Fraud Exam 3

Theft Act Investigative Methods

Activities that directly investigate the fraud act.

Surveillance and covert operations, invigilation, obtaining physical evidence, gathering electronic (computer) evidence.

Conversion Investigative Methods

Searching public records, online sources, the net worth method.

Concealment Investigative Methods

Document examination, audits, electronic searches, physical asset counts.

Inquiry Investigative Methods

Interviews and interrogation, honesty testing.

Deciding When to Investigate

Fraud investigation only proceeds when predication is present. Once there is predication of fraud, management must decide whether or not to investigate.

Considerations For Investigation

Perceived strength of the predication — does it seem real?

Perceived cost of the investigation

Exposure or amount that could be taken

Signal that investigation (or lack thereof) sends to others inside and outside the organization

Risks of investigating and not investigating

Public exposure or loss of reputation from investigating or not investigating

Nature of the possible fraud

Impact on the organization’s culture

Initial Investigation Decisions

Once predication is established, investigate to answer the questions: who, why, how, and how much?

Initial observations and predication evidence are often the “tip of the iceberg” of a larger fraud scam.

Frauds grow geometrically over time, so prompt investigation prevents loss of assets and reputation. 

Deciding Optimal Investigation Methods

Focus on the strongest type of evidence for the specific fraud.

Physical evidence gathering is best for inventory fraud. Uncovering concealment effort works best for payroll fraud. Indirect evidence is most effective for collusive and kickback fraud.

Inquiry methods are most useful after identifying who to interview and what questions to ask.

Public records can confirm lifestyle symptoms of suspect fraud perpetrators.

Investigation Professionalism

Remain objective as you investigate. Use professional skepticism and do not take findings at face value. 

Never make assumptions regarding guilt. Do not permit your suspicions or prior investigative experience affect your treatment of people and evidence. 

Keep all investigation findings confidential. Disseminate information only to those who have a need to know. 

Beginning an Investigation

Avoid arousing suspicion: use words like “audit” and “inquiry.” Start with circumstantial evidence and work towards information-gathering specific to the prime suspect(s). 

Properly performed surveillance is done without the perpetrator’s knowledge. Perform interviews in reverse order of association and proximity to the suspect(s). Evidence and people have a way of “disappearing” once a case is revealed.

Recommended Investigative Pattern

1. Check personnel records or company records (such as purchasing records)

2. Interview former employers or unsuccessful vendors

3. Search public records, invigilation, or surveillance

4. Interview other buyers, coworkers, etc.

5. Interview suspect

Vulnerability Chart

Coordinates elements of the possible fraud:

• Assets that were taken or are missing

• Individuals who had theft opportunities

• Theft investigative methods

• Concealment possibilities

• Conversion possibilities

• Symptoms observed

• Pressures of possible perpetrators

• Rationalization of perpetrators 

• Key internal controls 

Surveillance and Covert Operations

Theft investigation techniques that rely on the physical assets

Three main types of surveillance: stationary or fixed point, moving or tailing, electronic surveillance

Most fraud investigations involve some form of surveillance. Coordinate surveillance and covert operations with law enforcement specifically trained in covert operations and safety.

Simple Fixed Point Observation

Step 1: investigators locate the scene to be observed and action likely to occur at the scene.

Step 2: investigators keep detailed notes or video of the activities at the scene involving the suspect:

• Date and day of observation

• Name of the observer and corroborating witnesses

• Position from which the observation was made

• Time log of all movements and activities of the suspect

Mobile Observation and Tailing

More risky and costly than stationary surveillance. Investigators could be subject to physical violence. Include law enforcement and follow established safety procedures and processes.

Advantages of mobile surveillance are identifying the receiver of stolen goods and identifying the payer of bribes and kickbacks. 

Electronic Surveillance

Video camera recording is common. Wiretapping is usually only available to law enforcement officers.

Employee privacy policies limit the value of electronic surveillance. Data on corporate computers and cloud sites are company property and usable fraud investigations. 

Legal counsel should be consulted prior to proceeding with any electronic surveillance methods. Monitored persons have a reasonable expectation of privacy under the 4th Amendment to the Constitution. 

Prerequisites for Undercover Investigation

1. Large-scale collusive fraud or crime is likely

2. Other methods of fraud investigation fail

3. The investigation can be closely monitored 

4. There is significant reason to believe that fraud is occurring

5. The investigation is in strict compliance with the organization’s law and ethics

6. The investigation can remain secretive 

7. Partnership with law enforcement has been obtained

Database Searches

Public databases can be searched using artificial intelligence to identify suspicious transactions. Consumer electronics, computer cameras and Internet of Things (IOT) gadgets can conduct surveillance on persons without them being aware.

Invigilation

Theft act investigative technique that involves close supervision of suspects during an examination period. Temporary controls during the examination period make fraud virtually impossible to commit. Establishes a fraud-free, control period.

Observed changes between control and non-control periods indicates that fraud may be occurring. Required detailed recording before, during, and after invigilation. 

Physical Evidence

Useful if fraud involved theft of physical stock which can be counted or inventory which can be searched.

Direct evidence of theft: broken locks, cutting marks, tire tracks, fingerprints

Indirect evidence of theft: vehicle rental to transport stolen goods, computer evidence of conversion

Fraud is rarely seen and has few physical symptoms 

Electronic Evidence

The gathering of electronic evidence is termed as computer forensics. Frequently used in modern fraud investigation.

Gathering of electronic evidence is a highly technical task and must be performed correctly. Incorrectly gathered data may be inadmissible in court. 

Evidence gathering processes vary from device to device.

Cloud storage access frequently requires a subpoena or written permission from the perpetrator.

Electronic Communications

Electronic communications such as emails, text messages, and social media posts are rich sources of fraud evidence. Search warrants may be required to access accounts.

Consider national culture and business practices to determine which communication platforms to investigate. Remember that email records may reside on sending computers or servers. 

Concealment

Following theft, perpetrators conceal their fraud by covering their actions, obscuring evidence, or removing red flag fraud indicators.

Is typically accomplished by manipulating documents.

Electronic documents can be modified or deleted from databases, logs, and communications. 

Aspects of Documentary Evidence

Investigative techniques involve ways to discover physical or electronics records that have been manipulated or altered.

Documentary evidence is preferable to eyewitness. Documents cannot forget or tell inconsistent stories. Documents are always available to fraud investigators who know where to find them.

Documentary Evidence Handling

Chain of custody documents

Marking of evidence

Organization of documentary evidence

Coordination of evidence

Rules concerning original versus copies of documents

Chain of Custody

In order for documentary evidence to be accepted by the courts, its chain of custody must be maintained from the time of receipt. 

Record of when the document was received and what happened to it since its receipt. 

Memoranda describe document receipt and status change. Professional programs like EnCase and The Forensic Toolkit calculate checksums for chain of custody evidence. 

Marking the Evidence

Received documentary evidence must be uniquely marked for later identification. Transparent storage envelope to contain documents. Label date received and examiner’s initials.

Create copies of all documents and store them in the same location and file as the originals. 

The use of copies during the investigation can prevent damage to originals. Originals can be removed from safekeeping during the trial as needed.

Organization of the Evidence

Fraud cases can create tremendous amounts of documentary evidence. Physical document depositories and databases are often needed.

The FBI has one of the world’s most advanced document examination laboratory’s. It supports extensive and ongoing documentation digitalization. It maintains powerful data search and analysis tools for use by investigators and attorneys.

FBI system saves up to two years of document review time compared to manual processes. Document digitalization is common in both civil and criminal cases. 

Machine learning and artificial intelligence is improving analysis efficiency. Consistent organization scheme is essential for document management for a typical fraud case, regardless of technology. 

Organization schemes are usually based on witnesses, chronology, and transaction. 

Document Database Essentials

Creation dates of documents

Sources of documents

Dates when the documents were obtained

Brief descriptions of document contents

Subjects of documents

Identifying or bates number

Bates Numbers

Used by litigation attorneys to track all documents, both physical and electronic. 

Include the following: defendant or plaintiff identifier, defendant or plaintiff location identifier, unique document number

Coordination of Evidence

Large cases involving multiple participants benefit from investigation analysis software.

Software uses link analysis to help investigators understand complex scenarios and large volumes of information. Establishes links between people, places, and events. Generates charts and other graphical results.

Original Documents vs. Photocopies

Photocopies are used during the investigation. Original documents are reserved for use in the actual trial.

Original documents are always preferable to photocopies. Photocopies are considered secondary evidence in a court of law.

Courts only permit use of photocopies if there is proof that the original exists. Tampering is possible during photocopying.

Court Admissions of Photocopies

The original document was lost or destroyed without the intent or fault of the party seeking to introduce the secondary evidence.

The original document is in the possession of an adverse party who fails to produce it after a written notice to do so or who is outside the jurisdiction of the court’s subpoena power.

The document or record is in the custody of a public office.

The original documents are too voluminous to permit careful examination, and a summary of their contents is acceptable.

Obtaining Documentary Evidence

Computer-based queries of accounting and other databases are the best way to obtain documentary evidence.

Traditional auditing with discovery sampling is appropriate for non-electronic evidence. 

The least reliable methods are chance, accident, or tip. 

Audits

Evidence is provided by each of seven tests conducted by auditors:

• Tests of mechanical accuracy (recalculations) 

• Analytical tests (tests of reasonableness)

• Documentation

• Confirmations

• Observations

• Physical examinations

• Inquiries 

Discovery Sampling

A form of statistical sampling which permits auditors to make inferences to the population. Performable with most audit software. 

Addresses probability of discovering at least one error in a given sample size if the population error rate is a certain percentage. 

Step 1: test a random sample

Step 2: use probability theory to draw inferences about population from the sample

If one of the sample documents is fraudulent, the auditor can be 100% sure that fraud exists. If none of the sampled documents is fraudulent, then fraud may still exist. 

The more confident the auditor wants to be and the less risk of missing fraudulent documents, the larger the sample size needed. Population size makes little difference in sample size. Sample size should be less than 10% of population size.

Sample Results

Inferences about the population.

Helpful when populations are large, allows quantification of risk, and allows inference.

Sampling Risk

Possibility that the sample will not be representative of the population.

Example: sampled documents show no fraud, but fraud is actually being perpetrated

Non-Sampling Risk

Risk that a finding will be misinterpreted.

Example: an auditor examines a fraudulent check and does not recognize it as being fraudulent. 

Documentation of Discovery Sampling

The investigator must document the method used for determining sample size. Specified population error rate and confidence level.

The investigator must also document the sampling method. Random number table or computer generator. Rules for determining starting point and progression through a random number table.

Discovery Sampling Error Evaluation

If the investigator finds errors using discovery sampling, they must determine if the errors are intentional and if the errors are indicative of fraud. 

Sampling Risk Consideration

Can be significant in fraud investigation because fraud is frequently conducted in just a few transactions. 

Non-Sampling Risk Consideration

Cannot be quantified, but can be reduced by careful planning.

Hard-to-Get Documentary Evidence

Valuable evidence which is difficult to obtain.

Examples include web-based emails, private bank and brokerage records, tax records.

Ways to access are by subpoena (issued by a court or grand jury), by search warrant (issued by a judge), or by voluntary consent.

Subpoenas

Orders issued by a court or grand jury to produce documents. Failure to honor is punishable by law and they are only enforceable by an agent of the grand jury or court. 

Need for one is a good reason to coordinate fraud investigation with law enforcement.

They all include who is making the request, of whom the request is being made, what exactly is being asked for. 

Document Experts

Sometimes it is necessary to determine if a document is authentic. Questionable documents can be genuine, counterfeit, or forged.

Document examination applies forensic chemistry, microscopy, and photography to make determinations about documents.

Document experts can determine:

• Was a document written by the person whose signature it bears?

• Has it been forged?

• Has it been altered?

• Are two documents substantially the same?

Perpetrator Spending Trends

Fraud perpetrators may initially commit fraud to meet an immediate financial need, but continue to engage in fraud after that need has been met.

Perpetrators spend stolen money to improve their lifestyles rather than save or invest it.

Lifestyle changes are easier to detect than theft acts or concealment records for some types of fraud. Conversion investigation can be used to strengthen cases when concealment or theft act evidence is present. 

Conversion Searches

Two reasons to perform are to determine the extent of embezzlement and to gather evidence that can be used in interrogations to obtain a confession.

Interviewing is the most common technique used to investigate and resolve fraud. Question-and-answer session designed to elicit information. Interview questions regarding unearned income can verify that a suspect’s lifestyle cannot be supported by their earned income. 

Information relevant in conversion investigation is available from: federal, state, and local agencies; private information sources; online information sources; net worth method of spending analysis.

Emergence of online resources have made conversion investigation more efficient.

Government Sources of Information

Federal, state, and local government agencies maintain public records. Laws dictate types of records maintained. 

Most public records can be accessed by anyone requesting them. Particular records are exempt from public access due to privacy laws.

State and local records are typically more useful than federal records for fraud investigations.

Private Information Sources

Utility records: gas, electric, garbage, water, sewer.

Previous acquaintances, including former spouses.

Physical trash searches. Only legal once the trash leaves the suspect’s home or yard. Shredded documents can be pieced back together with software assistance.

Personal computer, tablet, and phone searches.

Credit reporting agencies.

Gramm-Leach Bliley Act of 1999

Investigators prohibited from obtaining information from a financial institution using false pretenses.

Financial institutions permitted to share customer information if they disclose to customers they are doing so. 

Customers must be provided the opportunity to opt out of information sharing. Few customers opt out of information sharing because doing so usually requires providing written notice to the bank.

Online Databases

An increasing of number commercial databases provides information helpful to fraud investigations. Subscription-based, per-use fee, and unlimited free searching.

Databases contain unique information useful to investigations. 

Searching multiple sources is most likely to reveal essential information on a particular suspect.

The Net Worth Method

Used to determine the extent of stolen funds.

Uses a formula based on a person’s assets (things owned), liabilities (debt), living expenses, and income.

Public records and databases are used to supply input data.

Used by federal agencies to identify criminal activity. 

The Net Worth Formula

1. Assets — liabilities = net worth

2. Net worth — prior year’s net worth = net worth increase

3. Net worth increase + living expenses = income

4. Income — funds from known sources = funds from unknown sources