Fluent Essays

Please give this within 30 hrs. Instruction: 1. Read the Chapter 7 reading. 2. Write a write-up outlining ( small article) the major points, 3-5 point for this chapter. 3. This paper should be more than 1 page. 4. Times New Roman, 12 pont, Double space. Due on Wednesday, September 29, 2021, befroe 11 pm, US central time (Chicago). There are almost 36 hrs to complete this. only one transaction. The next question I had was how the bank account could have balanced and reconciled within QuickBooks without the identified transaction on the bank statement. I retrieved my laptop and booted it again, expecting to find one of two things. Either the account was not balanced and reconciled within QuickBooks as thought, or a transaction had to have been entered into QuickBooks using different information from the United Alliance payment, allowing the account to balance and reconcile. Once I was back into the division’s QuickBooks file, I scrolled through the operating account register to the date of the payment on the bank statement. Sure enough there was a posted transaction in the register for the same date and the same dollar amount. However, rather than being a payment to United Alliance, the transaction was posted as a general journal entry. The entry included the following description, ‘‘Draw—Controller’s Name.’’ The entry and amount was posted to the ‘‘Office Expense’’ ac- count. I scanned the rest of the register of the operating account for similar entries. None were found. I printed the general journal entry and placed it into a clear sleeve, then attached an evidence sticker to the sleeve. I labeled the evidence sticker with the date, time, location, and description, and placed the sleeve with the boxes. Having found the first sign of activity relating to the United Alliance account being concealed from detection, I realized the lateness of the day and decided to end on that note. I put the organized bank records back into each respective box, and brought the boxes back to the storage room. Once all the boxes were inside, I locked the door and sealed it with evidence tape. I noted the date and time in my notebook, then returned to the room to make more notes on my findings. I decided I would sit on the latest findings until tomorrow, after I had spent more time going through the bank statements and information in the boxes. ! ! ! At home that evening, I revisited my notebook and read through the day’s notes. I added more details and described how I had found the payment to United Alliance on the bank statement, as well as the concealed United Alliance payment within QuickBooks. Importance of Documentation (Keeping Track of Things) 93 The next morning I returned to the boxes. I met the senior accountant and brought him up to speed with my previous day’s findings. I left the senior accountant with the boxes and found Tim. I reviewed the various bank accounts identified by each bank with him. I changed my mind about waiting, and shared with him the concealed United Alliance payment. Tim seemed pleased that pieces of the puzzle were starting to come together. I asked Tim where he stood with the request for the controller to sign for the United Alliance statements, and he said the request was finished and forwarded to counsel for review and approval. Tim said that once the request was approved, he would contact the controller to set up a date and time to discuss the financial analysis of the division. I returned to the senior accountant and went to work with the bank account listings and boxes of evidence. I retrieved the boxes from the storage room, noting the date and time I broke the seal on the door. I put the piles back out on the tables from yesterday, and started to match up the bank statements with the listed bank accounts. I retrieved more boxes containing financial information and sorted through the contents, putting any bank accounting information into stacks on still more tables to ensure I kept each box’s contents separate. It became apparent that the division main- tained far too many bank accounts, and as an aside I made a note to recommend the division consolidate the bank accounts into a minimal number of accounts. LEARNING POINT By now you should have noticed that I never left the collected evidence alone or unattended for any time. In order to ensure the chain of custody (discussed earlier) remains intact, protecting the admissibility of the evidence, the evidence needs to remain secured at all times until presented in court. In the event the evidence needs to be removed from a secured storage location, it must be attended at all times, and never left alone in a room, let alone in a car. Properly maintain chain of custody accounts for the evidence’s movements, from the time it is collected to the time it is presented in court. 94 Anatomy of a Fraud Investigation Working with the senior accountant, it wasn’t until later in the day that we were able to match all the piles to the listed bank accounts, and identify the accounts that we had not found any information for. As we found information pertaining to each bank account, we found the same account on the lists provided by the banks and highlighted the listed account in yellow. As I scanned the lists for any accounts that were not highlighted, I saw one account that was provided on the list that was labeled closed. The listing indicated the account was closed three months earlier. I wanted to know why I didn’t find any bank statements or other information for this account, so I left the senior accountant with the boxes and brought the listing to Tim. Tim indicated the identified account was included with all the other accounts for which Tim had already requested monthly statements. Knowing that it could take up to 12 weeks for the bank to produce the requested statements, I asked Tim to make a special request of the bank for that one particular bank account, to see if we could get access to the bank statements sooner. Tim said he would go over to the bank and see what they would do for him for that one account. ! ! ! When I returned back to the boxes, the senior accountant indicated the human resource director had called looking for me. He said she was out at the division, and that I was to call her once I received FRAUD FACTS According to Black’s Law Dictionary, chain of custody is defined as ‘‘the movement and location of real evidence, and the history of those persons who had it in their custody, from the time it is obtained to the time it is presented in court.’’1 ‘‘Chain of custody requires testimony of continuous possession by each individual having possession, together with testimony by each that the object remained in substantially the same condition during its presence in his possession. All possibility of alteration, substitution or change of condition need not be eliminated. For example, normally an object may be placed in a safe to which more than one person had access without each such person being produced. However, the more authentication is generally in issue, the greater the need to negate the possibility of alteration or substitution.’’2 Importance of Documentation (Keeping Track of Things) 95 the message. I went to the phone in the corner of the room and called her. The human resource director told me that the office manager called the division returning my message, and provided me with a phone number where I could reach him. I asked her if there was any substance to her conversation with the office manager, and she said there was no conversation. I hung up with her and called the number she provided. A male answered, and I asked if I had reached the office manager. He asked who was calling, and I told him my name. I asked him if we could set up a time to meet to discuss the financial aspects of the division. He asked me if he had to meet with me. I told him he didn’t have to do anything, but also reminded him that he was still an employee on paid administrative leave, and that if he did not meet with me, I would forward that information to the human resource director. He asked me what we would talk about. I told him we would discuss the financial operations and bookkeeping procedures of the division, as well as the roles and responsibilities of the individuals who worked within the division. He asked me where we would meet, and I told him we should meet out at the division, so that if there was any information he needed to get regarding the division, he would have access to it (he likely didn’t know the extent to which we had removed the financial documen- tation from the division, as the mole didn’t have access to those areas and no one was present when we removed all the documents that first day). He agreed to meet, and asked when I wanted to meet. I suggested we meet tomorrow morning, 9:00 A.M., as I already had something to do today in the afternoon (and I knew I wanted to ensure we had an entire day to meet if needed without running out of time in the event he had to be somewhere today). I really didn’t have anything in the afternoon, but he had no way of knowing that, and I wanted time to prepare for the interview. I also wanted to keep the office manager in suspense a bit longer, rather than satisfy his need for knowledge on the same day he called and spoke with me. Anxiety is a good thing. He agreed to meet, and we scheduled our meeting for the next day, first thing in the morning at the division. He hung up and I retrieved my notebook to document the call. Then, I shared the call with the senior accountant who had heard most of it anyway 96 Anatomy of a Fraud Investigation because he was in the same room with me. I called the human resource director, and asked that she come back to the division to meet me early tomorrow morning to let me in, as well as to act as a witness if needed during the interview. She said she would be out there anyway making a deposit and going through the bills to be paid by the division. I left the senior accountant with the boxes and went to find Tim. I stood in his doorway while he finished a call, and sat down in front of his desk after he waved me in. Once he finished the call I told him I had just spoken with the office manager, and that I would be meeting him in the morning. ! ! ! Without the bank records for the identified account and the United Alliance statements, I turned my attention to preparing for tomor- row’s interview with the office manager. I returned to the senior accountant, and together we put the records back into the boxes. Once we returned all the boxes to the storage room, I sealed the room again, noting the date and time in my notes. The senior accountant went off to work on other things and I returned to my notebook to review my notes from my initial interaction with the office manager. I spent the rest of the afternoon preparing an outline and notes of issues I wanted to discuss with the office manager. The three most important questions I had to resolve were as follows: 1. How much activity went through the United Alliance account and for how long? 2. How was the United Alliance account paid each month? 3. Where did the funds come from to pay the United Alliance account? I listed out the areas where the office manager had provided inaccurate, misleading, or outright deceptive responses during our interview on the first day. Things like no credit card and no new bank accounts. I wanted to see if he would tell me what his relationship was with the controller, as well as the women in the office, including the woman who worked right alongside him and cried all the time, and the woman who charged personal activity on Importance of Documentation (Keeping Track of Things) 97 the United Alliance card (a.k.a. the mole). I also wanted to deter- mine what else may have been happening at the division beyond the United Alliance account. It is not unusual for interviewees to provide knowledge of other fraudulent or illegal activity, especially if it is perceived to take the focus and heat off of them (at least for a little while). As I thought about the upcoming interview in the morning, I called the human resource director to see if she was going to be out at the division until the end of the day. I wanted to walk through the space and offices again with this interview in mind, and select the most appropriate location to have the meeting. She answered and indicated she would wait for me to come out. I finished making notes on what I wanted to accomplish and headed out to the division. I arrived at the division to find the human resource director working at the office manager’s desk, reviewing the mail and sorting bills to be paid just as she said she would be doing. We talked about my call with the office manager for a few minutes, and then I walked through the division looking at each office. The office I had used to conduct the interviews with the other employees was good for that purpose, quiet and secluded, but it was a distance from the office manager’s desk. I was concerned about being that far away should the interview not go well. I wanted a space that was private, yet close enough to the human resource director. It had to be away from his work area where he could find comfort if he became stressed, and yet LEARNING POINT To ensure an effective interview, you must prepare in advance for the interview, provided the interview wasn’t needed to be conducted on a spontaneous basis, which is rarely the case. Identifying the areas that need to be covered, questions to be asked, and issues to be resolved will help ensure nothing is missed due to a lack of memory. The entire interview doesn’t need to be written out, but a general outline will help ensure all areas are covered prior to ending the interview. In many cases, you will only get one chance at an interview, so best to plan as if each interview will be the only interview that will be conducted. Planning should also encompass the physical environment and details for the interview, as discussed earlier and below. 98 Anatomy of a Fraud Investigation include no distractions. I decided on the office immediately adjacent to the office manager’s desk. The human resource director could work right at his desk just outside the office, and if needed, could come in within seconds. I also figured with her working right outside the office, she would be able to hear everything said during the interview (my hunch was proved to be correct after the interview was finished). I sat at the table and determined where I would sit as well as where I would have the office manager sit. I then sat in the seat I identified for the office manager, and looked around the office for any distractions potentially available to him. I moved things from in front of where he would be sitting to shelves behind him. Other things were moved into boxes and put away, leaving as little as possible in the office. Once I thought I was finished, I asked the human resource director to come in. I had her sit in the chair identified for the office manager, and asked her what she thought were distractions. I moved everything she identified. Then, I sat in my seat and thought about the office manager sitting across the table from me. I asked the human resource director a few questions, and looked to see if I had any distractions that could take my attention from the office manager. All the things I had moved behind the office manager’s seat needed to be moved again, as I could see myself looking up at them while listening to the office manager (I was looking at them already while listening to the human resource director). I had the human resource director return to the office manager’s desk, and asked her to listen to me while I talked on my cell phone. I closed the door and called a friend. I talked at a normal tone with my friend for a minute or two, and then I went out to ask the human resource director if she had heard what I was saying. She had heard everything, and I wasn’t speaking loudly on my phone. With the office chosen and set for the morning’s interview, I turned off the lights and grabbed my things to leave. I asked the human resource director to meet me in the morning at the division at 8:15 A.M., to provide me with a solid half-hour of preparation time prior to the interview. I asked her to be prepared to come into the interview if needed, especially if the office manager confessed or provided some information that could immediately impact the current employment status (paid administrative leave) of any individuals. Importance of Documentation (Keeping Track of Things) 99 She said she would be working right outside the office and would hear everything. She said she could be in the meeting within seconds if there became such a need. I thanked her and headed out the door. It was the end of another long day. LEARNING POINT Planning for an interview should also encompass how to document the interview, having supplies on hand such as a pad and pen, and considering ‘‘what if’’ scenarios. For instance, what if the interviewee admits to some wrongdoing during the interview? Are you prepared to have the interviewee write out in detail his story? Will someone be available if needed to witness and/or notarize his written statement if one is provided? What happens if the individual admits to wrongdoing, and the plan is to place the individual on paid administrative leave pending a decision on his fate with the organiza tion? Will someone appropriate with human resources responsibilities be available to place the individual on leave? Once the interview has begun, it may be too late to have these issues addressed on the spot. The best case scenario is to have contemplated these types of issues in advance, and if needed, execute the plan. The worst case scenario is that resources are prepared to act, but end up never needing to react. 100 Anatomy of a Fraud Investigation 7C H A P T E R IMPORTANCE OF DOCUMENTATION (KEEPING TRACK OF THINGS) Knowing nothing was likely to happen at the division for the rest of the afternoon, I went back to the office I had used for the interviews. It was quiet and secluded, and I knew that I had two things to accomplish. First, I needed to check in with Tim to determine what he was doing regarding bank accounts, credit card accounts, and other related information. We had confirmation from the interviews that the division used a United Alliance credit card account with multiple cards issued on the account. We didn’t have all the credit card statements or supporting charge information, but we had the full account number from the statement provided by the informant. We needed to determine how much volume had been going through that card and for how long. I also needed Tim to request a search of the banks for any bank accounts we did not have bank statements for. He could start by having the known banks provide a listing of any and all current and past accounts in the name of the division, using the division’s federal identification number (or tax identification number) as the identi- fier of any accounts belonging to the division. Once we had a listing from each bank of all the accounts, we could then compare the records in the boxes to determine if all the statements had been found. One goal was to determine how the United Alliance card had been paid each month. 87 Second, I needed to catch up on my documentation for the files. My notes in my notebook were good, but more detailed documenta- tion was needed for the files to support the investigation, especially knowing that the results and consequences of these types of investi- gations were commonly contested by the target, likely leading to civil litigation potentially years down the road. The better and more LEARNING POINT It is one thing to identify unauthorized, non business related personal charges on a company credit card. It is another to determine how the charges were paid. Simply doing one without the other could lead the investigator and the investigation to have problems. It is not uncommon for a credit card to be paid with multiple checks, one from the business and one from the person who charged personal items on the account. It is also not uncommon for the business to pay 100% of the credit card balance, and have the person who made personal charges provide the business with payment to cover the personal charges. Although paying for the charges doesn’t undo the fact that personal charges were made on the account, the fact that the business suffered no financial loss will have an impact on the findings. When it comes to credit card activity, it is important to determine the following: 1. The business maintained a written policy regarding the permitted uses for the credit card. 2. Individuals with access to the credit cards had knowledge of the policies, including permitted and prohibited uses. 3. Charges on the account were identified and determined to be not business related (i.e., personal in nature). 4. The charges were attributable to an identified individual with access to the credit card in question. 5. Supporting receipts and documentation for the charges identifies that the charges were personal in nature and had no business purpose. 6. The targeted individual did not personally pay for the personal charges, either directly to the credit card company or to the business as reimbursement. 7. The business paid the full amount of the credit card payments, and there were no repayments made personally by the individual to the business to cover the personal expenses. 88 Anatomy of a Fraud Investigation detailed my documentation was for the files while it was fresh in my mind, the better my recollection would be two or three years down the road when I could be potentially testifying at a trial. I shut the door and called Tim on his cell phone. He was in his office. I discussed the United Alliance account with him, and he said he had already spoken with customer service at United Alli- ance, and that they would provide the statements only to the individual named on the account. Tim said they would also provide the statement details if they were provided a valid subpoena or a search warrant. I knew that since a civil or criminal matter had not yet been initiated in this matter, the subpoena and search warrant options were not actual options at this time. That would leave us only the option of a request from the controller himself to United Alliance, or at a minimum, a request signed by the controller to United Alliance for copies of the monthly statements for the account. Tim said he had already started drafting a request to present to the controller to sign, and I indicated I had one from a previous case if needed. I told Tim to make sure the request authorized United Alliance to provide copies of the information directly to Tim. Once drafted, the question that would remain was whether the controller would be willing to sign the request. I asked Tim where he stood with the division’s known bank accounts. Tim said he had all the accounts successfully changed earlier in the day, and that he was now an authorized signer on all the known accounts. I asked Tim if he had already requested a search by each bank for any and all accounts to determine if other accounts existed. Tim said he had already obtained that information, and reviewed the identified accounts to ensure he had been added to each identified account. I asked Tim to provide me with a copy of each bank’s listing of accounts, so I could compare the identified accounts to information contained in the boxes. Tim said he received a voice message from the informant earlier in the day, and that he had spoken with the informant by telephone. Tim said he asked the informant if they knew how the United Alliance account was paid each month. Tim stated the informant said they did not know how the United Alliance account was paid or where the records were stored if they were not found within the office manager’s desk along with the bank statements and other paid bills. Tim said the informant also told him that they had spoken with the woman responsible for program-related Importance of Documentation (Keeping Track of Things) 89 activities (the woman who admitted to using the card for personal purposes), and that she told the informant that she had been talking with the controller and the office manager each day by telephone. The informant told Tim that the controller and office manager called her at home each night to determine what was happening and both had assured her that they would be cleared of any wrongdoing, that there was nothing to be found, and that they had done nothing wrong or improper. I finished my call with Tim and reviewed the day’s interview notes. I went back through each page of notes, and added further details to each interview not already documented. I added entries for the message left for the office manager requesting to schedule a meeting. When I finished, I went to find the human resource director. She was sitting at the office manager’s desk going through the division’s mail and invoices. I asked her to come into the office for a minute, and once there, shared with her the information provided by Tim about the woman (a.k.a. ‘‘the mole’’) at the division. I told her we should be careful going forward about what we talk about and where we talked so as to not provide any further information to the controller or office manager through the woman. I also asked her if she thought it made sense to bring her in and ask her more questions, especially directed toward her potential relationship with the controller, the office manager, or both individuals. The human resource director thought we should simply be more careful not to discuss anything at the division, and let the woman continue acting as she has to see what if anything happens with her. I agreed we would wait to talk with her again after we received the United Alliance statements and knew better the extent of her personal activity on the United Alliance account paid by the division. ! ! ! I left the division and returned to the main office to continue reviewing the box contents, focusing on looking for how the United Alliance balance was being paid. I also wanted to access the Quick- Books files again, to look for any signs of the United Alliance activity. I found the storage room sealed with the evidence tape intact the way I had last left it. I noted the date and time in my notebook, and broke the seal covering the door. I found the inventory listing and identified 90 Anatomy of a Fraud Investigation the boxes that contained bank statements and supporting informa- tion. I carried each box into the designated room, and locked the storage room. I also turned on my computer and accessed the copy of the division’s QuickBooks files I had made with the forensic computer specialist prior to returning the computers to the division. I looked through the chart of accounts (the listing of every account within the QuickBooks company file), the vendor listing (for both active and inactive vendors), the ‘‘Other Names’’ listing (one-time vendors both active and inactive), and the other lists within QuickBooks. I didn’t find any activity for United Alliance. Using audit tools and reports available within QuickBooks, I reviewed the voided, changed, and deleted activity to see if the United Alliance activity had been changed or deleted. There was minimal activity and clearly nothing that related to United Alliance payments. It seemed as if the United Alliance activity was never posted by the division within their QuickBooks files. I shut down my laptop and turned my attention to the first box in the room. I emptied the contents on a long table and began sorting the records. The box contained bank statements for several bank accounts at the bank primarily used by the division. Based on the volume of transactions, I determined that at least one of the accounts LEARNING POINT QuickBooks is a powerful and commonly used accounting package suitable for small to medium size businesses and organizations. Accessing informa tion within QuickBooks and generating reports can’t be any easier. However, the trade offs for ease of use and access come in the form of lack of controls over the integrity of the information contained within QuickBooks. Quick Books is the only accounting package I know that allows users to change or delete transactions after they have already been posted, allowing transactions and information to be easily manipulated. In the hands of an individual committing fraud and seeking concealment of his scheme, QuickBooks easily fits the bill for a desired accounting system. The key to relying on any information generated from QuickBooks is corroboration. Generate the reports, but before relying on them, you need to reconcile them to other information, such as bank statements and canceled checks, to ensure the integrity of the information generated from QuickBooks. Importance of Documentation (Keeping Track of Things) 91 was the division’s primary operating checking account. I started a pile for statements containing that account number, and segregated the other statements and information by account number, resulting in several growing piles on the table. Once I had sorted all the contents into piles, with one pile designated for nonspecific infor- mation, I re-sorted the operating statements into sequential order by month and year. I checked through the dates of each statement, and it appeared I had all the monthly statements as far back as the last fiscal year-end, which made sense since the division’s files should have been maintained by fiscal year. Anxious to see if there was any activity relating to United Alliance within the operating account bank statements, I started scanning each month’s statement, starting with the earliest month. I scanned the deposits, checks, and electronic withdrawals, looking for any activity with United Alliance. I found nothing in the first month. I continued to the second month, and proceeded month after month until I had reached the end of the stack. There was nothing paid from the operating account to United Alliance during this fiscal year. Still anxious to see if any payment had ever been made directly from the division’s operating account to United Alliance, I found another box that contained financial documents. I put the box contents on a separate table and sorted the contents. I found similar statements for the same bank accounts, but for the last fiscal year. I sorted the operating statements by calendar month, and started reviewing where I had left off, working backwards this time from the latest month to the earliest month. It wasn’t until I reached the eighth or ninth statement, which would be within the first few months of the last fiscal year, that I identified an electronic payment made to United Alliance on a statement. I knew a common method to process credit card payments was to have them withdrawn elec- tronically from the bank account, and had a hunch that if I looked long enough I would find activity linking the United Alliance account to a bank account. The payment was not a large payment, merely a few hundred dollars, not nearly the dollar level I had envisioned based on the information that had been provided by the informant. It was, none- theless, a payment, and in order for me to link the United Alliance account to a bank account belonging to the division, I needed to find 92 Anatomy of a Fraud Investigation