Presentation on theme: "Editor of the Journal of Forensic & Investigative Accounting."— Presentation transcript:
1Editor of the Journal of Forensic & Investigative Accounting. How to Conduct An Internal Investigation D. Larry Crumbley, CPA, CFF, Cr.FA, MAFF, FCPA KPMG Endowed Professor Department of Accounting Louisiana State University Room 2833, Business Education Complex Baton Rouge, LA FaxDr. Crumbley is theEditor of the Journal of Forensic & Investigative Accounting.Former editor of the Journal of Forensic Accounting: Auditing, Fraud, and Risk,Former chair of the Executive Board of Accounting Advisors of the American Board of Forensic Accountants,Former member of the NACVA’s Fraud Deterrence Board, andOn the AICPA’s Fraud Task Force ( ).A frequent contributor to the Forensic Examiner and Value Examiner, Professor Crumbley is an author of more than 55 books and 350 articles. His latest book entitled Forensic and Investigative Accounting, 5th edition, is published by Commerce Clearing House ( ). Some of his 13 educational novels, e.g., Trap Doors and Trojan Horses and The Big R: A Forensic Accounting Action Adventure, have as the main character a forensic accountant. His goal is to create a television series based upon the exciting life of a forensic accountant and litigation consultant.11
2Wide Variety of Investigations Fraud investigationTracing assetsDamages calculationsValuation calculationsWitness locationEmployment investigationsWorker compensation claimsPrivate family investigationsHomicideSuicideMissing person investigationPersonal background checksCorporate investigationsCivil investigationsNegligence or criminal investigationsSource: Erik Laykin, Investigative Computer Forensics, Hoboken, N.J.: John Wiley, 2013, p.130.22
3SAS No. 99: SKEPTICISMAn attitude that includes a questioning mind and a critical assessment of audit evidence.An auditor is instructed to conduct an audit “with a questioning mind that recognizes the possibility that a material misstatement due to fraud could be present, regardless of any past experience with the entity and regardless of the auditor’s belief about management’s honesty and integrity.”“Things are not always as they appear, sonny boy.” James Patterson, Honeymoon, Warner Books, 2006.33
4Mind-Set: SKEPTICISMRonald Reagan said with respect to Russia, “Trust, but verify.”FA’s motto should be “Trust no one; question everything; verify.”As Charles Manson said, “Total paranoid is total awareness.”Ron Durkin says auditors must go beyond skepticism to “thinking forensically.” [More than skeptical ]This ain’t my first rodeo I didn’t make it all the way through school. But my mama didn’t raise no fool. I may not be the Einstein of our time. But honey, I’m not dumb and I’m not blind. Vern Gosdin44
5PredicationThe ACFE group indicates that in the private sector, a fraud investigation should not be conducted without proper predication.Examples: Anonymous tips, complaints, audit inquires, conflict of interest.Thus, predication is the basis for undertaking a fraud investigation.Without predication, the target might be able to sue for real or imaginary damages.55
6Be An Investigator “Because I was an investigator,” he said. “O.K.,” she said. “Investigators investigate. That, I can follow. But don’t they stop investigating? I mean, ever? When they know already?”“Investigator never know,” he said. “They feel, and they guess.”“I thought they dealt in facts.”“Not really,” he said. “I mean, eventually they do, I suppose. But ninety-nine percent of the time it’s ninety-nine percent about what you feel. About people. A good investigator is a person with a feel for people.”Lee Child, Echo Burning, N.Y.: Jove Books, 2001, p. 281.66
7Investigative Technique “You know how it goes,” I said. “You get a case. You just keep poking around, see what scurries out.” p. 144.“How,” Susan said, “on earth are you going to unravel all of that?”“Same way you do therapy,” I said.“Which is?”“Find a thread, follow it where it leads, and keep on doing it.”“Sometimes it leads to another thread.”“Often,” I said.“And then you follow that thread.”“Yep.”“Like a game,” Susan said.“For both of us,” I said.Susan nodded. “Yes,” she said, “tracking down of a person or an idea or an evasion.”pp. 270 – 271.Source: R.B. Parker, Widow’s Walk, Berkley Books, 2002.77
8Fraud Detection Process Discuss facts and objectives with client/attorney (e.g., conflict of interests).Evaluation whether to accept the engagement.Prepare a work program.Develop time and fee schedule.Obtain approval of work program, staff assignments, and fee estimates.Obtain an engagement letter.7/ Identify fraud exposures and symptoms.9/ Evaluate evidence obtained and determine if more evidence is needed.11/12. Search for and evaluate additional evidence.Discuss preliminary findings with client/attorney.Draft a final report.Review the report and work papers.Resolve professional disputes.Clear review points and open items.Communicate report or findings.Help attorney prepare court case/testify.Perform follow-up procedure.File work papers/report.Source: Carmichael et. al, PPC Fraud Detection, Vol.1, Ch. 2 (2002).88
9Informal observations while in the business. Wandering AroundInformal observations while in the business.Especially valuable when assessing the internal controls.Observe employees while entering and leaving work and while on lunch break.Observe posted material, instructions, job postings.Observe information security and confidentiality.Observe the compliance with procedures.Appearance is not necessarily reality. Man of La Mancha99
10Investigative Techniques “Facts weren’t the most important part of an investigation, the glue was. He said the glue was made of instinct, imagination, sometimes guesswork and most times just plain luck.” (p. 163).“In his job, he [Bosch] learned a lot about people from their rooms, the way they lived. Often the people could no longer tell him themselves. So he learned from his observations and believed that he was good at it.” (p. 31).Michael Connelly, The Black Ice, St. Martin’s Paperbacks, 1993.1010
11Investigative Techniques and Evidence Documentary evidence – written evidence on paper or computer medium.Testimonial evidence – testimony of individuals.Observational evidence – evidence, actions, or observations seen by an investigator.Physical examination of evidence (e.g., counts or inspections).Fixed point observations of activities (e.g., watching a scene and recording).Moving observations.Invigilation – strict temporary controls are imposed so that fraud virtually impossible. Keep detailed records.Covert observations.Forensic document examination.Source: D.R. Carmichael et.al., Fraud Detection, Vol. I, Practitioners Publishing Co., 2002, pp. 3-1 to 3-4
12• Items maintained as privileged or confidential. DocumentationThe forensic accountant needs to track and document the steps in any investigation process, including:• Items maintained as privileged or confidential.• Requests for documents, electronic data, and other information.• Memoranda of interviews conducted.• Analysis of documents, data, and interviews and conclusions drawn.Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; 2008, p. 43.1212
13Chain of CustodyJust as in the movies or on a television show such as CSI, forensic accountants must safeguard evidence through a financial chain of evidence (e.g., fraud in a computer).There must be a way to show that the evidence has not been tampered with or damaged.If documents are seized, the forensic accountant should put his or her initials and date of the seizure on the back of each document.Or put the document in a transparent envelope and write a description on the envelope.Store the original and work only with a copy.
14Enforcement Manual Enforcement Manual History and Custody of Documents U.S. Department of LaborPension and Welfare BenefitsAdministration Date _______________________________Case Number________________________Case Name __________________________22. How were the documents obtained?____ By consent (note any significant comments of the principal or third party witness and any unusual circumstances which occurred)?____ By legal process (describe).What is the relationship between the documents and the person submitting them?22. Were manual transcripts or facsimile copies made of any of the documents either in whole or in part?.______ Yes ______NoIf Yes, list documents copies. Manner of reproduction22. Have all copies been compared with the original documents and identified? _____Yes _____NoIf No, why not? Were the original documents described herein under your control or supervision at all times prior to their return to the principal, third party witness, or representative?_____Yes _____NoIf No, set forth circumstances of any transfer in control Did the principal, third party witness, or a representative request access to the documents during your custody?___ Yes ___ NoIf Yes, who requested access and what action was taken?Signature ___________________Title ________________________PWBA (May 1987)
15Principles of Investigation Documentation Take notes on everything you do.Document every effort to contact a witness and all surveillance in the running resume.Prepare a report whenever there is a possibility you will have to testify.Take verbatim statements from hostile or unhelpful witnesses; obtain declarations from friendly witnesses.Provide all of the case’s documents to the client at the conclusion of the case – or have a document retention policy that decrees the maintenance of most records for at least five years.P.A. Becnel, IV and S.J. Krischke, Principles of Investigative Documentation, Springfield, IL: C. C. Thomas Publisher, 2012, 172 pp.
16Scienter NecessaryTo prove any type of fraud, prosecutors must show that scienter was present.That is, the fraudster must have known that his or her actions were intended to deceive.The allure of numbers to most of us, is like the excitement of settling sand--a narcoleptic surety. Crafty criminals prey on this boredom. They pile on the numbers, spewing meaningless records in the false books.Cory Johnson1616
17Two Major Types of Fraud Investigations Reactive: Some reason to suspect fraud, or occurs after a significant loss.Proactive: First, preventive approach as a result of normal operations (e.g., review of internal controls or identify areas of fraud exposure). There is no reason to suspect fraud. Second, to detect indicia of fraud.Source: H.R. Davia, “ Fraud Specific Auditing,” Journal of Forensic Accounting, Vol. 111, 2002, pp1717
18Proactive Is Beneficial The threat of a future investigation reduces the occurrence of fraudulent behavior from 75% to only 43%.The larger the pay-off, the more likely a person will commit fraudulent behavior.Give the fox a key to the hen house and he/ she is going to eat hens.Source: S. L. Tate et. al, “The Small Fraud Paradigm: An Examination of Situational Factors That Influence the Non-Reporting of Payment Errors,” J. of Forensic Accounting, Vol.7, 2006, p. 406.The greater the risk of detection, the less likely a person is to violate the law.Jeremy Bentham18th Century Philosopher1818
19Proactive vs. Reactive Approaches Proactive approaches includeEffective internal controls,Financial and operational audits,Intelligence gathering,Logging of exceptions, andReviewing variances.Reactive detection techniques includeInvestigating complaints and allegations,Intuition, andSuspicion.Jack Bologna and Robert Lindquist, Fraud Auditing and Forensic Accounting, 2d Edition, New York: John Wiley, 1995, p. 137.1919
20Proactive Is BestWhen the IRS began requiring banks to issue Form 1099s reporting interest, the reported interest income increased by $8 billion (even though for 3 years the IRS did not have computer matching capacity).When the IRS began to require taxpayers to list a social security number for dependents, the next year the number of reported dependents dropped by seven million. More than 11,000 of these taxpayers claimed seven or more dependents in 1986, but they claimed none in 1987.When the IRS began to require taxpayers to list a name, address, and social security number for babysitters, two years later 2.6 million babysitters disappeared.2020
21Fraud Deterrence Better Than Fraud Investigation Fraud deterrence less expensive.Deterrence is more comprehensive.Fraud deterrence produces greater savings.Deterrence is faster.Fraud deterrence promotes better customer relations.Daniel Finnegan, “Deterring Fraud,” Quality Planning Corporation, 1991.2121
22Fraud Deterrence Review Analysis of selected records and operating statistics.Identify operating and control weaknesses.Proactively identify the control structure in place to help prevent fraud and operate efficiently.Not an audit; does not express an opinion as to financial statements.May not find all fraud especially where two or more people secretively agree to purposely deceive with false statements or by falsifying documents.[Always get a comprehensive, signed engagement letter defining objectives.]2222
23Financial Fraud Detection Tools Interviewing the executivesAnalyticsPercentage analysisHorizontal analysisVertical analysisRatio analysisUsing checklists to help detect fraudSAS checklistAttitudes/Rationalizations checklistAudit test activities checklistMiscellaneous fraud indicator checklist“Objectively obtaining and evaluating evidence is the essence of auditing.”(AAA, Committee on Basic Auditing Concepts, 1973, 2)2323
24Analytical Procedures Analytical procedures involve the study or comparison of the relationship between two or more measures for the purpose of establishing the reasonableness of each one compared. Five types of analytical procedures help find unusual trends or relationships, errors, or fraud:Horizontal or Percentage AnalysisVertical AnalysisVariance AnalysisRatio Analysis or BenchmarkingComparison with other operating information24Source: D.L. Crumbley, J.J. O’Shaughnessy, and D.E. Ziegenfuss, 2002 U.S. Master Auditing Guide, Chicago: Commerce Clearing House, 2002, p. 592.24
25Financial Statement Fraud Audit Obtain current year’s financial statements.Obtain prior 3 years’ financial statements.Perform vertical/ horizontal analysis of the 4 years, plus all current quarters.Pay attention to footnotes.Analysis of %s and footnotes by senior auditors.Nonsense %s and footnotes inquire explanations from financial management.Interview lower level financial employees who approved questionable journal vouchers.Combine explanations with visits to accounting records/ source documents.2525
26Horizontal AnalysisSuppose advertising in the base year was $100,000 and advertising in the next three years was $120,000, $140,000, and $180,000. A horizontal comparison expressed as a percentage of the base year amount of $100,000 would appear as follows:26Year 4Year 3Year 2Year 1Dollar Amount$180,000$140,000$120,000$100,000Horizontal Comparison180%140%120%100%26
27Red Flags with Horizontal Analysis When deferred revenues (on the balance sheet) rise sharply, a company may be having trouble delivering its products as promised.If either accounts receivable or inventory is rising faster than revenue, the company may not be selling its goods as fast as needed or may be having trouble collecting money from customers. For example, in 1997 Sunbeam’s revenue grew less than 1% but accounts receivable jumped 23 percent and inventory grew by 40 percent. Six months later in 1998 the company shocked investors by reporting a $43 million loss.If cash from operations is increasing or decreasing at a different rate than net income, the company may be being manipulated.Falling reserves for bad debts in relation to account receivables falsely boosts income (cookie jar accounting).2727
28More Red FlagsLook for aggressive revenue recognition policies (Qwest Communication, $1.1 billion in ). Beware of hockey stick pattern.Beware of the ever-present nonrecurring charges (e.g., Kodak for at least 12 years).Check for regular changes to reserves, depreciation, amortization, or comprehensive income policy.Related-party transactions (e.g., Enron).Complex financial products (e.g., derivatives).Unsupported top-side entries (e.g., WorldCom).Under-funded defined pension plans.Unreasonable management compensationSource: Scott Green, “Fighting Financial Reporting Fraud,” Internal Auditor, December 2003, pp2828
29Ink Analysis Martha Stewart was undone by a blue ballpoint pen. Stockbroker belatedly inserted a note to help cover up Ms. Stewart’s improper stock trading. Blue ballpoint ink used is different from ink elsewhere on the trading worksheet.Prosecutors used forensic ink analysis in Rite Aid case to show that certain documents were backdated (ink used to sign letter was not commercially available until 3 months after the letter was dated).Xerox laser printers now encode the serial number of each machine in tiny yellow dots in every printout, nestled within the printed words and margins. It tracks back to you like a license plate.Advice for fraudsters: use pencils.Source: Mark Maremont, “In Corporate Crimes, Paper Trail Often Leads to Ink Analysts’ Door,” Wall Street J., July 1, 2003, p. A-1.2929
30InvigilationInvigilation is a rather expensive investigating technique that can be used in potential fraud situations to discover the fraud and can later be used in the courtroom.Here detailed records are kept before and after the invigilation period to determine the amount of fraud.During the invigilation period strict controls are imposed (e.g., cameras) so that the fraud is virtually impossible.Or the invigilation period could be while the suspect is on vacation.
31Invigilation Technique No controlsControls or vacation14 days$67,000 lost$0 lost$62,000 lost
32When Fraud Is Discovered Notify management or the board when the incidence of significant fraud has been established to a reasonable certainty.If the results of a fraud investigation indicate that previously undiscovered fraud materially adversely affected previous financial statements, for one or more years, the internal auditor should inform appropriate management and the audit committee of the board of directors of the discovery.A written report should include all findings, conclusions, recommendations, and corrective actions taken.A draft of the written report should be submitted to legal counsel for review, especially where the internal auditor chooses to invoke client privilege.3232
33E-ZPass Catching Cheaters E-ZPass and similar electronic toll collection systems are emerging as a new and powerful means to prove infidelity.Generally mounted inside a vehicle's windshield behind the rearview mirror, the remote-sized, E-ZPass devices communicate with antennas at toll plazas, automatically deducting money from the tag-holder's prepaid account and recording when and where the vehicle crossed the toll.Many states provide electronic toll information in response to court orders for criminal and civil cases, including divorces, which are used to prove the defendant was not where he or she claimed to have been."E-ZPass is an E-ZPass to go directly to divorce court, because it's an easy way to show you took the off-ramp to adultery," said Jacalyn Barnett, a New York divorce lawyer who has used E-ZPass records a few times.Chris Newmarker, “E-ZPass records out cheaters in divorce court.” AP, 2007.
34Seven Investigative Techniques Public document review and background investigation (non-financial documents).Interviews of knowledgeable persons.Confidential sources.Laboratory analysis of physical and electronic evidence.Physical and electronic surveillance.Undercover operations.Analysis of financial transactions.Source: R.A. Nossen, The Detection, Investigation and Prosecution of Financial Crimes, Thoth Books, 1993.3434
35Investigation Tasks 35 1) Interviewing, including: a) Neutral third-party witnesses.b) Corroborative witnesses.c) Possible co-conspirators.d) The accused.2) Evidence collection, including: a) Internal documents, such asi) Personnel files.ii) Internal phone records.iii) Computer files and other electronic devices.iv) .v) Financial records.vi) Security camera videos.vii) Physical and IT system access records. b) External records, such asi) Public records.ii) Customer/vendor information.iii) Media reports.iv) Information held by third parties.v) Private detective reports.3) Computer forensic examinations.4) Evidence analysis, including:a) Review and categorization of information collected.b) Computer-assisted data analysis.c) Development and testing of hypotheses.Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; 2008, pp3535
36Some Important StuffOnce a USB has been imaged, a forensic accountant should use a read-only copy and investigate the file structure for evidence of financial fraud.MD5 hashes verified that two files are exactly the same.Hash values allow forensic accountants to determine if two financial files are exactly the same.The hash calculator can be downloaded for free.Disk Investigator can be used to discover what is hidden on a hard drive and help recover lost data.36
37Evidence RequestsOnce legal requests for electronic evidence are received, such normal business practices need to be stopped and hard drives need to be imaged.Evidence requests likely to include all s; headers; logs; all data files created with word processing, spreadsheet, accounting software, sound recordings, or presentation software; network activity logs; task lists; databases; and e-calendars. All such requests encompass the data on servers, workstations, laptops, floppy disks, only repositories, tapes, voice messaging systems, CDs, DVDs, memory sticks, cell phones, iPads, and all stored backups of data.After this request and until the pertinent drives are imaged, new files should not be saved to working computers.37
38So You Find Fraud• Criminal referral — The organization may refer the problem to law enforcement voluntarily, and, in some situations, it may be required to do so. Law enforcement has access to additional information and resources that may aid the case. Additionally, referrals for criminal prosecution may increase the deterrent effect of the organization’s fraud prevention policy. An appropriate member of senior management, such as the chief legal counsel, should be authorized to make the decision as to whether pursuing criminal prosecution is appropriate.• Civil action — The organization may wish to pursue its own civil action against the perpetrators to recover funds.• Disciplinary action — Internal disciplinary action may include termination, suspension (with or without pay), demotion, or warnings.• Insurance claim — The organization may be able to pursue an insurance claim for some or all of its losses.Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; 2008, pp3838
39Notify your insurer. Failure to notify may negate your coverage. KPMG provides 10 steps to follow when an organization finds or suspects fraud:Shut the door! Keep assets secure until you can provide appropriate long-term security.Safeguard the evidence. Ensure that all records and documents necessary for an investigation remain intact and are not altered by you or anyone else.Notify your insurer. Failure to notify may negate your coverage.Call a professional. Do not confront or terminate the employment of a suspected perpetrator without first consulting your legal advisor.Prioritize your objectives. What’s most important: punishment, loss recovery, prevention, detection of future occurrences?39
40KPMG’s 10 steps to follow contd.. Consider prosecution. Before you make the call, weigh the plusses and minuses and determine if your insurance company requires prosecution.Terminate business relations. If the fraud is external, business relations with the suspect individual or organization should be terminated.Seek advice and assistance. An important consideration is whether you have the knowledge and resources necessary to effectively manage the process.Prepare a witness list. It is important that statements be taken before a “party line” can develop.Consider the message. Whatever you do will affect future situations. Now may be the time to change the way your business operates.40
41Where Details Communicated Internally 41Source: Who is the Typical Fraudster (2011) KPMG
42Where Details Communicated Externally 42Source: Who is the Typical Fraudster (2011) KPMG
43Source: Who is the Typical Fraudster (2011) KPMG Outcomes & Responses43Source: Who is the Typical Fraudster (2011) KPMG
44Interview vs. Interrogation Interview-non-accusatory process where person asks questions to develop factual information (e.g., who, what, when, where, how).Interrogation-accusatory interview to obtain an admission of guilt.“Doubt leads to inquiry, and inquiryleads to the truth.”Saint Thomas Aquinas44
45Selecting the Right Interviewees “Someone knows what is going on. If you tune in, you will get a feel for it.”Lorraine Horton, Kingston, R.I.“It is important that you select the right person to interview, and be conversant in interviewing techniques. For instances, pick someone from customer complaints or an employee who didn’t get a raise for two years, as they would be likely to provide the needed information.”R.J. DiPasquale, Parsippany, N.J.Source: H.W. Wolosky, “Forensic Accounting to the Forefront,” Practical Accountant, February 2004, ppListen to rouges and whistle-blowers who complain.45
46Differentiate Between the Two InterviewInterrogationInvolves a witnessInvolves a suspectInvolves a victimInvolves custodyNo Miranda rightsRequires Miranda rightsGeneral informationSpecific factsLess demandingMore demandingCasualHighly structuredInterview in the fieldInterrogate at the officeInformation not knownConfirm known informationScattershot approachPin-down approach46Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press, 1992, p.5.
47Moving from Unwilling to Willing Chair Ask general questions.Win them over.Make them feel that this is what’s best for them.Take away the foundation.Gain their confidence.Explain the facts.Relate to them.Deescalate the crisis.Give them a way out.Explain the advantages of cooperation.Give them a change to explain.Lie to them.Downplay the disadvantages of cooperation.Understand them.Hang it on them.Use deception.Put it on them.Play on their sympathy.Threaten them.Play on their conscience.Get them to trust.Determine their frame of mind.Mimic their manner.Talk to them.Empathize.Know how far to push.Show them what they’re looking at.Get on their level.Show them acceptance.Speak their language.Develop a rapport.Show them.Tell them.47Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press, 1992, p.8.
48Advantage and Disadvantages Advantages of an interview (non-accusatory)Facilitates the development of cooperation.Easier to develop rapport.More effective way of developing usable information.Disadvantages of interrogationInterviewee may be alienated and refuse to speak to anyone later.If interviewee will not speak to anyone, ability to obtain information or admission is diminished.Source: John E. Reed Associates, Inc.48
51Room Arrangement Details Establish a sense of privacy.No locks or physical impediments.Room plain color (e.g. no pictures, etc.)Lighting should provide good, but not excessive or glaring illumination of interviewee’s face. Same for interviewer.No telephones, cell phones, or beepers.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp
52Room Arrangement Details Chairs about 4 feet apart. Straight-back. No rollers. Facing each other.Both chairs at the same level (both at same eye level).Observation room arrangement if possible (or video). Record it, no video.In case of a female, another female should be present.Not at suspect’s home or officeNo bad breath odor.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp
53Interviewer’s Demeanor Civilian clothes. No uniform. Conservative suit, jacket, or dress.Relaxed and comfortable.No smoking.Questions in conversational tone. Non-accusatory.Keep eye contact. Neither person should wear dark glasses.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp
54Interviewer’s Demeanor Take written notes (but not in an interrogation).Use simple language.Never scold or reprimand if the suspect is caught in a lie.Do not pace around the room.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp
55Make Interviewee Comfortable He puts a strong hand on my shoulder. “I appreciate you helping us out, Michael." Unlike the FBI polo crew, he's wearing a gray suit with a small stain on his right lapel. His tie is pulled tight, but the top button on his stark white shirt is open. The effect is the most subtle hint of casualness in his otherwise professional demeanor."Quite a day, huh, Michael?" It's the third time since we've met that he's said my name, which I have to admit sets off my radar. As my old crime law professor once explained, name repetition is the first trick negotiators use to establish an initial level of intimacy. The second trick is physical contact. I look down at his hand on my shoulder.”Source: Brad Meltzer, The First Counsel, Grand Central Pub. NY., 2001, p.86
56The Reid Nine Steps of Interrogation The investigator directly and positively confronts the suspect.The investigator introduces an interrogation theme.The investigator handles the initial denials of guilt.The investigator overcomes the suspect’s objections.The investigator gets and retains the suspect's attention and clearly displays sincerity in what he says.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 125.
57The Reid Nine Steps of Interrogation The investigator recognizes the suspect’s passive mood.The investigator uses an alternative question- a suggestion of a choice to be made by the suspect concerning some aspect of the crime.The investigator has the suspect orally relate the various details of the offense that will serve ultimately to establish legal guilt.The verbal confession is converted into a written or recorded statement.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 125.
59Verbal and Nonverbal Behavior Verbal behavior includes not only words, but timing, pitch, rate, and clarity of the responses.Nonverbal behavior includes body movement, position changes gestures, eye contact, and facial expressions.See “Interviewing & Interrogation,” The Reid Technique, John E. Reid Associates, Inc., L.E.R.C Law Enforcements.59
60Nonverbal Language 60% of communication is nonverbal. Previous contact with person helpful.During President Bill Clinton’s testimony he touched his nose several times when he was lying, but did not touch his nose during truthful testimony.Two-thirds of truth interviewees cross their legs.Source: “Lying 101: There May Be Nonverbal Indicators of Lying,”60
61Posture Language Truthful Deceptive Frontally aligned. Upright or forward.Open (perhaps crossed legs).Dynamic, comfortable changes.DeceptiveNon-frontally aligned.Slouched, retracted or leaning.Barriers (crossed arms, purse in lap).Frozen and rigid.Source: John E. Reid Associates, Inc.61
62Some Lying Signs Covering mouth with hand. Rubbing nose. Frequent blinking.Biting lip.Moving or tapping foot.Crossing arms.Leaning forward.Handling objects (e.g., pencil, pen).Avoiding eye contact or averting eyes.Clearing the throat.Closing and opening coat.Picking at lint on clothing.Playing with collar.Moving away.Shrug gestures.Slow response.Higher pitch.Long answer.Gap between words becomes longer.Non-words such as uh.Source: “Lying 101: There May Be Nonverbal Indicators of Lying,”62
63Deception Indicators Frequent changes in position Tapping of feet Dryness of mouthRestlessnessFrequent changes in positionTapping of feetFidgetingGripping arms of the chairElbows held close to the bodyRunning hands through the hairChewing of fingernails, pencils, or other objectsExcessive sweatingPulsation of the carotid arteryPallor, flushing, or change in complexion, colorExcessive swallowingAvoiding direct gazeAppearance of being disturbed and/or very tenseAudible turbulence in the stomach.63Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press, 1992, p.139.
64Establishing a Baseline Dance continued to ask about his life [the bad guy] in Seaside and in prison, observing him the whole while: how he behaved when she asked the questions and how he behaved when he answered. She wasn’t doing this to get information-She’d done her homework and knew the answers to everything she asked-but was instead establishing his behavioral baseline.In spotting lies, interrogators consider three factors: nonverbal behavior ( body language, or kinesics), verbal quality ( pitch of voice or pauses before answering) and verbal content (what the suspect says). The first two are far more reliable indications of deception, since it’s much easier to control what we say than how we say it and our body’s natural reaction when we do.The baseline is a catalog of those behaviors exhibited when the subject is telling the truth. This is the standard the interrogator will compare later with the subject’s behavior when he might have a reason to lie. Any differences between the two suggest deception.Finally Dance had a good profile of the truthful Daniel Pell and moved to the crux of her mission.Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.8.64
65Establishing a Baseline (cont.) Still relaxed. The body language wasn’t any different from his baseline. He was showing only emblems-common gestures that tended to substitute for words, like shrugs and finger pointing. There were no adaptors, which signal tension, or affect displays-signs that he was experiencing emotion.‘Not Really.’Which wasn’t an answer to a yes-or-no question; it was even more slippery than ‘I don’t recall.’ Dance noticed too that pell had put his hands, tipped with long, clean nails, on the table at the word ‘ relatives’. This was a deviation from base-line behavior. It didn’t mean lying, but he was feeling stress. The questions were upsetting him.Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.9-11.65
66Studying and MirrorsHe was in no hurry [the bad guy]; interviewers and interviewees share mutual curiosity. (She told the students in her interrogation seminars, “They’re studying you as hard as you’re studying them-usually even harder, since they have more to lose.”Mirrors weren’t placed in interrogation rooms to hide cameras and witness-there are far better high-tech ways to do so –but because people are less inclined to lie when they see themselves.Dance gave a faint smile. ‘ And you understand that you can withdraw from this interview anytime you want and that you have a right to an attorney?’Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.6-7.66
67Conducting Effective Interviews Preferable to use copies of documents rather than originals.Interview one person at a time.Location to be chosen to ensure privacy and to minimize interruptions.Use of cell phones is discouraged.Interview may be protected by legal privilege if the forensic accountant has been hired by counsel.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
68Interviewer Ideally have two interviewers. Encourage long answers. Initial contact polite and professional.Lead interviewer should focus on questions. Maintain eye contact.Interview partner take detailed notes.Close on a positive note.Prepare record of interview as soon as possible.If traveling away from office, let someone know where you are interviewing the person.Conducted in business location.Ask for a business card.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
69Recording InterviewsIf the decision is made to record interviews, proper and reliable equipment is required and a chain of custody for the recordings will be necessary.If recorded statements are used in a later proceeding, the recordings will have to be authenticated and any transcriptions will have to be reviewed for accuracy.While most recording equipment uses a digital format, the digital recordings can easily be altered. Therefore, the original recordings must be retained where a proper chain of custody and retention can provide assurances that the original recoding has not been changed.Extreme care should be taken when making copies of the original recording.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
70Recording InterviewsWhen considering recording other persons, most state laws require the consent of one person to the conversation, but other states require the consent of all parties in the conversation.Surreptitious recordings also are fraught with significant legal issues.Consideration should be made to address a situation where a person may bring their own recorder to an interview and insist on making their own recording.Proper planning of the investigation with counsel should address these issues.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
71Upjohn WarningIn cases where illegal behavior is suspected, interviews should not be conducted until the client’s counsel has been consulted.If it is decided that an attorney will be present during the interview, typically the attorney will begin by giving the witness an Upjohn warning.An Upjohn warning is a disclaimer issued by an attorney for a company to an employee of the company.In the Upjohn warning, the employee is advised that the attorney does not represent the employee, but rather represents the company as a legal entity.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
72Do’s of Interviewing Consult counsel once allegations are made. Prepare and discuss an interview plan or theme.Conduct one interview at a time, unless the situation dictates otherwise.Arrange a safe and private interview location.Gather and organize pertinent documents before the interview.Obtain information concerning the person being interviewed before the interview.Exhibit courteous and professional appearance and behavior at all times.Be punctual.Conduct the interview with more than one person.Establish rapport during initial contact.Maintain control in the interview.Close on a positive note for future contacts.Prepare reports as close as possible to interview.Listen to you instincts.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
73Don’ts of Interviewing Conduct interview without a plan of action.Fail to discuss the interview with partner.Argue with interviewee.Lose objectivity during the interview.Become judgmental during a confession.Include personal opinions in notes or written reports.Provide promises or assurances.Threaten interviewee with disclosure of interview results, discipline, or job security.Discuss interviews with anyone outside the investigation.Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.
74Lying: James R. Brown Style “I lied in person to investors when I met them. I lied in company’s filings. I lied in the company’s press releases.” Adelphia Communications vice-president of finance.He had no formal training in accounting and finance.Adelphia began manipulating its financial reports soon after the company went public in 1986.We regularly fabricated statistics on the number of subscribers, cash flow, cable-system upgrades, and other closely followed metrics.74
75Lying: James R. Brown Style (cont.) Top executives would meet on Saturdays to determine if we were meeting loan agreements. If not, we would make other types of manipulations of either arbitrarily moving expenses between companies or adding invented affiliate income or interest income from one internal company to another.For more than 10 years we kept two sets of books.Source: Chad Bray, “Adelphia Witness Lays Out Lies,” WSJ, May 19, 2004, pp. C-1 and C-2.I swear on my heartI was telling the truthat the time.Baby I lied. Baby I lied.Deborah Allen75
76Fewer People Lie in E-mail People tell fewer lies in s than in phone calls and face-to-face conversations.Possible reason: Most people know that s leave a record.J. T. Hancock, Corporate Human InteractionI got one thing to tell you, I…oooo, I ain’t tryin’ to sell ya’, No lies.Grand Funk Railroad76
77Interviewing Techniques “Bosch didn’t say anything. He knew that sometimes when he was quiet, the person he needed information from would eventually fill the silence.” (pp. 5-6).“Just listen. You are a detective. Detectives are supposed to listen. You once told me that solving murders are getting people to talk and just listening to them.” (pp ).Source: Michael Connelly, The Black Ice, St. Martin’s Paperback, 1993.77
78Progression of Interpersonal Communication Investigative Communication TypeInvestigative ConversationStructured Investigative InterviewingBasic Forensic InterrogationAdvanced Forensic InterrogationTime RequirementsFlexibleThirty minutes to one hourThree to six hoursRequired EnvironmentPrivate settingIntimate setting78
79Progression of Interpersonal Communication Skill/ Training RequirementsMinimal training required. Preferable to have training in active listening skills, question formulation and basic behavior analysis as well as psychology of investigative discourse.Minimum fifteen hours training in structured interview formats and behavior analysis.Minimum fifteen hours interviewing training plus thirty hours of training in Reid Nine Steps.*Minimum standards for structured formats and basic interrogation as well as minimum ten hours of advanced training.79*Inbau, F.E., Reid, J. E. & Budkley, J.P. (1986) Criminal Interrogation and Confessions, third edition (Baltimore, Williams and Wilkins). Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.I
80Progression of Interpersonal Communication Appro- priate Use and RestrictionsWhen you are looking for direction in an investigation. Result is a gamble rather than a predictable outcomeWhen you have established the need for a formal investigation and are interacting with witnesses, victims, complainants or suspects. Must accept information as it is presented without confrontation.When you are interacting with an uncooperative suspect and require a truthful account of that person’s guilt. Make use of perception manipulation and as such requires compre-hensive quality control.Most desirous form for uncooperative suspects of severe offences or suspects who may be emotionally unstable. Does not use perception manipulation and therefore beneficial when you need to identify true motivation for the offense.80Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.IA Thousand Lies What is a man that stays true to the game But has to cheat a little to get by Well that is a person that I know too well What if a man doesn’t stay true to the game Don’t care for no one, only cares for his greed. Machine Head
81Chance of ConfessionJohn Baldwin found in 600 investigative interviews that 35.7 percent of suspects confessed from the outset and an additional 16.2 percent confessed initially to part of the allegation.“Police Interviewing Techniques,” British Journal of Criminology, Vol. 33, 1993.William Morrisette believes that “an investigator who properly identifies and implements the appropriate investigative communication type should be able to achieve an 85 percent confession rate through basic interrogation and a 95 percent rate by way of advanced interrogation.”81
82Deception Variables The presence of deceptions are Some variables in the management discussion and analysis section of annual report can provide early fraud prediction rate from 56% to 65%.The presence of deceptions areLess terms indicating positive emotions.Less present tense verbs.Presence of an increased number of words.Fewer colons.Fewer semicolons.Lower use of “for example.”Lower lexical diversity.C.C. Lee, N. T. Churyk, and D.D. Clinton, Validating Early Fraud Prediction Using Narrative Disclosures, JFIA, Vol. 5, No. 1, January – June, 2013.82
83Better Whistleblower Letters Self-reference, indicating first-hand knowledge of the incident.A higher level of writing.As many examples (numeric lists, quantifiers, causal relationships, citations, and explanations) requiring the use of various styles (commas, semi-colons, parentheses, and quotations) as possible documenting the incident.Source: Pope and Churyk, The Anatomy of A Whistleblower Letter: A Descriptive Study, forthcoming, J. of Forensic & Investigative Accounting
84Fraud Detection Questions Reason Why? Do you know why you are here today?Principle: Innocent subjects will acknowledge the reason for the interview, while the guilty subject will generally avoid indicating knowledge of the issue.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.84
85Fraud Detection Questions Know/Suspect: Who do you think may have taken that $5,000 from the safe?Principle: Innocent subjects are more likely to volunteer a name or offer a suspicion.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.85
86Fraud Detection Questions Vouch: Is there anyone that you work with that you feel would not have taken that $5,000 from the safe?Principle: Innocent subjects will vouch for others, while the guilty will vouch for themselves or no one.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.86
87Fraud Detection Questions Think: Do you think that the $5,000 was actually stolen?Principle: Innocent subjects will generally agree that the money was actually stolen.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.87
88Fraud Detection Questions Opportunity: Who do you think would have the best opportunity to take that $5,000 from the safe?Principle: Innocent subjects will usually offer a name of an individual or named position who would have had the best opportunity.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.88
89Fraud Detection Questions Happen: What do you think should happen to the person who stole that missing $5,000?Principle: Innocent subjects will generally offer harsher punishment than the guilty.Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.89
90Fraud Detection Questions 2nd Chance: Would you be inclined to give someone a second chance?Principle: Innocent subjects generally continue to offer harsh punishment, while the guilty are more likely to offer a second chance.See Porter and Crumbley, Teaching Interviewing Techniques toForensic Accountants Is Critical, J. of Forensic & InvestigativeAccounting, Vol. 4: No, 1, January – June 2012, ppWayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.90
91DifferencesRonald L. Durkin suggests the following differences in a forensic audit versus a traditional audit:Not limiting the scope of the engagement based upon materiality.Not accepting sampling as evidence.Not assuming management has integrity.Seeking the best legal evidence.Melding the requirements of the evidential matter standard with the rules of evidence.Source: R.L. Durkin, “Defining the Practice of Forensic Accounting,” CPA Expert, Special Edition, 1999.9191
92Inexperienced Forensic Auditors Find out who did it. Do not worry about all the endless details.Be creative, think like the fraudster, and do not be predictable. Lower the auditing threshold without notice.Take into consideration that fraud often involves conspiracy.Internal control lapses often occur during vacations, sick outages, days off, and rest breaks, especially when temporary personnel replace normal employees.H. R. Davia, Fraud 101, New York: John Wiley & Sons, 2000, pp9292