[author: Dean Driskell]

Introduction

The term forensic accounting is often misused and misunderstood.

Tell someone you are a forensic accountant, and the response typically is: “So, like CSI[1] on television!” Sort of. But forensic accountants investigate numbers instead of murders and dead bodies.

However, the practice of forensic accounting can be just as fascinating. Furthermore, performing forensic analyses can be some of the most rewarding, but also the most challenging work for a professional accountant. For instance, as a forensic accountant the author has traced assets belonging to Holocaust victims, testified in litigations where the continuance of the company was at stake, worked as a special master[2], investigated Ponzi schemes[3], managed teams involved in billion-dollar litigations, analyzed large bank frauds, worked with the FBI and the U.S. Department of Justice in white-collar criminal matters, and testified in a televised murder trial.

The AICPA (the governing body of professional accountancy in the United States) defines forensic accounting as “…the application of specialized knowledge and investigative skills possessed by CPAs to collect, analyze, and evaluate evidential matter, and to interpret and communicate findings in the courtroom, boardroom or other legal or administrative venue.”[4] Therefore, professional accountants, mostly CPAs, conduct forensic accounting engagements. A subcategory of forensic accounting is fraud examination, which may be conducted by either accountants, nonaccountants or Certified Fraud Examiners (also referred to as “analysts” throughout this discussion).

A quick look at the business press over the past year produces numerous articles on financial statement frauds, corporate investigations, asset misappropriations, public corruption, and a host of other occupational frauds[5]. In fact, the ACFE (Association of Certified Fraud Examiners) reported in its 2020 Global Study on Occupational Fraud and Abuse, Report to the Nations, that fraud is a global problem affecting all organizations worldwide. The 2020 study, covering 2,504 cases from 125 countries, found fraud caused total losses exceeding $3.6 billion USD[6]. These numbers do not appear to be decreasing even with additional resources allocated at the corporate level and the passing of 20 years since the Sarbanes-Oxley Act (“SOX”)[7] became law.

When forensic accountants investigate allegations of misconduct or fraud within businesses, those investigations are often referred to as internal investigations. This paper provides a practical guide to conducting forensic accounting and internal investigations and offers some real-world examples. It addresses what to do once you discover an issue (or are retained to investigate an issue) from the perspective of the analyst. Additionally, the best practices at different stages of a forensic accounting investigation are delineated, including:

• Beginning the engagement,
• Planning and communications during the engagement,
• Executing the engagement, and
• Reporting findings.

A forensic accounting investigation accomplishes several important tasks. It assists triers of fact in understanding the financial analysis and the quantification of damages. Some investigations may extend to rooting out corruption in governmental and business organizations which may ultimately bring criminals to justice.

WHERE TO START

In most forensic engagements, an interested party wants an answer to two three primary questions:

• What happened?
• Who is responsible?
• How much are the damages?

Other than internal investigations, forensic accountants may be retained for other types of forensic accounting assignments. Some may already be in litigation, and an expert is needed to provide an analysis on the quantification of damages. These include but not limited to the following examples:

• Assessment of economic damages and lost profits,
• Valuation of business interests, intellectual property, real estate, intangibles, or other assets,
• Transfer pricing, and
• Intellectual property infringement.

Other types of engagements include investigations of suspicion of fraud. For example, a governmental agency or business entity has a suspicion (or in some cases a confirmation) that some type of fraud has occurred in the organization. Forensic accountants or analysts are frequently retained to assist in the investigation of such frauds. In some instances, the analyst will be retained directly by the organization, while in other instances outside legal counsel retains the specialists[8]. Examples of fraud examinations include:

• Corruption, including conflicts of interest, bribery, illegal gratuities, and economic extortion,
• Asset misappropriation, including theft, fraudulent disbursements, inventory, and other assets,
• Financial statement fraud.[9]

According to the ACFE, fraud examinations can also address other organizational objectives, including[10]:

• Identifying improper conduct,
• Identifying the persons responsible for improper conduct,
• Stopping fraud,
• Sending a message throughout the organization that fraud will not be tolerated,
• Determining the extent of political liabilities of losses that might exist,
• Helping to facilitate the recovery of losses,
• Stopping future losses,
• Mitigating other potential consequences,
• Strengthening internal control weaknesses.

TYPES OF ENGAGEMENTS

There are infinite types of forensic accounting engagements. Most are classified as either accounting or nonaccounting, litigation or nonlitigation; and fraud or nonfraud. While there is certainly overlap within these groups, the primary reason for the classification system is to make certain that the assembled professional team is both qualified and has the specialized knowledge to complete the assignment. For example, if the assignment relates to financial statement fraud, the team is going to require accounting expertise. Further, if there is a fraud component, the team will also require someone with experience interviewing financial personnel.

Finally, the analyst should assume that any assignment may end in litigation and therefore should consider whether he or she would make a credible witness in the case. If the answer to that question is no; the analyst should either reject the assignment or add someone to the team that would serve as a potential expert witness.

PROFESSIONAL STANDARDS

The analyst should also consider which (if any) professional standards might apply to the assignment. Credentialed accountants, valuation experts, and fraud professionals all have separate professional organizations with different sets of standards. CPAs should consider the following processional standards:

• AICPA Code of Professional Conduct
• AICPA Statement on Standards of Consulting Services
• AICPA Statement on Standards for Attestation Services
• AICPA Statement on Standards for Forensic Services No. 1[11]

The valuation profession follows the Uniform Standards of Professional Appraisal Practice (“USPAP”), which is the recognized ethical and performance standards for the appraisal profession in the United States. Certified Fraud Examiners are regulated by the Association of Certified Fraud Examiners Code of Professional Ethics and Code of Professional Standards. It is the analyst’s responsibility to know and to follow which standards apply to any assignment

OTHER CONSIDERATIONS[12]

Prior to accepting any assignment, analysts should make certain that they, or their firm, have no conflicts of interest. Generally, analysts should examine the company, key executives, and any potential targets for conflicts. The AICPA provides guidance on conflicts in the Forensic & Valuation Services Section Special Report 08-1: Independence and Integrity and Objectivity in Performing Forensic and Valuation Services.

It is always a best practice to have an engagement letter with the client, preferably with the outside legal counsel representing the organization. It is also important, in general terms, to outline the nature and professional standards governing the assignment. If these issues are not addressed, the client may incorrectly assume that the forensic accountant is providing some type of assurance (such as an “audit” or a “review”). Unless such assurances are being provided, the analyst (even a nonaccountant) should avoid using terms like “audit” and “review” in engagement letters, working papers, and client correspondence. The AICPA provides additional guidance on engagement letters in the Forensic & Valuation Services Practice Aid 04-1: Engagement Letters for Litigation Services.

Once retained by the client, the analyst should develop a scope of work for the assignment. At the beginning of the assignment, a high-level work plan should suffice. This plan may be expanded and refined as additional facts are discovered and analyses performed. It is important to keep outside legal counsel appraised (assuming the client heeded the analyst’s advice to hire outside counsel) of the progress of the work and informed of any changes in scope. This communication should help create a team environment and ease tensions when an invoice is submitted.

Analysts are independent experts, and therefore they should not be influenced by the client or outside legal counsel’s need to control the scope of the assignment, and sometimes go as far as requesting the analyst to issue a report of “no findings.” If the analyst is placed in this predicament, he or she should consider resigning from the assignment.

Taking the time to understand the required professional standards, properly staff the assignment, investigate potential conflicts, prepare effective engagement letters, develop efficient work plans, and communicate with outside counsel will result in conducting a successful forensic accounting assignment.

Clients are often concerned about the costs of engagements and analysts need to address that concern effectively. More often than not, one of the first questions a client may have is: “How much is this going to cost?” While estimating that number is very difficult in litigation settings, it is virtually impossible in fraud investigations.

FREQUENT DILEMMAS IN INVESTIGATIONS

The Cost of Collusion

At the beginning of an engagement, the analyst doesn’t know how deep the rabbit hole goes. What starts with an anonymous tip[13] from one employee, may turn into collusion with multiple employees, all of whom will then need to be investigated. Thus, affecting the analyst’s scope of work and its costs.

Collusion creates other more significant problems. It overrides internal controls, systems access, and ordinarily solid processes and procedures. Additionally, if the assignment is with a public company and the fraud touches an employee that the outside auditor relied upon in conducting the audit or internal control review, the outside auditors are likely going to be concerned about the reliability of their audit and wish to conduct some type of shadow investigation. Such an investigation is going to require periodic reporting, and additional time, from the forensic accountant.

Example: An investigation was launched into a large manufacturing conglomerate which related to a financial statement fraud. The investigation showed that the CFO conspired with the division heads to falsify account records in order to maximize bonus pools. Collusion between senior employees creates roadblocks for the analysts which makes fraud investigations difficult to solve and costly to complete.

Other Roadblocks: When Individuals Lie

People are going to lie, which will slow down a probe. There are situations in which employees lie to cover up office affairs, where assistants lie to cover for their bosses, and controllers lie to cover for their business units. The most effective way to combat this behavior is to analyze the evidence, the data and to effectively interview employees. One effective way is confronting liars by showing them the data and evidence that they are refuting. Sometimes this the quickest way to get to the truth. Once the interviewee realizes the analyst has done the necessary due diligence, he or she is boxed in and has to be much more truthful giving answers.

Example: Several years ago, the corporate controller for a major division of a Fortune 500 company was being interviewed in a fraud case. The company received a whistleblower complaint from its internal fraud hotline stating that the division was fraudulently overstating its operating results. On the morning of Day One of the investigation, the controller sat in the conference room, lined with the leather-bound volumes of internal controls, process and procedures documents required under SOX, and said his books were perfectly clean and accurate. On the afternoon of Day Three, after several interviews, the analysis of several hundred transactions, and a list of thirty or so written questions about certain end of the month journal entries, the same controller walked into the same conference room and confessed to the fraud. Because of his title and his longevity in the organization, he was able to override any of the existing internal controls. The SOX documents were worthless. When asked why he was confessing, he confided that he knew once the right questions were asked that the fraud would eventually be discovered. It was only a matter of time until his fraud would be uncovered. He said he could not sleep at night. Analysts need to be consistent and skeptical in their investigation, and they will eventually find the answers.

E-records

Finally, electronic record keeping has made fraud investigations infinitely more complicated. Twenty years ago, an investigator might have looked through file cabinets located in an executive’s office in search for answers. But today, there are file servers, email systems, shared drives, text messages, and chat rooms. Many businesses retain their data– forever! So, all of it should be analyzed for relevancy. And even with computer tools, SQL databases, and structured data and computer analytics professionals doing the work, this analysis takes time and is expensive.

Example: An employee was suspected of skimming money from her employer, when confronted, she denied the allegations. Her company emails were pulled - along with her voice mail messages, text messages, and group chats from her company server. She did not know that the company saved the metadata from the instant messages she sent through her work computer. Those messages not only showed how she was skimming the money, but also showed she was spending a significant amount of it on her boss, with whom she was also having an affair. The company terminated both employees and referred the case to local law enforcement for prosecution.

THE BENEFITS OF A WORK PLAN

The best recommendation on how to manage client’s expectations and engagement costs is by utilizing a phased approach. Do this by creating an approach memorandum (or work plan) at the beginning of each forensic investigation. At a high level, the memorandum outlines the steps of the investigation and its estimated cost. At the end of every week, revise the memorandum, update the estimates, and circulate the updates to counsel and/or the client. This process keeps everyone on the same page and minimizes any “sticker shock” for future billings.

A DEEPER DIVE INTO THE PROCESS

Preliminary Assessment

It is generally appropriate to conduct some type of preliminary assessment at the beginning of any forensics investigation. This may include:

• gaining an understanding of internal controls and processes,
• performing an analysis of records, and
• conducting some preliminary discussions with executives who are not a target[14] of the investigation[15].

In many instances, the assessment requires the interaction of the forensic analyst with employees of the accounting and finance department of the company. Care must be taken during these interactions as the accounting and finance departments are often the targets of the investigation – and news travels fast, even in very large organizations. In this type of environment, the analyst should make an introduction as a member of the external audit team (with prior notification of counsel).

The AICPA provides the following questions that may assist with the assessment:[16]

• What types of data are available? First, understand the type of financial information that is available. Second, knowing the related time periods covered will help the practitioner assess the level of work and the cost required to gather and analyze the information.
• Is this data available in electronic format? Electronic data will make analysis more efficient and will provide for more comprehensible procedures. It is also helpful to request data that are in a proper format and compatible with any tools that the forensic accountant will use to perform analysis. Including a specimen document request letter that may facilitate the accurate collection of electronic data.
• Will the information be complete? Incomplete information will limit the practitioner’s ability to produce accurate conclusions. The time spent to fill-in incomplete data will also affect the cost of the investigation.
• Are there nonfinancial types of information that could help with the investigation? Other types of information, such as phone records, email, and building access logs could assist the forensic accountant with the assignment. It is important to inquire about what types of nonfinancial information is available.

Subsequent to the preliminary assessment, the analyst should update the approach memorandum and consider any necessary changes to the team structure. Team changes are generally made because of complex accounting issues, specific industry expertise requirements, and electronic data issues.

Working Papers

It is imperative that the analyst retain a complete set of working papers prepared during the investigation. That is not to say that all notes, schedules, and other documents should be retained. Instead, determine whether notes or other materials are relevant to the investigation. If so, the notes should be formed into a memorandum or other document. If not, the materials should be discarded. This is especially important for interview memorandums. The purpose of the interview memorandum is not to transcribe everything said during the interview, but rather to summarize the relevant content. It is permissible to quote the interviewee for particularly important details.

In the event the analyst takes possession of original documents, it is important that the proper chain of custody be maintained to ensure preservation of the evidence[17]. This is particularly important for documents with original signatures or items like cancelled checks, computer hard drives, etc.

Communication

Communication should be directed to the client, whether that client is outside legal counsel or company management. In some cases, the client may be the company’s board of directors or audit committee. As noted above, it is always preferable for the client in forensic investigations to be legal counsel. That way if the analyst determines there is collusion or management involvement in the fraud, the analyst has an unbiased communication partner. If company management is the client, it is best to have management involve the board of directors or audit committee early in the assignment for the same reasons.

Finally, at some point in the investigation, the analyst and the client will need to determine how to communicate the conclusions from the assignment. This generally takes the form of a written report or an oral presentation. There are pros and cons to each method. Written reports take time and are expensive to write but provide high levels of detail. Clients usually prefer written reports if they wish to refer the case to law enforcement or plan to seek reimbursement of costs from their insurance carrier. Oral reports can be prepared quickly but only offer summary information.

Clients generally prefer oral reports if they are concerned with legal privilege and discovery issues – if there is no report, no report can be produced. There are clients who have requested oral presentations, but written reports for recommendations for internal controls as they wished to share the latter with their outside auditors.

Executing the Engagement

Subsequent to the approval of the work plans by the client, the analyst should begin executing the plan. While every forensic accounting assignment will vary, there are a couple of execution categories that should remain the same.

First, gather the relevant hard copy and electronic documents. In some cases, the hard copy documents may be voluminous. If so, the engagement team should either keep the copies of the documents off-site or work with the client to obtain means to limit access to employees. Electronic documents (emails, spreadsheets, shared drives, etc.) are generally processed and loaded into a review environment tool. The processing of documents is complex and outside the scope of this discussion.

Second, depending on the type of assignment, the next step may involve the use of analytical procedures. These procedures may identify trends or unusual transactions that would assist the analyst. Some examples of analytical procedures include[18]:

• Comparison of company financial data versus operational data, such as production levels, number of employees. and square footage,
• Comparison of current company data versus historical periods,
• Comparison of actual financial results versus company budgets, forecasts, or projections,
• Comparison of company data versus industry and competitor data,
• Comparison of financial statement information with income tax returns,
• Comparison of financial statements submitted to different parties or regulators,
• Comparison of subsets of company data versus other subsets of company data (i.e., comparison of data on a disaggregated basis such as by division, product, location, or employee),
• Analyses of financial data in context of external events (i.e., economic, political, etc.) or circumstances; and
• Vertical, horizontal, financial statement, and financial ratio analyses.

Third, the analyst should begin scheduling interviews as quickly as possible. Prior to any interview, the analyst should consider the following issues:

• Will outside legal counsel (for the company) attend the interview? If so, will they provide Upjohn[19] warnings, background of the investigation, and or other privilege instructions? If not, will the analyst perform this task?
• Generally, the interviews should follow a set order. The analyst should interview the whistleblower first (if applicable) and the subject of the investigation last. It is also a best practice to interview lower-level employees first. This should provide a solid base of knowledge for the interview of senior personnel.
• Site of the interviews. If interviewing an internal whistleblower, it is better to conduct the interview at an off-site location. If on-site, find a quiet and private location to conduct interviews so that the interviewee will feel comfortable.
• What if the interviewee requests legal counsel? Generally, this means an immediate halt to the interview until such time that interviewee can discuss options with his or her counsel.

Generally, the interviewer should have one additional person in attendance to take notes during the interview. It’s best to place the person taking notes slightly out of the direct eyesight of the interviewee. This keeps the interviewee’s focus on the interviewer and not the notes that are being taken.

Interview memorandums should be prepared as quickly as possible after the interviews. This keeps the details of the interview fresh in the analyst’s mind and significantly improves the quality of the memorandums. On occasion, an interviewee will ask for a copy of the interview memorandum. Refuse this request on the basis that the document is legally privileged and work product of the investigation.

More Interviewing Insights

Conducting interviews can be, by far, the most exciting part of forensic investigations. But they also need to be successful, and the only way to achieve that is through preparation. The analyst – as the interviewer – needs to walk into the interview knowing more than the interviewee thinks the analyst knows. That means doing the legwork and creating an outline.

But perhaps more importantly, the analyst needs to listen to what the interviewee is saying. There are situations where the interviewer is so intent on his next question that he did not hear the response to the previous question. The analyst needs to remain flexible enough to deviate from the outline when the interviewee goes in a fruitful direction but return if it isn’t going anywhere. If it seems like the interviewee is not being truthful, repeat the question but in slightly different ways each time. Return to topics and see if the interviewee gives slightly different responses. Many times, persistence will pay off and lead to the truth. And the last question should always be: “Is there anything else you would like to tell me?” There could be some surprising responses.

Example: An office manager of a large construction company was being interviewed because an internal whistleblower alleged that several construction executives at the company were paying political contributions to select local politicians and got reimbursements for those payments from company funds. The reimbursements were alleged to have been categorized as travel and other expenses in the company’s accounting system. When the whistleblower was interviewed, she said that the office manager knew “everything that happened in this company” and that she was “close friends” with the executives in question. So, the analyst spent several days going through the expense reports and pulled every expense for the past three years categorized as “travel” or “other” that did not have supporting documentation. Then, an interview with the office manager was scheduled. The interviewer outlined the whistleblower’s allegations. The office manager denied any knowledge of the allegations. The next several hours were spent going through the expense reports. The analyst showed ten reports to the office manager and then asked: “Do you know anything about these.” She would deny knowledge. Then, ten more reports were covered, and the analyst said: “Someone from an earlier interview said you were knowledgeable about this process.” She continued denying that she had any knowledge. At some point, she stopped and said: “How long are we going to be here?” The analyst responded: “Until we find the truth.” After several more examples, she paused and explained how the fraud worked. She did not participate but knew the details. She was tired of answering questions and just wanted someone to know that she was not responsible for the fraud. In this case, persistence paid off.

Finally, the analyst may perform additional substantive procedures as necessary. These processes may include observations of internal control systems, asset tracing, analysis of access logs, examination of metadata from electronic media, selection of journal entries from the general ledger, and analysis of unusual or related party transactions. It is wise to seek consensus with the client before undertaking these procedures (especially if the procedures were not part of the original work plan).

Reporting Findings

Documenting findings is important and may be done in a variety of ways – both written and oral reports directly to the client are common. Additionally, the analyst may be asked to submit a report to a court or a law enforcement agency. Any investigative report should contain the following basic elements[20]:

• Identify the client
• Include the analyst’s qualifications and background
• Describe the predication[21]
• State in broad terms what the analyst was asked to do
• Describe the engagement scope, including the time period examined
• Include mention of any restriction as to distribution and use of the report
• Identify the professional standards under which the work was conducted
• Identify exclusions in the reliance on the analyst’s report
• State that the work should not be relied on to detect fraud
• Include a list of the documents reviewed and relied upon during the investigation
• Include the names, titles/organizations, and dates of interviewees
• Include the procedures performed and the technical pronouncements relied upon
• Describe the observations and identify the findings.

Finally, the analyst should not state definitive conclusions of fraud. The analyst may conclude there were indications of fraud and may even state that the subject of the investigation confessed to certain allegations. The act of fraud is a legal conclusion and should be reserved for courts, judges, arbitrators, and juries.

CONCLUSION

Taking the time to properly plan and organize a forensic investigation will produce more efficient investigations and cost savings to your clients. This involves communicating initial cost estimates, changes in scope, and tentative findings with the client.

Other issues, especially the pros and cons of the various types of reports, should be discussed early in the engagement. If the client either intends to seek reimbursement for the costs of the fraud and investigation for its insurance carrier or wishes to refer the matter to a law enforcement agency for prosecution, the analyst should prepare a written report. If these issues are not important to the client, but there are concerns about confidentiality or legal privilege, an oral presentation may suffice.

Finally, the key to the investigation very well may lie in the forensic interviews. Analysts should thoroughly prepare for the interviews and walk in knowing more than the interviewee expects. Clients should expect that the analyst has experience with effective interview techniques and can handle deceptive or confrontational interviewees.