Your Federal Quarterly Tax Payments are due April 15th Get Help Now >>

Fraud Investigation - Download as DOC by rwb11526


Fraud Investigation document sample

More Info
									                                When Fraud Hits:
                      Incident Investigation and Remediation
                                                                                 Jonny Frank.
                                                                                Michael Carey*

It happens eventually to almost every audit team, and will continue with
increased frequency in the post-Sarbanes environment. Management identifies
reports a fraud, which, under the new PCAOB auditing standards, must be
reported to and evaluated by the independent auditor. And, as a reminder to
PwC auditors, firm policy requires immediate notification both to the Regional
Risk Management Partner and the Office of General Counsel.

Incident investigation and remediation consists generally of two components - -
fact finding and remediation. Remediation often follows the conclusion of the fact
investigation. But, with the increased emphasis on antifraud programs and
controls, the better practice is to commence remediation as soon as possible
without jeopardizing the fact finding process.

This article describes the nuts and bolts of incident investigation and remediation.
For a more detailed description, see Fraud Risks & Controls 200 page
whitepaper, Incident Investigation and Remediation Methodology”, or our book
chapter, The Role of the Forensic Accountant In Internal Investigations – both of
which can be obtained from the PwC Fraud Risks & Controls database.


We begin with remediation to emphasize that this component should coincide,
rather than succeed, the fact finding investigation. Remediation involves financial
recovery, settlement of criminal and civil liabilities as well as the development of
controls to ensure that the misconduct does not recur.

For management, remediation generally involves (i) quantifying damages,
(ii) taking disciplinary and legal action against wrongdoers, (ii) recovering losses
and other damages; (iii) understanding the business implications, and, (iv)
learning from the incident to improve controls and prevent recurrence.

For the independent auditor, remediation entails (i) evaluating the deficiencies in
internal controls that permitted the fraud and (ii) altering the nature, timing

  Jonny Frank and Michael Carey are members of PwC Assurance Fraud Risks & Controls, which
assists audit teams and clients to assess fraud and reputation risk, implement antifraud programs
and controls, design and perform fraud audits and remediate control weaknesses that result in
fraud and other misconduct. Mr. Frank simultaneously serves as Senior Faculty Fellow on the
business school faculty of the Yale School of Management and as an adjunct professor on the
law faculties of Fordham University and Brooklyn Law School. Both authors were in the PwC
Dispute Analysis & Investigation practice, prior to joining FR&C.

extent of audit procedures to be performed during the financial statement audit to
be responsive to such deficiencies.

Addressing control failures requires management and the independent auditor to
consider the roots of how and why specific instances of fraud and/or misconduct
were able to occur. Fraud, by definition, demonstrates a failure of controls,
except in situations where detective controls are shown to be effective by
identifying a fraud in a timely fashion.
Both management and the independent must be prepared to explain to the audit
committee and independent auditor (i) why the controls failed, and (ii) what action
has been taken to prevent a recurrence.
Fact Finding Investigation
Corporate fact finding investigations - - generally referred to as an “internal
investigation” because the company is sponsoring the investigation rather than a
third party, most typically the government – consists generally of five basic
phases - -(i) planning, (ii) covert investigation, (iii) transitional confrontation, (iv)
overt investigation, and (v) reporting. While these phases generally follow one
another, in a larger internal investigation the investigative plan allows flexibility to
switch back and forth between phases; that is, changing the circumstances may
require the investigative team to return to the covert or transition phases even
though the team is already conducting an overt investigation.


Allegations of corporate wrongdoing tend immediately to become emotional and
personal. Management has a natural tendency to dispense with planning and
proceed directly to confront and/or suspend the suspected individuals.

Look before you leap. Planning considers short and longer term implications
including: (i) setting the scope of the investigation, (ii) assembling appropriate
internal and external investigative resources, (iii) determining an investigative
plan, (iv) evaluating the legality, as well as the business implications, of the
proposed investigative techniques, (v) formulating a succession plan, if
appropriate, and (vi) devising an internal and external communications strategy.

Covert Investigation

The covert phase consists of investigative activity taken before the subject of the
investigation becomes aware that an investigation has been implemented.
Covert investigation is essential for several reasons. First, it allows the
investigative team to collect facts before confronting the subject. Second, it can
prevent claims of obstruction of justice based on document destruction, records’
alteration, lying to government officials and witness tampering. (Recent
corporate scandals, such as the Martha Stewart prosecution, demonstrate how
obstruction of justice can eclipse the substantive misconduct.) Third, certain

covert investigative techniques, such as sting operations and consensual
surveillance of encounters between a cooperator and the subject, can be critical
to proving the critical element of “intent”. Stated differently, these techniques
provide visibility into the subject’s state of mind, rather than trying to determine
intent with circumstantial evidence.

Following are a sample of investigative techniques used during the covert phase

Commercial Databases/Internet/Public Records

The explosion of information sources available on the Internet and through
commercial online services has revolutionized the investigative process. Virtually
every business investigation now begins with some form of online research. In a
matter of hours, a skilled investigator can develop information, which can provide
critical leads and make connections that may never be found through traditional
field investigation.

Computer Forensics

Likewise, most fact finding investigations include a discrete review of the
subject's secretary's e-mail, hard drive, server, backup tapes, voicemail systems,
floppy disks, and home computers.

This data often includes "smoking gun" evidence. Several years ago, for
example, review of a client -owned hard drive revealed a U.K. website dedicated
to religious confessions to which the subject admitted his wrongdoing to a “virtual

Consensual Recordings

Investigators commonly employ consensual recordings, if the team includes an
accomplice. The cooperating witness engages the subject in conversation
regarding current or past fraud. If permissible, the team records the conversation
for later use in the investigation and remediation.

Workplace Evidence

Covert desk and file searches frequently yield incriminating evidence, as do
personnel files, travel and expense reports, telephone records and statements
(including office, cellular and calling card) and company credit card statements.

Field Interviews

Interviews of employees, former employees and third parties such as vendors,
suppliers and customers many times provide insight into the suspected

employee’s activities and, perhaps, the alleged wrongdoing itself. The
investigative team, however, must balance the risk that the suspected employee
will learn of the investigation and attempt to subvert the fact-finding process.

Forensic Accounting

Forensic accountants piece together financial data and search for anomalies and
irregularities that are the hallmarks of fraud. In most cases, management can
furnish the forensic accountant with key data without jeopardizing the secrecy of
the investigation.

Surveillance and Sting Operations

The investigative team will consider physical, audio and video surveillance,
provided the activity is ongoing and susceptible to this investigative technique.
Surveillance is generally most successful when the improper activity involves
theft of physical property or trade secrets.

The team will also consider sting operations to investigate ongoing misconduct.
Undercover operatives, for example, may pose, say, as willing purchasers of
stolen trade secrets to investigate corporate espionage, stolen merchandise to
investigate theft rings, and as vendors to investigate allegedly corrupt purchasing

Transitional Confrontation

The transition phase is a critical, albeit very brief, phase of a corporate internal
investigation. It is that moment that the subject of the investigation becomes
aware that he or she is the subject of an investigation.

The investigative team has a distinct advantage - - only they are aware that an
investigation has commenced. A skilled investigator seeks to exploit that
advantage and the element of surprise by careful planning including (i) selecting
the person(s) to confront the subject, (ii) choosing the time, order and location of
the confrontation, and (iii) determining the best approach toward the

The transition phase also requires contingency planning for next steps. The
investigative team must plan and guard the preservation of documentary,
physical and electronic evidence. Additionally, the investigative team, together
with the client, must plan for the on-going operation of the business, including the
possibility of a disruption of relations with employees, vendors and customers
and, where the circumstances are newsworthy, the public.

   Over Investigation

The overt phase typically is the most extensive phase and involves more
traditional investigative and audit techniques.

It is during this phase that the investigative team conduct witness interviews,
analyze and reconstruct data, financial records and other documentary evidence,
and examines physical evidence.

Investigative Mentality

Corporate internal investigations rarely require sophisticated technical accounting
skills. Rather, the challenge for most accountants and auditors is developing the
necessary investigative mentality.

Materiality, for example, means something quite different to an investigative
accountant than to a financial auditor. Financial auditors primarily are interested
only on issues that have a potential material financial impact. An investigative
accountant maintains a much more expansive view. Even the smallest detail can
be material to an internal investigation.


Witness statements generally comprise the most critical evidence in internal
investigations. Documents often serve as the corroboration for witness
testimony. Interviewees can steer the investigator to the key documents and
explain the details and nuances.

Effective interviewing is a skill that requires training and experience. There are
entire courses, textbooks and programs dedicated to the subject.

There is no single right or wrong method for conducting an interview. Proper
planning is essential, particularly with respect to (i) order and number of
interviews, (ii) the interviewers, (iii) order and substance of inquiries, and (iv)
types of questions, e.g., open, closed, confirmatory, and challenging.

Document Gathering and Examination

Documents generally fall into two categories: paper and electronic.
The investigative team should be careful to search for all relevant documents.
The investigative team must develop an understanding of how the client
maintains and stores records. Moreover, the search should include informal as
well as formal company records. In many companies, for example, employees
maintain their own personal desk files in addition to the official company file.
These need to be included in the search.


The organization, contents and style of the investigative report will vary, and
management sometimes will issue no written report, although this is becoming
less common.

More significant investigations often require lengthy reports including volumes of
working papers. These reports typically discuss and include (i) the basis upon
which an investigation has been initiated, (ii) investigative scope and disclaimers,
(iii) an executive summary of the findings and recommendations, (iv) list of
acronyms and abbreviations at the front or back of the report, (v) a detailed
chronology, (vi) methodology, (vii) a detailed narrative of facts with authoritative
references, and a (vi) a discussion of the findings, conclusions and

Closing Thoughts

Corporate America has placed increased emphasis on prevention and detection
of fraud. Some fraud, nonetheless, is inevitable. While they need become fraud
controls experts or forensic investigators, auditors should be familiar with the
basics incident investigation and remediation, as they carry out their mandate of
evaluating the fraud and its impact on the integrated audit.



To top