36 Schemes Committed by Perpetrators in the Accounting Department – 367 Cases Source: 2012 Wells Report, ACFE.
Frequency of Anti-Fraud Controls* * ”External Audit of F/S” = independent external audits of the organization’s financial statements “Internal Audit / FE Department” = internal audit department or fraud examination department “External Audit of ICOFR” = independent audits of the organization’s internal controls over financial reporting “Management Certification of F/S” = management certification of the organization’s financial statements 37
Source: 2010 Wells Report, ACFE. Frequency of Occupational Fraud Schemes 38
54 Contrasting Auditing, Fraud Examination, & Forensic Accounting Source: G.S. Smith and D.L. Crumbley, “Defining a Forensic Audit,” Journal of Digital Forensics, Security, and Law, 2009, Vol. 4, No. 1, p. 69. Auditing is a macro process, and forensic accounting is a micro process.
55 Financial Audit v. Forensic Audit The typical financial audit is a sampling activity that doesn’t look at every transaction and can therefore be exploited by someone who knows how to rig the books. Forensic accounting focuses on a specific aspect of the books and examines every digit. While the average accountant is trying to make everything add up, a forensic accountant is performing a detailed financial analysis to find out why everything doesn’t or shouldn’t add up. It’s a far more time-consuming enterprise and can be significantly more expensive than regular auditing work. Jake Poinier, “ Fraud Finder,” Future Magazine, Fall 2004, http://www.phoenix.edu/students/future/oldissues/Winter2004/frau d.htm
Social Engineering Schemes (contd.) Phishing – increasing. Pretexting – assume the identity of an authority figure. Find a picture of an identity badge. Phreaking – pretending to be in a position of authority to obtain information.
68 Continuous Monitoring D. R. Hermanson, B. Moran, C. S. Rossie, and D. T. Wolfe, “Continuous Monitoring of Transactions to Reduce Fraud, Misuse, and Errors,” J. of Forensic Accounting, Vol. 7, 2006, pp. 17-30. Management engages an independent outside supplier to install and manage software to continuously analyze every transaction within business applications to detect improper activities and anomalies that indicate errors, control overrides, and fraud [Oversight Systems]. The software sorts incidents into errors, misuse, and fraud (a detective control). Suspicious transactions can be identified and categorized for future follow-up. Flag items such as manual income-increasing adjustments, adjustments made late in the year, large dollar amounts. Large companies with revenues over $1 billion. Over the course of a year monitoring each module (e.g., A/P, Sales, G/L) is designed to cost approximately the amount the company would pay for one fulltime internal auditor per module. One company saved $2 million of external auditing fees for using C/M in the 404 area.
82 Full – and – False Inclusion Tests These tests are used to ascertain the proper universe of data under investigation, so that no appropriate data is excluded and no extraneous data is included. Full-and-false inclusion tests may be helpful for finding hidden assets. Yellow crime scene tape of FA, according to Darrell Dorrell.
84 Financial Models (cont.) Constructing a formal model of key factors, relationships, and interactions. Analyzing, testing, and presenting results produced by running the model using various combinations of assumptions, relationships, and activity levels. Revising or updating the output as time passes using amended or incremental inputs. Submitting the model to the client for future use and maintenance with appropriate documentation and training. Sources: Edward A. Bender, An Introduction to Mathematical Modeling (New York: John Wiley & Sons, 1978), p. 3. Preparing Financial Models, Practice Aid 06-2, New York: AICPA, 2006, pp.2-3.
Carbon Dating Paper and Signatures There are reports of using radioactive carbon dating and microscopy to prove the age of a document and the age of the signature differ by a matter of years. Dating the other writing on the paper further corroborates the allegation of forgery. Sources have reported that in Atlanta, the procedure has been used on the “original” note produced in court by the pretender lender, proving the document was a forgery even though the borrower conceded the signature was authentic. If a document is dated 5 years ago, and the signature, endorsement or assignment execution that is dated on the paper is more recent, or the actual signature is more recent than the rest of the document (the paper, the other writing etc.) then the signature was not on the document at or near the time of the document’s creation. 89 FORENSIC FILES: CARBON DATING THE PAPER AND THE SIGNATURE TO PROVE FORGERY Neil Garfield, January 25, 2011
Carbon Dating Paper and Signatures If it’s the borrower’s signature that has been technologically reproduced and introduced as an original, it means that the actual original note is somewhere else. It also raises the possibility that more “originals” are circulating in those fictitious “Trusts” or “pools” purporting to claim the obligation, note or mortgage. If the signature or the paper that is presented as an assignment dated at or near the time of closing with the borrower, but either the paper, the signature, the witness signature or the notary signature or stamp does not coincide with the date of the purported document, the same analysis holds: it is a forgery. 90 FORENSIC FILES: CARBON DATING THE PAPER AND THE SIGNATURE TO PROVE FORGERY Neil Garfield, January 25, 2011
Forensic Information System for Handwriting (FISH) U.S. Department of Justice The document-part image is acquired by scanning the entire document and selecting the desired part by using a 6.5 x 6.5 cm ruled square. Once the block of writing is selected, the document is rescanned, producing an enlargement of the part on the screen. By adjusting the contrast between the writing and the paper surface to conform to that of the original document, the examiner can present features, such as tapered beginning and ending strokes or light connecting strokes, as they appear on the original document. The examiner may also remove unwanted features from the document image. The feature extraction process can being according to the type of writing indicated on the document-part data entry screen, The first step is the text-insensitive feature extraction (TIM), an automatic process in which FISH marks the exact center of the part and draws eight vectors out to the edges. The system then uses black-and-white pixel chain formations and auto-correlation functions to mathematically treat and store the writing, the TIM is then saved and isolation for selected features begins. This involves circling the desired letter or combination. The next extraction deals with tracing or line-following. A set of measurements then marks the height of the base ovals. At least 10 measurements are taken. After the interactively measured features are recorded a screen appears that lists the number of measurements taken, the median measurement, and the standard deviation for each category. 92
The Hitler Diaries Debacle (1980s) It was an analysis of the ink and paper used to write the diaries that revealed them as fakes. An ultraviolent-light examination revealed that the paper contained an ingredient that wasn't used in paper until 1954. Hitler died in 1945. Further forensic tests on the ink showed it had been applied to the paper within the last 12 months. As it turns out, though, the handwriting analysis was in fact correct – the person who’d written the diaries had also written the exemplars. Konrad Kujau, later found out to be an experienced con artist, had also forged the exemplars the police were using as comparison documents. Published by Sunday Times when Rupert Murdoch was executive editor. Julia Layton, How Handwriting Analysis Works 93
99 When Benford Analysis Is or Is Not Likely Useful When Benford Analysis is Likely UsefulExamples Sets of numbers that result from mathematical combination of numbers- Result comes from two distributions. Accounts receivable (number sold times price). Accounts payable (number bought times price). Transaction-level data – No need to sample.Disbursements, sales, expenses. On large data sets – The more observations, the better. Full year’s transactions. Accounts that appear to conform – When the mean of a set of numbers is greater than the median and the skewness is positive. Most sets of accounting numbers. When Benford Analysis Is Not Likely UsefulExamples Data set is comprised of assigned numbersCheck numbers, invoice numbers, zip codes. Numbers that are influenced by human thought. Prices set at psychological thresholds ($1.99), ATM withdrawals. Accounts with a large number of firm- specific numbers. An account specifically set up to record $100 refunds. Accounts with a built in minimum or maximum. Set of assets that must meet a threshold to be recorded. Where no transaction is recorded.Thefts, kickbacks, contract rigging. Source: Durtschi, Hillison, and Pacini, “The Effective Use of Benford’s Law to Assist in Detecting Fraud in Accounting Data,” J. of Forensic Accounting, Vol. V, 2004, p. 24.
119 Early Warning Signals of Possible Trouble for Municipal Entities 1.Current year operating deficit 2.Two consecutive years of Operating Fund deficit 3.Current year operating deficit that is larger than the previous year’s deficit 4.A General Fund deficit in the current year – balance sheet – current position 5.A current General Fund deficit (two or more years in the last five) 6.Short-term debt outstanding at the end of the fiscal year, greater than five percent of main Operating Fund Revenues 7.A two-year trend of increasing short-term debt outstanding at fiscal year end 8.Short-term interest and current year-end service greater than 20 percent of total revenues 9.Property taxes greater than 90 percent of the tax limit 10.Debt outstanding greater than 90 percent of the debt limit 11.Total property tax collections less than 92 percent of total levy 12.A trend of decreasing tax collections – two consecutive years in a three-year trend 13.Declining market valuations – two consecutive years – three- year trend 14.Expanding annual unfunded pension obligations Source: H.C. Grossman and T.E. Wilson, “Assessing Financial Health,” Handbook of Governmental Accounting & Finance, Somerset, N.J.: John Wiley & Sons, 1992, pp. 38-1 to 38-13.
123 Office of New York State Comptroller Indicator 6: Liquidity Cash and Investment as a Percentage of Current Liabilities Cash and Investments as a Percentage of Gross Monthly Expenditures a.Cash and Investments Current Liabilities b.Cash and Investments Gross Expenditures/12 Negative Trend: Percentages decreasing over time. A government should generally have year-end cash equal to about 50% of current liabilities and 75% of average monthly expenditures. A governmental accounting textbook states that this quick ratio (or acid test) omits receivables and amounts due from other funds because of difficulties converting them into cash. They suggest that a large state government should consider a quick ratio of less than 50 percent as an indicator of financial stress.* Indicator 7: Long-Term Debt Long-Term Debt Population Negative Trend: Percentage increase over time Note: An increase in #7 would likely trigger a future increase in #3 formula as well as a decrease in #8. Indicator 8: Capital Outlay Capital Outlay Gross Expenditures Negative Trend: Percentage decreasing over time Note: This eighth indicator is an early warning sign of financial stress. * Razek and Hosch, ibid., p.411.
124 Office of New York State Comptroller Indicator 9: Current Liabilities Current Liabilities Gross Revenues Negative Trend: Percentage increasing over time Indicator 10: Intergovernmental Revenues Intergovernmental Revenues Gross Revenues Negative Trend: Percentage increasing over time. Indicator 11: Economic Assistance Costs Economic Assistance Cost Gross Expenditures Negative Trend: Percentage increasing over time.
125 Office of New York State Comptroller Indicator 12: Public Safety Public Safety Cost Gross Expenditures Negative Trend: Percentage increasing over time Indicator 13: Tax Limit Exhausted Tax Levy Tax Limit Negative Trend: Percentage increasing over time The tax limit is the maximum amount of taxes that can be levied based upon some statutory authority. Indicator 14: Debt Limit Exhausted Total Debt Subject to Limit Debt Limit Negative Trend: Percentage increasing over time Debt limit is the maximum amount of debt that can be issued under applicable statutory authority. Compare this ratio with indicators 3 and 7.
130 Acquisition/Payment Cycle From 62 standard audit procedures, external and internal auditors judged these 20 procedures to be more efficient is detecting fraud in the acquisition and payment cycle (in descending order). Examine bank reconciliation and observe whether they are prepared monthly by an employee who is independent of recording cash disbursement or custody of cash. Examine the supporting documentation such as vendor’s invoices, purchase orders, and receiving reports before signing of checks by an authorized persons. Examine the purchase requisitions, purchase orders, receiving reports, and vendors’ invoices which are attached to the vouchers for existence, propriety, reasonableness and authenticity. Examine internal controls to verify the cash disbursement are recorded for goods actually rendered to the company. Discuss with personnel and observe the segregation of duties between accounts payable and custody of signed checks for adequacy. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 204-205
131 Acquisition/Payment Cycle (Contd.) Confirm inventories in public warehouse and on consignment. Examine internal controls to insure the vendor’s invoices, purchase orders, and receiving reports are matched and approved for payment. Examine internal controls for the following documents: vendor’s invoices, receiving reports, purchase orders, and receiving reports. Trace a sample of acquisitions transactions by comparing the recorded transactions in the purchase journal with the vendor’s invoices, purchase requisitions, purchase orders, and receiving reports. Establish whether any unrecorded vendors’ invoices or unrecorded checks exist. Examine the internal control to verify the proper approvals of purchase requisitions and purchase orders. Reconciled recorded cash disbursement with disbursements on bank statements. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 204-205
132 Acquisition/Payment Cycle (Contd.) Discover related party transactions. Examine the internal control to verify the approvals of payments on supporting documents at the time that checks are signed. Discuss with personnel and observe the procedures of examining the supporting documentation before the signing of checks by an authorized person. Examine canceled checks for authorized signatures, proper endorsements, and cancellation by the bank. Account for the numerical sequence of prenumbered documents (purchase orders, checks, receiving reports, and vouchers). Trace a sample of cash payment transactions. Trace resolution of major discrepancy reports. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 204-205
133 Sales/Collection Cycle These 10 audit procedures were judged as being more effective for detecting fraud in the sales and collection cycle (in descending order) Observe the proper and appropriate segregation of duties. Review monthly bank reconciliation and observe independent reconciliation of bank accounts. Investigate the difference between accounts receivable confirmation and customer account receivable balances in the subsidiary ledger and describe all these exceptions, errors, irregularities, and disputes. Review sales journal, general ledger, cash receipts journal, accounts receivable subsidiary ledger, and accounts receivable trial balance for large or unusual amounts. Verify accounts receivable balance by mailing positive confirmations. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 209
134 Sales/Collection Cycle (Contd.) Examine internal controls to verify that each cash receipts and credit sales transactions are properly recorded in the accounts receivable subsidiary ledger. Examine subsequent cash receipts and the credit file on all accounts over 120 days and evaluate whether the receivable are collectible. Compare dates of deposits with dates in the cash receipts journal and the prelisting cash receipts. Examine copies of invoices for supporting the bills of lading and customers’ orders. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 209
135 Inventory/Warehouse Cycle These 14 standard audit procedures were judged by external and internal auditors as being more effective for detecting fraud in the inventory and warehousing cycle 9in descending order): Discover related party transactions. Follow up exceptions to make sure they are resolved. Review major adjustments for propriety. Review inventory count procedures: a. Accounting for items in transit (in and out); b. Comparison of counts with inventory records; and c. Reconciliation of difference between counts and inventory records. Review adequacy of physical security for the entire inventory. Confirm inventories in public warehouse. Review procedures for receiving, inspecting, and storing incoming items and for shipments out of the warehouses. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 206-207
136 Inventory/Warehouse Cycle (Contd.) Trace shipments to sales records, inventory records, and bill of lading (shipping documents). Determine if access to inventory area is limited to approval personnel. Observe the physical count of all location. Recount a sample of client’s counts to make sure the recorded counts are accurate on the tags (also check descriptions and unit of count, such as dozen or gross) Trace inventory listed in the schedule to inventory tags and the auditor’s recorded counts for existence, descriptions, and quantity. Trace shipments to sales journal. Perform compilation tests to insure that inventory listing schedules agrees with the physical inventory counts. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 206-207.
137 Payroll/Personnel Cycle These 12 audit procedures were judged the more effective for detecting fraud in the payroll and personnel cycle (in descending order): Sample terminated employees and confirm that they are not included on subsequent payrolls and confirm propriety of termination payments. Observe the actual distribution of payroll checks to the employees. Observe the duties of employees being performed to insure that separation of duties between personnel, timekeeping, journalizing payroll transactions, posting payroll transactions, and payroll disbursement exists. Examine internal controls to verify that hiring, pay rates, payroll deductions, and terminations are authorized by the personnel department. Sample personnel files and physically observe the presence of personnel in the work place. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 208.
138 Payroll/Personnel Cycle (Contd.) Examine internal control over payroll records to verify that payroll transactions are properly authorized. Discover related party transactions. Review the files of new hires for appropriate approvals, pay rates, and dates of accession. Review the payroll journal, general ledger, and employee individual pay records for large or unusual amounts. Examine internal controls to verify that unclaimed payroll checks are secured in a vault or safe with restricted access. Examine internal controls to verify that employee time cards and job order work tickets are reconciled. Glen D. Moyes and C. Richard Baker, “Auditors’ Beliefs About the Fraud Detection Effectiveness of Standard Audit Procedures,” Journal of Forensic Accounting, Vol. 4, 2003, p. 208.