Interviews

An employee’s or individual suspect’s right to avoid self-incrimination applies to employers, investigators, and law enforcement personnel. An employee who refuses to cooperate during an interview while invoking the Fifth Amendment, however, may be subject to employment termination. In custodial settings by law enforcement, and in those settings where the suspected perpetrator has been taken into custody and denied freedom presumably against their will, federal law may require that a Miranda warning be read to the suspect. Because employers do not have the right to place employees in a custodial setting, an employee has limited Fifth Amendment rights. Public employers, however, are held to a higher standard, and their employees can invoke their Fifth Amendment protections without fear of reprisal.

The Miranda warnings consist of the following:

• The interviewee has a right to remain silent
• The interviewee’s answers may be used against him
• The interviewee has a right to an attorney
• If the interviewee cannot afford an attorney, one will be provided at no cost
• The interviewee can decide at any time to invoke these rights

A second issue arises regarding employee interviews under the Sixth Amendment, and whether the employee has a right to legal counsel. As long as a nonpublic entity is conducting the interview, an employee does not have the right to have a lawyer present, nor does the employee have the right to consult his or her attorney prior to an interview. The employee maintains the right to consult an attorney if he or she requests one, however. With regard to the Fourteenth Amendment, private employers do not have to offer employees due process of law. In contrast, law enforcement and public entities have such an obligation under this amendment. For example, federal employees may have a right of notice of charges and may have the right to rebut any charges put forward.

The Fourth, Fifth, Sixth, and Fourteenth Amendments are all federal rights. In many cases, other federal and state laws regulate the rights of individuals. While such statutes and laws cannot have the impact of limiting federal constitutional rights, those rights may be expanded. Some of the common means by which federal rights are altered are via employment contracts, collective bargaining and other union agreements, various nondiscrimination statutes, and the Fair Labor Standards Act.

In addition, individuals may be entitled to various common law protections with regard to interviews. These include⁴:

• Minimization of invasion of the employee’s privacy
• Limitations on interview content to employee job duties and responsibilities
• Limitations on public disclosure of the employee’s private facts
• Limitations on intentional infliction of emotional distress on the employee
• Limitations on defamation—unfounded facts and accusations made by the interviewer
• A duty to deal fairly and in good faith
• No false imprisonment—false imprisonment may be inferred based on the size, nature, and lighting of the room, the amount of force involved, any violent behavior by the interviewer, limitations of ability to leave the interview room, and number of persons involved

While interviews may be conducted subject to the rules, laws, and other issues cited above, confessions resulting from interviews and interrogations create additional challenges. First, in order for confessions to be valid, they must be deemed voluntary. Confessions cannot be obtained as a result of coercion or under threats of violence. Furthermore, promises by the interviewer of leniency can nullify a confession. Promises to recommend a lighter sentence or to report cooperation by the subject, however, are generally not thought to be coercive in nature. Courts have weighed the “substantial risk” of a false confession when determining whether a confession has been coerced.⁵ Small deceptions are generally permitted and will not risk the validity of the confession. With regard to deceptions, a simple rule is to ask yourself, “Is what I am about to do, or say, apt to make an innocent person confess?” If the answer is “yes,” the statement should not be made.⁶

Searches

The Fourth Amendment protects individuals against unreasonable searches and seizures. First, unreasonable searches and seizures are forbidden. All warrants for searches and arrest must be supported by probable cause, and all warrants must be reasonably specific as to persons, places, and things.⁷ The overriding rule is that individuals have a “reasonable expectation of privacy.” Whether a search or surveillance is reasonable is generally based on the totality of the circumstances. A search warrant based on probable cause has the effect of being reasonable. A major exception to the need for a warrant is in instances where law enforcement has reason to believe that a crime has been committed (or is about to be committed) and an immediate search is required.

Fourth Amendment protections are further refined in specific circumstances as follows.⁸ First, public employers, e.g., government, are not required to obtain a search warrant when they conduct workplace searches for investigations of workplace misconduct. The issue is that workplace investigations are substantially different from those conducted by law enforcement because the goal is not law enforcement but rather efficient office operations, a premise upheld by the U.S. Supreme Court. Furthermore, while individuals have a reasonable expectation of privacy in many places, such as homes and automobiles, such an expectation does not apply in the workplace. For example, items of a personal nature may be left at home and need not be stored in the confines of an office, desk, or filing cabinet.

A workplace search is considered reasonable under two circumstances:

• The search must be justified at its inception because it is likely to reveal evidence of work-related misconduct. The requirement implies that a clear suspicion exists based on a preliminary review of the evidence.
• The search is necessary to further the investigation. An example of this concept is that the investigator is able to obtain files that are a required part of the investigation. The requirement implies that the search is likely to reveal pertinent information.

Assuming that the search is reasonable based on these criteria; the scope of the search must be no broader than is necessary to serve the organization’s legitimate, work-related purpose. The investigator may, in fact, have no search limitations if the employee has no reasonable expectation of privacy in the place to be searched. For example, a general filing cabinet with travel reimbursement forms has no reasonable expectation of privacy whereas the individual’s desk is much more likely to yield items of a personal nature. Thus, many workplace areas have no reasonable expectation of privacy for any employee. The key factor is exclusive control. If the individual has exclusive control over a particular area, a reasonable expectation of privacy is more likely to become an issue. As noted above, even with exclusive control, the only standard that an employer must meet is that the search is reasonable based on the above guidelines.

A second area of special consideration for the Fourteenth Amendment is searches incidental to arrest. First, an arrest can only be made based on probable cause. (A citizen may make an arrest only for a crime committed in his or her presence.) As such, law enforcement officers may search an area within his or her immediate control at the time of the arrest without a warrant for the purposes of self-protection and to prevent the destruction of evidence. If the arrest is later invalidated, however, the search is also invalidated. This potential suppression of evidence can be very frustrating to law enforcement investigators. Of course, no warrant is required for evidence that is in plain view. Furthermore, borders and customs agents are provided an exception for searches without warrants.

Search of motor vehicles, including cars, truck, watercraft, and airplanes, may be conducted without a warrant if the law enforcement personnel believe that contraband is present or the vehicle contains other evidence of a crime. The risk of flight with regard to motorized vehicles makes them inherently more risky. Once moved, evidence may be removed or destroyed and such a risk necessitates prompt action. In addition, unlike a home where expectation of privacy is paramount, motorized vehicles are subject to a much lower expectation. The motorized vehicle may be moved to a police facility and inventoried prior to search, and law enforcement may proceed with the search without a warrant. The ability to search vehicles also applies to the contents of the vehicle (e.g., luggage) but does not extend to passengers. Passengers may not be searched without a prior arrest or warrant.

Individuals may waive their Fourth Amendment rights that prevent certain types of searches. Consent by an individual eliminates the need for a search warrant by law enforcement. Like confessions, the waiver of this right will be scrutinized to ensure that it was not coerced in any way. Thus, law enforcement personnel must be able to defend the waiver against claims of false imprisonment, force, violence, and limitations of ability to leave the area, as well as accusations of deceit, bribery, or misrepresentation. Unlike the Miranda warning related to statements, no warning must be made regarding an individual’s right to refuse a search. Illegally obtained evidence may not be introduced in court. Furthermore, any information derived from illegal evidence cannot be introduced. This is known as “fruit from the forbidden tree.”

Surveillance

Surveillance can be more complex than interviews and searches. Although the rules of conduct for interviews and searches have been defined through federal and state laws and interpretations by the U.S. Supreme Court, the conduct of surveillance has many more issues to consider. As such, counsel should be consulted when surveillance is contemplated. Such techniques include electronic surveillance, including audio and video monitoring and recording. Generally these techniques are not conducted by fraud examiners and forensic accountants because these professionals do not have the required training and skill set. Furthermore, such operations are more common when the suspected activity is complicated and involves multiple individuals, organizations, and jurisdictions. Many of these types of investigative operations are conducted by private investigators or law enforcement officers who have the necessary education, training, and experience.

Several types of surveillance are possible:

• Fixed-point surveillance (e.g., stakeout) involves observing activity from a stationary, discreet location
• Mobile surveillance
• Videography (if audio is also captured during the surveillance, different laws, rules, and regulations are in effect, because audio surveillance has much more stringent requirements)
• Audio or electronic surveillance (e.g., wiretapping)

Surveillance is generally legal. Once the investigator enters the realm of electronic (audio) surveillance, the laws and requirements become more complicated. Generally, federal law prevents the interception and/or recording of wire, oral, or electronic communications except by the following⁹:

• Law enforcement officers with a warrant
• Operator of a switchboard or common carrier providing services carrying out job duties and responsibilities
• An employee of the FCC carrying out job duties and responsibilities
• A party to a communication who has given prior consent to the interception (one-party consent)
• A person acting under the Foreign Intelligence Act of 1978

The warrant requirement is the most complicated issue faced by forensic accountants and fraud examiners. With the exception of 13 states, any party to a conversation may record their own conversation. Although the interception and recording of live communication is generally forbidden by federal law without a warrant, stored communication (including voicemail and e-mail) is not nearly as well protected. For example, employers can access stored voicemail and e-mail on their own servers but cannot access the same communications stored by an outside provider (e.g., messages stored on Sprint voicemail). More interestingly, any party to the communication may provide the necessary permission and access to persons not party to the communication.

Generally, video surveillance is permissible as long as it does not violate a person’s reasonable expectation of privacy. Anyone in a public park, parking lot, or mall may be videotaped without violating any laws as long as no audio of the target is recorded. Where individuals have a reasonable expectation of privacy, however, such as in their own home, employee restrooms, employee locker rooms, or employee changing areas, video surveillance is not permitted without the existence of extenuating circumstances and a warrant.

Generally, a private employer is prohibited from conducting polygraph examinations (lie-detector tests) unless the employer has suffered economic loss and has reasonable suspicion that the particular employee was involved in the issue under investigation. Like other aspects of the investigation, reasonable suspicion is an evidence-based decision. Under no circumstances, however, can a nongovernment employer use a polygraph examination to screen applicants.

Discharging a Suspected Wrongdoer from Employment

Assuming that an internal, private investigation by an employer results in the conclusion that a particular individual committed a fraud act; can the employer dismiss that employee? Perhaps more intriguing, what if the suspected employee refuses to cooperate and that investigation cannot continue? What then? While public employers are governed by a stricter standard, employer rights are dictated by the jurisdiction in which they operate. Generally, employment is considered at will. This characteristic allows either the employee or the employer to sever the relationship at any time for almost any reason. Employees may have some protections against dismissal for improper reasons, however, even in at will states.

As such, it is advisable that employers document good cause for any termination in the employee’s personnel file. Good cause might include the following:

• The employee’s conduct was against written policy
• The employee’s conduct made for unsafe or inefficient business operations
• The company completed a reasonable investigation to ensure that any such questionable act was committed by the employee and has evidence to support such a claim
• The investigation was fair, objective, and evidence suggested the elimination of alternative suspects
• The termination was nondiscriminatory, meaning that all persons committing such an act were or would be terminated
• The punishment fits the crime, meaning that the punishment is reasonable given the nature of the offense

Such incidents and punitive actions by the company should be carefully considered and well documented. Nothing prevents an employee from suing a former employer in civil court, even if the termination is arguably a reasonable response to the alleged offense.

Privileges

Legal privileges are protections against certain types of testimony. With the exception of the privilege against compelled self-incrimination, most of the following privileges are not constitutionally based:

• Attorney–client privilege
• Attorney work-product privilege
• Physician–patient privilege
• Marital privileges
• Miscellaneous privileges

Complaints and Pretrial Activity

Civil lawsuits begin when the plaintiff files a complaint in an appropriate jurisdiction. The complaint must provide assurance to the court that it has jurisdiction, outline the grounds for relief, and make a demand for judgment. Because the complaint is filed before the plaintiff may have all of its facts (i.e., before discovery, which is discussed below), the complaint does not need to be overly particular. Interestingly, fraud civil complaints must be specific and outline the fraud misrepresentations (the act), to whom (the impacted victim), how the misrepresentations were false, and other particular details in order to understand the fraud act. Yet, because the plaintiff most likely does not have complete access to the defendant’s information and records, the plaintiff may not have a complete story. Normally the defendant files an answer to the complaint, denies liability, and may add counterclaims against the plaintiff or even ask the court for a dismissal. The process to file a complaint and to await the defendant’s response can be very time-consuming, and in very larges cases can extend over a year or more. Of course, time is money so the more time spent, the greater the legal fees to the plaintiff and defense lawyers and others involved in the case.

Once the complaint and answer have been filed (and assuming that the case continues in the civil courts) discovery begins. Discovery is the process by which each side may explore the merits of the other side’s arguments by obtaining documentary and testimonial evidence. Any matter or material relevant to the civil action that is not privileged is subject to discovery. Normally, discovery may take at least four forms.

Initially, interrogatories are passed to the opposing council. Interrogatories are questions that require answers and those answers become part of the testimonial record. As such, answers are provided under oath. Although interrogatories are one of the least expensive means to obtain evidence from the opposing party because of an inability to ask follow-up questions, except through additional interrogatories, they may not be effective. Opposing parties tend to provide truthful responses yet minimal information.

Subsequent to interrogatories, opposing parties submit “requests to produce documents” to one another. These requests may include copies of contracts, notes from meetings, calendars, invoices, and accounting records of all sorts including general ledgers, trial balances, journal entries, journal entry backup, financial statements, and tax returns. Just about any information that is captured in paper or electronic form is subject to discovery. In very complex cases, the review of discovered documents alone can take years. While attorneys and experts can become almost overwhelmed with produced documents, most are remiss to limit the amount of document production for fear of missing that critical piece of paper that blows their case wide open.

Third, attorneys start to take sworn testimony from opposing parties in the form of depositions. Depositions that are grounded in the evidence and documents are popular and provide very useful information. The format is that the deponent (the person being deposed) provides sworn testimony based on questions developed by opposing council. Assuming that the attorney is well prepared and accomplished, he or she can use the deposition exercise to evaluate a number of issues:

• How good of a witness will this person be; how good will they come across in front of a jury; can I get this person angry, aggressive, defensive, or emotional?
• What is the opposing side’s theory of the case; what arguments are they likely to make in court; how deep is the evidence trail behind their theory of the case?
• Is their witness making informed statements grounded in the evidence, or is this person likely to shoot from the hip?
• How does this person react when I propose or suggest my side’s theory of the case? Does this person refute my theory with evidence; are they dismissive; are they emotional?

Thus, the deposition process not only provides the opportunity to obtain additional evidence, it provides a good opportunity, especially with key witnesses, including fraud examiners and forensic accounting expert witnesses, to evaluate each side’s case and their witness quality. As depositions proceed, it is often common for each side to develop additional requests for the production of documents based on deposition testimony of various parties. For example, a former accountant may know of the existence of a box of records in a storage area that was previously overlooked in a prior request for the production of documents.

The fourth and last stage of discovery is an attempt by counsel to get the other side to agree to certain basic aspects and facts of the case through “requests for admission.” This process helps determine what issues are points of contention as the trial approaches, and what points can be agreed upon by both sides. Thus, a request for admission attempts to narrow the scope of the trial to its essential points of contention.

Negotiated Settlements

Once discovery is completed and before trial, judges will often attempt to cajole both sides into settling the case based on the relative merits of their evidence and legal positions. In fact, some attorneys estimate that fewer than five percent of civil actions ever come to trial. There are three major forms of negotiated remedies: out-of-court settlements, arbitration, and mediation. Out-of-court settlements occur when both sides come to a settlement position after examination of their own clients, the evidence, the qualities of their fact witnesses, the strength of their expert opinions, and other important aspects of the case. Assuming that the two sides are reasonably close, the attorneys will confer with their clients and negotiate with the opposing attorney. This process can take weeks or months and may even start during the deposition phase. Normally a negotiated settlement will not be achievable prior to the end of, or near the end of, discovery.

If a negotiated settlement between opposing attorneys in concert with their clients does not work, a second approach is mediation. In this environment, an independent, objective mediator will work with both sets of opposing counsel to help reach a settlement between the two (and their clients). The mediator does not decide who should win, but his or her responsibility is to assist both sides to more objectively assess the merits of their case and work toward a mutually agreeable resolution. Since the mediator has no authority on which to decide cases, any settlement is voluntary on the part of the opposing parties.

A third possibility is arbitration. Like a mediator, an arbitrator is an independent third party who has the authority to determine the outcome of the case. Thus, the arbitrator acts like the judge and jury, listening to the primary aspects of each side’s case and deciding what he or she believes to be the most appropriate outcome based on the merits of the cases presented. Arbitration may be binding, meaning that the “verdict” of the arbitrator is final, or it can be nonbinding. Even a nonbinding “verdict” may bring the parties closer together and may result in an out-of-court settlement because of the ability of the arbitrator to independently and objectively evaluate the merits of each side’s case.

Pretrial Motions and the Civil Trial

Assuming that the discovery process is complete and any out-of-court attempts to settle the case fail, a slew of pretrial motions are likely to follow:

• Writ of Attachments to prevent defendants from disposing of assets
• Sequestration, in which the court takes possession of certain assets pending the outcome of the trial
• Motions for Injunctive Relief to prevent a defendant from transferring or moving assets pending the trial’s outcome
• Motions to Dismiss
• Motions to Make (some aspects of the civil action) More Definite and Certain
• Motions in Limine to prohibit reference to prejudicial matte
• Motions to Strike inflammatory, prejudicial, or irrelevant material from trial
• Motions for Continuance to postpone a hearing or trial
• Motions for Summary Judgment that request the judge to decide the merits of the case without a trial based on material and testimony submitted

Normally, counsel is going to object to motions proposed by the other side of the civil action and a judge will need to decide on the motions in advance of the trial.

It will take months, if not years, for a civil action to actually be heard in a court of law. While many aspects of the civil trial mirror that of a criminal trial, a few important differences exist. First, in most cases the jurors number six persons, and if the opposing attorneys agree, a unanimous verdict is not required. Furthermore, a civil action only requires a preponderance of the evidence, meaning that the evidence stacks up slightly more heavily on one side than the other. This contrasts with the criminal threshold of “beyond a reasonable doubt.” During civil trials the plaintiff goes first, followed by the defense. Then the plaintiff gets a chance to rebut the defense’s position. Once a verdict is received, either side may appeal the liability issues and/or the damages portion of the verdict. Furthermore, a plaintiff or defendant who wins monetary damages in a lawsuit will normally have to take additional steps to collect the award. Such steps may include obtaining a financial judgment, garnishing wages, and levying assets. A postjudgment discovery process may be necessary to locate assets available to satisfy a judgment or identify assets that have been moved or transferred in an attempt to avoid satisfying the judgment.

Basic Accounting Principles—A Survivor’s Guide to Accounting

In this section, we present an overview of the accounting system that every fraud examiner or forensic accountant needs to understand for successfully navigating financial books and records. Figure 3-1 depicts the flow of accounting information.

Basic (accounting) bookkeeping involves the recording, classifying, and summarizing of economic events in a logical manner for the purpose of providing accounting, financial, and nonfinancial information for decision making.

Auditors are concerned with determining whether information recorded in the accounting books and records properly reflects the underlying economics of the transactions. Thus, auditors need to know how to audit and how to evaluate recorded activity for compliance with generally accepted accounting principles (GAAP). Like auditors, the fraud examiner and forensic professional need to have some understanding of transactions and how those transactions are reflected in the books and records. If the facts at issue are associated with allegations of financial statement fraud, the investigator needs to have a thorough understanding of GAAP, auditing procedures, and the impact of any applicable regulations. As noted in prior chapters and throughout this text, fraud examiners and forensic specialists must be able to follow the money. But they must also be able to recognize and identify red flags and anomalous situations where the accounting numbers and amount reflected in underlying accounting records do not make sense or do not seem to add up. Recognition and identification of red flags inherently assumes that the investigator has some expectation of how the numbers should look. This requires some knowledge of basic accounting as well as knowledge of expected relationships between accounting metrics and nonfinancial data generated inside and outside of the organization. Of course, the fraud examiner and forensic accountant must also possess expertise in accumulating and interpreting evidence. The antifraud professional must design procedures to identify anomalies, investigate those anomalies, form and test hypotheses, and evaluate the evidence generated.

As a starting point, activities occur between the company and its stakeholders (board of directors, executive team, management, employees, creditors, bankers, suppliers, employee recruits, customers, suppliers, communities, government agencies, labor unions, etc.). These interactions result from negotiations and generate paper and electronic documentation of the activities and financial details such as location, prices, quantities, and timing (e.g., dates). Some of the financial aspects of these activities are considered financial transactions, and from those, various forms of physical and electronic paperwork are created: receipts, invoices, contracts, requests for proposal, proposals, purchase orders, bills of lading, shipping documents, funds transfer authorizations, and other source documents. This documentation may be captured in physical form such as printed documents and receipts or entirely in electronic format. The physical and electronic documentation captures the essential terms of the transactions and provides a primary means of inputting data into the formal accounting system. In other cases, the passage of time generates the need for accounting transactions. An example is that over time, the value of a delivery truck declines in the pursuit of revenue. Accounting needs to capture the decline in value across time. In another example, the passage of time generates interest obligations owed to creditors. Again, issue is a result of an organization—stakeholder interactions in prior periods; yet, this obligation needs to be reflected in the accounting system.

Transactions are input (recorded) into the accounting system through journal entries and electronic interfaces with operational (nonaccounting) information systems and posted into the general ledger. The general ledger is analogous to a series of buckets where the accounting transactions are organized and stored. Periodically, the information in the general ledgers is reconciled back to the underlying source documents as well as information provided by nonaccounting systems and external stakeholders, such as banks, credit card companies, vendors, and customers. For example, banks provide monthly statements and the activities reflected on them can be reconciled to the cash “bucket” in the general ledger. The reconciliation process is conducted to ensure the integrity of the information in the general ledger. Once the entity’s financial managers are satisfied with the integrity of the general ledger, the financial statements, tax returns, and other summarized financial and nonfinancial information can be created, distributed, and shared for the purposes of performance assessment (evaluation) and decision making.

One of the critical general ledger “buckets” for the fraud examiner and forensic accountant is the cash general ledger account. Most antifraud professionals follow the money. The company receives cash from its customers in the form of currency, checks directly from customers, and checks and electronic deposits from credit card companies. Although fewer in number, entities also receive cash from stockholder investments, loans from creditors, and from sales of old or used equipment. Entities disburse cash by writing checks and distributing them to employees, suppliers, creditors, and others. Cash disbursements can be made via the U.S. Postal Service, wire transfers, and through electronic funds transfer (EFT). All of these cash transactions are captured with various physical and electronic medium and are input into the entity’s accounting system and ultimately into the cash general ledger account (“bucket”).

At the same time, the entity’s bank is capturing and recording the transaction as well. Optimally, good accounting practice mandates that these two systems (the company’s cash account and the bank’s records of those same transactions) be checked for agreement each month through a formal reconciliation. Similar to cash, most transactions are tracked not only by the company but also by other parties to the transaction, such as customers, vendors, and creditors. Thus, fraud examiners and forensic accountants review the company’s accounting books and records as well as the corresponding information from third parties to look for discrepancies from which fraud investigations are often launched.

Not only do fraud examiners and forensic accountants need to monitor transactions from the perspective of the company and corresponding outsiders but they also need to ensure that the accounting information corresponds to the company’s nonaccounting information because many business activities are not captured in the accounting system, but rather a function of operational management information systems and data from a variety of other sources. For example, a contract between a company and a customer to deliver goods and services next year is referred to as “backlog” and is not reflected in the accounting records until the company starts to fulfill its contractual obligation. Yet, backlog is a critical metric, the detail of which is carefully measured, monitored, and evaluated across time.

Notice how the information sources and flow are depicted in Figure 3.1 that starts on the left by capturing data reflecting financial transactions, nonfinancial operational systems, and the passage of time into the accounting system. Management information systems (MIS) are used to provide the data required by managers to run their operations. For example, a petroleum plant would carefully monitor raw materials inventory levels, the transfers of raw materials into the manufacturing process, and various aspects of production to ensure quality, the amount of manufacturing output, and inventory levels of finished product. These data are critical for plant managers; they could not do their job without detailed and accurate information. In some systems, data from the nonaccounting systems are designed to interface electronically with the accounting information systems. In others, summarized data from the MIS systems are used as a manual input into the accounting system. In either case, antifraud professionals and forensic accountants will use data from nonaccounting sources as a means of looking for discrepancies with data reflected in the accounting records, a source of red flags.

Nonfinancial data can be generated from many sources. As an example, consider a bar owner who is suspected of underpaying taxes. A method commonly used is to look for data that is not normally captured in the accounting system. To illustrate, as described in DiGabrile, one crafty fraud examiner took all of the invoices supporting cost of goods sold, added up the quantities purchased, and multiplied the quantities by the selling prices on the bar’s menu. The approach resulted in hundreds of thousands of dollars of underreported revenue. Because quantities presented on an accounting record (i.e., an invoice that describes prices, quantities, and dates) are not captured by the accounting system, it becomes a nonfinancial information source upon which to identify discrepancies. To be successful, fraud examiners and forensic accountants need to continually seek out information sources from independent third parties and from internal sources that are not directly reflected in the accounting system as a means of evaluating data captured and reported in accounting reports, such as financial statements and tax returns. Even the reconciliation of tax returns to financial statements often reveals discrepancies between the two that serve as red flags that require additional investigative inquiry.

Other basic but critical aspects of the accounting process that fraud examiners and forensic accountants need to know include the following:

• Types of financial statements
• How cash transactions are categorized: operating, investing, and financing activities
• A second categorization approach: assets, liabilities, stockholders equity, revenues, and expenses
• Every transaction affects at least two general ledger “buckets” (accounts)
• Accrual accounting: the revenue recognition principle and the expense matching principle
• Accounting choices and exceptions: materiality and conservatism
• The importance of what’s not on the financial statements. Consider the following example:

The checking account for this start-up business has an initial deposit of $750 from the owner, pays for various items totaling $900, and collects $300 from sales to customers. These transactions leave a month-end checking account balance of $150. The ultimate question: Is the business owner better off at the end of the month than at the beginning? On the one hand, he started with $750 in cash but only has $150 now; that doesn’t sound so good. On the other hand, the owner now has equipment and production machinery that have value and an ongoing business operation—also valuable. Another issue not addressed in the accounting system is the sales potential. Is a $300 sale per month a maximum or is that the result of a few days’ sales at the end of the first month of business after the infrastructure was put in place? While this example has only a few transactions, what if the business had 100, 1,000, or 10,000 cash transactions? The point is that simply looking at checking account information is not enough. The accounting profession has responded to this anomaly by transferring the above information into a series of financial statements: balance sheet, income statement, and the cash flow statement. These documents meaningfully reorganize the above data for effective performance assessment and decision making.

Performance Assessment and Decision Making

One of the primary benefits of the financial and nonfinancial data generated, examined, interpreted, and monitored through the accounting process is for their use as inputs in performance assessment and decision making. Importantly, performance evaluation and decision making are ultimately grounded in professional judgment. Judgment is a function of education, training, and experience. Often accounting and nonaccounting information serve as the foundation of assessment and decisions. As sometimes stated, the accounting and nonaccounting data and analysis will seldom tell one what to do, it will most often eliminate many bad courses of action, leaving management and stakeholders with a relatively few choices (e.g., two, three, or four) upon which decision makers can focus their attention. Evaluation is typically done at the internal (e.g., trends across time) and external (company comparison to the industry and/or key competitors) levels.

One analysis is to prepare common-sized financial statements: balance sheets, income statements, and cash flows. With common-sized statements, balance sheet line items are presented as a percentage of total assets, and income and cash flow statement line items are presented as a percentage of total net sales or gross revenue. The percentages can then be examined internally across time and temporally to competitors and industry metrics.

Ratio analysis is another evaluation technique. There are five categories of ratios:

• Liquidity ratios
• Operating efficiency ratios
• Operating profitability ratios
• Business risk (operating) analysis ratios
• Financial risk (leverage) analysis ratios

Much has been written about these ratios, their calculation, use, and interpretation. In the following table, we will present each of the five categories, the specific ratios, and the usual formula for calculation.

The Dupont model is a method of performance measurement that demonstrates how the tools of evaluation fit together for a more comprehensive analysis. For example, return on assets can be expressed as a function of net income, net sales, and assets as follows:

Return on assets can be also described as a function of net income, stockholders’ equity, and assets as follows:

Further, return on equity can be also described as a function of net income, net sales, stockholders’ equity, and assets as follows:

Of course, as noted throughout the discussion of accounting, financial and nonfinancial data, and analysis above and throughout this text, forensic accountants and fraud examiners are experts with metrics, numbers, and analysis. As such, the FAFE professional will be correlating financial and nonfinancial data, metrics, and numbers from a variety of sources to evaluate their reasonableness and compare hypotheses (fraud theories) and assertions (claims made by parties to a civil dispute). It’s important that the professional consider hypotheses and assertions from many angles and attempt to examine data and interpret findings with an open mind and let the evidence lead them to defensible conclusions and opinions.

The AICPA and Statement on Auditing Standards No. 99

While the FASB develops generally accepted accounting principles, the purview of auditing of nonpublic companies falls under the guidelines of the American Institute of Certified Public Accountants (AICPA).

Subsequent to the passage of the Sarbanes–Oxley Act of 2002, regulation of public companies became the responsibility of the newly created Public Company Accounting Oversight Board (PCAOB), but the AICPA retained the authority to set standards and make rules in five major areas:

• Auditing standards (for nonpublic companies)
• Compilation and review standards
• Other attestation standards
• Consulting standards
• Code of professional conduct

An audit is performed to ensure that the financial statements are fairly presented and are free from material misstatement. Note that this does not imply that financial statements are entirely correct or accurate. More specifically related to fraud, AICPA Statement on Auditing Standards (SAS) No. 99 directs that an audit should be planned and performed to obtain “reasonable assurance” about whether the financial statements are free of material misstatements, whether caused by error or fraud.

Furthermore, auditing standards require that an audit be completed with due professional care, which, in turn, requires that the auditor exercises professional skepticism. The causes of misstatements are errors and fraud. Fraud can arise from one of two sources: misappropriation of assets that rises to the level of materiality or (material) financial reporting fraud. (The ACFE lists three sources of what it defines as occupational fraud: asset misappropriations, fraudulent financial statements, and corruption. The latter category is distinguished from the first two in that it requires a coconspirator, sometimes not employed by the entity.) Examples of financial reporting fraud include the falsification of underlying accounting books and records and omission of certain transactions.

Professional skepticism entails three overlapping concepts:

• An attitude that includes a questioning mind and a critical assessment of audit evidence
• Conducting of the engagement that recognizes the possibility of material misstatement due to fraud
• Dissatisfaction with less-than-persuasive evidence

Stated more succinctly, an auditor should have a questioning mind, recognize that financial statements may be materially misstated, and require persuasive evidence (evidence-based decision making).

SAS No. 99 specifically recognizes the importance of the fraud triangle: incentives (pressures), opportunity, and rationalization. SAS No. 99 offers an eight-step approach when considering the risk of materially misstated financial statements due to fraud.

Step 1 states that at the outset of an audit engagement auditors should undertake a staff discussion concerning the risks of fraud. The staff discussion should consist of brainstorming as well as considering how and where the financial statements might be susceptible to fraud and emphasize the need for professional skepticism.

Step 2 involves gathering information necessary to identify fraud risks, including inquiries of management, the audit committee, internal auditors, and others; the results of analytical procedures; identified fraud risk factors; and other information that may be suggestive of fraud.

During Step 3, auditors attempt to identify risks that may result in fraud, giving consideration to the types of risks, the significance or magnitude of the risk, the likelihood of the risk, and the pervasiveness of the risk.

In Step 4, the auditor assesses fraud risks after consideration of programs and controls to prevent fraudulent financial reporting. The auditors must rely on their understanding of the systems of internal control and evaluate whether they actually address the fraud risks identified. Since internal controls are designed to reduce the opportunity for fraud, this reassessment after recognition of internal control policies and processes is an important step in the process.

Step 5 requires the auditor to develop specific responses to fraud risks. As the risk of materially misstated financial statements increases, the auditor may respond in several ways. For example, the auditor can assign more experienced staff to the engagement, give more attention to accounting policies and choices, and apply less predictable audit procedures. In short, the auditor needs to increase the amount and quality of audit evidence by altering the nature, timing, and extent of audit procedures. A critical aspect of step 5 is assessing the possibility of management override. Despite a well-designed and implemented system of internal controls, certain individuals in management and the executive suite have tremendous influence and control. At times, the influence and control is so powerful that some managers may be able to override the system of internal controls. Essentially, the system of internal controls operates fine but for the actions of a few select, powerful individuals. The risk of management override should not be underestimated even in the most successful and well-run entities. To address the issue of management override, auditors should examine adjusting journal entries, support for adjusting journal entries, accounting estimates, underlying rationale and support for accounting estimates, and unusual (one time), significant transactions and the underlying rationale and support for the accounting treatment of these transactions.

Step 6 considers the audit evidence and requires auditors to continually assess fraud risk throughout the audit. The auditor needs to evaluate analytical procedures performed as substantive tests, evaluate risk of fraud near completion of fieldwork, and respond to identified material misstatements.

In Step 7, the auditor must communicate his findings as follows:

• All fraud to an appropriate level of management
• All management fraud to the audit committee
• All material fraud to management and the audit committee
• If reportable conditions related to the internal control environment have been identified, the auditor must communicate those to the audit committee

Step 8 ensures that the auditor has documented each of these steps in the consideration of fraud:

• Staff discussion
• Information used to identify risk of fraud
• Fraud risks identified
• Assessed risks after considering programs and controls
• Results of assessment of fraud risk
• Evaluation of audit evidence
• Communications requirements

The Sarbanes–Oxley Act of 2002

The Sarbanes–Oxley Act of 2002 was signed into law on July 30, 2002, to address corporate governance and accountability as well as public accounting responsibilities in improving the quality, reliability, integrity, and transparency of financial reports. The Act provides sweeping measures aimed at

• Establishing higher standards for corporate governance and accountability
• Creating an independent regulatory framework for the accounting profession
• Enhancing the quality and transparency of financial reports
• Developing severe civil and criminal penalties for corporate wrongdoers
• Establishing new protections for corporate whistleblowers

The Act has authorized the SEC to issue implementation rules on many of its provisions intended to improve corporate governance, financial reporting, and audit functions. The SEC has issued the following implementation rules pertaining to the Act:

• New standards of professional conduct for attorneys
• Standards and procedures related to listed company audit committees
• Strengthening of the commission’s requirements regarding auditor independence
• Disclosure in management’s discussion and analysis about off-balance sheet arrangements and aggregate contractual obligations
• Disclosures regarding a Code of Ethics for Senior Financial Officers and Audit Committee Financial Experts
• Retention of records relevant to audits and reviews
• Insider trades during pension fund blackout periods
• Conditions for use of non-GAAP financial measures
• Certifications of disclosure in companies’ quarterly and annual reports

These implementation rules are expected to create an environment that promotes strong marketplace integrity, new criminal and civil penalties for violations of securities laws, improve the probability of detection and deterrence of corporate misstatements, and restore public trust in the quality and transparency of financial information. Table 3-1 summarizes important provisions of the Act aimed at improving corporate governance, financial reports, and audit functions.

Enhanced Financial Disclosure Requirements

Protections for Corporate Whistleblowers under Sarbanes–Oxley

The Sarbanes–Oxley Act establishes broad new protections for corporate whistleblowers. There are two sections of the Act that address whistleblower protections: Section 806 deals with civil protections and Section 1107 establishes criminal liability for those who retaliate against whistleblowers.

Enhanced Penalties for White-Collar Crime

As part of Congress’ general effort to deter corporate accounting fraud and other forms of white-collar crime, the Sarbanes–Oxley Act also enhances the criminal penalties for a number of white-collar offenses.

The Public Company Accounting Oversight Board (PCAOB)

Title I of Sarbanes–Oxley establishes the Public Company Accounting Oversight Board whose purpose is

to oversee the audit of public companies that are subject to the securities laws, and related matters, in order to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports for companies the securities of which are sold to, and held by and for, public investors. (Section 101)

In short, the Board is charged with overseeing public company audits, setting audit standards, and investigating acts of noncompliance by auditors or audit firms. The Board is appointed and overseen by the Securities and Exchange Commission. It is made up of five persons, two who are or have been CPAs and three who have never been CPAs. The Act lists the Board’s duties, which include the following:

• Registering public accounting firms that audit publicly traded companies
• Establishing or adopting auditing, quality control, ethics, independence, and other standards relating to audits of publicly traded companies
• Inspecting registered public accounting firms
• Investigating registered public accounting firms and their employees, conducting disciplinary hearings, and imposing sanctions where justified
• Performing such other duties as are necessary to promote high professional standards among registered accounting firms, to improve the quality of audit services offered by those firms, and to protect investors
• Enforcing compliance with the Sarbanes–Oxley Act, the rules of the Board, professional standards, and securities laws relating to public company audits

Dodd-Frank

The Dodd-Frank Wall Street Reform and Consumer Protection Act (generally referred to as Dodd-Frank) was signed into law on July 21, 2010, in response to the financial crisis of 2008. Major highlights of this financial reform legislation included the following:

• Consumer Protection—The Consumer Financial Protection Bureau, housed within the Federal Reserve system, was established to ensure that consumers receive the financial information necessary to protect them from hidden fees, abusive credit terms, and deceptive lender practices.
• Regulate Wall Street and Reduce Big Bonuses—A provision of this legislation gives shareholders the right to a nonbinding vote on executive pay (“say on pay”) and golden parachutes.
• End Too-Big-To-Fail Bailouts—By imposing harsher capital and leverage requirements, Dodd-Frank seeks to discourage financial firms from becoming too large. It also develops a safe process to liquidate those firms that collapse, financially.
• Identify and Prevent Future Financial Crises—The Financial Stability Oversight Council was established to monitor systemic risk and take action before large, complex organizations threaten U.S. economic stability.
• Transparency and Accountability for Complex Financial Instruments—Closes loopholes that permit irresponsible and abusive practices for over-the-counter derivatives, asset-backed securities, hedge funds, and mortgage brokers.
• Investor Protection—The Credit Rating Agency-related provisions increase the agencies’ liability for inaccurate ratings and give the SEC leverage in imposing sanctions and bringing cases against these agencies for material misstatements or fraud. Other noteworthy provisions within the law encourage whistleblower reports and increase SEC funding to strengthen investor protection activities.

Since the enactment of Dodd-Frank, approximately 30% of the regulations have yet to be implemented. Under the administration of President Donald J. Trump, however, it doesn’t seem likely that, at least, some of those rules will ever see the light of day. Regulatory policy is a function of the administration and political party in power. Currently, there are areas where rollbacks of the original legislation are being considered, including adjusting the size at which banks are subject to regulatory oversight and exempting “small” banks—banks with assets of less than $100 billion—from some loan, mortgage, and trading requirements. For example, the Volcker Rule, which prohibits making certain kinds of speculative investments with customers’ money, would not apply to small banks.

Committee of Sponsoring Organizations’ (COSO) Enterprise Risk Management Framework (ERM)

The Committee of Sponsoring Organizations (COSO) of the Treadway Commission is a joint initiative of the American Accounting Association (AAA), the American Institute of CPAs (AICPA), the Financial Executives Institute (FEI), the Institute for Management Accountants (IMA), and the Institute of Internal Auditors (IIA). In September 2004, COSO released their ERM framework, recognized by the SEC as the critical methodology for Sarbanes–Oxley Section 404 compliance. It outlined the principles and components of effective risk management processes. Furthermore, the ERM framework describes how risks should be identified, assessed, and addressed. Interestingly, the framework emphasizes not only how effective risk management processes work but also the possibility of enhanced profitability and return as a result of process evaluation and streamlining.

The fundamental purpose of the ERM framework approach is to help entities ensure that they will be able to achieve their operational and financial objectives and goals including:

• Achieving high-level strategic goals and the entity’s mission
• Effective and efficient use of the company’s operational resources
• Reliability of the company’s financial reporting systems
• Compliance in meeting applicable laws and regulations
• Safeguarding of company resources by preventing loss through fraud, theft, waste, inefficiency, bad business decisions, etc.

In order to achieve its objectives, the ERM framework outlines the various components of good risk management processes. Some of those components consider an entity’s risk tolerance and risk appetite. Other components evaluate the entity’s internal environment; its ability to set objective; the need to identify events that could have an effect on an entity’s ability to achieve its objectives; its risk assessment including response; its control environment, information, communication, and its ability to monitor activities and events.

The COSO ERM Framework also has some specific suggestions for creating an antifraud environment:

• Consider and document fraud vulnerabilities
• Consider and document strategic objectives, the entity’s risk appetite, risk tolerances, and consider them in the context of fraud probabilities
• Identify and document events that create risks of fraud
• Document enterprise risks by looking at the likelihood and impact of fraud vulnerabilities at all levels of the company
• Evaluate possible responses to fraud risks
• Implement and document antifraud control activities, policies, and procedures
• Communicate fraud prevention information, policies, and procedures throughout the company
• Monitor and document the success and failure of antifraud prevention controls and react to any findings

In 2017, COSO released Enterprise Risk Management–Integrating with Strategy and Performance. This new document builds on its 2004 guidance and is the first major design revision. It recognizes the evolving risks in a dynamic business environment. The updated edition is designed to help organizations create, preserve, and realize value while improving their approach to managing risk. The update, developed by PwC under the direction of the COSO Board, highlights the importance of enterprise risk management in strategic planning. It also emphasizes embedding ERM throughout an organization, as risk influences strategy and performance throughout the organization.

IIA Practice Advisories 1210.A1 and 1210.A2

Internal audit can be an integral resource in creating an antifraud environment. The Institute of Internal Auditors (IIA) has issued Practice Advisories 1210.A1 and 1210.A2 that address identification of fraud and the internal auditors’ responsibility for fraud detection, respectively. The IIA standards require the internal auditor to have sufficient knowledge to identify the indicators of fraud. The standards further recognize that fraud can be perpetrated for the benefit of, or to the detriment of, the organization and by individuals outside as well as inside the organization.

Examples of frauds designed to benefit the organization include the following:

• Sale or assignment of fictitious or misrepresented assets
• Improper payments such as illegal political contributions, bribes, kickbacks, and payoffs to government officials, intermediaries of government officials, customers, or suppliers
• Intentional improper representation or valuation of transactions, assets, liabilities, or income
• Intentional improper transfer pricing (e.g., valuation of goods exchanged between related organizations)
• Intentional improper related-party transactions
• Intentional failure to record or disclose significant information to outside parties
• Prohibited business activities such as those that violate government statutes, rules, regulations, or contracts
• Tax fraud

Examples of fraud perpetrated to the detriment of the organization include the following:

• Acceptance of bribes or kickbacks
• Diversion to an employee or outsider of a potentially profitable transaction
• Embezzlement, including efforts to falsify financial records to cover up the act
• Intentional concealment or misrepresentation of events or data
• Claims submitted for services or goods not actually provided to the organization

Management and internal audit have differing roles with respect to fraud detection. The normal course of work for the internal audit activity is to provide an independent appraisal, examination, and evaluation of an organization’s activities as a service to the organization. The objective of internal auditing in fraud detection is to assist members of the organization in the effective discharge of their responsibilities by furnishing them with analyses, appraisals, recommendations, counsel, and information concerning the activities reviewed. The engagement objective includes promoting effective control at a reasonable cost. The IIA standards recognize that management has primary responsibility for the prevention, deterrence, and detection of fraud.

Nevertheless, in carrying out their responsibilities internal auditors should consider the following:

• Whether the organizational environment fosters control consciousness (tone at the top)
• Whether realistic organizational goals and objectives are set
• Written policies (e.g., code of conduct) and the response to policy violations
• Authorization for transactions, both existence and implementation
• Policies, practices, procedures, reports, and other mechanisms are developed to monitor activities and safeguard assets, particularly in high-risk areas
• Communication channels provide management with adequate and reliable information
• The response to recommendations to establish or enhance cost-effective antifraud controls

When red flags are identified and the internal auditor suspects that fraud may have occurred, the appropriate levels of corporate governance should be informed. The chief audit executive has the responsibility to report immediately any significant fraud to senior management and the board. When the incidence of significant fraud has been established with reasonable certainty, senior management and the board should be notified immediately. When conducting fraud investigations, internal auditors should

• Assess the probable level and the extent of complicity in the fraud within the organization
• Determine the knowledge, skills, and other competencies needed to carry out the investigation effectively to ensure the appropriate types and levels of technical expertise
• Design procedures to identify the perpetrators, the extent of the fraud, the techniques used to perpetrate the fraud, and the underlying causes
• Coordinate activities with management personnel, legal counsel, and other specialists as appropriate
• Be cognizant of the rights of alleged perpetrators and personnel and the reputation of the organization itself

Once a fraud investigation is concluded, internal auditors should assess the facts known to determine if controls need to be implemented or strengthened to reduce future vulnerability and design engagement tests that will help to disclose the existence of similar frauds. A draft of the proposed final communications on fraud should be submitted to legal counsel for review.

Short Answer Questions

1. What was Enron’s first successful market?
2. What created to opportunity for Enron to trade in this market?
3. What was the name of Enron’s Internet trading venture?
4. What was the name of Enron’s fair value accounting model?
5. What related party legal entity did Enron make famous?
6. Who was the famous whistleblower who penned the memo “Has Enron Become a Risky Place to Work?”

Discussion Questions

1. Was Enron an accounting fraud or a business failure concealed by fraud?
2. Enron extensively used fair value accounting. What prevents companies from abusing fair value accounting the way that Enron did?
3. Did Enron’s auditor fail or was the auditing firm a victim as well?