Fraud Investigations from Investigation to Presentation
An article by Brian Dilley of KPMG Forensic Accounting.
At KPMG, we use i2 charts in two distinct ways:
Investigation charts to identify the connections between individuals;
Presentation charts to summarize the confusing collection of information in a form
which can be easily understood.
Our work is largely in the civil arena, although we are now involved in an increasing number
of criminal actions. As part of the civil process, we regularly have to present complicated
information to the senior management of our client and to the solicitors and counsel who are
progressing the case on which we are working. It is imperative that these individuals, who
have not been involved in any of the detailed investigation work on the case, can understand
clearly the details that we are presenting to them.
Filtering Complex Investigation Charts
One of the ways in which we achieve the above objective is to extract sections from large and
complex investigation charts in order to produce smaller, more manageable, presentation
charts. There are many ways in which this can be done within i2 both in preparation for and
during meetings with your targets. For example, if you have a complex investigation chart and
your client is particularly interested in one individual, it is very simple to use the "Select
Linked" command to immediately produce a smaller chart showing only the information
relating to that one individual. We call such charts "Centre of the Universe" charts.
Use of "Edit view"
When presenting an i2 chart on a PC, it is often necessary to focus in on a specific area of a
large chart. This can be achieved using the "Edit view" command. By selecting the areas
before the presentation, and saving the selection using "Edit view", you can reduce the risk of
focusing on the wrong area during the presentation, which reduces the effectiveness of your
message. You can also save several views and scroll through them to produce a smooth
Use of Cards on Presentation Charts
When preparing an investigation chart, every i2 user will be aware of the necessity to include
as much detail as possible on the cards behind the links in order that the source
documentation can be located efficiently at a later date. This is equally the case when
producing a presentation chart. In our experience, the lawyers often return six months to one
year later with a summary chart that relates to a particular part of the action. The first thing
they want to know is where the information came from. As such it is imperative that the detail
is on the card and the source documentation can be found immediately.
Using the Analyst's Notebook within the asset tracing process is the perfect example of the
use of investigation charts to produce presentation charts. Three years ago, in conjunction
with the case lawyers, we issued tracing proceedings against a number of offshore
companies who had been the recipients of our client‟s funds. The first stage of the
destinations were further off-shore companies and, using i2 to show the flow of the funds
through the entities, we were able to obtain further injunctions against the second stage group
This process continued until such time as the banks providing the information could not trace
the funds themselves as they were becoming mixed with further funds from other sources. At
this stage they gave us (under order of civil injunctions) the bank statements of over 50
companies. We input these bank statements onto a database that resulted in a database of
over 4,000 transactions.
Using the link analyser we produced a chart of these 4,000 transactions. The chart can be
seen in figure 1. Using "Grouped" within the "Rearrange" function, we were able to identify
that the companies dealing with each other on a daily basis and passing funds between them
were those appearing on the outside of the circle. A more detailed investigation revealed that
there were a number of shareholder and directorship links between these companies. We
were then able to show that these companies were a group of companies acting as if one
entity. As such, we were able to return to the court with an asset freezing application against
Part of our application to the court consisted of presentation charts of the types of funds-flows
that were occurring within the group of companies. For example, it was commonplace to see
funds being paid through five or six different companies on the same day. We were able to
present this to the court in an understandable form such as the diagram in figure 2. This chart
was arrived at by analysing the chart in figure 1. We selected a company that we knew to be
central to the group. Using the “Select Linked” command we selected all the items within one
link of this organization and copied the resulting selection into a new chart. We then took each
of the entities receiving money from that company in turn and, from figure 1, again selected all
the entities within one link. We pasted this into our new chart and rearranged. What we found
was that there were payments that not only went from one entity to the other, but also
payments that went from the first to the second entity via a number of different routes. The
resulting chart is in figure 2.
A capability now available in iBase, which would have saved a vast amount of time in this
situation, is the ability to switch between showing the connection count on the links and the
details on the card once the link analyser had been run. In this way it becomes very easy to
identify, on smaller summary charts, where a payment of the same amount on the same date
had passed between a number of the companies.
Following the asset freezing application, a number of the companies denied being part of the
same group. The court then asked us to provide more information on why we believed that
they were. The starting point for providing the information was to highlight the company in
figure 1, select all the entities within one link and copy the result to a separate chart. By using
this approach we immediately had a chart of all the payments received and paid to other
companies within the group. To this we then added information in relation to company
structure and this formed the basis of our response to the court.
Information and Action Points
One of the primary uses of the i2 software is as a case management tool. On to our chart in
figure 1 we placed a number of action and information points in order to use the chart as a
progressive, up to date state of affairs. Information points, using an "i" icon, show, on the face
of the chart, important information in relation to a company or bank which would otherwise be
omitted from the chart or contained within the cards. With action points it is important to
regularly update the action points and ensure that the action is occurring. By placing these on
the face of the chart it is simple to see at any one time what remained outstanding in relation
to the case.
Although a number of the procedures highlighted above are now somewhat outdated by the
iBase software, the principles still hold true to the use of i2 whether you are working in the
civil or criminal arena. The progression from complex investigation chart to clear presentation
chart is essential if you want your „client‟ audience to be "enlightened" as to the point you are
trying to make.
Brian Dilley wrote the above article from KPMG for the i2 newsletter.