Forensic and Investigative Accounting

Forensic and Investigative Accounting
Chapter 1 Introduction to Forensic and Investigative Accounting © 2011 CCH. All Rights Reserved. 4025 W. Peterson Ave. Chicago, IL

Forensic Accounting vs. Fraud Auditing
Fraud Auditor: An accountant especially skilled in auditing who is generally engaged in auditing with a view toward fraud discovery, documentation, and prevention. Chapter 1 Forensic and Investigative Accounting

Forensic Accounting vs. Fraud Auditing
Forensic Accountant: A forensic accountant may take on fraud auditing engagements and may be a fraud auditor, but he or she will also use other accounting, consulting, and legal skills in broader engagements. In addition to accounting skills, he or she will need a working knowledge of the legal system and excellent communication skills to carry out expert testimony in the courtroom and to aid in other litigation support engagements. Chapter 1 Forensic and Investigative Accounting

Forensic Accounting Defined
Time: Forensic accounting focuses on the past, although it may do so in order to look forward. Purpose: Forensic accounting is performed for a specific legal forum or in anticipation of presentation before a legal forum. Peremptory: Forensic accountants may be employed in a wide variety of risk management engagements within business enterprise as a matter of right, without the necessity of allegations (e.g., proactive). Chapter 1 Forensic and Investigative Accounting

Forensic Accounting Defined
Forensic accounting is the action of identifying, recording, settling, extracting, sorting, reporting, and verifying past financial data or other accounting activities for settling current or prospective legal disputes or using such past financial data for projecting future financial data to settle legal disputes. Chapter 1 Forensic and Investigative Accounting

Historical Roots of Accounting
10,000 years ago—Temple priests took inventory of village livestock. 3,000 B.C.—Scribes recorded ruler’s wealth. 1887—American Association of Public Accountants (later becoming the AICPA) was formed. 1896—New York State legislated the first CPA law. 1900—School of Commerce, Accounts, and Finance at New York University opens. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Historical Roots of Accounting
1902—Congress calls for audit reports for large corporations. 1913—Federal Reserve Board created. 1913—Federal income tax law was passed. 1914—Federal Trade Commission created. By 1921—All states had passed laws requiring exam for CPA certificate. Chapter 1 Forensic and Investigative Accounting

History of Financial Reports and Legal Challenges
Financial reports were created by accountants long before independent audits were mandated. Current system of accounting checks and balances is relatively recent. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

History of Financial Reports and Legal Challenges
Before financials were audited by outside experts, the courts often handled challenges and brought in experts to give testimony. Practice of forensic accounting was common even before independent accountants were asked to certify financial statements in auditing engagements. Chapter 1 Forensic and Investigative Accounting

Threads of Forensic Accounting
1817—Canadian court decision of Meyer v. Sefton. 1824—James McClelland started his business in Glasgow, Scotland. 1856—In England, the audit of corporations became required. Chapter 1 Forensic and Investigative Accounting

Forensic Accounting in Print
Articles on arbitration, fraud, investigation, and expert witnesses began appearing in the late 1800s. After a comment in 1925 by the Chairman of the U.S. Board of Tax Appeal, The Journal of Accountancy proposed that educational institutions should start including in their curricula the study of the law of evidence. Chapter 1 Forensic and Investigative Accounting

Phrase “Forensic Accounting” Is Born
Maurice E. Peloubet coined the phrase in print in 1946. Max Lourie wrote an article and also claimed to coin the phrase, seven years after Peloubet. Lourie’s article voiced three important positions: An accountant should not have to attend law school to learn the art of expert testimony. Colleges and universities should deliver forensic accounting training. Forensic accounting reference books and textbooks should be developed for students. The first forensic accounting book appeared in 1982. Chapter 1 Forensic and Investigative Accounting

FBI and Forensics During WWII, the FBI employed approximately 500 agents who were accountants. In 1960, about 700 FBI agents were Special Agent Accountants. Today, there are more than 600 FBI agents with accounting backgrounds. The FBI has a Financial Crimes Section that investigates money laundering, Internet crimes, financial institutions fraud, and any other economic crime. Chapter 1 Forensic and Investigative Accounting

AICPA Practice Aid In 1986, the AICPA broke forensic accounting into two broad areas: investigative accounting and litigation support. The types of litigation services were further broken down in Practice Aid 7, listing: damages antitrust analyses accounting valuation general consulting analyses Chapter 1 Forensic and Investigative Accounting

Panel on Audit Effectiveness
In 1998, the Public Oversight Board appointed the Panel on Audit Effectiveness to review and evaluate how independent audits of the financial statements of public companies are performed and to assess whether recent trends in audit practices serve the public interest. Chapter 1 Forensic and Investigative Accounting

Panel on Audit Effectiveness
In 2000, the Panel issues a 200-page report, Report and Recommendations, which includes a recommendation that auditors should perform forensic-type procedures during every audit to enhance the prospects of detecting material financial statement fraud. Chapter 1 Forensic and Investigative Accounting

AICPA Fraud Task Force Report
In 2003, the AICPA’s Litigation and Dispute Resolution Services Subcommittee issued a report of its Fraud Task Force entitled, “Incorporating Forensic Procedures in an Audit Environment.” The report covers the professional standards that apply when forensic procedures are employed in an audit and explains the various means of gathering evidence through the use of forensic procedures and investigative techniques. Chapter 1 Forensic and Investigative Accounting

Accountant’s Role in Fraud Detection
In the early 1980s, companies began to use computers to perform their record keeping. Intense competition caused auditing fees to fall as much as 50% from the mid-1980s to the mid-1990s. Auditors cut costs by reducing the process of reviewing hundreds of corporate accounts. They grew more reliant on internal controls. The Journal of Forensic Accounting was created. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Top executives were able to circumvent internal controls and manipulate the records. This lead to situations such as Enron, WorldCom, Xerox, Adelphia Communication, and the fall of Arthur Andersen in the early 2000s. Due to the financial disaster of companies such as Enron and WorldCom, there has been an increased use of forensic techniques in audits and an increase in fees. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Some accounting experts believe that every audit engagement should include much more skepticism and detailed review of transactions. Other accounting experts suggest that only special engagements specifically targeting fraud can adequately and effectively root out the problem. The Big Four and the next two accounting firms believe that every public corporation should have a forensic audit every three years. Chapter 1 Forensic and Investigative Accounting

Recent Events Economic recessions often increase fraud, since executives may engage in more “cooking the books” techniques to improve financial results, and financially strapped employees will steal business funds or commit other types of fraud and abuse. In April 2009, Audit Analytics predicted that 3,589 companies (nearly 25%) will report that their auditors doubt they will continue as going concerns. In 2001, the percentage was only 19.2 percent.1 The Federal Government’s $787 billion economic stimulus and bailout programs will be breeding grounds for fraud, waste, and abuse. Dan Weil estimates that up to $50 billion of the total (or 5 to 10 percent) will be susceptible to fraud. FBI Director Robert Mueller warns of fraud stemming from the stimulus packages.2 There should be much work for forensic accountants. 1 Sarah Johnson, “Auditors: Nearly 25% of Companies May Not Be Going Concerns,” CFO, April 22, 2009, 2 Dan Weil, “Expert: Stimulus Fraud May Hit $50 Billion,” Newsmax.com, June 16, 2009, Chapter 1 Forensic and Investigative Accounting

Big-Six's Position A forensic audit is akin to a police investigation. All public companies should have a forensic audit on a regular basis. Companies would be required to have such an audit every three or five years or face these audits on a random basis. Forensic auditors scrutinize any records of companies, including s, and would be able, if not required, to question all company employees, and to require statements under oath. Might be necessary for an audit network or a specialized forensic auditors to complete a forensic audit with the aid of independent attorneys (not those who have represented the audit client in the other engagements). Source: “Serving Global Markets and the Global Economy: A View from the CEOs of the International Audit Networks, November 2006, p. 13. Chapter 1 Forensic and Investigative Accounting

More Differences Two practitioners have suggested these additional procedures may be used in a forensic audit: Extensive use of interviews and leveraging techniques designed to elicit sufficient information to prove or disprove a hypothesis. Document inspection that may extend to authentication procedures and handwriting analysis. Significant public records search to uncover, for example, unexpected title or ownership, other known addresses, and prior records of individuals. Legal knowledge regarding rules of evidence including chain of custody and preservation of evidence integrity. Source: Annett Stalker and M.G. Ueltzen, “An Audit Versus A Fraud Examination,” CPA Expert, Winter 2009, p. 4. Chapter 1 Forensic and Investigative Accounting 23

Inexperienced Forensic Auditors
Find out who did it. Do not worry about all the endless details. Be creative, think like the fraudster, and do not be predictable. Lower the auditing threshold without notice. Take into consideration that fraud often involves conspiracy. Internal control lapses often occur during vacations, sick outages, days off, and rest breaks, especially when temporary personnel replace normal employees. H. R. Davia, Fraud 101, New York: John Wiley & Sons, 2000, pp Chapter 1 Forensic and Investigative Accounting 24

Contrasting Auditing, Forensic Accounting, and Fraud Examination
Characteristic Audit Fraud Examination Forensic Accounting Time perspective: Historical Future and historical Primary focus: Periodic Reactive Proactive and ongoing Investigation scope: Narrow Broad ranging Main work product is: Audit opinion Fraud case report Forensic audit report Main responsibility to: Company and public Defrauded party Concerned principal or third party Guidelines are: Rules-based Principles-based; under audit rules, it is rule-based Principles-based Purpose of report: Ensure GAAP is followed Identify perpetrator of fraud Fraud risk assessment and strategic services Professional stance: Non-adversarial Adversarial Adversarial and non-adversarial Chapter 1 Forensic and Investigative Accounting 25

Some White Collar Crimes
Antitrust. Bankruptcy fraud. Corporate/securities fraud. Health care fraud. Insurance fraud. Mass marketing fraud. Money laundering. Mortgage fraud. Chapter 1 Forensic and Investigative Accounting 26

Sarbanes–Oxley Legislation
Title 1 establishes the Public Company Accounting Oversight Board (PCAOB) under the SEC to regulate auditing and to discipline auditors. Title 2 contains a series of rules to ensure that auditors are independent from their clients. For example, neither the primary nor reviewing partner may audit the same client for more than five consecutive years, and the auditor must report all material written communication to the audit committee. Title 3 requires publicly traded companies to have an audit committee, the CEO and CFO must certify their company’s financial statements, and provides rules for the conduct of officers and their attorneys. Title 4 prohibits personal loans and requires certain financial disclosures. Title 5 mandates rules for financial security analysts (i.e., research analysts) to avoid conflicts of interest. Titles 6, among other provisions, allows federal courts the power to bar individuals who violate security laws from participating in penny stocks. Chapter 1 Forensic and Investigative Accounting 27

Sarbanes–Oxley Legislation
Title 7 requires reports and studies on consolidation of accounting firms, credit rating agencies, enforcement actions, and investment banks. Title 8 provides protection for whistleblowers and mandates penalties and fines for certain acts not dischargeable by bankruptcy. For example, failure of an auditor to keep working papers for 5 years is subject to fines and 10 years in prison, and fine or imprisonment of up to 25 years for anyone knowingly defrauding shareholders of publicly traded companies. A person can receive 20 years in prison and fines for altering, destroying, mutilating, concealing, covering up, falsifying or making a false entry in any record, document, or tangible object. Title 9 increases maximum prison sentences for mail and wire fraud from 5 to 20 years. Willfully and knowingly certifying financial reports not in compliance with the Act is now a criminal offense. Title 10 says that it is the “Sense of the Senate” to require the CEO to sign the corporate tax return. Title 11 provides a possible 20-year prison sentence for anyone altering, destroying, mutilating, or concealing a record, document, or other object (or otherwise impeding) for an official proceeding. Chapter 1 Forensic and Investigative Accounting 28

Termites, Rust, and Fraud
Just as termites never sleep, fraud never sleeps. Just like termites, fraud can destroy the foundation of an entity. Chapter 1 Forensic and Investigative Accounting

Professors’ Top Ten Topics in Forensic Accounting Curricula
Fundamentals of fraud. Financial statement fraud. Types of fraud. Cooking the books and problems in accounting. Elements of fraud: pressure, opportunity, and rationalization. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Professors’ Top Ten Topics in Forensic Accounting Curricula
Antifraud controls. Internal control evaluation. Theory and methodology of fraud examination. Principles of ethics and corporate code of conduct. Fraud detection and deterrence programs. Practitioners tend to emphasize litigation service more than professors. Chapter 1 Forensic and Investigative Accounting

Knowledge, Skills and Abilities Needed by Forensic Accountant
Law, legal system, courts, and courtroom procedure. Financial statement fraud. Corporate governance, shareholder rights and litigation, securities laws, and protections. Report writing and communication. Criminal law and procedure. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Knowledge, Skills and Abilities Needed by Forensic Accountant
Computer fraud and cybercrime. Human factors involved in intelligence gathering, interview techniques and understanding the motivations for fraud and other criminal activities. Ethical issues in business. Business valuation. Chapter 1 Forensic and Investigative Accounting

Find It, or I’ll Sue Accountants must be attuned to detecting fraud at every level of service, including standard accounting services, compilations, reviews, and bank reconciliations. If there is fraud and you don’t detect it, you are going to be sued, and you will likely lose, as the public perception is the accountant is the watchdog. Robert J. DiPasquale, Parsippany, N.J. Source: H.W. Wolosky, “Forensic Accounting to the Forefront,” Practical Accountant, February 2004, pp Chapter 1 Forensic and Investigative Accounting 35

Forensic Accounting Knowledge Base
Chapter 1 Forensic and Investigative Accounting 36

Careers in Forensic Accounting
Parade magazine on April 15, 2007, indicated that the hottest jobs for college graduates were forensic accountants. Chapter 1 Forensic and Investigative Accounting

Income Expectations for Forensic Accountants
Salaries start around $50,000. Senior-level government employees can earn between $85,000 to $95,000. In the private sector, one can earn between $125,000 to $150,000. Chapter 1 Forensic and Investigative Accounting

Consulting Fees Forensic accountants work with attorneys, private investigators, law enforcement officers, corporate security specialists, the IRS, and the FBI. In 1999, Kessler International stated that the firm charges about $300 per hour for forensic consultations. Chapter 1 Forensic and Investigative Accounting

Background in Forensic Accounting
A forensic accounting background is helpful in these professional specialties: Accountants Consultants Internal auditors IRS auditors Government auditors FBI agents SEC accountants Bankruptcy specialists Professors Bank examiners Chief financial officers Valuators of closely held businesses Chapter 1 Forensic and Investigative Accounting

Specialties Within Forensic and Investigative Accounting
Employee Crime Specialist Asset Tracing Specialist Litigation Services Specialist and Expert Witness Chapter 1 Forensic and Investigative Accounting

Forensic Groups and Credentials
American College of Forensic Examiners International (ACFEi) Certified Forensic Accountant (Cr.FA) Association of Certified Fraud Examiners (ACFE) Certified Fraud Examiner (CFE) Association of Certified Fraud Specialists (ACFS) Certified Fraud Specialist (CFS) Chapter 1 Forensic and Investigative Accounting

Forensic Groups and Credentials
Forensic Accounting Society of North America (FASNA) None National Association of Certified Valuation Analysts (NACVA) Certified Valuation Analyst (CVA) Certified Forensic Financial Analyst (CFFA) Certified Fraud Deterrence (CFD) (merged with CFFA in 2007) Chapter 1 Forensic and Investigative Accounting

Professional Groups and Credentials
National Litigation Support Services Association (NLSSA) None Network of Independent Forensic Accountants (NIFA) Institute of Business Appraisers Certified Business Appraiser (CBA) American Institute of CPAs Certified Financial Forensics (CFF) Chapter 1 Forensic and Investigative Accounting

CPA Certificate Important
AICPA research indicates that CPAs represent 94 percent of forensic experts hired over two years. Source: Field of Forensic Service Remains Hot, A. E. Feldman Blog, -services-rem... Chapter 1 Forensic and Investigative Accounting 45

Difficulties With Fraud
Joseph Wells says Regrettably, the actual cost of fraud is unknown and unknowable. It is a concept the criminologists call “the dark figure.” Unlike visible crimes such as robbery, not all frauds are uncovered. Of those uncovered, not all are reported. No agency is tasked with compiling comprehensive data on fraud. Source: Chapter 1 Forensic and Investigative Accounting 46

Predication The ACFE group indicates that in the private sector, a fraud investigation should not be conducted without proper predication. Examples: Anonymous tips, complaints, audit inquires, conflict of interest. Thus, predication is the basis for undertaking a fraud investigation. Without predication, the target might be able to sue for real or imaginary damages. Chapter 1 Forensic and Investigative Accounting 47

Skills of a Forensic Accountant
Mean Analytical Skills 6.51 Basic Accounting Skills 6.31 Problem Solving Skills 6.30 Data Analysis Skills 6.27 Interviewing Skills 6.25 Verbal Communication Skills 6.11 Basic Computer Skills 6.05 Source: D.A. McMullen and M.H. Sanchez, “A Preliminary Investigation of the Necessary Skills, Education Requirements, and Training Requirements for Forensic Accountants,” Journal of Forensic and Investigative Accounting, Vol. 2, Issue 2, July-December, 2010, p.43. Chapter 1 Forensic and Investigative Accounting 48

Characteristics of a Forensic Accountant
Mean Persistence 6.12 Skepticism Puzzle Skills 6.08 People Skills 6.04 Flexibility 5.91 Works well in teams 5.84 Experience in Auditing 5.80 Source: D.A. McMullen and M.H. Sanchez, “A Preliminary Investigation of the Necessary Skills, Education Requirements, and Training Requirements for Forensic Accountants,” Journal of Forensic and Investigative Accounting, Vol. 2, Issue 2, July-December, 2010, p.43. Chapter 1 Forensic and Investigative Accounting 49

Demand for Forensic Accountants
Robert Half 2009 Salary Guide indicates that even in the 2009 economic recession, there was still a strong demand for forensic accountants. In a 2008 AICPA survey, two out of three accountants indicated that their forensic practices had grown over the past year. Source: Robert Half, Robert Half 2009 Salary Guide, Accounting and Finance. P.R. Newswire, Demand for Forensic CPAs Accelerates, AICPA, Survey Shows, New York, September 25, 2008. Chapter 1 Forensic and Investigative Accounting 50

Society for Financial Examiners
Established in 1973, the Society for Financial Examiners is a professional organization for examiners of insurance companies, banks savings and loans, and credit unions. SOFE offers three professional designations which are earned by completing extensive requirements and a series of examinations. Source: Chapter 1 Forensic and Investigative Accounting 51

International Association of Asset Recovery
The International Association of Asset Recovery (IAAR) has a new certification called the Certified Specialist in Asset Recovery (CSAR). The IAAR mission is to help practitioners to win back assets that rightful belong to victims, government agencies, other organizations, or individuals who have been victimized by criminal or wrongful conduct. Source: Chapter 1 Forensic and Investigative Accounting 52

Corporate Crime Reporter
The Corporate Crime Reporter is a legal print newsletter published and mailed 48 times a year (corporatecrimereporter.com). Some articles are posted on their website, but are only highlights from the print newsletter. Chapter 1 Forensic and Investigative Accounting 53

An International Problem
Fraud is an international phenomenon touching all countries. Transparency International (TI) is a global network including more than 90 locally established national chapters and chapters-in-formation, whose goal is to fight corruption in the national arena. TI produces a Transparency International Corruption Perception Index (CPI), which ranks more than 150 countries by their perceived levels of corruption, as determined by expert assessments and opinion surveys. Chapter 1 Forensic and Investigative Accounting

Michael Comer’s Types of Fraud
Corruptions (e.g., kickbacks). Conflicts of interest (e.g., drug/alcohol abuse, part-time work). Theft of assets. False reporting or falsifying performance (e.g., false accounts, manipulating financial results). Technological abuse (e.g., computer related fraud, unauthorized Internet browsing). Comer’s Rule: Fraud can happen to anyone at anytime. Source: M.J. Comer, Investigating Corporate Fraud, Burlington, Vt.: Gower Publishing Co., 2003, pp. 4-5. Chapter 1 Forensic and Investigative Accounting 56

The Cost of Fraud Organizations lose 5 percent of annual revenue to fraud and abuse. Fraud and abuse costs organizations more than $2.9* trillion annually. * $994 billion in 2008 in U.S. $652 billion in $660 billion in 2004. Source: 2010 Wells Report Chapter 1 Forensic and Investigative Accounting 57

Advantage of Compliance Spending
General Counsel Roundtable says that each $1 of compliance spending saves organizations, on the average, $5.21 in heightened avoidance of legal liabilities, harm to the organization’s reputation, and lost productivity. Source: Jonny Frank, “Fraud Risk Assessments,” Internal Auditor, April 2004, p. 47. Chapter 1 Forensic and Investigative Accounting 58

Some Research on Fraud Primary motivation to commit fraud [Dechow et al.] Desire to obtain low-cost loans. Weaker governance system. Experience higher cost of capital after fraud discovered. Summers and Sweeney [1998]: In the presence of fraud, insiders reduce their holdings of company stock through high levels of selling activity. Also, growth, inventory, and ROA differ significantly. Chapter 1 Forensic and Investigative Accounting 59

The Methods - Frequency
Asset misappropriation accounted for more than four out of five offenses or 90% in 2010 (88.7% in 2008) (91.5% in 2006) (92.7% in 2004). $135,000 Bribery and corruption constituted about 30% (27.4% in 2008) (30.8% in 2006) (30.1% in 2004) of offenses. $250,000 ($375,000) ($538,000) Fraudulent statements were the smallest category of offense 5% (10.3% in 2008) (10.6% in 2006) (7.9% in 2004) (most costly). $4 million per scheme. Source: 2010 Global Fraud Study, ACFE. Chapter 1 Forensic and Investigative Accounting 60

Transparency International Corruption Perceptions Index 2010
Chapter 1 Forensic and Investigative Accounting 61

One Small Clue A former Scotland Yard scientist tried to create the world’s biggest fraud by authenticating $2.5 trillion worth of fake U.S. Treasury bonds. When two men tried to pass off $25 million worth of the bonds in Toronto in 2001, a Mountie noticed the bonds bore the word “dollar” rather “dollars.” Police later raided a London bank vault and discovered that the bonds had been printed with an ink jet printer that had not been invented when the bonds were allegedly produced. Zip codes were used even though they were not introduced until 1963. Sue Clough, “Bungling Scientist Is Jailed for Plotting World's Biggest Fraud,” News.telegraph.co.uk, January 11, 2003. Chapter 1 Forensic and Investigative Accounting 62

Catch Me If You Can Numbers Don’t Lie. Criminals are another story. Money talks. But more often it whispers. When shady characters are up to no good, they often leave a trail of questionable financial transactions. Chapter 1 Forensic and Investigative Accounting 63

Three M’s of Financial Reporting Fraud
Manipulation, falsification, or alteration of accounting records or supporting documents from which financial statements are prepared. Misrepresentation in or intentional omission from the financial statements of events, transactions, or other significant information. Intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure. Source: D.S. Hilzenrath, “Forensic Auditors Find What Some Companies Try to Hide,” The Washington Post, November 23, 2002, p.19. Chapter 1 Forensic and Investigative Accounting

Fraud Schemes Based on SEC Releases
Fictitious and/or overstated revenues and assets. Fictitious reductions of expenses and liabilities. Premature revenue recognition. Misclassified revenues and assets. Overvalued assets or undervalued expenses and liabilities. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Fraud Schemes Based on SEC Releases
Omitted liabilities. Omitted or improper disclosures. Equity fraud. Related-party transactions. Alter ego. Minimizing income or inflating expenses to reduce tax liabilities. Chapter 1 Forensic and Investigative Accounting

Shenanigans to Boost Earnings
Recording revenue before it is earned. Creating fictitious revenue. Boosting profits with nonrecurring transactions. Shifting current expenses to a later period. Failing to record or disclose liabilities. Shifting current income to a later period. Shifting future expenses to an earlier period. Chapter 1 Forensic and Investigative Accounting

Rationalization Sherron Watkins provides an excellent comment about rationalization with respect to Enron’s Jeff Skilling and Andy Fastow. At what point did they turn crooked? “But there is not a defining point where they became corrupt. It was one small step after another, with more and more rationalizations. There was a slow erosion of values over time.” Source: Pamela Colloff, “The Whistle-Blower,” Texas Monthly, April 2003, p. 141. Chapter 1 Forensic and Investigative Accounting 68

Reframing Behavioral psychologists call this rationalization “reframing,” where someone who is about to cheat will adjust the definition of cheating to exclude his or her actions. Dan Ariely says “people who would never take $5 from petty cash have no problem paying for a drink for a stranger and putting it on a company tab.” Source: S.L. Mintz, “The Gauge of Innocence,” CFO, April 2009, p. 56. Chapter 1 Forensic and Investigative Accounting 69

Internal vs. External Fraud
Employee Management Stock theft Lapping Check forgery Misappropriation of cash assets Expense accounts False insurance claims False financial statements Credit card fraud Misappropriation of cash/assets False invoices Unnecessary purchases Product substitution Chapter 1 Forensic and Investigative Accounting

Internal vs. External Fraud (contd.)
Employee Management Petty cash Check forgery Bribes/secret commission Kickbacks Bid rigging/price fixing Loans/ investments Ghost vendors False representation of funds Ghost employees Diversion of sales Source: KPMG, Fraud Awareness Survey, Dublin: KPMG, 1995, pp Chapter 1 Forensic and Investigative Accounting

Four Factors Contributing to Business Fraud
Motive Opportunity Lack of integrity (or rationalization) Capacity—the person must have the necessary traits, abilities, or positional authority to commit the crime Source: Wolfe and Hermanson, “The Fraud Diamond,” The CPA J., December 2004, pp Chapter 1 Forensic and Investigative Accounting

Components of Internal Controls
Control environment Risk assessment Control activities or control procedures Information and communication systems support Monitoring Source: SAS No. 94, The Effect of Information Technology on the Auditor’s Consideration of Internal Control in a Financial Statement Audit, New York: AICPA. Chapter 1 Forensic and Investigative Accounting

Types of Controls Preventive Controls Segregation of duties Required approvals Securing assets Passwords Using document control numbers Drug testing Job rotation Computer backup Chapter 1 Forensic and Investigative Accounting

Types of Controls Detective Controls Reconciliations Reviews Event notifications Surprise cash count Counting inventory Chapter 1 Forensic and Investigative Accounting

Types of Controls Corrective Controls Training Process redesign Additional technology Quality circle teams Budget variance reports Chapter 1 Forensic and Investigative Accounting

Earnings Management Earnings management may be defined as the “purposeful intervention in the external financial reporting process, with the intent of obtaining some private gain.” – Katherine Schipper, “Commentary on Earnings Management,” Accounting Horizon, December 1989, p. 92. Chapter 1 Forensic and Investigative Accounting

Difficult to Measure Integrity
Richard Davis says there is no psychometric way to measure integrity, so forget about personality tests to pick the fraudsters. They are easily faked. He is more hopeful about new methods involving microexpressions, or those brief facial expressions that may reveal a person’s predisposition to fraud. Source: S.L. Mintz, “The Gauge of Innocence,” CFO, April 2009, p. 57. Chapter 1 Forensic and Investigative Accounting 78

Psychology of Fraud Fraud can be explained by three factors: Supply of motivated offenders. Availability of suitable targets. Absence of capable guardians (e.g., internal controls). The three B’s -- babes, booze, and bets. Some fraudsters wish to make fools of their victims. They take delight in the act itself. Risk of fraud is a product of both personality and environmental (or situational) variables. Grace Duffield and Peter Grabosky, “The Psychology of Fraud,” Australian Institute of Criminology, No. 19. Chapter 1 Forensic and Investigative Accounting 79

Parallel Universe: Two Opinions
External auditors must do a regular audit of a company (e.g., financial statements are fairly stated) and must also audit the internal controls to ensure that the financial statements are accurate (e.g., issue two opinions). Prior to the external auditors’ arrival, the company itself must review its internal controls and issue a report on the effectiveness of these controls. There will be two external opinions: on management’s assessment of the internal controls over financial reporting and another one on the effectiveness of the internal controls themselves (e.g., statements are fairly stated). PCAOB Release Chapter 1 Forensic and Investigative Accounting 80

Anti-Fraud Program An auditor must perform “company-wide anti-fraud programs and controls and work related to other controls that have a pervasive effect on the company, such as general controls over the company’s electronic data processing.” Further, the auditor must “obtain directly the ‘principal evidence’ about the effectiveness of internal controls.” PCAOB endorses the COSO Cube. Source: PCAOB Release Chapter 1 Forensic and Investigative Accounting 81

Source: 2008 Wells Report, ACFE. Chapter 1 Forensic and Investigative Accounting

Fraud’s Fatal Failings
85% of fraud victims never get their money or property back. Most investigations flounder, leaving the victims to defend for themselves against counter-attacks by hostile parties. 30% of companies that fail do so because of fraud. Source: Michael J. Comer, Investigating Corporate Fraud, Burlington, VT: Gower Publishing, 2003, p. 9. Chapter 1 Forensic and Investigative Accounting 83

COSO Study Findings Financial fraud affects companies of all sizes, with the median company having assets and revenues just under $100 million. The median fraud was $12.1 million. More than 30 of the fraud cases each involved misstatements/misappropriations of $500 million or more. The SEC names the CEO and/or CFO for involvement in 89 percent of the fraud cases. Within two years of the completion of the SEC investigation, about 20 percent of the CEOs/CFOs had been indicted. Over 60 percent of those indicted were convicted. Motivations include meeting expectations, concealing deteriorating financial conditions, and preparing for debt/equity offerings. Chapter 1 Forensic and Investigative Accounting 84

COSO Study Findings Revenue frauds accounted for over 60 percent of the cases. Overstated assets, 51%. Understatement of expenses/ liabilities (31%). Misappropriation of assets, 14%. Many of the commonly observed board of director and audit committee characteristics such as size, meeting frequency, composition, and experience do not differ meaningfully between fraud and no-fraud companies. Recent corporate governance regulatory efforts appear to have reduced variation in observable board-related governance characteristics. Twenty-six percent of the firms engaged in fraud changed auditors during the period examined compared to a 12 percent rate for no-fraud firms. Chapter 1 Forensic and Investigative Accounting 85

COSO Study Findings Initial news in the press of an alleged fraud resulted in an average 16.7 percent abnormal stock price decline for the fraud company in the two days surrounding the announcement. News of an SEC or Department of Justice investigation resulted in an average 7.3 percent abnormal stock price decline. Companies engaged in fraud often experienced bankruptcy, delisting from a stock exchange, or material asset sales at rates much higher than those experienced by no-fraud firms. 50% of the stock traded on NASDAQ over a variety of industries. Chapter 1 Forensic and Investigative Accounting 86

COSO Study Findings 20% of the fraud companies were in the computer hardware/software industry and 20% were in financial service providers. 11% were in health care and health products. 45% of the Section 404 opinions indicated effective controls and 45% indicated ineffective controls. Source: COSO News Release, Alamonte Springs, May 20, 2010, Chapter 1 Forensic and Investigative Accounting 87

Fraud Pentagon Source: P.D. Goldman, Fraud in the Markets (John Wiley & Sons: 2010), pp Chapter 1 Forensic and Investigative Accounting 88

A Thin Line There certainly is a thin line between legal earnings management and abusive earnings management. Where does a company cross the line between criminal behavior and merely conduct that is beneficial to the organization? Chapter 1 Forensic and Investigative Accounting

Court-Appointed Trustee
Forensic accountants are being used by the court – appointed trustees (Irving Picard and Securities Investor Protection Corporation) to reconstruct the books of Bernard L. Madoff Investment Securities (BLMIS). According to Picard, there were paper records, microfilm, and microfiche. But there was nothing that was electronic. Every customer statement was fiction, so the first task is to reconstruct the books and records of BLMIS. One of the early projects was to digitize the records so they are easier to compare, including customer statements, incoming letters, faxes, and bank records. The forensic accountant will use records from third parties and customers. Every customer account must be reconstructed from the ground up. Stephen Harbeck, President of Securities Investor Protection Corporation, stated that the forensic accountants “are working as quickly as possible to catalog all the far-reaching aspects of the Madoff scheme and to recover money for investors to the extent possible by law.” The cost of the Ponzi scheme may be as high as $65 billion. Source: WebCPA staff, Forensic Accountants Reconstruct Madoff Books, May 15, 2009. Chapter 1 Forensic and Investigative Accounting

PCAOB Guidance: Smaller Public Companies
Scaling the Audit for Smaller, Less Complex Companies. Evaluating Entity-Level Controls. Assessing the Risk of Management Override and Evaluating Mitigating Actions. Evaluating Segregation of Duties and Alternative Controls. Auditing Information Technology Controls in a Less Complex IT Environment. Considering Financial Reporting Competencies and Their Effect on Internal Control. Obtaining Sufficient Competent Evidence When the Company Has Less Formal Documentation. Auditing Smaller, Less Complex Companies with Pervasive Control Deficiencies. Chapter 1 Forensic and Investigative Accounting

Entity-Level Controls
Controls related to the control environment. Controls over management override; the company's risk assessment process. Centralized processing and controls, including shared service environments. Controls to monitor results of operations. Controls to monitor other controls, including activities of the audit committee and self-assessment programs. Controls over the period-end financial reporting process. Policies that address significant business control and risk management practices. Source: PCAOB, October 17, 2007, pp. 12. Chapter 1 Forensic and Investigative Accounting

Definition of Fraud Four major legal elements of fraud would be: A false representation or willful omission regarding a material fact. The fraudster knew the representation was false. The target relied on this misappropriation. The victim suffered damages or incurred a loss. Chapter 1 Forensic and Investigative Accounting

Audit Procedures Audit evidence is gathered in two fieldwork stages: Internal control testing phase. Account balance testing phase. Chapter 1 Forensic and Investigative Accounting

Definitions Materiality is the measure of whether something is significant enough to change an investor’s investment decision. Control risk is risk that a material error in the balance or transaction class will not be prevented or detected. Chapter 1 Forensic and Investigative Accounting

Definitions Inherent risk is risk that an account or transactions contain material misstatements before the effects of the controls. Detection risk is risk that audit procedures will not turn up material error when it exists. Chapter 1 Forensic and Investigative Accounting

External Auditors and Fraud Detection
Although auditors have previously had the responsibility to detect material misstatement caused by fraud, SAS No. 82 details more precisely what is required to fulfill those responsibilities. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

External Auditors and Fraud Detection
Now, auditors must specifically assess and respond to the risk of material misstatement due to fraud and must assess that risk from the perspective of the broad categories in the SAS. External auditors have to satisfy new documentation and communication requirements. SAS No. 82 superseded by SAS No. 99. Chapter 1 Forensic and Investigative Accounting

Fraudulent financial reporting may occur by the following:
Manipulation, falsification, or alteration of accounting records, or supporting documents from which financial statements are prepared. Misrepresentation in or intentional omission from the financial statements of events, transactions, or other significant information. Intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure. Source: SAS No. 99, “Consideration of Fraud in a Financial Statement Audit,” New York: AICPA Chapter 1 Forensic and Investigative Accounting 100

SAS No. 99 Ways to Overcome the Risk of Management Override of Controls Examining journal entries and other adjustments. Reviewing accounting estimates for bias, including a retrospective review of significant management estimates. Evaluating the business rationale for significant unusual transactions. Chapter 1 Forensic and Investigative Accounting 101

How Management Overrides Controls (SAS No. 99)
Recording fictitious journal entries (especially near end of quarter or year). Intentionally biasing assumptions and judgments used to estimate accounts (e.g., pension plan assumptions or bad debt allowances). Altering records and terms related to important and unusual transactions. Chapter 1 Forensic and Investigative Accounting 102

Think Like A Crook Know your enemy as you know yourself, and you can fight a hundred battles with no danger of defeat.” Chinese Proverb. Military leaders study past battles. Football and basketball teams study game films of their opponents. Chess players try to anticipate the moves of their opponent. Examples: If contracts above $40,000 are normally audited each year, check the contracts between $30,000-$40,000. FAs must learn the tricks of the trade as well as the trade. Chapter 1 Forensic and Investigative Accounting 103

SAS No. 99 Recommendations
Brainstorming Increased emphasis on professional skepticism. Discussions with management. Unpredictable audit tests. Responding to management override of controls. Chapter 1 Forensic and Investigative Accounting

SAS No. 99: Skepticism An auditor is instructed to conduct an audit “with a questioning mind that recognizes the possibility that a material misstatement due to fraud could be present, regardless of any past experience with the entity and regardless of the auditor’s belief about management’s honesty and integrity.” FA’s motto should be “Trust no one; question everything; verify.” Chapter 1 Forensic and Investigative Accounting

Public Company Accounting Oversight Board (PCAOB)
The Sarbanes-Oxley Act of 2002 created a new, five-member oversight group called the PCAOB. The PCAOB is empowered to set accounting standards that establish auditing, quality control, and ethical standards for accountants. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Public Company Accounting Oversight Board (PCAOB)
The PCAOB is also empowered to adopt or amend standards issued or recommended by private accounting industry groups or to adopt its own standards independent of such private industry standards or recommendations. Chapter 1 Forensic and Investigative Accounting

Walkthroughs According to the PCAOB, in a walkthrough, an auditor traces “company transactions and events – both those that are routine and recurring and those that are unusual – from origination, through the company’s accounting and information systems and financial report preparation processes, to their being reported in the company’s financial statements.” Source: PCAOB Briefing Paper, Proposed Auditing Standards, October 7, 2003. Chapter 1 Forensic and Investigative Accounting

Internal Auditors and Fraud Detection
The Institute of Internal Auditors’ Due Professional Care Standard (Section 280) assigns the internal auditor the task of assisting in the control of fraud by examining and evaluating the adequacy and effectiveness of the internal control system. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Internal Auditors and Fraud Detection
However, Section 280 says that management has the primary responsibility for the deterrence of fraud, and management is responsible for establishing and maintaining the control systems. In general, internal auditors are more concerned with employee fraud than with management and other external fraud. Chapter 1 Forensic and Investigative Accounting

When Fraud Is Discovered
Notify management or the board when the incidence of significant fraud has been established to a reasonable certainty. If the results of a fraud investigation indicate that previously undiscovered fraud materially adversely affected previous financial statements, for one or more years, the internal auditor should inform appropriate management and the audit committee of the board of directors of the discovery. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

When Fraud Is Discovered
A written report should include all findings, conclusions, recommendations, and corrective actions taken. A draft of the written report should be submitted to legal counsel for review, especially where the internal auditor chooses to invoke client privilege. Chapter 1 Forensic and Investigative Accounting

Audit Committee The audit committee is the subcommittee of an organization’s board of directors charged with overseeing the organization’s financial reporting and internal control processes. The audit committee’s biggest responsibility is monitoring the component parts of the audit process. Chapter 1 Forensic and Investigative Accounting

Management’s Role The Sarbanes-Oxley Act of 2002 mandates that CEOs and CFOs certify in periodic reports containing financial statements filed with the SEC the appropriateness of financial statements and disclosures. Chapter 1 Forensic and Investigative Accounting

Board of Directors’ Role
Oversee the integrity, quality, transparency, and reliability of the financial reporting process. Oversee the adequacy and effectiveness of the internal control structure in preventing, detecting, and correcting material misstatements in the financial statements. Oversee the effectiveness, efficacy, and objectivity of audit functions. Chapter 1 Forensic and Investigative Accounting

Enter the Forensic Accountant
Forensic accountants may be brought in to: Investigate the minute any irregularities surface. Measure risk factors and create policy that brings the forensic accountant in when certain scores are attained. Check in randomly as a matter of routine. Chapter 1 Forensic and Investigative Accounting

Audit Tests The Panel on Audit Effectiveness recommended that surprise or unpredictable elements should be incorporated into audit tests, including: Recounts of inventory and unannounced visits to locations. Interviews of financial and nonfinancial client personnel in different locations. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Auditing Hints SAS No. 99 does not require auditors to make inquiries of “others,” as opposed to management. Auditors must talk to and interview others below management level. If asked, employees may be willing to report suspicious activities. Use independent sources for evaluating management (e.g., financial analysts). Surf the internet. Auditors need to follow the performance history of managers and directors. If a company has an anonymous reporting system, obtain information about the incidents reported and consider them when assessing fraud risk. (continued on next slide) Chapter 1 Forensic and Investigative Accounting 118

Auditing Hints Be sure to perform analytical procedures, and the work should be reviewed by senior members of the audit team. Auditors should select sample items below their normal testing scope (e.g., HealthSouth). Fraud procedures should be more than checklists. Audits should focus on finding and detecting fraud. Ask for and review all “top drawer” entries. Ask for and review all side agreements. Look for hockey stick patterns. Chapter 1 Forensic and Investigative Accounting 119

Audit Tests Requests for written confirmations from client employees regarding matters about which they have made representations to the auditors. Tests of accounts not normally performed annually. Tests of accounts traditionally or frequently deemed “low risk.” Chapter 1 Forensic and Investigative Accounting

Financial Statement Fraud Categories and Red Flags
Overstated revenues. Management estimates. Pro formas can mislead. Earnings problems: masking reduced cash flow. Earnings before interest, tax, depreciation, and amortization (EBITDA). Excessive debt. Inventory problems. Chapter 1 Forensic and Investigative Accounting

Cooking-the-Books Often Collaborative Effort
For restatements between January 1, 1997 to June 30, 2002, 45% were accused of securities fraud and subject to shareholder suits. Average of 7 individuals were implicated, including CEOs CFOs COOs General counsel Directors Internal/external auditors Source: Robert Tillman and Michael Indergaard, Control Overrides in Financial Statement Fraud. Chapter 1 Forensic and Investigative Accounting 122

WorldCom Fraud Massive
At least 40 people knew about the fraud. They were afraid to talk. Scott Sullivan handed out $10,000 checks to 7 involved individuals. Altered key documents and denied Andersen access to the database where most of the sensitive numbers were stored. Andersen did not complain about denied access. Company officials decided what tax rates they wanted and then used the reserves to arrive at the tax rates. Source: Rebecca Blumenstein and Susan Pullian, “WorldCom Fraud Was Widespread,” Wall Street J., June 10, 2003, p. 3. Chapter 1 Forensic and Investigative Accounting 123

Financial Statement Fraud Categories and Red Flags
CPA problems. Sales and expenses problems. Big bath. Balance sheet account problems. Pension plan problems. Reserve estimates (cookie jar accounting). Personal piggy bank. Barter deals. Chapter 1 Forensic and Investigative Accounting

HealthSouth From 1999 to 2001, HealthSouth’s net income increased nearly 500 percent, but revenue grew only five percent. On March 19, 2003, the SEC said that HealthSouth faked at least $1.4 billion in profit since 1999. Professional fees associated with the reconstruction of HealthSouth’s financial records and restatement of 2001 and 2002 consolidated financial statements totaled over $270 million. Chapter 1 Forensic and Investigative Accounting

Financial Fraud Detection Tools
Interviewing the executives. Analytics. Percentage analysis: Horizontal analysis. Vertical analysis. Ratio analysis. Chapter 1 Forensic and Investigative Accounting

Financial Fraud Detection Tools
Using checklists to help detect fraud: SAS checklist. Attitudes/Rationalizations checklist. Audit test activities checklist. Miscellaneous fraud indicator checklist. Chapter 1 Forensic and Investigative Accounting

Behavioral Approaches
Some fraud schemes cannot be effectively detected using data-driven approaches. Instead, behavioral considerations may help an auditor find fraud. Employee attitudes, feelings, values, norms, interaction with peers, and general satisfaction should all be considered when looking for fraud. Chapter 1 Forensic and Investigative Accounting

Federal Sentencing Guidelines
Federal Sentencing Guidelines were adopted in 1984 to emphasize fairness, consistency, punishment, incapacitation, and deterrence in sentencing. This mandatory sentencing regime was in place until the Supreme Court in and converted the guidelines to advisory status, stating that these guidelines violated the Sixth Amendment. District court judges are now required only to consider guideline ranges. Under the sentencing guidelines the base offense level is determined for a specific offense.3 For example, the basic offense level for larceny, embezzlement, and other forms of theft is 6 where the loss is $5,000 or less. However, if the loss is more than $2.5 million, add 18 to the 6. Other adjustments are made for victim, role, obstruction of justice, multiple counts, and defendant’s criminal history. Negative adjustments can be made for accepting responsibility.4 (continued on next slide) Chapter 1 Forensic and Investigative Accounting 129

Federal Sentencing Guidelines
If an individual has an offense level of 16 and falls into the first criminal history category, the guideline sentence is 21 to 27 months. If, however, the criminal history category is 5, the guideline prison sentence is months. A Department of Justice Fact Sheet dated March 15, 2006 said that as a result of the Booker decision, the fairness, consistency, predictability, and accountability that were the hallmarks of the mandatory guidelines are in serious jeopardy as a result of a decline in compliance with the guidelines. Within one year the number of sentences imposed within the guidelines has dropped 62.2 percent.5 1 U.S. v. Blakely, 542 U.S. 296 (2004). 2 U.S. v. Booker, 543 U.S. 220 (2005). 3 U.S. Sentencing Commission, Guideline Manual, §3E1.1 (November 2008), p.16. 4 Ibid., p. 395. 5 Department of Justice, Fact Sheet: The Impact of United States v. Booker on Federal Sentencing, March 15, 2006. Chapter 1 Forensic and Investigative Accounting 130

Effective Ethics and Compliance Program
If a company has an effective ethics and compliance program (i.e., internal audit department), 3 offense points are deducted from the total score. So if the total score is 29 before the reduction of 3 points, the fine would be $ 8.1 million; whereas a score of 26 results in a fine of only $ 3.7 million. Chapter 1 Forensic and Investigative Accounting

Accounts Payable Fraud Red Flags
Duplicate payments (2% of total purchases) $80 million times 2% = $1.6 million loss. Extract only the numerical digits of an invoice number and match on only the numbers portion of the invoice. Try identifying the dates that are similar such as dates that are less than 14 days. Try matching on the absolute value of the amount. Rounded-amount invoices. Invoices just below approval amounts. Abnormal invoice volume activity (two invoices one month and 60 the next). Vendors with sequential invoice numbers. LC 0002, LC 0003, LC 0004 Above average payments per vendor. C. Warner and B. G. Dubinsky, “Uncovering Accounts Payable Fraud,” Fraud Magazine, July/ August 2006, pp Chapter 1 Forensic and Investigative Accounting 132

Employee Fraudsters Lisa Eversole, in “Profile of a Fraudster,” lists the following characteristics of occupational fraudsters: Egotistical Risk taker Hard worker Greedy Disgruntled or a complainer Overwhelming desire for personal gain Pressured to perform Inquisitive Rule breaker Under stress Financially needy Big spender Close relationship with vendors/suppliers Chapter 1 Forensic and Investigative Accounting

Effects of Fraud Four-year class action lawsuit against Tyco. Fraud was $1 to $2 billion. PWC payment $225 million Tyco payment $2.975 billion Total $3.2 billion Chapter 1 Forensic and Investigative Accounting

Fannie Mae Forensic Probe
BOD hired investigators who cleared the current management of Fannie Mae of knowingly participating in any wrongdoing. The report took 17 months; 616 pages plus 2,000 plus pages of supporting documents. Cost of $60 million to $70 million. The fraud was estimated to be $11 billion. Former N.H. Senator Warren Rudman used The Huron Consulting Group. Chapter 1 Forensic and Investigative Accounting

A Forensic Accounting Expert Witness
Harvey R. Kelly led the investigation and testified against CEO Richard M. Scrushy (HealthSouth). He acknowledged turning up “nothing that had Mr. Scrushy’s name on it,” that connected the former CEO to the fraud at HealthSouth, which inflated earnings by $2.7 billion. “Our job wasn’t to figure out who all the bad guys were. Our job was to help the company get the right numbers and figure out how much the fraud was.” He and his investigators sifted through millions of documents during their 23,000-hours fraud investigation. PWC was paid about $9 million to conduct the forensic audit in 2003. HealthSouth deleted old s every 60 days. Now with the NYC office of Alix Partners LLC, he was being paid about $700 an hour by the government for his testimony. Source: Evelina Shmukler, “Scrushy Team Cross-Examines Forensic-Accounting Witness,” WSJ, February 1, 2005, C-4. Chapter 1 Forensic and Investigative Accounting

Governmental Fraud Where Is $9 Trillion? The U.S. Federal Reserve can not account for $9 trillion in off-balance sheet transactions. Also, no one at the Federal Reserve has any idea what are the losses on its $2 trillion portfolio. On May 12, 2009, Inspector General Elizabeth Coleman could not explain the $1 trillion plus expansion of the Federal Reserve’s balance sheet since September While testifying before Congress, Coleman said the IG does not have jurisdiction to audit the Federal Reserve. If a U.S. business lost $9 trillion or created $9 trillion on their balance sheet, they would suffer severe penalties. Source: Julie Crawshaw, “Federal Reserve Cannot Account for $9 Trillion,” Newsmax.com. May 12, Chapter 1 Forensic and Investigative Accounting

Employee Fraudsters Bev Harris, in “How to Unbezzle a Fortune,” says that fraudsters and embezzlers are the nicest people in the world: Wide-eyed mothers of preschoolers. Your best friend. CPAs with impeccable résumés. People who profess deep religious commitments. Your partner. Loyal business managers who arrive early, stay late, and never take a vacation. And sometimes, even FAMILY MEMBERS. So if you’re looking for sinister looking, waxed mustache, and shifty eyes, you’re in for a surprise—scoundrels come in every description. Chapter 1 Forensic and Investigative Accounting

Careful With Property Tax Refund Checks
Supervisor of the Real Property Tax Adjustment Unit in Washington, D.C., Harriette Walters, used at least 92 payments to dummy corporations in a scam to obtain $31.7 million. Fraud was never noticed by city officials, internal, or external auditors. Auditors never examined why the city’s property tax refunds were steadily rising. Sham companies’ bank accounts were controlled by Walters’ brother. Many applications for refund were identical to prior ones. In a FBI raid of her house, 100 pieces of jewelry, a mink coat, 90 designer purses, 68 pairs of shoes, designer luggage, Rolex watch, silver bar cart, and more were found. She had a $1.4 million in bills at Neiman Marcus on a $81,000 yearly government salary. Chapter 1 Forensic and Investigative Accounting 140

Discrepancies That May Indicate Fraud
Transactions that are not recorded in a complete or timely manner or are improperly recorded as to amount, accounting period, classification, or entity policy. Unsupported or unauthorized balances or transactions. Last-minute adjustments that significantly affect financial results. Evidence of employees’ access to systems and records inconsistent with that necessary to perform their authorized duties. Chapter 1 Forensic and Investigative Accounting

Types of Misappropriations
Embezzlement Cash and check schemes Larceny of cash Skimming Swapping checks for cash Check tampering Kiting Credit card refund and cancellation schemes (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Accounts receivable fraud Lapping Fictitious receivables Borrowing against accounts receivable Inventory fraud Stealing inventory Short shipments with full prices (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Accounts payable fraud Double billing Shell companies Fictitious disbursements Doctored sales figures Sham payments Price manipulations: land flipping, pump and dump, and cybersmearing Money laundering Bid rigging Chapter 1 Forensic and Investigative Accounting

Fighting Fraud An organization may want to: Put in place a business ethics policy. Reflect the company’s position on fraud in Rules of Conduct. Identify and assess primary potential risks faced by the business. Determine adequate plans and procedures to deal with fraud once it has been discovered. Have a forensic accountant review and help to audit the company’s security measures. Select and promote staff based on sound employment practices. Chapter 1 Forensic and Investigative Accounting

Preventing Employee Fraud
Have a fraud hotline. Institute a mandatory vacation policy. Rotate assignments of employees who handle cash, payables, and receivables. Have a written and signed ethics policy. Have internal auditors do different procedures each time they audit a unit. Observe and listen to employees; look for lifestyle changes. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Really understand the business unit and what functions employees actually perform. Do not allow employees or executives to get away with anything. In a small business, the owner should receive the monthly bank statements unopened. Bank statements should always be reconciled. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Supervisors should try to think like criminals. Do not assume employees behave honestly. Check employee references and résumés. Think outside the box. Bond employees. Use a positive pay system. Use a locked box system. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Count the cash twice in one day. Count the cash at irregular intervals. Unannounced inventory counts. Have a fraud risk assessment. Beware of related parties. Avoid check-signing machines and signature stamps. Be careful allowing employees to make side agreements. Chapter 1 Forensic and Investigative Accounting

Proactive and Reactive Fraud Investigations
There are two major types of fraud investigation: Reactive investigations occur after there is a reason to suspect fraud or after there is a significant loss. Proactive investigations occur as a part of normal operations even when there is no reason to suspect fraud. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Proactive and Reactive Fraud Investigations
The threat of a future investigation reduces the occurrence of fraudulent behavior from 75% to only 43%. When the IRS began to require taxpayers to list a social security number for dependents, the number of reported dependents dropped by 7,000,000 the next year. Chapter 1 Forensic and Investigative Accounting

Steps to Consider Once Fraud Is Detected
Call legal counsel. Get the insurance carrier involved as early as possible. Take immediate steps to safeguard existing assets from further damage. Quietly and confidentially gather evidence. Manage information on a need to know basis in the early stages of discovery. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Steps to Consider Once Fraud Is Detected
Consider communications very carefully whether they are to employees or those outside the company. Consider setting aside time immediately to scope out an action plan. Consider those who might assist in the crisis and take steps to eliminate any conflict of interest issues. Consider prosecution which acts as a deterrent for future fraud. Chapter 1 Forensic and Investigative Accounting

Wells Report Measures The 2004 Wells Report provides an excellent ranking of the helpful measures for preventing fraud: Strong internal controls (3.66) Willingness of companies to prosecute (3.44) Regular fraud audit (3.40) Fraud training for auditors (3.33) Anonymous fraud reporting mechanisms (3.27) Background checks of new employees(3.25) Established fraud policies (3.12) Ethical training for employees (2.96) Workplace surveillance (2.89) Chapter 1 Forensic and Investigative Accounting

Fraud in Not-for-Profit Organizations
The website of Clark, Schaefer, Hackett & Company states the following reasons not-for-profit organizations become targets of fraud: Many smaller not-for-profits just don’t have the personnel size required for a real segregation of duties. They often don’t require much approval for disbursements. And, when fraud is discovered, they frequently don’t prosecute it very aggressively because of the perceived negative publicity. Chapter 1 Forensic and Investigative Accounting

State and Local Government Susceptibility
Government bankruptcy is an important issue for fraud prevention and detection because like business corporations and organizations, governments facing severe financial difficulties can be fertile ground for fraud. Government bankruptcy also may trigger an investigation in order to determine if fraud has contributed to such financial distress. Chapter 1 Forensic and Investigative Accounting

Uncovering Elusive Fraud
Analyze account records and trace funds. Research background and search for assets. Develop confidential sources. Interview/interrogate persons and find witnesses. Conduct surveillance efforts. Guide undercover operations. Recognize and preserve physical evidence. Chapter 1 Forensic and Investigative Accounting

Game Theory and Strategic Reasoning
Fraud risk assessment Auditors who use long lists of fraud cues and fraud checklists are inaccurate in their fraud risk assessments. Auditors generally overweight cues indicative of management’s character even though these cues are the most likely cues to be unreliable. Audit standards should be designed to persuade auditors to consider how management might manipulate their perceptions of fraud cues. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Audit planning Auditors should develop audit strategies that are unpredictable, especially with regard to the nature of their evidence. Audit plans are more predictable and less effective at detecting fraud when auditors use procedures based on prior audits or standard audit programs. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Audit planning (cont’d) Audit standards should require auditors to engage in strategic reasoning by considering the types of fraud that management might perpetrate and how these frauds might be concealed from the audit. The goal of audit standards should be to encourage auditors to gather new, unusual, or random audit evidence not easily anticipated by management. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Implementation of the audit Learning from experience is critical to effectively performing in a strategic setting. Auditors are often insensitive to new evidence regarding fraud risk and can more effectively learn from their interactions with the client. Audit standards can improve learning by requiring activities such as documenting and communicating the nature of their interactions with management. Chapter 1 Forensic and Investigative Accounting

Continuous Monitoring
Some benefits to continuous monitoring are: Independent testing of controls. Timely notification to management of controls breakdowns. Fraud reduction and improved risk management. Improvements to efficiency and effectiveness. Extensibility to multiple end-to-end business processes. Chapter 1 Forensic and Investigative Accounting

Some Forensic Techniques and Tools
Check, deposit, and credit card spreads Timeline analysis Tracing schedule Link analysis Invigilation Genogram Proof of cash Entity charts Full- and-false inclusion tests Net worth method Chapter 1 Forensic and Investigative Accounting

Check Kiting Scheme Peter L. Cash, a director of Peoples Bank of Coffee County, Alabama, kited checks between various bank accounts for each of his businesses to create an involuntary overdraft of more than $8 million between October 2005 and July Cash would continuously draw an insufficient check on one account and deposit that check into another account. This process gave the four victim banks the false impression that there was money in his business accounts. The fraud became apparent when he ended the kiting scheme and all checks and deposits cleared the various banks. Source: “Elba Businessman Pleads Guilty to Bank Fraud Charges,” U.S. Attorney’s Office, 25 October 2010; available at press/ cash.pdf Chapter 1 Forensic and Investigative Accounting

Embezzlement Scheme Fraudsters may use simple methods to commit their embezzlement. Teri Lyn, an accounts payable clerk at McClelland Equipment, wrote 18 checks to herself for a total of $18,000. She would type her name and address on an address label which she put over the “account” or “to - - pay to the order of” person that she had dummied the check out to get it signed. The fraud was discovered when a check processor peeled back the label on one of the dummied checks and found that the check was supposed to go to a company rather than Teri Lyn’s individual account. The processor called Lyn’s company, she confessed, and served 13 months of a two-year sentence. Source: The Montel Williams Show, “My Life As a Thief,” June 11, 2004, 2004 Paramount Pictures Corp. Chapter 1 Forensic and Investigative Accounting

Form 1099 Technique Fraudster taxed in year of embezzlement. Victim allowed deduction in year of discovery. Form 1099 Approach probably not worthwhile. Chapter 1 Forensic and Investigative Accounting

Forensic Audit Approaches Used by the IRS
Direct methods involve probing missing income by pointing to specific items of income that do not appear on the tax return. In direct methods, the agents use conventional auditing techniques such as looking for canceled checks of customers, deed records of real estate transactions, public records and other direct evidence of unreported income. Chapter 1 Forensic and Investigative Accounting

Forensic Audit Approaches Used by the IRS
Indirect methods use economic reality and financial status techniques in which the taxpayer’s finances are reconstructed through circumstantial evidence. Chapter 1 Forensic and Investigative Accounting

Minimum Income Probes For nonbusiness returns, an agent questions the taxpayer or the representative about possible sources of income other than reported on the return. If there is no other information in the file indicating potential unreported income, the minimum income probe is met. Chapter 1 Forensic and Investigative Accounting

Minimum Income Probes For taxpayers who are self-employed and file a Schedule C or F, an analysis is made of tax return information to determine if reported income is sufficient to support the taxpayer’s financial activities. Chapter 1 Forensic and Investigative Accounting

Lifestyle Probes The lifestyle of a taxpayer or employee may give clues as to the possibilities of unreported income. Obvious lifestyle changes may indicate fraud and unreported income: Lavish residence Expensive cars and boats Vacation home Private schools for children Exotic vacations Chapter 1 Forensic and Investigative Accounting

IRS Financial Status Audits
If someone is spending beyond his or her apparent means, there should be concern. If a forensic accountant suspects fraud or unreported income, a form of financial audit may be appropriate that will enable the investigator to check the lifestyles of the possible perpetrators. Chapter 1 Forensic and Investigative Accounting

Indirect Methods An indirect method should be used when: The taxpayer has inadequate books and records. The books do not clearly reflect taxable income. There is a reason to believe that the taxpayer has omitted taxable income. There is a significant increase in year-to-year net worth. Gross profit percentages change significantly for that particular business. The taxpayer’s expenses (both business and personal) exceed reported income, and there is no obvious cause for the difference. Chapter 1 Forensic and Investigative Accounting

Market Segment Specialization Program
The Market Segment Specialization Program focuses on developing highly trained examiners for a particular market segment. An integral part of the approach used is the development and publication of Audit Technique Guides. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Market Segment Specialization Program
These Guides contain examination techniques, common and unique industry issues, business practices, industry terminology, and other information to assist examiners in performing examinations. A forensic accountant can use this resource to learn about a particular industry (many are free). Chapter 1 Forensic and Investigative Accounting

Cash T A cash T is an analysis of all of the cash received by the taxpayer and all of the cash spent by the taxpayer over a period of time. The theory of the cash T is that if a taxpayer’s expenditures during a given year exceed reported income, and the source of the funds for such expenditures is unexplained, such excess amount represent unreported income (e.g. embezzled income). Chapter 1 Forensic and Investigative Accounting

Preliminary Cash-T Gross Receipts: Business Expenses: Schedule C $120,000 $95,000 Preliminary Understate-ment Personal Living Expenses $60,000 $155,000 $35,000 Chapter 1 Forensic and Investigative Accounting 178

Source and Application of Funds Method (Expenditure Approach)
This technique is a variation of the net worth method that shows increases and decreases in a taxpayer’s accounts at the end of the year. The format of this method is to list the applications of funds first and then subtract the sources. If the taxpayer’s applications exceed his or her known cash receipts (including cash on hand at the beginning of the year), any difference may be unreported income. Chapter 1 Forensic and Investigative Accounting

Net Worth Method The net worth method is a common indirect balance sheet approach to estimating income. To use the net worth method, an IRS agent or forensic accountant must: Calculate the person’s net worth (the known assets less known liabilities) at the beginning and ending of a period. Add nondeductible living expenses to the increase in net worth. Account for any difference between reported income and the increase in net worth during the year as (a) nontaxable income and (b) unidentified differences. Chapter 1 Forensic and Investigative Accounting

Bank Deposit Method The bank deposit method looks at the funds deposited during the year. This method attempts to reconstruct gross taxable receipts rather than adjusted. Chapter 1 Forensic and Investigative Accounting

Gross Business Receipts Formula
1. Total bank deposits $XXX Less: 2. Nontaxable and nonbusiness receipts deposited (XXX) 3. Net deposits resulting from business receipts Add: 4. Business expenses paid by cash 5. Capital items paid by cash XXX 6. Personal expenses paid by cash 7. Cash accumulated during the year from receipts 8. Subtotal 9. Less: Nontaxable and nonbusiness cash used for (4) through (7) 10. Gross business receipts as corrected 11. Adjustments for accrual basis taxpayers Chapter 1 Forensic and Investigative Accounting

Six Requirements for a Valid Contract
Offer and acceptance. Lawful objective. Capacity of parties to perform. Something of value exchanged. Appropriate form (e.g., in writing). Entered into freely. Chapter 1 Forensic and Investigative Accounting

Procurement Fraud Techniques
Bribes and kickbacks. Bid rigging. Defective pricing. Phantom vendors ( Product substitution. Conflict of interests. False claims. Chapter 1 Forensic and Investigative Accounting

Procurement Fraud Techniques
Cost mischarging. Contract specification failures. Duplicate, false, or inflated invoices. Split purchases. Unnecessary purchases. Defective delivery. Chapter 1 Forensic and Investigative Accounting

Foreign Corrupt Practices Act (FCPA)
The purpose of the Foreign Corrupt Practices Act (FCPA) of 1977 is to combat corrupt business practices such as bribes and kickbacks. Thus, for more than 30 years these foreign bribery laws in the United States have restricted all U.S. employees, regardless of where the business is conducted. Chapter 1 Forensic and Investigative Accounting

Red Flags of Bribery and Kickbacks
Lack of standard invoices. Requests for funds to be routed to a foreign bank. Requests for checks made payable to “cash” or to “the bearer.” Commission substantially higher than going rate. Requests for a large line of credit from a customer. Chapter 1 Forensic and Investigative Accounting

Red Flags of Bribery and Kickbacks
Insistence by a government official that a certain third-party agent or supplier be used. Lack of staff or facilities to actually perform the service. Request by a local agent for a rate increase in the middle of negotiations. Suggest need to utilize more than one local agent. Chapter 1 Forensic and Investigative Accounting

Red Flags of Phantom Vendors
Invoices for unspecified consulting or other poorly defined services. Unfamiliar vendors. Vendors that have only a post-office-box address. Vendors with company names consisting only of initials. Many such companies are legitimate, but crooks commonly use initials when naming companies. Chapter 1 Forensic and Investigative Accounting

Red Flags of Phantom Vendors
Rapidly increasing purchases from one vendor. Vendor billings more than once a month. Vendor addresses that match employee addresses. Large billings broken into multiple smaller invoices, each of which is for an amount that will not attract attention. Chapter 1 Forensic and Investigative Accounting

Bid Rigging A Virginia businessman paid a $47,000 penalty for rigging bids during North Carolina’s forclosure auctions. Bruce McBarnette and his company Summit Connection would enter into agreements with other bidders to stop bidding on certain properties in exchange for payments from the other bidders. The auctions took place in Durham and Mecklenberg counties in North Carolina. McBurnette said he did not know the activity was illegal because he had seen the practice before. Source: Raleigh (AP), “Va Businessman Pays Fine for Bid-rigging in N.C.,” Independent Tribune, December 28, 2010, p. A-6. Chapter 1 Forensic and Investigative Accounting

Definition A definition of money laundering that covers both legal and illegal contexts is to take money that comes from one source, hide that source, and make the funds available in another setting so that the funds can be used without incurring legal restrictions or penalties. Chapter 1 Forensic and Investigative Accounting

Steps in Money Laundering
The traditional money laundering process can be divided into three steps: Money is deposited in a bank or financial institution. A set of complex transfers is made to disguise the original source for the money and to hide the audit trail. (This step is called layering the transactions.) The money is integrated back into the legitimate money supply. Chapter 1 Forensic and Investigative Accounting

Cybercash Creates New Laundering Opportunities
Using the Internet, it will be possible for anyone to transfer large sums of money from one location to another without using a bank and with the transfers being totally anonymous. Chapter 1 Forensic and Investigative Accounting

Cybercash Creates New Laundering Opportunities
Today, cybercash transactions are beginning to take place without the need for third parties and the consequential scrutiny that might otherwise exist. Furthermore, cybercash transfers can be structured so that they originate in a jurisdiction where such activities are not considered illegal. Chapter 1 Forensic and Investigative Accounting

Possible Users of Money Laundering Practices
Grant recipients Criminals Political asylum seekers Chapter 1 Forensic and Investigative Accounting

Correspondent Banking
Correspondent banking takes place when one bank provides services to another bank to move funds, exchange currencies, and access investment services such as money market accounts, overnight investment accounts, CDs, trading accounts, and computer software for making wire transfers and instant updates on account balances. Chapter 1 Forensic and Investigative Accounting

Correspondent Banking
A payable-through account enables the respondent bank’s clients within the country where the bank is registered to write checks that are drawn directly on the respondent bank’s correspondent account in the United States. Chapter 1 Forensic and Investigative Accounting

Tools Banks Use to Identify Money Launderers
Monitoring software Currency Transaction Reports (CTRs) Suspicious Activity Reports (SARs) Chapter 1 Forensic and Investigative Accounting

Due Diligence Laws for Banks
Laws and regulations require that a bank perform due diligence in its relationships with other banks and important clients as well as continually monitor account transactions. Within banks, due diligence must co-exist with the client’s need for privacy and the secrecy laws existing in many foreign jurisdictions that prevent access to bank documents. Chapter 1 Forensic and Investigative Accounting

Shell Banks Shell banks are generally high-risk banks that exist without any physical presence in any legal jurisdiction. These banks have a banking license in a specific country, but they are not likely to have a staff and may be operated as part of another business or operated out of an individual’s personal residence. Chapter 1 Forensic and Investigative Accounting

Offshore Banks An offshore banking license prevents the organization from transacting banking activities with any citizens of the licensing jurisdiction or transacting business with the currency of the licensing jurisdiction. These bank operations solely exist within international financial transactions. Chapter 1 Forensic and Investigative Accounting

Cash-Oriented Businesses
Currency exchanges Online auctions Casinos Purchasing departments Chapter 1 Forensic and Investigative Accounting

Audit Trail Churning Laundering cycles Illegal cash Deposited into bank Purchase asset Sell asset Documented legal cash Chapter 1 Forensic and Investigative Accounting

Finding Money Laundering Schemes
Web logs Tracing IP addresses HTTP common logfile format Wire transfers Bank reports IRS Form 8300 Chapter 1 Forensic and Investigative Accounting

Guarding Against Money Laundering
Individual due diligence. Business associations. Employment. Company due diligence in verification procedures. Corporate ownership and governance. Bearer shares. Trust due diligence. Trust deeds. Beneficiaries. Chapter 1 Forensic and Investigative Accounting

Accountant’s Role as Gateway Keeper
AICPA Auditing Standards Governing Money Laundering. SAS No. 54, Illegal Acts by Clients. SAS No. 82, Consideration of Fraud in a Financial Statement Audit (now replaced by SAS No. 99). Lack of Reporting Requirement. Chapter 1 Forensic and Investigative Accounting

USA Patriot Act of 2001 International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001 (MLAA). Payable-through accounts. Enhancements and restrictions under MLAA. Reporting requirements under MLAA. Chapter 1 Forensic and Investigative Accounting

Litigation in the United States
The U.S. tort system cost $248.1 billion in 2009, which was about $808 per U.S. citizen ($12 in 1950). Medical malpractice costs totaled nearly $30.4 billion in 2007, or about $101 per person (compared to $5 per person in 1975). Some of these costs are expert witnessing fees. Chapter 1 Forensic and Investigative Accounting

Litigation in the United States
The five major phases of litigation are: Pleadings. Discovery. Trial. Outcome. Possible appeal. Much of the work for forensic accountants occurs in the discovery stage. Chapter 1 Forensic and Investigative Accounting

Forensic Report Chapter 1 Forensic and Investigative Accounting

Civil Procedure Body of rules and practices by which justice is handed out by the legal system. Federal Rules of Civil Procedure (FRCP): governs U.S. district courts.* Federal Rules of Criminal Procedure. Federal Rules of Evidence. * Find at Chapter 1 Forensic and Investigative Accounting

Types of Litigation Services Provided by Accountants
Consultant Expert witness Court-appointed experts and special masters Chapter 1 Forensic and Investigative Accounting

Standards of Conduct for Performing Litigation Services
Knowledge, skills, experience, training, and education. Professional codes of conduct. Conflicts of interest. Written agreement to perform litigation services. Chapter 1 Forensic and Investigative Accounting

Expert vs. Lay Witnesses
A lay (or fact) witness testifies as to facts. An expert witness is an individual who, because of specialized training or experience, is allowed to testify in court to help the judge or jurors understand complicated and technical subjects. Chapter 1 Forensic and Investigative Accounting

Qualifying as an Expert Witness
Under the Frye standard, the test for admitting expert testimony is: Whether the expert’s testimony will assist the trier of fact in understanding the evidence or in determining a fact in issue. Whether the theories and/or techniques relied upon by the expert are generally accepted by the relevant professional community. Whether the particular expert is qualified to present expert testimony on the subject at issue. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Under the Federal Rules of Evidence, a judge will permit an accountant to testify as an expert witness only if the judge decides that: The accountant’s testimony will help the jurors or judge understand the evidence or determine a fact in issue. The accountant is qualified as an expert by knowledge, skill, experience, training, or education. The accountant can show that his or her testimony (a) will be based on sufficient facts or data and (b) will be the product of reliable principles and methods that have been applied reliably to the facts of the case. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

In Daubert v. Merrill Dow Pharmaceuticals, Inc., the U.S. Supreme Court established the rule for federal courts that trial judges have a special responsibility to ensure that scientific testimony is not only relevant, but also reliable. In Kumho Tire Company, Ltd. v. Carmichael, the Supreme Court decided that a judge’s “gatekeeping” obligation applies not only to scientific testimony but to all expert testimony. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

In Daubert, the U.S. Supreme Court suggested that judges consider the following factors: Whether the theory or technique in question can be (and has been) tested. Whether the theory or technique in question has been subjected to peer review and publication. The theory or technique’s known or potential error rate. Whether the theory or technique has attracted widespread acceptance within the relevant community. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Figlewicz and Sprohge in their article, “The CPA’s Expert Witness Role in Litigation Services: A Maze of Legal and Accounting Standards,” offer ten guidelines to help avoid legal challenges: Know the relevant professional standards. Apply the relevant professional standards. Know the relevant professional literature. Know the relevant professional organizations. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Use generally accepted analytical methods. Use multiple analytical methods. Synthesize the conclusions of the multiple analytical methods. Disclose all significant analytical assumptions and variables. Subject the analysis to peer review. Test the analysis—and the conclusions—for reasonableness. Chapter 1 Forensic and Investigative Accounting

Preparing to Testify as an Expert Witness
Maintaining independence from the client. Evidence upon which experts may rely. Use of confidential client information. Expert reports. Working papers. Evaluation of other experts. Exhibits and other demonstrative evidence. Chapter 1 Forensic and Investigative Accounting

Testifying at a Deposition
Expert witnesses can expect to be asked about the following at a deposition: The scope of their assignment. Their current employment (job title, duties). Their educational background. Licenses. Work experience. Memberships in professional organizations. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Testifying at a Deposition
Publication and lectures. Fields in which they are qualified as an expert. Other work they have performed as an expert or other litigation consultant. What compensation they are receiving (and what percentage of their compensation is derived from testifying as an expert witness). What opinions they have formed. The bases for their opinions. Almost anything. Chapter 1 Forensic and Investigative Accounting

Cross Examination Tactics
Do not speak to people outside courtroom while waiting and during breaks. Turn off your cell phone or pager before entering the court. Do not wear emblems. Avoid humor, but laugh at judge’s humor. Keep your hands on top of the table, not hidden. Be sure your attorney questions you in detail about your qualifications in order to impress the judge/jurors. Do not allow the other side to stipulate you as an expert. Dress neatly and conservatively. Arrive on time at the court house (have multiple reminders). When taking the oath as a witness, say loudly, “I do.” Be sincere and respectful. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Cross Examination Tactics
Talk directly to the jurors (or judge if no jurors). Look them in the eyes. Make contact with each of the jurors. Explain number carefully, possibly using analogies with tax returns and checkbook. Pausing does not harm you. Use first person, active person: I reviewed these records, and I found…. Tell stories about people. Be careful when shown passages from textbooks, etc. Jurors have nothing to do for long periods. They are always watching. Be careful every place in the court house, even while driving to the court house. When you are in trouble in the court room, do not lean back. Instead lean forward. When you are finished, do not leave the courtroom until there is break. Chapter 1 Forensic and Investigative Accounting

Testifying at Trial According to Bursztajn and Brodsky in their article, “Ethical and Effective Testimony During Direct Examination and Cross-Examination Post-Daubert,” the following should be the primary goals of an expert witness: To communicate the truth to the jury in an ethical, objective, and effective way. To maintain your autonomy, authenticity, and integrity. To uphold the values of your profession. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Testifying at Trial To interact with attorneys and with the judge and jury in an atmosphere of mutual respect. To engage in an ongoing dialogue with your attorney so that, together, you can educate as well as learn from the judge and jury as to what questions each may have. To speak directly to the issues. To make complex matters understandable without oversimplifying. Chapter 1 Forensic and Investigative Accounting

Liability of Expert Witnesses
Witness immunity Threat of lawsuit Claims of negligence Bases for liability Breach of contract Negligence Criminal process Chapter 1 Forensic and Investigative Accounting

Daubert Chapter 1 Forensic and Investigative Accounting

Searchable Databases of Daubert Decisions
“Daubert on the Web” Online free tracking service. In June 2001, 87 cases were under the field “Accountants and Economists” with an admissibility rate of .598. There are a total of 25 fields with various “admissibility rate,” such as Appraisers Computer experts, Criminologists, Marketing experts, Polygraphers, Statisticians, In Louisiana, there have been at least 33 Daubert challenges with a 60% admission rate. Chapter 1 Forensic and Investigative Accounting

Written Reports An expert should never draft a written report of any kind unless he or she has been expressly directed to do so by hiring counsel. Federal Rules of Civil Procedure 26(a)(2)(B) requires a written report. Keep a diary of interview dates, etc. Do not destroy interview notes. Chapter 1 Forensic and Investigative Accounting

Written Report Contents (FRCP 26(a)(2)(B))
All opinions to be expressed and the bases for them. Data or other information considered in forming the opinions. Any exhibits to be used as a summary of or support for opinions. Witness qualifications, including a list of all publications authored within the last 10 years. Witness compensation. List of other disputes in which the witness has testified at deposition or trial during the last 4 years. Signature of the expert testifying. Note: Federal Rule of Civil Procedure 27(e)(1) indicates that an expert must update a written report or disposition. Chapter 1 Forensic and Investigative Accounting

Types of Expert Reports
Fact-oriented report – gathers and evaluates facts and uses them to prepare a report. Check and re-check the numbers and the facts. Opinion report (e.g., valuation report) – more subjective and rely more on the professional judgment of the expert. Combination of above types. Chapter 1 Forensic and Investigative Accounting

Trends and Outcomes of Daubert and Frye Challenges
Number of challenges to financial expert witnesses fell in 2010, but the success rates increased to their highest level since 2005. Five federal circuits adjudicate the majority of all Daubert challenges to financial expert witnesses. Plaintiff financial expert witnesses are challenged more frequently, consistently two to three times as often as defense experts, but their exclusion rates have been lower than defense experts in five of the last six years. Economists, accountants, and appraisers are the more frequently challenged financial expert witnesses but also the ones more likely to survive the challenge. Chapter 1 Forensic and Investigative Accounting

Trends and Outcomes of Daubert and Frye Challenges
Case type affects the frequency and outcome of Daubert challenges to financial expert witnesses. For the 11th consecutive year, lack of reliability is the top reason financial experts are included. Exclusions more commonly result from the misuse of accepted methodologies than from the introduction of unusual or untested analytical methods. Source: PricewaterhouseCoopers, Daubert Challenges to Financial Experts: An 11-year Study of Trends and Outcomes, 2011, p.6. Chapter 1 Forensic and Investigative Accounting

Rules of Evidence The rules of evidence are the rules governing the admissibility of evidence in a legal proceeding and the weight to be given to evidence that is admitted. Chapter 1 Forensic and Investigative Accounting

What Is Evidence? Evidence is testimony, writings, and material objects offered to prove an alleged fact or proposition. Direct evidence is evidence that directly proves a fact at issue, without the need for any inference or presumption. Circumstantial evidence is evidence from which a fact at issue may be proved indirectly (e.g., Casey Anthony’s trial). Chapter 1 Forensic and Investigative Accounting

Relevance Requirement
Circumstantial evidence. Inflammatory evidence. Evidence about plaintiff’s character. Evidence of habit. Exclusionary rules. Evidence of liability. Chapter 1 Forensic and Investigative Accounting

Privileged Communications
Attorney-client privilege. Employee communications. Work product rule. Attorney-requested accounting work. Medical privilege. Spousal privilege. Other types. Religious. Governmental. Chapter 1 Forensic and Investigative Accounting

Hearsay Rule Hearsay is an oral or written assertion, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted. As a general rule, hearsay is not admissible as evidence in a legal proceeding (except by an expert witness). (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Hearsay Rule In some situations a statement that appears to be hearsay is offered to prove a fact other than the matter asserted: Legally operative fact. Effect on the listener. State of mind of the declarant. Impeachment. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Hearsay Rule There are three concepts underlying the exceptions to the general rule barring hearsay: Trustworthiness. Unavailability of the declarant. Practical considerations. Chapter 1 Forensic and Investigative Accounting

Authentication Requirement
To be admissible as evidence in a legal proceeding, a document or other material usually must be authenticated or identified as to what its proponent claims it to be. Chapter 1 Forensic and Investigative Accounting

Best Evidence Rule Under the best evidence rule (also referred to as the original writing rule), to prove the contents of a writing, recording, or photograph, the original writing, recording, or photograph usually must be presented. Attorneys can get around this rule. Chapter 1 Forensic and Investigative Accounting

Demonstrative Evidence
Demonstrative evidence is an item that illustrates testimony but has no probative value in itself (such as a chart, diagram, photograph, video, or model). Chapter 1 Forensic and Investigative Accounting

Special Rules Criminal cases. Administrative proceedings. Tone of the proceedings. Residuum rule. Chapter 1 Forensic and Investigative Accounting

Residuum Rule The residuum rule is that no finding may be supported solely by hearsay evidence. Chapter 1 Forensic and Investigative Accounting

Maximizing Client Confidentiality
Michael Mostek, in Expert Witnessing in Forensic Accounting, provides the following advice for protecting the work product privilege: The attorney should directly retain the consultant. The agreement should be between attorney and expert. The expert should obtain facts through, or at the direction of, the attorney. The investigation should be done at the direction of the attorney. The attorney should be present when the consultant first meets with the client. Chapter 1 Forensic and Investigative Accounting

AICPA Top Technologies Task Force
The task force found the following top ten technologies for 2010 in descending order of importance: Control and Use of Mobile Devices. Information Security. Data Retention Policies and Structure. Remote Access. Staff and Management Training. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

AICPA Top Technologies Task Force
Process Documentation and Improvements. Saving and Making Money w/Technology. Technology Cost Controls. Budget Processes. Project Management & Deployment of New. Chapter 1 Forensic and Investigative Accounting

Using Technology to Gather Evidence
Drill-down functionality. Electronic imaging. Benford’s law. Digital Analysis Tests and Statistics (DATAS). Data warehousing/mining. Data extraction versus data investigation. Inductive vs. deductive method. Chapter 1 Forensic and Investigative Accounting

Computer Evidence Protecting data in hardware seizures. Insidious s. Documenting computer evidence. Chapter 1 Forensic and Investigative Accounting

Evidence Management Do not mark, staple, or otherwise alter any documents or other evidence that might find its way into court. Record how the documents were obtained and who has handled it (chain of custody). Use see-through holders to avoid putting fingerprints on documents. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Evidence Management Store original documents and working papers in fireproof safes or locked cabinets. Protect material stored on a computer with a password. Make backup copies on a regular basis and store in a separate location. Copy, inventory, and index evidence so that it can be readily found when needed. Chapter 1 Forensic and Investigative Accounting

Questioned Documents Invoices and other documents may be fake or altered when: Font sizes or types are not consistent. No address is shown for the vendor or customer; this situation is especially suspicious if a vendor has not identified an address to which a check can be sent. The document has no identifying numbers such as invoice number, purchase order number, or customer number. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Questioned Documents All invoice numbers on invoices from vendors are numbered sequentially, with no numbers skipped. No tax is shown for taxable items. No shipping or freight cost is shown for items that would have been shipped at the purchaser’s expense. Little or no detail is provided on the invoice or document. Chapter 1 Forensic and Investigative Accounting

Forensic Accounting Investigations
“In today’s internal forensic accounting investigations, massive amounts of electronic data, transactional detail, electronic communications and historic reports comprise the full universe of information that is typically available to the forensic team to perform the fact finding and corresponding analysis of the investigation. Dealing with this enormous amount of data is time consuming, challenging and costly. However, when you add the complexity associated with a growing number of electronic data types, password cracking and restoration of information on historical media (e.g., backup tapes), the challenges of accessing the relevant information are even more difficult.” Source: Matthew Greenblatt and Stephen O’Mally, “Inside an Internal Accounting Investigation,” New York Law Journal, May 29, 2007. Chapter 1 Forensic and Investigative Accounting

Computer Online Forensic Extractor
Forensic accountants may be able to make use of evidence obtained by law enforcement officers by a free Microsoft device called Computer Online Forensic Extractor (COFEE). The COFEE device is installed on a USB flash drive or other external disk drive to gather digital evidence. The digital forensic tool contains 150 commands that can dramatically reduce the time it takes to gather digital evidence by decrypting passwords and analyzing a computer’s Internet activity as well as data stored in the computer. The investigator does not have to seize the computer, which would involve disconnecting from the network, turning off the power, and possibly losing data. Essentially the investigator scans for evidence on site with a pre-configured COFEE device by inserting the USB device into the suspected computer. Chapter 1 Forensic and Investigative Accounting

Other Digital Multifunctional Devices
Forensic accountants can obtain evidence from other digital multifunctional devices (MFDs). For example, digital copiers store thousands of records in internal memory when documents are copied, printed, scanned, and faxed. Even when the individual walks away from the machine, the information remains in memory. Billions of pages of information also are stored on printers, copiers and facsimile. Forensic auditors should conduct an inventory of data storage devices that may contain appropriate evidence. Chapter 1 Forensic and Investigative Accounting

Legal Framework of Damages
In order to win an award for damages, the injured party must generally prove two points: That the other party was liable for the damage. That the injured party suffered damages as the results of the actions or lack of actions of the offending party. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 265 265

Legal Framework of Damages
Proximate (direct) cause—The damages caused were a direct result of the offending party’s actions or lack of actions. Reasonable certainty—That it is “reasonably certain” that the injured party would have earned the claimed amount of damages “but-for” the actions of the other party. Courts tend not to create profits where none existed before Forseeability—That a prudent person could look into the future and see that the actions of the offending party would damage the other party to the litigation. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 266 266

Two Types of Harm Tort—The occurrence of the harmful act itself is wrongful. Breach of contract—A failure without excuse or justification to fulfill one’s obligations under a contract. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 267 267

Two Types of Damages Restitution—When the harmful act unjustly enriches the defendant at the expense of the plaintiff. Reliance—When the harmful act is fraud and the intent of damages is to restore the plaintiff to the position as if no promises had been made. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 268 268

Damages Calculation Approaches
The out-of-pocket loss refers to the difference between the actual value received and the actual value conveyed. The plaintiff can recover nothing beyond his or her investment. Under the benefit-of-the-bargain theory (or expectations remedy), the damages include not only the money invested but also other expenses such as increased costs, lost profits, and decreased value of the investment. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 269 269

Damages Calculation Example
Debra (defendant) sells Paula (plaintiff) an asset with an alleged value of $2 million for $1.8 million. However, the asset really had a market value of only $1.6 million. The fraud damages can be calculated in two ways: Out-of-pocket loss rule: $1.8 million - $1.6 million = $200,000. Benefit-of-the-bargain rule: $2 million - $1.6 million = $400,000. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 270 270

Lost Profits Methods Before-and-after method—Take sales or sales growth before the act and compare to the comparable figures afterward. Yardstick (or benchmark) method—Compare sales or sales growth of the company to other companies or to other industry averages. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 271 271

Lost Profits Methods “But-for” method—The difference in the estimated profits (but-for the actions of the defendant) and the actual profits. Direct method—Any agreement may indicate how to calculate. Combination method—May use a combination of methods. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 272 272

Economic Framework for the Lost Profits Estimation Process
Macroeconomic analysis. Industry analysis. Company-specific analysis. Financial analysis conclusion. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 273 273

Length of the Loss Period
Projecting lost revenues. Measuring profitability. Mitigation and offsetting profits. Time value of money considerations. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 274 274

Components of Damages Lost profits Lost value Lost cash flows
Lost revenue Extra costs Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 275 275

Defendant’s Damages Estimate
The defendant’s expert report would include his or her damages estimate along with support for the numbers presented. In order to arrive at a “zero” damages estimate, a defendant must demonstrate to the court that the plaintiff suffered no financial damages. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 276 276

Plaintiff’s Damages Estimate
Much of the support for the damages estimate for the plaintiff comes from various accounting records, but the use of those supporting data also shows that damages estimates are both an art and a science. The scientific part is primarily the understanding and appropriate use of accounting information. The art part of the process is in knowing how the accounting information is used in creating components of the damages estimate. (continued on next slide) Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 277 277

Plaintiff’s Damages Estimate
In addition, expert witnesses frequently use many other kinds of information other than traditional accounting records in arriving at and defending damages calculations. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 278 278

Expert’s Journey Through the Legal System
Testimony early in case Pretrial summary judgments Decision to try the case (continued on next slide) Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 279 279

Expert’s Journey Through the Legal System
Defending the expert report Deposition testimony Trial testimony Questioning by client’s attorney Questioning by opposing attorney Preparation for trial testimony Rebuttal testimony Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 280 280

Cost Behavior Defined In its simplest form, cost behavior is the way that cost(s) change with respect to changes in the volume of activity. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 281 281

Developing a Theoretical Model for Damages
Sometimes it is necessary to develop a theoretical model for damages Frequently actual damage calculations are measured against the theoretical model The theoretical framework should be supported by accounting foundations such as Incurred historical costs The matching concept Relevant costs Conservatism Differential or incremental costs Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 282 282

Antitrust Laws Antitrust laws are an outgrowth of the early years of the Industrial Age in the United States when a small number of powerful businessmen used any tactic at their disposal to force competitors out of business. Because such business practices were not in the best interest of the country, federal legislation was passed that prohibits the formation and continuation of monopolies except when in the best interest of the public. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 284 284

Role of Accountants in Antitrust Litigation
Accountants may be called upon to determine whether there is liability under the antitrust laws. The primary issue that forensic accountants address is whether the defendant has engaged in predatory pricing. After liability is proved in an antitrust case, then the forensic accountant will be asked to estimate damages. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 285 285

Predatory Pricing Predatory pricing is the act of pricing a product so low that the only logical explanation is that the pricing is designed to drive competitors out of business. The operational definition is whether a company prices its products or services below “average variable cost” and, if so, predatory pricing is present. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 286 286

Cost Behavior Defined In its simplest form, cost behavior is the way that cost(s) change with respect to changes in the volume of activity. Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 287 287

Common Types of Cost Behavior
Fixed costs Variable costs Mixed costs Semivariable costs Semifixed costs Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 288 288

Cost Behavior Assumptions
Basis of cost behavior estimates Relevant range assumption Time assumption Ways of estimating cost behavior Account analysis method High-low method Regression analysis Engineering or work-measurement method Chapter 1 Chapter 10 Forensic and Investigative Accounting Forensic and Investigative Accounting 289 289

Reasons Why Managers Want to Know About Cost Behavior Patterns
To use in many different types of cost-volume-profit (CVP) analyses. For use in flexible (dynamic) budgeting activities. For use in standard costing, in particular, MOH variance analysis. For use in determining Manufacturing Overhead (MOH) application rates. For use in litigating or defending a wide variety of cost-related legal issues: Federal antitrust cases - predatory pricing. Alleged contractual violations. Measurements of damages for lost sales/profits/etc. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 290 290

Common Types Of Cost Behavior
FIXED COSTS: Costs that fundamentally are not driven by changes in volume. Y = Total Cost Y = a, where a is the amount of fixed cost Common examples of fixed costs - Depreciation, Property taxes, Supervisor salaries Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 291 291

VARIABLE COSTS: Costs that change directly and proportionately with the volume of activity. Y = bX, where b is the slope of the line (the increase in cost relating to the increase in volume) and X is the measure of the volume of activity. Common examples of variable costs - Direct materials, Direct Labor, Sales Commissions Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 292 292

MIXED COSTS: Costs that contain both a fixed and a variable component. Y = a + bX, Where a equals the fixed component and bX is the variable component. Common examples of mixed costs - Some lease agreements, some utility costs, many overhead costs. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 293 293

SEMI-VARIABLE COSTS: Costs that change but not proportionately with the volume of activity. Learning curve costs - are costs that increase at a decreasing rate with the volume of activity. When graphed, learning curve costs slope upward and to the right but not in a straight line; Instead they curve downward. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 294 294

SEMI-FIXED COSTS: Costs that increase in steps or jumps. Also called set function costs Some argue that all fixed costs are step function costs over the long run Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 295 295

Cost Behavior Assumptions
Relevant Range: Cost behavior estimates are usually based on historical cost observations and analyses. If cost behavior characteristics are projected outside of the observed range of activities, the projections may not be accurate. Time assumption: As time passes, the business environment changes, and cost behavior may change as well. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 296 296

Cost Behavior Estimation Methods
Most organizations have very little cost information that is captured and reported by type of cost behavior pattern. In order to determine cost behavior characteristics, accountants must use a variety of methods to estimate cost behavior patterns. EXPERIENCE: Often a working knowledge of a firm’s accounting system will provide some knowledge of the nature of cost behavior in the firm’s accounting system. Merely trying to separate all current cost accounts into fixed and variable costs is usually not a very accurate method of estimating cost behavior. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 297 297

PLOTTING COST DATA: “A picture is worth a 1,000 words”, is an old saying that has some merit in describing cost behavior patterns. It is really easy now to take accounting cost data and use many different software packages to plot data. The resulting graphs can provide a good idea of the general nature of the cost volume relationships, although precise descriptive cost models are not provided. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 298 298

HIGH-LOW METHOD: The highest and lowest costs are identified along with their related volume levels. These are used to estimate fixed and variable costs: Example: Variable cost = $300,000 - $280,000 100,000 un. - 90,000 un. = $20,000 = $2.00 / unit 10,000 un. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 299 299

HIGH-LOW METHOD (cont.) Fixed cost = $300,000 - (100,000 units x $2.00 unit) = $100,000 Total cost = $100, $2.00 X Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 300 300

REGRESSION/CORRELATION ANALYSIS An analytical tool for measuring the degree of association between two or more variables. It is a two-step process: Regression measures the nature of the association between the variables. Correlation measures the strength of the association between the variables. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 301 301

Regression/Correlation Analysis
TYPES OF REGRESSION: Simple Linear Regression or Bi-Variate Regression Two variables: A dependent variable which is usually cost in our analyses. An independent variable or predictor variable which is usually the measure of the volume of activity in our analyses. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 302 302

A positive (+) value for b indicates that the dependent and the independent variables are positively correlated (moving in the same direction). A negative (-) b value indicates that the dependent and the independent variables are moving in opposite directions. (Example, and increase in interest rates is related to a decrease in construction costs.) The a value indicates point where the regression line crosses the “Y” axis. What does a negative? positive? value for a indicate? Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 303 303

The coefficient of determination measures the amount of explained variance (i.e. Of the total variance of the dependent variable about its mean (average) value, the amount of that variance that can be explained by changes in the volume of activity is measured by the coefficient of determination.) For example, a coefficient of determination of .84 or 84% means that 84% of the dependent variable’s total variance can be explained by changes in the volume of activity. Association vs. Causation - Regression/correlation analysis shows the degree of association between variables, but it does not prove causation. Chapter 1 Forensic and Investigative Accounting IES-Tomkins College 304 304

Standard Error of the Estimate: Indicates the variability of the data used in the regression calculations. The greater the variability of the data, the less precision that results from estimates made from the regression data. Point estimates are made and confidence intervals are used to achieve desired levels of precision. t-tables and z tables: Used to provide desired precision levels. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 305 305

Using Regression Analysis for Damages in General
Virtually all cases in which liability is found has a damages phase to the case. Most scenarios require an analysis of what would have happened absent the act that caused the liability. Regression analysis gives an expert a foundation from which to develop and support costs behavior assertions. There is a solid analysis approach which describes the nature of the analysis so the expert can present his/her findings clearly to the jury/judge in order to gain support of the expert’s opinions. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 306

USING REGRESSION/CORRELATION ANALYSIS MULTIPLE REGRESSION More than one independent variable. Most medical research uses multiple regression. Still one “a” value and “r” value. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 307 307

Reasons for the Unexpected
Some of the accounting reasons that regressions may yield unexpected or perplexing results include: When and how allocations are made. The nature of transfer prices in an organization. Entity concept: what part of the business is involved in the case? Accounting policies can make a big difference in cost behavior analysis. Forensic accountants must be adequately informed about the nature and operation of the accounting system for each and every business that they are evaluating. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 308 308

Federal False Claims Act
The Federal False Claims Act was passed to protect the government from the unscrupulous acts of a few government contractors that intentionally or carelessly overcharge the government for goods or services. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 309 309

Federal False Claims Act Litigation
Fraud allegations Whistleblower allegations Qui tam suits Origin Current application The role of the US Justice Department in Qui Tam suits Reasons for bringing action Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 310 310

Accountant’s Role in Federal False Claims Act Litigation
Accountants may act as an expert witness for the defense, the government, or a whistleblower litigating the qui tam parts of the case. The dynamics of FFCA cases can be quite different than typical cases. Accountants have a unique role to play in FFCA cases. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 311 311

Typical questions that accountants help courts to answer are: What costs should be included in the contract? How should costs be measured under the contract? What is the correct timing of the costs and/or revenues under the contract? What accounting concepts, rules, etc., apply under this contract? What is the magnitude of the damages that occurred because of the fraud that took place? Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 312 312

Under the Federal False Claims Act, a person acts knowingly with respect to information if the person has: Actual knowledge of information. Acts in deliberate ignorance of the truth or falsity of the information. Acts in reckless disregard of the truth or falsity of the information. Chapter 1 Chapter 11 Forensic and Investigative Accounting Forensic and Investigative Accounting 313 313

Measuring Damages in Personal Cases
Damage calculations that require additional knowledge and skills (other than those used in commercial damages), include: Wrongful death. Wrongful discharge. Complete or partial disabilities. Divorces. Similar situations that take into account the economic value of persons. Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 315 315

Use of a Forensic Economist or a Forensic Accountant
What does an attorney look for in and expert witness in economic damages cases? What is the nature of the damage calculations? Who is best suited to calculate and explain the damage components? Historically forensic economists have provided most economic damage testimony Now many more forensic accountants are providing economic damages testimony Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 316 316

What is Necessary to Win a Economic Damages Case?
As with any civil litigation case it is necessary to prove: Liability: some wrongful event has occurred, usually a tort As a result of this wrongful event the plaintiff has incurred some measurable damages The plaintiff must present and defend the damage amount The defendant will attempt to reduce or eliminate any damage measure of the plaintiff Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 317 317

General Theory of Economic Damages
The wrongful act of the tortfeaser has caused the plaintiff to be in a different position that he/she otherwise would be Ideally the compensable damages will restore the injured party to his/her previous position Damages will depend upon what the law will allow Different states allow different measures of damages under varying circumstances Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 318 318

Wrongful Death with Dependents
Lost wages Lost benefits Lost services provided to survivors Funeral and administration of the estate Less income that the deceased would have used for consumption Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 319 319

Wrongful Death of a Child
Loss of a child’s services Medical and funeral expenses Cost of counseling for remaining family Non-economic-loss of love and companionship to the end of the last parent’s life Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 320 320

Issues that Impact Amount of Damages in a Personal Injury Case
For a person who has sustained permanent work-related disabilities, the issues that impact the amount of damages that will accrue to the injured person over his or her remaining lifetime include: How long will the person live? What level of injuries were sustained? What is the impact of those injuries on the employee’s remaining work effort and abilities to perform services outside of the workplace? Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 321 321

Calculation of Economic Damages in a Personal Injury Case
For a person who sustains permanent work-related disabilities, the calculation of economic damages would be based on a variety of issues, including: What are the characteristics of that person’s work life? What is the employee’s educational background? What is the employee’s gender? What is the employee’s expected time left in the work force? Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 322 322

Government Data for Analysis and Support
There is a wealth of U.S. Government Data to use in case analysis and support U.S. Department of Labor Bureau of Labor Statistics The Economic Report of the President The U S Census Bureau Statistical Abstract of the United States Other Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 323 323

The Role of Statistical Data in Measuring Economic Damages
Statistical data adds realism and conservatism to economic damage calculations There are many factors that may not be part of a person’s work/life plans that have a statistical probability of occurring Life expectancy Unemployment Earnings trends Injuries Others Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 324 324

Measuring Economic Damages in a Wrongful Discharge Case
Commonly used components for measuring economic damages in a wrongful discharge case include: Lost wages: Earnings history Earnings estimates Royalties Fringe benefits Lost profits. FICA tax payments that employer would have paid. Health insurance premiums that employer would have paid. Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 325 325

Present Value Concepts
Frequently wages and other employee benefits are adjusted for future expected growth. Conversely, amounts that would have been received in the future should be adjusted to their present value. These two processes can have a major impact on the net amount of damages in a case Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 326 326

Determining Growth and Discount Rates
In some states there is a statutory rate of interest for certain types of cases In other situations, the expert is expected to determine and defend an appropriate discount rate Sometimes experts can use statistical data for growth or discount rates Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 327 327

Common Components of Fringe Benefits
Paid health care. Life insurance. Education programs. Payroll taxes (FICA taxes, federal and state unemployment taxes, workers’ compensation taxes). You cannot “double count” damage costs Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 328 328

Measuring Damages for Household Services
When a person is injured or killed, it may be logical to assess the amount of lost household services What amount of services did the person in question provide before the event that caused the loss? What amount of services can the person in question provide after the event? What percent of services was lost? What is the “value” of the lost services? Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 329 329

Examples of Job-Related Costs
Job-related costs need to be deducted form the Damage estimate. Job-related costs are costs that employees incur as the result of their employment. Some examples include: Cost of commuting to work. Union dues. Professional fees. Job-related clothing costs. Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 330 330

Thoughts About Testifying in and Economic Damages Case
Be accurate and complete Know the facts about the case well “Prepare” your own cross examination To the extent that it makes sense show that your analysis in conservative Be truthful Chapter 1 Chapter 12 Forensic and Investigative Accounting Forensic and Investigative Accounting 331 331

Definition of Computer Forensics
Computer forensics is the analysis of electronic data and residual data for the purposes of its recovery, legal preservation, authentication, reconstruction, and presentation to solve or aid in solving technology-based crimes. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 333 333

Digital Forensics Digital forensics is the investigation of all electronic devices such as cell phones, Blackberries, and iPods as well as computers to meet all the collection and preservation goals of computer forensics. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 334 334

SAS No. 99 Guidelines for Testing Digital Data
SAS No. 99 states: In an IT environment, it may be necessary for the auditor to employ computer-assisted audit techniques (for example, report writers, software or data extraction tools, or other system-based techniques) to identify the journal entries or other adjustments to be tested. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 335 335

IT Guidelines under COSO Framework
Guidelines have been established for these areas: Internal control environment Objective setting Event identification Risk assessment Risk response Control activities Information and communication Monitoring Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 336 336

COBIT’s Goals COBIT’s goals are to set control objectives for IT compliance using a strategic planning perspective and at the same time to outline, in detail, the proper procedures to be followed for specific compliance measures. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 337 337

ISO/IEC 1799:2005 Information Technology – Security Techniques
Guidelines published by the International Organization for Standardization and used as standardization for security. They include standards for security policy; the organization of information security; asset management; human resources security; physical and environment security; communication management; access controls; information acquisition; incident management; continuity management; and compliance Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 338 338

Technical Skills for Digital Evidence Collection
Necessary skills are based on the following requirements: Understanding of various operating systems Quickly identifying pertinent digital data Properly preserving data Properly securing data Properly collecting data Maintaining a proper chain of custody Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 339 339

Forensic Investigative Tools
Imaging software: EnCase SafeBack Data extraction or data mining software: ACL Data Extraction and Analysis (IDEA) Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 340 340

Data Mining Strategies
Link Analysis: Identify correlations in the database Case Base Reasoning: Associations with past data Sequence Analysis: Relationships based on timelines Cluster Analysis: Separating groups into their distinctive characteristics Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 341 341

Zipf’s Law Uses frequency distributions to identify anomalies that may be an indicator of financial fraud. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 342 342

Audit Trails Computer logs found in software such as PeopleSoft and SAP can be used to trace the activities of employees to determine if they are following unauthorized policies that may be an indicator of fraudulent activity. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 343 343

Log Parsers Log Parsers are utility programs that allow the investigator to be able to format raw log entries into a format that is useful for an investigation. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 344 344

Conclusions Expanded methods to standardize security policies are being made in an attempt ot make it more difficult for cybercrimes to attack the financial databases of companies. The passage of time will determine the success of these methods. Chapter 1 Chapter 13 Forensic and Investigative Accounting Forensic and Investigative Accounting 345 345

Hacker Defined A hacker is generally defined as an individual or group whose intent is to gain access to a computer network for malicious purposes. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 347 347

Collecting Clues and Evidence
A forensic investigator needs to be familiar with the protocols used on the Internet to be able to collect clues about either internal or external attackers. In addition, when law enforcement officials send requests or subpoenas for information about a company’s logs, the forensic analyst must understand the type of information being sought. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 348 348

Protocols Internet protocols are those rules allowing different operating systems and machines to communicate with one another over the Internet. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 349 349

Transmission Control Protocol (TCP) and Internet Protocol (IP)
TCP/IP protocols are the communication guidelines used and widely supported over the Internet. Almost every packet of information sent over the Internet uses the datagrams contained within a TCP/IP envelope. The datagrams consist of layers of information needed to verify the packet and get the information from the sender’s to the receiver’s location following traffic control guidelines. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 350 350

Message encapsulation is used in sending the packets. In message encapsulation, each layer of information in the sent packet is interpreted by the same layer at the receiving end of the transmission. Additionally, each layer can only communicate with the one directly above or below it. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 351 351

Layered Operating System Interconnection (OSI) Model Application Layer Transportation Layer Network Layer Data Link Layer Hardware Layer Electronic Impulse Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 352 352

The application layer issues the commands that define the operations. The transportation layer functions to provide reliable message delivery. The network layer controls the route the data takes to get to its destination. (continued on next slide) Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 353 353

The data link layer transfers the datagram from one network node to another. The hardware layer (or physical layer) provides the means of sending and receiving data on a network by converting bits into voltages for transmission to a coax cable. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 354 354

IP Address Defined An IP address is a 32-bit number (four bytes) that identifies the sender and recipient who is sending or receiving a packet of information over the Internet. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 355 355

New Version of IP Addresses
IPv4 is being replaced with IPv6. The reason for the change is that the 32 bit version has run out of IP addresses. IPv6 uses 64-bits. IPv6 provides for approximately 340,282,366,920,938,000,000,000,000, 000,000,000,000 unique IP addresses. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 356 356

Web Log Entries One important method for finding the web trail of an attacker is in examining web logs. Recorded network logs provide information needed to trace all website usage. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 357 357

Web Log Entries Information provided in a log includes the visitor’s IP address, geographical location, the actions the visitor performs on the site, browser type, time on page, and the site the visitor used before arriving. Logs should be stored on a separate computer from the web server hosting the site so they cannot be easily altered. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 358 358

TCPDUMP TCPDUMP is a form of network sniffer that can disclose most of the information contained in a TCP/IP packet. A sniffer is a program used to secretly capture datagrams moving across a network and disclose the information contained in the datagram’s network protocols. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 359 359

Decoding Simple Mail Transfer Protocol (SMTP)
SMTP is the protocol used to send over the Internet. SMTP server logs can be used to check the path of the from the sending host to the receiving host. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 360 360

Decoding Simple Mail Transfer Protocol (SMTP)
Most of the important information about the origin of an message is in the long form of the header. The most important data for tracing purposes is the IP addresses and the message ID. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 361 361

Tracing and Decoding IP Addresses
Traceroute Whois Ping Finger searches Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 362 362

Narrowing the Search Preliminary Incident Response Form
John Doe subpoena Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 363 363

Forensic Audit The forensic audit is an audit performed to determine whether fraud is being committed in the executive boardroom. The monitoring methods used in a forensic audit are investigative, directed at top-level executives, and do not rely on a traditional accounting audit practices. Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 364 364

Due Diligence Searches
Internet databases General searches Name, telephone number, and address search engines Internet relay chat (IRC), FTP, and Listserv searches Usenet postings search Legal records Instant messaging (IM) Web page searches Government data searches Miscellaneous searches Chapter 1 Chapter 14 Forensic and Investigative Accounting Forensic and Investigative Accounting 365 365

Introduction to Cybercrime
Most common complaints: Virus attacks % Insider abuse of net access % Laptop/mobile theft % Unauthorized access to information % Denial of service % System penetration % Abuse of wireless network… % Financial Fraud …… % Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 367 367

Net Frauds Net frauds ensnare unsuspecting Internet users into giving up their resources to an online criminal. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 368 368

Unauthorized Access to Network Assets
Unauthorized access to steal proprietary information can be considered a distinct crime from fraud. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 369 369

Types of Unauthorized Access
Access using wardialers in modem attacks. Access via buggy software. Access via trusted server. Backdoor entry. Access via social engineering. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 370 370

Intangible Assets Information on the Internet and in computer databases represents intangible assets composed of bits and bytes. The destruction of electronic representations or the erasure of data without physically damaging a tangible computer asset may not be considered a crime. (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 371 371

Intangible Assets If data is accessed but not used for any purpose, then no crime may have been committed. Statutes may not provide for the recognition of criminal trespass, a property crime, based on a virtual presence (and no physical presence). Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 372 372

1986 OECD Time Capsule Recommendations
The input, alteration, erasure and/or suppression of computer data and/or computer programmes made willfully with the intent to commit an illegal transfer of funds or of another thing of value; The input, alteration, erasure and/or suppression of computer data and/or computer programmes made willfully with the intent to commit a forgery; (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 373 373

The input, alteration, erasure and/or suppression of computer data and/or computer programmes, or other interference with computer systems, made willfully with the intent to hinder the functioning of a computer and/or telecommunication system; The infringement of the exclusive right of the owner of a protected computer programme with the intent to exploit commercially the programme and put it on the market; (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 374 374

The access to or the interception of a computer and/or telecommunication system made knowingly and without the authorization of the person responsible for the system, either (i) by infringement of security measures or (ii) for other dishonest or harmful intentions. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 375 375

Cybercrime or Not? Spoofing. Use of bots. Chaffing. Steganography.
Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 376 376

International Law Although approximately 240 countries have IP domain registrations, the countries with cybercrime statutes are fewer. Some countries have broad provisions for computer crimes, some have limited provisions, and still some have no provisions at all. (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 377 377

International Law In 2001, the Council of Europe Convention on Cybercrime issued a model law for its member states including transactional cooperation recommendations. The Council’s model law has 48 sections for incorporation into national laws on cybercrime. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 378 378

Federal Statutes Related to Cybercrimes
18 U.S.C. 1029 Fraud and Related Activity in Connection with Access Devices 18 U.S.C. 1030 Fraud and Related Activity in Connection with Computers 18 U.S.C. 2701 Unlawful Access to Stored Communications Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 379 379

USA Patriot Act of 2001 The USA Patriot Act has strengthened U.S. cyber laws and expanded cybercrime definitions. Under the Act, an activity covered by the law is considered a crime if it causes a loss exceeding $5,000, impairment of medical records, harm to a person, or threat to public safety. (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 380 380

USA Patriot Act of 2001 Amendments made by the Act make it easier for an Internet service provider (ISP) to make disclosures about unlawful customer actions without the threat of civil liability to the ISP. Another revision made by the Act provides that victims of hackers can request law enforcement help in monitoring trespassers on their computer systems. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 381 381

Draft Legislation: Cybersecurity Act of 2009
Gives the President power to shut down the Internet in case of an national emergency Sets national standards for cybersecurity and qualifications for cybersecurity professionals The legislation is still pending. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 382 382

State Legislation Many of the states have separately enacted money laundering, identity theft, online gambling, cyberstalking and other Internet statutes in their codes. Many statutes do not refer to “cybercrimes” as they were originally enacted when there was no Internet. Thus, legislative oversight in the acts tends to focus on “computer crimes,” “unlawful access,” or “property crimes.” Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 383 383

Fighting Cybercrime The following list describes the skill set needed to fight cybercrime: Ability to build an Internet audit trail. Skills needed to collect “usable” courtroom electronic evidence. Ability to trace an unauthorized system user. (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 384 384

Fighting Cybercrime Knowledge base to use in recommending or reviewing security policies. Knowledge of the most recent computer fraud techniques. Basic understanding of the information that can be collected from various computer logs. Ability to place a valuation on incurred losses from attacks. (continued on next slide) Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 385 385

Fighting Cybercrime Technical familiarity with the Internet, web servers, firewalls, attack methodologies, security procedures, and penetration testing. Understanding of organizational and legal protocols in incident handling to prevent employee rights violations. An established relationship with law enforcement agencies. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 386 386

Filing Reports of Cybercrimes
An investigator should know where, besides law enforcement, such crimes can be reported. There are a number of websites that collect information about events that may be cybercrimes. Chapter 1 Chapter 15 Forensic and Investigative Accounting Forensic and Investigative Accounting 387 387

Reasons to Quantify Loss
To report the crime to law enforcement. To recover damages under an insurance policy. To record for internal purposes. Chapter 1 Forensic and Investigative Accounting

Extent of the Problem In 2006, the annual Computer Crime and Security Survey of high-tech and financial corporations found: $241,150 was the average loss with the largest loss set at $40M. The most detectable crimes noted by the respondents were insider abuse, laptop theft, and virus or worm infections. Twenty percent of respondents experienced rootkit or Trojan infections. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Extent of the Problem Eighty-three percent of the attacks originated from outside the organization. Financial losses from breach of confidential information averaged $2M. Over the previous year, there had been a doubling in the percent of attacks launched for “illicit financial gain.” (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Extent of the Problem A notable change in 2006 was the increase in Trojan and rootkit attacks used to steal Internet banking and other passwords, or other personal information. The source point for these attacks are the companies' point of Internet access. A large percentage of the attacks in 2006 were conducted to simply create malicious damage. Chapter 1 Forensic and Investigative Accounting

State Statutes Describing Losses
The following factors are shown as remediable activities and loss classifications: Verification costs to check systems (diagnosis–remediation). Restoration costs to put systems back online (testing). Market value or replacement value of the property destroyed or services. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

State Statutes Describing Losses
Lost profits. Reasonable value of loss caused by “unavailability.” Investigation costs. Past or future losses. Injury suffered. Loss of computer time (lost productivity). Cost of replacing lost data. Chapter 1 Forensic and Investigative Accounting

Federal Identification of Damage Losses
The federal government identifies the following damage losses in cyber attacks: Responding to an attack. Costs of making a damage assessment. Time and costs of restoring the system. Loss of revenues from the interruption. “Other damages” related to an interruption of service. Chapter 1 Forensic and Investigative Accounting

Examples of Tangible Losses
Market value or replacement cost of property destroyed in attack. External investigation costs. Lost worker productivity. Cost of replacing lost data. Chapter 1 Forensic and Investigative Accounting

Productivity Losses Productivity losses arise from the reduction of efficient, “normal” production of work due to an event such as a cyber attack. Chapter 1 Forensic and Investigative Accounting

Examples of Intangible Losses
Unavailability of a website. Lost profits. General injury. Destroyed or lost information contained on compromised PCs. Loss of optioned opportunities. Chapter 1 Forensic and Investigative Accounting

Costs and Types of Insurance Coverage
First-party liability coverage is for direct damage to the insured from a cyber attack. Third-party liability provides coverage from the negligent acts of the insured as, for example, when the insured’s computers are unknowingly used to launch an attack against a primary target. Premiums for these policies can cost $20,000 to $40,000 annually for coverage up to $50 million each. Chapter 1 Forensic and Investigative Accounting

First-Party Cyber Insurance
First-party cyber insurance usually includes coverage of losses from: Malicious destruction or alteration of information. Theft of data such as credit card numbers. Lost business income up to 12 months after the attack. Extortion from threats such as introducing viruses into a network. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Introducing fraudulent information into a network. Defamation. Cost to repair and replace data. Unintentional virus transmission. Denial of service attacks. IP infringement from website squatters. Illegitimate use of network. Defacement of a website and related losses. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

Coverage of extra expense incurred during a disruption. External consultant fees. Intellectual property infringement from the disclosure of trade secrets. Rehabilitation expenses to reestablish the insured’s reputation and market share. Crisis communication expenses with clients to provide assurances the system is reliable and safe. Chapter 1 Forensic and Investigative Accounting

Seeking Insurance Coverage
Qualifying for coverage Risk survey Security audit What insureds should know about coverage Third-party lawsuits Intangible losses Chapter 1 Forensic and Investigative Accounting

Valuation and Appraiser Accreditations
Business appraisers have traditionally come from either a finance or accounting background. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 405 405

The following certifications are offered: Accredited Senior Appraiser (ASA) and Accredited Member (AM) awarded by the American Society of Appraisers (ASA). Certified Business Appraiser (CBA) awarded by the Institute of Business Appraisers (IBA). (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 406 406

Certified Valuation Analyst (CVA) awarded by the National Association of Certified Valuation Analysts (NACVA). Accredited in Business Valuation (ABV) awarded by the American Institute of Certified Public Accountants (AICPA). Chartered Financial Analyst (CFA) awarded by the Association for Investment Management and Research (AIMR). Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 407 407

Engagement Agreements
An engagement agreement is necessary in any valuation or client-related undertaking because it: Clearly sets forth the expectations of the business valuator and client. Reduces the chance for misunderstanding and, therefore, the risk of malpractice litigation and claims against the business valuator. Increases the likelihood of the valuator being paid, since it establishes a clear obligation on behalf of the client. (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 408 408

The following specifics need to be considered in drafting an engagement agreement: Identify the client. Specify the interest, date, purpose, and intended use of the valuation. Define the standard of value. (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 409 409

Assign responsibility for fees and costs. Price the engagement. Specify responsibility for real estate and other appraisal costs. Obtain a retainer. Protect against the use and misuse of forecasts by clients. Include indemnification language. Include other terms and conditions. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 410 410

Purposes for Obtaining Business Valuations
Tax purposes. Divorce distributions. Liquidations. Employee stock ownership plans (ESOPs). Lost profit analyses. Mergers and acquisitions. Minority shareholder distributions. Buy-sell agreements. Bankruptcies. Recapitalizations. Management buyouts. Allocations of purchase price. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 411 411

General Types of Valuations
Asset-based approach—This type of valuation is used to value asset-intensive businesses such as retail and manufacturing. The focus is on what the equipment and real estate are worth. Income approach—This type of valuation is useful for service companies. The focus is on how much money a buyer can make from the business. (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 412 412

General Types of Valuations
Market approach—This type of valuation looks at what the market is paying for similar businesses and is used to value many different types of businesses. The focus is on the marketplace: what others have paid for similar companies. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 413 413

Standards of Value Fair market value.
Fair value—100 percent controlling interest value. Fair value—minority interest and marketable value. Fair value—minority interest but nonmarketable. Investment value. Intrinsic value. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 414 414

Income Approach Capitalization of income method.
Discounted future income method. Discounted future cash flow method. Capitalization of excess earnings method. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 415 415

Market Approach Guideline (public company) method. Market data method.
Past transactions method. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 416 416

Cost Approach Book value (not really a valuation method).
Adjusted book value (adjusted net asset value). Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 417 417

Gathering Initial Information
Goals of pre-engagement phone contact include: Develop trust and rapport. Gain a brief understanding of the business. Determine who will be responsible for gathering information. Explain the valuation process and timing. Determine methods of corresponding with the client. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 418 418

Discerning What Data Is Required
Request forecasts of future financial results. Review articles on industry-related valuation issues. Request client information prior to company interviews. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 419 419

Spreading Financial Statements
Financial spreadsheet reports include: Actual and common-sized income statements. Actual and common-sized balance sheets. Financial statement ratios. Trend statements. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 420 420

Analyzing Financial Statements for Trends and Risks
The purpose of analyzing a company’s historic financial statements is to provide information about these factors that are crucial in the preparation of a valid valuation: Trends and what they say about the possible future. How well or how poorly a company performs compared to industry peers. Key elements of company strategy. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 421 421

Income Statement Profitability Analysis
Income statement profitability analysis helps valuators determine the following: Judgments about the historic performance of the company and the variability of results. Results against which to assess management’s strengths and weaknesses, and how this would impact an investor’s perception of the shares as an investment, and their associated risk. (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 422 422

Income Statement Profitability Analysis
An objective basis for comparing a company’s performance relative to its industry peers. Insight into a company’s economics and how the business achieves its net profit on a given level of revenues. Clues concerning the internal and external forces that affect the business, and what this suggests about risk, future threats, and opportunities. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 423 423

Income Statement Analysis
Revenues Past trends. Growth rates. Variability in individual annual results. Overall observed results. Identification of the appropriate questions. Gross profits Components of goods sold. Calculation of goods sold. (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 424 424

Income Statement Analysis
Operating expenses. Operating profits. Other income and expense. Pretax profitability. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 425 425

Business Valuation Standards
Uniform Standards or Professional Appraisal Practice (USPAP) from The Appraisal Foundation Code of Professional Conduct from the American Institute of Certified Public Accountants (AICPA) Statement of Financial Accounting Standards No. 157 from the Financial Accounting Standards Board (FASB) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 426 426

Features of the Standards
Independence. Fee not contingent on appraised value. Limiting conditions. Professionals participating in the assignment. Information sources used. Report content. Data collection and analysis. Methodology. Reconciliation of findings of value. Adjustments to valuation findings. Conclusion of value. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 427 427

Report Content Purpose and scope of the assignment.
Standard of value used. Identification of the specific interest being valued. Specific valuation date used. Relevant state law governing the entity. Scope of the valuation report. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 428 428

Organization of the Report
Front pages Cover sheet (with company name and valuation date) Transmittal letter Table of contents Introduction Company information Financial condition Valuation methodology (continued on next slide) Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 429 429

Organization of the Report
Valuation conclusion Exhibits Limiting conditions Definitions of valuation terms Qualifications of the valuation professionals who worked on the report Common size balance sheets of the company Common size income statements of the company Ratio analysis of the company Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 430 430

Standards of Valuation
The are a number of standards that may be applied to valuation engagements The Uniform Standards of Professional Appraisal Practice (USPAP) Codifies many common sense standards of professional appraisers American Institute of Certified Public Accountants (AICPA) Issues more general standards of valuation as it relates to the braod activities of CPAs Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 431

Statement of Financial Accounting Standards No. 157
This standard address the issue of “fair Value Measurements” It defines Fair Value Establishes a framework for measuring value in in GAAP Relates fair value to publications issued by the FASB Concepts Statements No. 2, No. 6, and No. 7 Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 432

Guidelines for Preparing to Testify
Review and update your resume. Know and understand the facts of the case. Anticipate and prepare answers for expected difficult questions at deposition and cross examination. Understand all information and calculations in the expert report. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 433

Guidelines for Preparing to Testify
Carefully prepare for deposition testimony. Be certain there are no conflicts of interest. The expert must testify so that court can clearly understand the issues in the expert’s testimony. Chapter 1 Chapter 17 Forensic and Investigative Accounting Forensic and Investigative Accounting 434

Questions Answered by Fraud Investigation
Who had the opportunity to commit fraudulent activity? How and when was the fraud committed? What was taken (how much money was lost)? Where were the assets moved (how were the assets converted to the benefit of the perpetrator)? Why was the activity intentional, rather than accidental, or the result of mistake or misunderstanding? Chapter 1 Forensic and Investigative Accounting

Accounting Anomalies Accounting anomalies often signal the presence of fraud. Examples of accounting anomalies include: Irregularities in source documents (e.g., missing documents, excessive voids or credits, common names or addresses of customers, increases in past due receivables, increased reconciling of items, etc.). Faulty journal entries. Inaccuracies in ledgers. Chapter 1 Forensic and Investigative Accounting

Internal Control Weaknesses
Lack of segregation of duties Lack of physical safeguards Lack of independent checks Lack of proper authorization Lack of proper documents and records Overriding of existing controls Inadequate accounting system Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships What Was Taken? $6 million USD of inventory missing from the Shanghai warehouse. $6 million USD cash associated with sales to customers. $5 million USD of accounts receivable (70% of which was for sales that were claimed never to have occurred) associated with customers claiming never to have ordered any inventory. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships Who Had the Opportunity? Hong Wu, the sales manager in Shanghai who was responsible for sales. Daqing Yang, the logistics manager for the Shanghai warehouse. Xiang Chu, accounting manager who made accounting entries and deposits. Alex Richards, Wu’s and Yang’s supervisor. Grant Williams, Chu’s supervisor. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships How Were the Assets Moved? Individuals—likely not actual customers—picked up inventory from the warehouse, sometimes without the need for required documentation. Logistics manager released inventory to individuals (supposedly customers) for cash. Cash was transferred from Yang to Wu. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships How Was the Theft Concealed? Wu attributed all/some of cash received by legitimate customers to other customers—some of which would have been used as down payments for other fictitious/improper sales. Part of cash received from individuals for inventory used to account for actual sales and part of cash withheld by Yang and Wu. (continued on next slide) Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships How Was the Theft Concealed? (continued) Sales made to future customers could have been made for amounts below those approved by TruGloss Shanghai JV. Yang and Wu could have involved Chu, Richards, and/or Williams to help ensure that fraud was not detected. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships How Were the Assets Converted? Inventory sold to individuals (who are not actual customers) at below market prices for cash—not possible to trace payments originating from certain customers to accounting transactions (because of the nature of a cash transaction). Yang and Wu may have laundered cash. Lapping of accounts receivable enabled turnover to occur until fraud detected. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships What Were the Red Flag Symptoms? Better than expected growth relative to local competition. Lack of proper separation of duties for operations, custody, accounting, and monitoring of assets. Insufficient oversight of operational employees. Above average performance for one segment of the joint venture, involving only a few individuals. Sales of inventory for cash at the warehouse, often without necessary documentation. High concentrations of repeat customers for one segment of the joint venture. Increase in accounts receivable aging. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships What Pressures and Rationalization Might Have Motivated the Frauds? None—perpetrators could be sociopathic fraud perpetrators—TruGloss Shanghai happens to be the latest victim. Financial pressures on any individual: Wu, Yang, Chu, Richards, and/or Williams. Pressure to achieve growth targets in a new market. Competitive pressure among sales or logistics managers. Belief that other competitors are conducting business in the same fashion. Culturally acceptable to conduct sales based on cash transactions at warehouse locations, regardless of internal controls imposed by partner from the United States. Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships What Key Internal Controls Could Have Prevented or Detected the Fraud? Background checks of managers at TruGloss Shanghai JV. Proper oversight by General Manager (Richards) and Finance Manager (Williams). Completion of required monitoring mechanism (i.e., internal audits) as required by policy. Insistence by accounting managers that no transaction be recorded without proper documentation and approval. Periodic and diligent comparisons of the joint venture to local competition and other international joint ventures—are the results at TruGloss Shanghai “too good to be true”? (continued on next slide) Chapter 1 Forensic and Investigative Accounting

TruGloss Shanghai JV: Unusual or Unrealistic Procedures and Relationships What Key Internal Controls Could Have Prevented or Detected the Fraud? (continued) Periodic monitoring and follow-up for aged accounts receivable. Required physical counts of inventories and mandatory reconciliations. Periodic analysis of gross margins and any other key ratios based on recorded amounts. Mandatory vacations for all management positions. Chapter 1 Forensic and Investigative Accounting

Tallahassee BeanCounters: Problem-Based Learning to Ask the Right Questions Questions to answer with respect to the potential or likely fraud circumstances in this case: Who could have committed a fraud? How could the fraud have been committed? Evidence of intent (which can be shown by repeated instances of taking). Economic impact (difference in reported and actual revenue, plus (if negative) underpaid sales tax (to the state) and arena rent (to the stadium owner) must be included as total loss due to theft. Evidence of conversion tracing funds to “dummy” (usually bank) account of employee suspect under a different, or possibly assumed, name. Chapter 1 Forensic and Investigative Accounting

Tallahassee BeanCounters: The Fraud Schemes
Ghost employee fraud Ticket fraud Equipment purchase fraud Chapter 1 Forensic and Investigative Accounting

Forensic and Investigative Accounting

Similar presentations

Presentation on theme: "Forensic and Investigative Accounting"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Forensic and Investigative Accounting

Similar presentations

Presentation on theme: "Forensic and Investigative Accounting"— Presentation transcript:

Similar presentations

About project

Feedback