayer has a business on the accrual method.
The following steps are related to a Federal (Form 1040) tax return; the referenced amounts are used to estimate the approximate cash in known bank accounts.
Income Section on the 1040:
Step 1: Identify wages.
Step 2: Identify normal wage deductions such as social security, Medicare, retirement and healthcare. If a W-2 is available, these amounts need not be estimated.
Step 3: Identify other sources of cash income on the 1040 such as interest. The examiner will need to analyze each item to ensure that the amount is typically received in cash. In this example, interest is likely received in cash but both business income and capital gains are likely to be partially cash and partially non-cash and the examiner needs to use the data in other parts of the tax return to estimate cash sources and uses.
Adjusted Gross Income Section on the 1040:
Step 4: Examine this section for out-of-pocket cash items. In this example, self-employment taxes are included with other tax payments and are not separately listed. Both the health insurance and retirement (IRA Deduction) are treated as cash uses.
Analyze page 2 of the 1040:
Step 5: Examine the “Tax and Credits,” “Other Taxes,” “Payments,” “Refunds,” “Amount You Owe” for cash transactions. In this example:
Analyze Schedule A—Itemized Deductions.
Step 6: Examine the itemized deductions on Schedule A. Notice that in many places, various IRS limits apply. As such, the examiner needs to capture the amount of estimated cash outflows.
Analyze Schedule C—Profit or Loss from Business.
Step 7: Examine the deductions on Schedule C. Notice that in some places (i.e., Meals and Entertainment), IRS limits apply. As such, the examiner needs to capture the estimated cash outflows. Notice that depreciation is a non-cash expense and that costs of goods sold need to be examined for purchases, labor, supplies and materials, and other costs.
Analyze Schedule D—Capital Gains and Losses.
Step 8: Examine the cash flows associated with schedule D. The primary goal here is to identify cash inflows from the sale of assets.
Analyze 8863—Education Credits.
Step 9: Examine the cash flows associated with IRS Form 8863. The primary goal here is to identify cash outflows for education.
Analyze 4562—Depreciation and Amortization.
Step 10: Recall that depreciation and amortization are non-cash expenses. However, the 4562 contained expenditures, cash outflows for the acquisition of long-term assets.
Analyze Other Tax Form.
Step 11: The above forms are the most common but by no means a comprehensive listing. For example, a taxpayer might have Schedule E (Form 1040) for real estate rentals and related income. Other tax forms would need to be carefully evaluated in terms of their impact on cash flow.
The analysis is presented in the schedule below. In this case, using the information on the tax returns, the individual would likely have cash of approximately $7,317. This can be compared to activity in the known cash accounts. The $7,317 is available for normal living expenses not reported in the tax return.
Example Cash-T | |||||||
See Appendix for Applicable Tax Return | Cash | ||||||
Item | Tax Form | Line | Sources | Uses | |||
Income: | |||||||
Wages | 1040 | 7 | 12,000 | ||||
Social Security (6.2%) | Estimated | 744 | |||||
Medicare (1.45%) | Estimated | 174 | |||||
Interest | 1040 | 8 | 100 | ||||
Adjusted Gross Income: | |||||||
IRA | 1040 | 32 | 2,000 | ||||
Health Insurance | 1040 | 28 | 3,000 | ||||
Tax Payments: | |||||||
Taxes Withheld | 1040 | 64 | |||||
Itemized Deductions: | |||||||
Medical | SchA | 1 | 3,500 | ||||
Taxes Paid | SchA | 9 | 1,350 | ||||
Interest Paid | SchA | 14 | 6,000 | ||||
Gifts to Charity | SchA | 18 | 750 | ||||
Job Expenses | SchA | 22 | 650 | ||||
Schedule C: | |||||||
Income − Gross Receipt | Sch C | 1 | 45,000 | ||||
Costs of Good Sold (Part III) | |||||||
Purchases | Sch C | 36 | 15,000 | ||||
Supplies and Materials | Sch C | 38 | 250 | ||||
Expenses | |||||||
Advertising | Sch C | 8 | 250 | ||||
Repairs and Maintenance | Sch C | 21 | 750 | ||||
Meals and Entertainment | Sch C | 24.b | 250 | ||||
Meals and Entertainment—Excluded | Estimated | 250 | |||||
Other | Sch C | 27 | 865 | ||||
Schedule D: | |||||||
Sales Price | Sch D | 8 | 2,000 | ||||
Education Credits | 8863 | 3 | 1,000 | ||||
Depreciation and Amortization: | |||||||
Forklift Purchase | 4562 | 6.b | 15,000 | ||||
Estimated Cash Activities | 59,100 | 51,783 | |||||
Estimated Available Cash | 7,317 |
For business tax returns, such as the IRS Form 1120, the form normally includes a beginning of year and end of year balance sheet. In such cases, the indirect method of cash, a technique commonly presented in most accounting textbooks, can be used to estimate cash flows related to the organization under examination.
Given that the above analyses estimate income from unknown sources indirectly and provide circumstantial evidence, the examiner needs to be prepared for typical defenses raised by targets. In addition to being prepared, the examiner should, to the extent possible, have an evidence trail that suggests that the possible defenses are not feasible.Defense #1: The estimated cash from unknown sources was accumulated in prior periods (e.g., cash hoard). The rebuttal, grounded in the evidence, may be as follows:Historical evidence suggests that the target is incapable of saving the amount specified.The target has large existing debt whose terms are unfavorable, suggesting that prior cash hoards are not likely.The target has made purchases using installment credit on generally unfavorable terms, suggesting that prior cash hoards are not likely.The target’s lifestyle is inconsistent with that of a person who saves money.During subsequent interviews, the subject could be asked the following questions, and when appropriate, supporting evidence could be requested:Where was cash kept?Who knew about the cash savings?In what denominations were the savings kept?What records or other documents exist to suggest prior savings?
Data availability increases every day. County courthouse records are being brought online. The number of electronic databases, whether free or by subscription, are ever increasing, as is the amount of data being tracked, gathered, organized, and made available for interested parties. The Internet has made access to public data easier than ever before. In fact, public data has become a controversial issue, because would-be perpetrators can easily access large quantities of sensitive data on the Internet during a single session online.
The primary benefit of using public sources of data such as the local county court house and extra-organizational sources of information are twofold. First, fundamental to an examination—which is centered on the act, the concealment, and the conversion—is that open sources of data provide evidence of conversion. These sources of information contain data about addresses, home ownership, registered boats and motor vehicles, debts, and similar indicators of credit obligations and their status. In examinations in which traditional bank, credit card, and investment records are scarce, the best way to develop convincing circumstantial evidence that the target is spending more than amounts obtained from known sources is by piecing together assets and liabilities from external data sources. The same is true when the target operates almost exclusively with cash. Although often incomplete, if the evidence demonstrates higher net worth or spending patterns than that from known sources, the examiner can conclude that conversion (benefit) has occurred.
The second major advantage derived from database searches, Internet searches, and other extra-organizational sources of data is developing new leads. For example, the names of spouses, former spouses, business associates, and businesses where the perpetrator is named as an officer or director can all be discovered by searching open sources of data. Still other benefits include leverage during witness interviews and interrogations, because information helps the examiner listen better, and know what to listen for. Searching for data about targets provides a richer understanding of the target and often new examination ideas. Examiners tend to be honest, but crooks are not! Although we practice thinking critically, as well as how to think like a fraudster, using all our tools, including extra-organizational sources of data, makes antifraud professionals more productive, effective, and efficient. Places where fraud examiners and forensic accountants may find data include:
When gathering data, the issue of ethics arises. Data and information are ethically neutral! Where ethical conundrums arise depends on how you collect data and what you do with it once gathered. Just because you are able to get information doesn’t mean you should. The bottom line is that examiners need to be ethical in how they use sensitive information.
The following tables (Tables 9-4 through 9-9) provide an overview of various sources of data. For a more detailed explanation of other types of data than those included here, please see Section 3.4 of the ACFE’s Fraud Examiners Manual. Fraud examiners and forensic accountants should understand that data sources and availability change constantly. This being the case, fraud and forensic professionals should make a habit of periodically looking for new sources, talking with fellow examiners about sources of data, and attending seminars to learn such things. Information is critical, so maintaining and improving knowledge of data information sources is essential to the long-term success of the examiner.
TABLE 9-4 Example of Cash T Account Method
20x0 Available Cash | ||||
Item | Form | Line | Income | Expense |
Wages | 1040 | 7 | $3,314.00 | |
FIT | W-2 | 2 | $162.00 | |
FICA | W-2 | 4 | $206.00 | |
Medicare | W-2 | 6 | $ 48.00 | |
State Withholding | W-2 | 18 | $126,00 | |
Refund | 1040A | 30 | $225.00 | |
$3,539.00 | $542.00 | |||
Available Cash | $2,997.00 |
Building Inspector | Building permits, blueprints submitted with applications and building inspector’s report |
Health Department | Health violations Death certificates |
Public Schools | Teacher biographies |
Tax Assessor/Collector | Information on real property and tax status |
Utility Company Records | These records include water, gas, and electricity usage and are generally restricted but can be subpoenaed under certain conditions |
Coroner | Records on Deceased Persons |
Court Clerk | Criminal and civil court records that include the issue at question (e.g., divorce, accident, personal injury), as well as personal information about the litigants and other information pertinent to the case, such as assets owned or controlled |
Public Schools | Teacher biographies |
Registrar of Voters | Voter registration records, including addresses and phone numbers |
County Recorder | Real estate transactions and ownership, mortgages, marriage records, wills admitted to probate, official bonds, mechanics liens, judgments, real estate attachments, and some bankruptcy papers |
Welfare Commission | Information gathered by social workers, psychologists, and physicians (although such information is typically available only by subpoena) |
Business Filings Division—Secretary of State | Various business records concerning business ownership and important stakeholders, fictitious business names/DBAs (doing business as), and UCC (Uniform Commercial Code) filings |
State Tax Department | Tax filings, inheritance and gift tax returns, some licenses and permits |
Professional Associations and Licensing Boards | Doctors, dentists, nurses, social workers, attorneys, accountants (CPAs), real estate licensees, notaries, law enforcement personnel, firefighters, security guards, stockbrokers, teachers, insurance agents, private investigators, bail bond agents, travel agents, and some contractors, engineers, electricians, and architects |
Bureau of Vital Statistics | Birth certificates, including parents’ names |
Department of Motor Vehicles (DMV) | Auto licenses, transfers, and sales and driver’s licenses |
Other, depending on jurisdiction | Health Department, Corrections (including parole and probation records), State Welfare Agency, Controller/Treasurer, Agriculture, Industrial Relations, Natural Resources, Horse Racing/Gambling Commission, Attorney General, Secretary of State, State Auditor, State Police, Department of Highways, State Securities Commissions, and State Utilities Commissions |
Inspectors General | Results of investigations and audits, although such information is typically available only by subpoena |
Commodities Futures Trading Commission | Registration information concerning firms and individuals, administrative and injunctive actions, financial reports, and customer complaints |
Department of Agriculture | Information concerning meat and poultry, feedlots, brokers, meat packers, canneries, farms, and ranches participating in USDA programs, food stamps, electric and telephone co-ops, applications for loans, grants, contracts from/with the USDA, crop insurance, logging, and import and export and personnel data |
Department of Commerce | The department maintains data on international trade, social and economic conditions and trends, patents, trademarks, ocean studies, domestic economic development, and minority businesses |
Social Security Administration | Original Social Security applications, including maiden and married names, date and place of birth, sex, race, parents’ names, and address at time of application |
Department of Defense | Military information for the Army, Navy, Air Force, and Marine Corps, including military pay, dependents, allotments, deposits, and other financial data |
Department of Education | Financial aid applications and earnings statements |
Department of Housing and Urban Development (HUD) | Includes the Federal Housing Administration and information on loans, cost certificates, mortgagees, mortgage companies, and developers, as well as investigation of HUD violations |
Department of Justice | Extensive law enforcement activities and data both domestically and internationally, including by INTERPOL, in more than 155 countries |
Department of Labor | Extensive information on labor-related issues, including occupational safety and health, mine safety, labor management, and the Employee Retirement Income Security Act of 1974 (ERISA) |
Department of State | All diplomatic activity and import and export licenses |
Department of Treasury: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) | Extensive work in law enforcement financial investigations for products, services, and crimes falling under its jurisdiction (as denoted in its name), including data on businesses and business owners, manufacturers, importers, and exporters |
Department of Treasury: Internal Revenue Service (IRS) | Tax investigations related to income tax, excise tax, currency transaction reports (CTR), and occupational tax |
Department of Treasury: U.S. Customs Service | Import and export data, including narcotics, border issues, and drug enforcement |
Department of Treasury: U.S. Secret Service | Responsibility for forgers, counterfeiters, and businesses reporting counterfeiting operations |
Department of Treasury: Office of Foreign Asset Control (OFAC) | Maintains lists of individuals, government entities, companies, and merchant vessels that are known or suspected to engage in illegal activities including Specially Designated Nationals and Blocked Persons (SDNs) |
Department of Veterans Affairs (VA) | Records of loans, tuition payments, insurance payments, and some medical data |
Drug Enforcement Agency (DEA) | Licensed handlers of narcotics and criminal records of persons convicted of drug violations |
Federal Aviation Administration (FAA) | Chain of ownership of all civil aircraft, including the manufacture, sale, transfer, inspection, modification of aircraft, bills of sale, sales agreements, mortgages and liens, as well as the listing of pilots, mechanics, flight engineers, and safety personnel |
Federal Bureau of Investigation (FBI) | Extensive law enforcement data, including databases, fingerprints, and wanted, missing, or unidentified domestic and foreign persons |
Federal Communications Commission (FCC) | Licensor of radio and television operators, including ownership and ownership changes |
Federal Energy Regulatory Commission (FERC) | Data on electric and natural gas providers, including officers, directors, and 10 percent stockholders |
Federal Maritime Commission | Data on oceangoing freight-forwarding licensees, including company history and officers, directors, and 10 percent stockholders |
General Services Administration (GSA) | Information on architects, engineers, property auctioneers, real estate appraisers, construction contractors, sales brokers, and GSA contract businesses |
Interstate Commerce Commission (ICC) | Financial information on truck lines and other interstate shippers, including officers; ICC provides safety checks |
National Aeronautics and Space Administration (NASA) | NASA contracts out the vast majority of its annual budget and maintains financial data and officer information on its contractors |
National Railroad Passenger Corporation (Amtrak) | Information on passengers, the railroad industry, railroad contractors/subcontractors, train routes, and schedules |
Nuclear Regulatory Commission (NRC) | Applications and licenses of persons and companies that export nuclear material and equipment |
Securities and Exchange Commission (SEC) | Extensive information on public companies, the majority of which is available free at www.sec.gov |
Small Business Administration (SBA) | Information on small businesses and their owner/officers for which it has guaranteed loans for business construction, expansion, equipment, facilities, material, and working capital |
Bureau of Public Debt | Information on the purchase and redemption of public debt, including savings bonds, marketable securities, and other U.S. government–backed securities |
Federal Highway Administration | Information on motor carriers, including licenses, inspections, registrations, and operating histories |
U.S. Citizenship and Immigration Services | Formerly the INS, the organization maintains information in aliens, registration records, lists of passengers and crews on oceangoing vessels, naturalization records, deportation records, and financial data on aliens and their sponsors |
U.S. Coast Guard | Names of merchant mariners and investigative records on smuggling and other criminal violations |
U.S. Government Accountability Office | As the investigative arm of Congress charged with examining matters relating to the receipt and payment of public funds; GAO audit and other reports are offered at www.gao.gov |
U.S. Postal Service | Extensive investigative work related to mail fraud, in addition to names and addresses of post office box holders and photocopies of postal money orders |
Federal Procurement Data System | Summaries of transactions and services negotiated with the U.S. government |
FedWorld Information Network | FedWorld provides government information and resources for consumers and search capabilities for over 30 million government Internet pages |
TABLE 9-9 Commercial Sources and Data Bases
Better Business Bureau | Chamber of Commerce |
Abstract and title companies | Bonding companies |
Western Union | Car Fax (auto histories) |
International Air Transport Association (aviation security, including terrorism) | International Foundation for Art Research |
National Association of Insurance Commissioners | Phonefiche (cross-referencing) |
Switchboard.com | ChoicePoint |
Phone numbers and addresses for business and individuals | Identification and credential verification services for business and government |
CDB Infotek | DBT On-Line |
Business-to-business provider of public record information products | Electronic information retrieval services and patent enforcement and exploitation services |
Lexis-Nexis | USDataLink |
Information and services solutions, including its flagship Web-based Lexis® and Nexis® research services, for a wide range of professionals in the legal, risk management, corporate, government, law enforcement, accounting, and academic markets | Employment screening and investigative services for asset protection, due diligence, and risk management |
infoUSA.com | Diligenz |
Mailing lists and e-mail lists of businesses | Due diligence for the lending, leasing, and legal industries through UCC searching, filing, tracking, and online portfolio management services from the online UCC database and film library |
KnowX | Dialog Information Retrieval Service |
Nationwide public records search, background checks, liens, bankruptcy public records, company background checks, real estate ownership information, and judgments | Alphanumeric and Boolean public records database search |
Although much data are available from various local, county, state, and federal governments, a challenge that the fraud examiner or forensic professional will encounter is the need for a subpoena to obtain the records. Another challenge is that publicly accessible data are disparate and located in many places, and thus requires significant time and expense to pull together. In response, commercial databases have been created to simplify and organize information, thereby making it easier to locate and obtain, provided that the examiner has the budget to pay for such resources. Some commercial sources of data and databases are listed in Table 9-9.
Individuals are often shocked at the amount of data that are available about them on the Internet with just a few short keystrokes. With the addition of blogs, chat rooms, and websites such as Facebook and Instagram, individuals provide sensitive information about themselves for anyone with the curiosity to read. Newsgroups and chat rooms are worldwide electronic discussion groups and permit the sharing of information between people who share similar interests. Even for those individuals not participating in Internet discourse and information sharing, a tremendous amount of information is available from other public and private sources. Google and other search engines can be used to search an e-mail address, name, user name, nickname, address, or phone number. As a simple experiment, type a person’s name in Google with quotation marks around it and see what comes up. This is easier for unique names than for those that are more common, but information abounds on the Internet, regardless. By simply using various Internet search engines, anyone can create a profile for another individual, business, or organization by searching name, address, phone number, or e-mail address.
E-mail is the most widely used application of the Internet and may provide clues to an investigator about a subject’s background. For example, [email protected] has some association with West Virginia University. Free e-mail is available from companies such as Yahoo!, Hotmail, and other e-mail service providers and may be used to engage in anonymous communications through the choice of the user portion of the e-mail address (i.e., [email protected]). Anonymous remailers can be used to send and receive e-mail communications around the world. Such services work by stripping all traces of the author’s identity from the original e-mail before forwarding it through a series of anonymous servers. Sophisticated parties may hide behind a series of remailers. Text messages, instant messages, Instagram, Snap Chat, Social Media, and other Internet sources are also available, some of which require legal approval and possibly technological support to harness the value of the information source.
Here are some of the various types of information available on the Internet:
We have eight types of assignments for instructors to choose from:
Read the following articles or other related articles regarding the Bristol-Myers case and then answer the questions below:
Security and Exchange Commission, “$750 Million Distribution Begins for Bristol-Myers Fraud Victims,” June 8, 2006.
Gold, Jeffrey, “Bristol Myers Reaches $300 Million Settlement,” Yahoo! Finance, June 16, 2005.
Starkman, Dean, “Civil charges Follow Indictments in Bristol-Myers Case,” The Washington Post, August 23, 2005.
Masters, Brooke A., “Bristol-Myers Ousts Its Chief at Monitor’s Urging, The Washington Post, September 13, 2006.
1. By what percentage could Bristol Myers earnings have declined in 2002 as a result of the fraud?
2. What was the first period that the SEC believed that Bristol Myers “stuffed the channels?”
3. Was channel stuffing the only scheme perpetrated by Bristol Myers? If the answer is “no,” name one other scheme.
4. What were the names of the marketing efforts that helped drive the need to channel stuff?
5. How much was the fine in the deferred prosecution agreement?
6. What was the total amount of fines and penalties levied against Bristol Myers?
10 What makes channel stuffing illegal by comparison to a car dealership that runs “mega” end-of-year sales?
2. Why are revenue recognition frauds such a frequent problem for the SEC?
3. What red flag symptoms might revenue recognition create and how might one best discover a revenue recognition fraud?
Assume the following information appeared on a 201x tax return:
Assignment: use the above chart to estimate the sources and uses of cash as well as the total cash that can be compared to activities and balances in known accounts.
Form | Form Description | Transation Type | Amount | Source | Use |
1040 | Tax Return | Wages | 25,000 | ||
1040 | Tax Return | Dividend Income | 10,000 | ||
1040 | Tax Return | Business Income | 12,500 | ||
1040 | Tax Return | Capital Gain | 2,500 | ||
1040 | Tax Return | Tax Witholding | 1,000 | ||
1040 | Tax Return | Tax Payments (201x) | 300 | ||
1040 | Tax Return | Amount You Owe | 500 | ||
Sch A | Itemized Deductions | State & Local Taxes | 200 | ||
Sch A | Itemized Deductions | Charitable Gifts | 400 | ||
Sch C | Business Income | Sales | 42,500 | ||
Sch C | Business Income | Contract Labor | 24,000 | ||
Sch C | Business Income | Depreciation | 2,500 | ||
Sch C | Business Income | Office | 3,000 | ||
Sch C | Business Income | Other | 500 | ||
Sch C | Business Income | Net Profit (or Loss) | 12,500 | ||
Sch D | Capital Gain | Proceeds | 11,000 | ||
Sch D | Capital Gain | Cost | 8,500 | ||
Sch D | Capital Gain | Gain Or (Loss) | 2,500 | ||
4562 | Depreciation | Purchase of Assets | 5,500 | ||
4562 | Depreciation | Write-off | 2,500 | ||
Net Cash |
Assume the following information was derived from reliable sources:
Indirect Methods of Income from Unknown Sources | ||||||
Net Worth | Lifestyle | Income from Known Sources | ||||
Description | Amount | Asset | Liability | Sources | Application | |
Boat | 25,000 | |||||
Boat Loan | 20,000 | |||||
Boat Loan Payments | 5,000 | |||||
Car | 40,000 | |||||
Car Loan | 30,000 | |||||
Car Loan Payments | 2,000 | |||||
Deposit to Bank Account | 500,000 | |||||
Dividends on Tax Return | 5,000 | |||||
Down Payment Boat | 12,000 | |||||
Down Payment Car | 7,000 | |||||
Down Payment Time Share | 6,000 | |||||
Down Payment Vacation Homes | 15,000 | |||||
Home | 275,000 | |||||
Home Equity Loan | 35,000 | |||||
Home Equity Loan Payments | 4,000 | |||||
Interest on Tax Return | 1,000 | |||||
Mortgage | 150,000 | |||||
Mortgage Payments | 3,000 | |||||
Mutual Funds | 20,000 | |||||
Purchase Mutual Funds | 20,000 | |||||
Time Share | 50,000 | |||||
Vacation Homes | 250,000 | |||||
Wages on W-2 and Tax Return | 75,000 | |||||
Net Worth | ||||||
Estimated Net Cash Income | ||||||
Estimated Income from Unknown Sources |
Assignments:
The following is the “inventory” of items received to continue the examination at Johnson Real Estate. The goal is to focus on the missing deposits: who, what, when, where, and how.
These items will be provided by the course instructor.
Assignment:
Continuing to focus on evidence associated with the act, concealment, and conversion, use the evidentiary material to continue the examination. In addition, as the examiner also start to think of terms of who, what (did the person(s) do), when (during what period?), where (physical place, location in books and records), and how (perpetrated, hidden, and did the perpetrator benefit).
Case background: See Chapter 1.
Question: Does Fairmont have any personnel whose last name is similar?
Student task: Students should (a) click on the hyperlinks (17 and 6) for both entries and (b) discuss the finding and recommend investigative next steps.
Student Material for step-by-step screenshots for completing the assignment are available from your instructor.
Case tableau background: See Chapter 1.
The payroll disbursements were for “two persons” named Ciotty and Ciotti with the same first name and address. The interesting observation is that Ciotty is dated February 28, 2019, or after while Ciotti are all before February 28, 2019. From the forensic audit, the first name and address for these entries are identical.
Question: Can you create a graphic that shows both payroll hours and gross for Ciotti before February 28, 2019, and Ciotty dated or/after February 28, 2019?
Student ask: Students should (a) present both payroll hours and gross for Ciotti before February 28, 2019, and Ciotty dated or/after February 28, 2019, and (b) discuss the finding and recommend investigative next steps.
Student Material for step-by-step screenshots for completing the assignment are available from your instructor.
Collect: Revenue/Income by service and product lines (quantities and prices, if available)
Competition and Product Differentiation
3.145.111.116