Insights
The term forensic accounting is often misused and misunderstood.
Tell someone you are a forensic accountant, and the response typically is: “So, like CSI[1] on television!” Sort of. But forensic accountants investigate numbers instead of murders and dead bodies.
However, the practice of forensic accounting can be just as fascinating. Furthermore, performing forensic analyses can be some of the most rewarding, but also the most challenging work for a professional accountant. For instance, as a forensic accountant the author has traced assets belonging to Holocaust victims, testified in litigations where the continuance of the company was at stake, worked as a special master[2], investigated Ponzi schemes[3], managed teams involved in billion-dollar litigations, analyzed large bank frauds, worked with the FBI and the U.S. Department of Justice in white-collar criminal matters, and testified in a televised murder trial.
The AICPA (the governing body of professional accountancy in the United States) defines forensic accounting as “…the application of specialized knowledge and investigative skills possessed by CPAs to collect, analyze, and evaluate evidential matter, and to interpret and communicate findings in the courtroom, boardroom or other legal or administrative venue.”[4] Therefore, professional accountants, mostly CPAs, conduct forensic accounting engagements. A subcategory of forensic accounting is fraud examination, which may be conducted by either accountants, nonaccountants or Certified Fraud Examiners (also referred to as “analysts” throughout this discussion).
A quick look at the business press over the past year produces numerous articles on financial statement frauds, corporate investigations, asset misappropriations, public corruption, and a host of other occupational frauds.[5] In fact, the ACFE (Association of Certified Fraud Examiners) reported in its 2020 Global Study on Occupational Fraud and Abuse, Report to the Nations, that fraud is a global problem affecting all organizations worldwide. The 2020 study, covering 2,504 cases from 125 countries, found fraud caused total losses exceeding $3.6 billion USD.[6] These numbers do not appear to be decreasing even with additional resources allocated at the corporate level and the passing of 20 years since the Sarbanes-Oxley Act (“SOX”)[7] became law.
When forensic accountants investigate allegations of misconduct or fraud within businesses, those investigations are often referred to as internal investigations. This paper provides a practical guide to conducting forensic accounting and internal investigations and offers some real-world examples. It addresses what to do once you discover an issue (or are retained to investigate an issue) from the perspective of the analyst. Additionally, the best practices at different stages of a forensic accounting investigation are delineated, including:
A forensic accounting investigation accomplishes several important tasks. It assists triers of fact in understanding the financial analysis and the quantification of damages. Some investigations may extend to rooting out corruption in governmental and business organizations which may ultimately bring criminals to justice.
In most forensic engagements, an interested party wants an answer to three primary questions:
Other than internal investigations, forensic accountants may be retained for other types of forensic accounting assignments. Some may already be in litigation, and an expert is needed to provide an analysis on the quantification of damages. These include but not limited to the following examples:
Other types of engagements include investigations of suspicion of fraud. For example, a governmental agency or business entity has a suspicion (or in some cases a confirmation) that some type of fraud has occurred in the organization. Forensic accountants or analysts are frequently retained to assist in the investigation of such frauds. In some instances, the analyst will be retained directly by the organization, while in other instances outside legal counsel retains the specialists.[8] Examples of fraud examinations include:
According to the ACFE, fraud examinations can also address other organizational objectives, including[10]:
There are infinite types of forensic accounting engagements. Most are classified as either accounting or nonaccounting, litigation or nonlitigation; and fraud or nonfraud. While there is certainly overlap within these groups, the primary reason for the classification system is to make certain that the assembled professional team is both qualified and has the specialized knowledge to complete the assignment. For example, if the assignment relates to financial statement fraud, the team is going to require accounting expertise. Further, if there is a fraud component, the team will also require someone with experience interviewing financial personnel.
Finally, the analyst should assume that any assignment may end in litigation and therefore should consider whether he or she would make a credible witness in the case. If the answer to that question is no; the analyst should either reject the assignment or add someone to the team that would serve as a potential expert witness.
The analyst should also consider which (if any) professional standards might apply to the assignment. Credentialed accountants, valuation experts, and fraud professionals all have separate professional organizations with different sets of standards. CPAs should consider the following processional standards:
The valuation profession follows the Uniform Standards of Professional Appraisal Practice (“USPAP”), which is the recognized ethical and performance standards for the appraisal profession in the United States. Certified Fraud Examiners are regulated by the Association of Certified Fraud Examiners Code of Professional Ethics and Code of Professional Standards. It is the analyst’s responsibility to know and to follow which standards apply to any assignment.
Prior to accepting any assignment, analysts should make certain that they, or their firm, have no conflicts of interest. Generally, analysts should examine the company, key executives, and any potential targets for conflicts. The AICPA provides guidance on conflicts in the Forensic & Valuation Services Section Special Report 08-1: Independence and Integrity and Objectivity in Performing Forensic and Valuation Services.
It is always a best practice to have an engagement letter with the client, preferably with the outside legal counsel representing the organization. It is also important, in general terms, to outline the nature and professional standards governing the assignment. If these issues are not addressed, the client may incorrectly assume that the forensic accountant is providing some type of assurance (such as an “audit” or a “review”). Unless such assurances are being provided, the analyst (even a nonaccountant) should avoid using terms like “audit” and “review” in engagement letters, working papers, and client correspondence. The AICPA provides additional guidance on engagement letters in the Forensic & Valuation Services Practice Aid 04-1: Engagement Letters for Litigation Services.
Once retained by the client, the analyst should develop a scope of work for the assignment. At the beginning of the assignment, a high-level work plan should suffice. This plan may be expanded and refined as additional facts are discovered and analyses performed. It is important to keep outside legal counsel appraised (assuming the client heeded the analyst’s advice to hire outside counsel) of the progress of the work and informed of any changes in scope. This communication should help create a team environment and ease tensions when an invoice is submitted.
Analysts are independent experts, and therefore they should not be influenced by the client or outside legal counsel’s need to control the scope of the assignment, and sometimes go as far as requesting the analyst to issue a report of “no findings.” If the analyst is placed in this predicament, he or she should consider resigning from the assignment.
Taking the time to understand the required professional standards, properly staff the assignment, investigate potential conflicts, prepare effective engagement letters, develop efficient work plans, and communicate with outside counsel will result in conducting a successful forensic accounting assignment.
Clients are often concerned about the costs of engagements and analysts need to address that concern effectively. More often than not, one of the first questions a client may have is: “How much is this going to cost?” While estimating that number is very difficult in litigation settings, it is virtually impossible in fraud investigations.
The Cost of Collusion
At the beginning of an engagement, the analyst doesn’t know how deep the rabbit hole goes. What starts with an anonymous tip[13] from one employee, may turn into collusion with multiple employees, all of whom will then need to be investigated. Thus, affecting the analyst’s scope of work and its costs.
Collusion creates other more significant problems. It overrides internal controls, systems access, and ordinarily solid processes and procedures. Additionally, if the assignment is with a public company and the fraud touches an employee that the outside auditor relied upon in conducting the audit or internal control review, the outside auditors are likely going to be concerned about the reliability of their audit and wish to conduct some type of shadow investigation. Such an investigation is going to require periodic reporting, and additional time, from the forensic accountant.
Example: An investigation was launched into a large manufacturing conglomerate which related to a financial statement fraud. The investigation showed that the CFO conspired with the division heads to falsify account records in order to maximize bonus pools. Collusion between senior employees creates roadblocks for the analysts which makes fraud investigations difficult to solve and costly to complete.
Other Roadblocks: When Individuals Lie
People are going to lie, which will slow down a probe. There are situations in which employees lie to cover up office affairs, where assistants lie to cover for their bosses, and controllers lie to cover for their business units. The most effective way to combat this behavior is to analyze the evidence, the data and to effectively interview employees. One effective way is confronting liars by showing them the data and evidence that they are refuting. Sometimes this the quickest way to get to the truth. Once the interviewee realizes the analyst has done the necessary due diligence, he or she is boxed in and has to be much more truthful giving answers.
Example: Several years ago, the corporate controller for a major division of a Fortune 500 company was being interviewed in a fraud case. The company received a whistleblower complaint from its internal fraud hotline stating that the division was fraudulently overstating its operating results. On the morning of Day One of the investigation, the controller sat in the conference room, lined with the leather-bound volumes of internal controls, process and procedures documents required under SOX, and said his books were perfectly clean and accurate. On the afternoon of Day Three, after several interviews, the analysis of several hundred transactions, and a list of thirty or so written questions about certain end of the month journal entries, the same controller walked into the same conference room and confessed to the fraud. Because of his title and his longevity in the organization, he was able to override any of the existing internal controls. The SOX documents were worthless. When asked why he was confessing, he confided that he knew once the right questions were asked that the fraud would eventually be discovered. It was only a matter of time until his fraud would be uncovered. He said he could not sleep at night. Analysts need to be consistent and skeptical in their investigation, and they will eventually find the answers.
E-records
Finally, electronic record keeping has made fraud investigations infinitely more complicated. Twenty years ago, an investigator might have looked through file cabinets located in an executive’s office in search for answers. But today, there are file servers, email systems, shared drives, text messages, and chat rooms. Many businesses retain their data– forever! So, all of it should be analyzed for relevancy. And even with computer tools, SQL databases, and structured data and computer analytics professionals doing the work, this analysis takes time and is expensive.
Example: An employee was suspected of skimming money from her employer, when confronted, she denied the allegations. Her company emails were pulled - along with her voice mail messages, text messages, and group chats from her company server. She did not know that the company saved the metadata from the instant messages she sent through her work computer. Those messages not only showed how she was skimming the money, but also showed she was spending a significant amount of it on her boss, with whom she was also having an affair. The company terminated both employees and referred the case to local law enforcement for prosecution.
The best recommendation on how to manage client’s expectations and engagement costs is by utilizing a phased approach. Do this by creating an approach memorandum (or work plan) at the beginning of each forensic investigation. At a high level, the memorandum outlines the steps of the investigation and its estimated cost. At the end of every week, revise the memorandum, update the estimates, and circulate the updates to counsel and/or the client. This process keeps everyone on the same page and minimizes any “sticker shock” for future billings.
Preliminary Assessment
It is generally appropriate to conduct some type of preliminary assessment at the beginning of any forensics investigation. This may include:
In many instances, the assessment requires the interaction of the forensic analyst with employees of the accounting and finance department of the company. Care must be taken during these interactions as the accounting and finance departments are often the targets of the investigation – and news travels fast, even in very large organizations. In this type of environment, the analyst should make an introduction as a member of the external audit team (with prior notification of counsel).
The AICPA provides the following questions that may assist with the assessment[16]:
Subsequent to the preliminary assessment, the analyst should update the approach memorandum and consider any necessary changes to the team structure. Team changes are generally made because of complex accounting issues, specific industry expertise requirements, and electronic data issues.
Working Papers
It is imperative that the analyst retain a complete set of working papers prepared during the investigation. That is not to say that all notes, schedules, and other documents should be retained. Instead, determine whether notes or other materials are relevant to the investigation. If so, the notes should be formed into a memorandum or other document. If not, the materials should be discarded. This is especially important for interview memorandums. The purpose of the interview memorandum is not to transcribe everything said during the interview, but rather to summarize the relevant content. It is permissible to quote the interviewee for particularly important details.
In the event the analyst takes possession of original documents, it is important that the proper chain of custody be maintained to ensure preservation of the evidence[17]. This is particularly important for documents with original signatures or items like cancelled checks, computer hard drives, etc.
Communication
Communication should be directed to the client, whether that client is outside legal counsel or company management. In some cases, the client may be the company’s board of directors or audit committee. As noted above, it is always preferable for the client in forensic investigations to be legal counsel. That way if the analyst determines there is collusion or management involvement in the fraud, the analyst has an unbiased communication partner. If company management is the client, it is best to have management involve the board of directors or audit committee early in the assignment for the same reasons.
Finally, at some point in the investigation, the analyst and the client will need to determine how to communicate the conclusions from the assignment. This generally takes the form of a written report or an oral presentation. There are pros and cons to each method. Written reports take time and are expensive to write but provide high levels of detail. Clients usually prefer written reports if they wish to refer the case to law enforcement or plan to seek reimbursement of costs from their insurance carrier. Oral reports can be prepared quickly but only offer summary information.
Clients generally prefer oral reports if they are concerned with legal privilege and discovery issues – if there is no report, no report can be produced. There are clients who have requested oral presentations, but written reports for recommendations for internal controls as they wished to share the latter with their outside auditors.
Executing the Engagement
Subsequent to the approval of the work plans by the client, the analyst should begin executing the plan. While every forensic accounting assignment will vary, there are a couple of execution categories that should remain the same.
First, gather the relevant hard copy and electronic documents. In some cases, the hard copy documents may be voluminous. If so, the engagement team should either keep the copies of the documents off-site or work with the client to obtain means to limit access to employees. Electronic documents (emails, spreadsheets, shared drives, etc.) are generally processed and loaded into a review environment tool. The processing of documents is complex and outside the scope of this discussion.
Second, depending on the type of assignment, the next step may involve the use of analytical procedures. These procedures may identify trends or unusual transactions that would assist the analyst. Some examples of analytical procedures include[18]:
Third, the analyst should begin scheduling interviews as quickly as possible. Prior to any interview, the analyst should consider the following issues:
Generally, the interviewer should have one additional person in attendance to take notes during the interview. It’s best to place the person taking notes slightly out of the direct eyesight of the interviewee. This keeps the interviewee’s focus on the interviewer and not the notes that are being taken.
Interview memorandums should be prepared as quickly as possible after the interviews. This keeps the details of the interview fresh in the analyst’s mind and significantly improves the quality of the memorandums. On occasion, an interviewee will ask for a copy of the interview memorandum. Refuse this request on the basis that the document is legally privileged and work product of the investigation.
More Interviewing Insights
Conducting interviews can be, by far, the most exciting part of forensic investigations. But they also need to be successful, and the only way to achieve that is through preparation. The analyst – as the interviewer – needs to walk into the interview knowing more than the interviewee thinks the analyst knows. That means doing the legwork and creating an outline.
But perhaps more importantly, the analyst needs to listen to what the interviewee is saying. There are situations where the interviewer is so intent on his next question that he did not hear the response to the previous question. The analyst needs to remain flexible enough to deviate from the outline when the interviewee goes in a fruitful direction but return if it isn’t going anywhere. If it seems like the interviewee is not being truthful, repeat the question but in slightly different ways each time. Return to topics and see if the interviewee gives slightly different responses. Many times, persistence will pay off and lead to the truth. And the last question should always be: “Is there anything else you would like to tell me?” There could be some surprising responses.
Example: An office manager of a large construction company was being interviewed because an internal whistleblower alleged that several construction executives at the company were paying political contributions to select local politicians and got reimbursements for those payments from company funds. The reimbursements were alleged to have been categorized as travel and other expenses in the company’s accounting system. When the whistleblower was interviewed, she said that the office manager knew “everything that happened in this company” and that she was “close friends” with the executives in question. So, the analyst spent several days going through the expense reports and pulled every expense for the past three years categorized as “travel” or “other” that did not have supporting documentation. Then, an interview with the office manager was scheduled. The interviewer outlined the whistleblower’s allegations. The office manager denied any knowledge of the allegations. The next several hours were spent going through the expense reports. The analyst showed ten reports to the office manager and then asked: “Do you know anything about these.” She would deny knowledge. Then, ten more reports were covered, and the analyst said: “Someone from an earlier interview said you were knowledgeable about this process.” She continued denying that she had any knowledge. At some point, she stopped and said: “How long are we going to be here?” The analyst responded: “Until we find the truth.” After several more examples, she paused and explained how the fraud worked. She did not participate but knew the details. She was tired of answering questions and just wanted someone to know that she was not responsible for the fraud. In this case, persistence paid off.
Finally, the analyst may perform additional substantive procedures as necessary. These processes may include observations of internal control systems, asset tracing, analysis of access logs, examination of metadata from electronic media, selection of journal entries from the general ledger, and analysis of unusual or related party transactions. It is wise to seek consensus with the client before undertaking these procedures (especially if the procedures were not part of the original work plan).
Reporting Findings
Documenting findings is important and may be done in a variety of ways – both written and oral reports directly to the client are common. Additionally, the analyst may be asked to submit a report to a court or a law enforcement agency. Any investigative report should contain the following basic elements[20]:
Finally, the analyst should not state definitive conclusions of fraud. The analyst may conclude there were indications of fraud and may even state that the subject of the investigation confessed to certain allegations. The act of fraud is a legal conclusion and should be reserved for courts, judges, arbitrators, and juries.
Taking the time to properly plan and organize a forensic investigation will produce more efficient investigations and cost savings to your clients. This involves communicating initial cost estimates, changes in scope, and tentative findings with the client.
Other issues, especially the pros and cons of the various types of reports, should be discussed early in the engagement. If the client either intends to seek reimbursement for the costs of the fraud and investigation for its insurance carrier or wishes to refer the matter to a law enforcement agency for prosecution, the analyst should prepare a written report. If these issues are not important to the client, but there are concerns about confidentiality or legal privilege, an oral presentation may suffice.
Finally, the key to the investigation very well may lie in the forensic interviews. Analysts should thoroughly prepare for the interviews and walk in knowing more than the interviewee expects. Clients should expect that the analyst has experience with effective interview techniques and can handle deceptive or confrontational interviewees.
We would like to thank F. Dean Driskell III for providing insight and expertise that greatly assisted this research.
F. Dean Driskell III is an Executive Vice President in J.S. Held’s Economic Damages & Valuations Practice. He specializes in performing consulting services for clients involved in various types of accounting, economic, and commercial disputes as well as fraud and forensic accounting matters. With more than 30 years of experience in financial analysis, accounting, reporting, and financial management, Dean has served clients and their counsel in both private and public sectors, providing technical analyses, accounting/restatement assistance, valuation services, and litigation support across a variety of industries, and as an expert witness in litigation.
Dean can be reached at [email protected] or +1 470 690 7925.
[1] CSI: Crime Scene Investigation is a procedural forensics crime drama television series which ran on CBS from October 2000 through September 2015.
[2] A special master is appointed by a court to carry out some sort of action on its behalf.
https://www.law.cornell.edu/wex/special_master.
[3] A Ponzi scheme is a fraudulent investing scam promising high rates of return with little risk to investors. The Ponzi scheme generates returns for early investors by acquiring new investors.
https://www.investopedia.com/terms/p/ponzischeme.asp.
[4] AICPA Practice Aid 10-1, Serving as an Expert Witness or Consultant.
[5] The Association of Certified Fraud Examiners (“ACFE”) defines occupational fraud as the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets.
[6] ACFE 2020 Global Study on Occupational Fraud and Abuse, Report to the Nations, page 8. Report may be downloaded for free at https://www.acfe.com/report-to-the-nations/2020/.
[7] SOX required corporate executives to certify the financial statements under penalty of prosecution. Additionally, companies were required to publish details of its internal accounting controls. The thought at the time was that these processes would significantly decrease corporate fraud events. As of this writing, the success of SOX is debatable.
[8] The retention of outside legal counsel in fraud examinations and that outside legal counsel retain the specialist is always recommended. This arrangement allows for confidentiality and legal privilege of the investigation until such time the company wishes to disclose any findings to governmental or other regulatory agencies.
[9] ACFE 2018 Global Study on Occupational Fraud and Abuse, Report to the Nations, page 11. Summarized from Occupational Fraud and Abuse Classification System (the Fraud Tree).
[10] ACFE 2016 Fraud Examiners Manual, page 3.101.
[11] The AICPA issued SSFS 1, which provides authoritative guidance for AICPA members providing litigation and investigative services, in June 2019. The statement defines litigation and investigation for accounting purposes, outlines key considerations for client and provider relationships, and establishes boundaries on the services members can provide. The new standards took effect for new engagements accepted on or after January 1, 2020.
[12] Summarized from AICPA Forensic and Valuation Section, How to Organize a Forensic Accounting Investigation.
[13] According to the ACFE 2014 Report to the Nations, more than 40% of all internal investigations originate with a tip from an employee, customer, or vendor.
[14] Keep in mind potential collusion issues as discussed above.
[15] AICPA Forensic and Valuation Section, How to Organize a Forensic Accounting Investigation, page 6.
[16] Ibid.
[17] Ibid., page 7.
[18] Ibid. page 13
[19] Informally known as a corporate Miranda warning. Notifies an employee being interviewed that the legal counsel for the investigation represents the company and NOT the employee.
[20] AICPA Forensic and Valuation Section, How to Organize a Forensic Accounting Investigation, page 17.
[21] Predication is the totality of circumstances that would lead a reasonable, professionally trained, and prudent individual to believe a fraud has occurred, is occurring, and/or will occur. ACFE 2016 Fraud Examiners Manual, page 3.105.
Our 2024 Nuclear Energy Industry Report explores the industry as it stands today, key drivers underlying its future, and new nuclear projects plus their associated intellectual property....
Insights on the new administration's impacts on environmental regulations, the future of fossil fuels vs renewable energy, and adapting ESG & sustainability programs....
This article focuses on the unique challenges facing behavioral health companies, especially those in distress....