Fluent Essays

Due on September 15th at 6 pm, in US central time.  For the instruction and information, check the attachment below. Instruction: 1. Read the Chapter 4 reading. 2. Write a write-up outlining ( small article) the major points, 3-5 point for this chapter. 3. Least one page (more is better) 4. Times New Roman, 12 pont, Double space. Due on September 15th at 6 pm, in US central time. (Chicago) I located bank statements and reconciliations in one of the boxes. I sorted the folders by account number, and read the bank and account numbers of each statement to the senior accountant, who captured them for the inventory. I never located any further information relating to the new account at the new bank as identified by papers found in the office manager’s trash bin. Inventorying the boxes took the better part of the day, and by the last box I had a pretty good sense of what was collected and what information was still needed, only to be obtained through some other means. No credit card statements or accounts were located in the boxes. I did find the manual multi-part cash receipts books that were used to record payments as they were received. The three-part, pre-numbered receipt books contained the pink receipt copies, while the white and yellow copies of each receipt had been properly removed from the books. The most recent books were found in boxes containing information collected from the office manager’s desk, and the older, completed receipt books were located in boxes also containing the receipts and deposit details of past periods. LEARNING POINT Many organizations have abandoned the use of manual, carbonless, multi part, pre numbered receipt books, only to be replaced by computer generated receipts, or worse, providing no receipt and indicating to customers that their canceled check is their receipt. Quite often in organizations that continued to utilize the manual receipt books, those receipts were the only means to identify that a potential problem was occurring. The receipt books provide a means for comparing the funds collected on any given day to the funds posted to the system, and also to the funds that actually made it to the bank in the form of deposits. To strengthen the internal controls created by using the manual receipt books, a supervisory level person independent of collecting payments and completing the receipts should retrieve the receipt books at random inter vals, and compare the collections up to that point in time with the completed receipts in the book. This measure will not only add a level of deterrence, as the employees never know when the book will be pulled and reconciled, but would also test for compliance with the receipting requirement. In the case of a potential theft of cash receipts or payments received by an organization, the receipt books could prove invaluable. Receipts in the (Continued ) Reviewing the Evidence (The Day After) 51 I pulled the receipt books from their respective boxes, and placed them into envelopes. I marked each envelope with an evidence label, and identified the box number and origination of each envelope’s contents. ! ! ! (Continued ) books could be identified for targeted periods, and compared to payments posted within the accounting system as well as to the actual bank deposits. In the case of lapping, where a payment from one customer is used to offset the outstanding balance of another customer to conceal the diversion of the payment made by the first customer, the receipt book would identify the customer who provided the payment. In comparing the manual receipt to the system entries, the payment either would match customers or it wouldn’t. Now if the manual receipt books were eliminated to streamline the process or remove a ‘‘redundant’’ step, identifying a lapping scheme would be much more difficult, if not impossible. FRAUD FACTS Lapping is the fraudster’s version of "robbing Peter to pay Paul" skimming. It is the extraction of money from one account to cover shortages in another account. For example, a fraudster steals the payment intended for customer A’s account. When a payment is received from customer B, the thief credits it to A’s account. And when customer C pays, that money is credited to B. Repeated many times, lapping is difficult for the dishonest employee to keep track of. As a result, almost all lapping schemes quickly reveal themselves. All material cash misappropriations send telltale signs: reduced cash combined with increased expenses and/or decreased revenue. Most lapping occurs because of inadequate control over incoming payments. The following are some classic "red flags" of lapping: ! Excessive billing errors ! Slowing accounts receivable turnover ! Excessive write-offs of accounts receivable ! Delays in posting customer payments ! Accounts receivable detail doesn’t agree with general ledger ! A trend of decreasing payments on accounts receivable ! Customer complaints1 52 Anatomy of a Fraud Investigation It was about 2:30 in the afternoon. I had been through all of the boxes, at least preliminarily, and the senior accountant had captured a decent inventory of what we had collected. Much of the information appeared to be unrelated to the allegations, and we started to think about how to separate the information that might be pertinent from that which could be returned to the division. It was at about that time that I received a call from the human resource director. She had gone out to the division first thing in the morning and was working with the remaining employees to minimize the effects of yesterday’s visit, as well as to help keep the division running as close to normal as possible. Tim, too, was busy throughout the day dealing with the banks to effect a change in authorized signers to allow the division to continue operations without having to open completely new bank accounts. While no further banking would be allowed through the controller, an additional authorized person would need to be added to all accounts. That person was Tim, and once authorized, Tim would be temporarily responsible for things like signing the division’s checks, authorizing payroll, and effecting bank transfers as needed. The remaining staff could continue to receive, process, and deposit payments under Tim’s guidance and review. The human resource director indicated to me that she was having a real problem with the woman who was present yesterday when we arrived, in that she could not get anything accomplished without crying. She said she spent most of the day crying, and nothing she would tell her could get her to come around. She asked me if I had any suggestions regarding what she could do with the woman. Due to the lateness of the afternoon, I didn’t see any point getting into the car and driving over to the division to talk with the woman. I figured if she had cried most of the day, then she needed more time before I could make any inroads in talking with her. I told the human resource director that she should send her home for the rest of the day, and that I would want to meet with her first thing in the morning. With that the human resource director walked her out and the woman left for the remainder of the day. I called the human resource director back to talk about how things went at the division for the day, and to see how the other employees who were not present yesterday reacted to the news. The human resource director said not much had happened at the division today, much as if the division’s office had been closed for a holiday. Reviewing the Evidence (The Day After) 53 She said two other employees, both women, had come in and wanted to talk privately with her to learn firsthand what had happened yesterday, and most importantly, what had led to yesterday’s abrupt visit. She also said both individuals asked to meet with me privately the next time I came out to the division. I asked the human resource director to set up meetings for tomorrow, as I would be out there anyway meeting with the first woman, and said that I would have time to meet each person during that visit. I also indicated that I would be bringing back some of the information to the division that was deemed not pertinent to the investigation the next day for filing back where it originated. I went back to work with the boxes and bags, focusing on segregating the pertinent information from all the rest of the boxes and bags. As I revisited each box in numerical order, I identified the items within each box deemed pertinent. I removed the contents deemed not pertinent, and placed them in a new box. The box was labeled, and the pertinent contents remained in the original num- bered box. In the case where an entire box was deemed non-pertinent, the box was set aside with the new boxes for return to the division. The senior accountant documented the segregation of the con- tents, as well as the new boxes filled with non-pertinent information. The spreadsheet originally consisted of 26 boxes and 4 bags, and now built off of those items were the new boxes established for non- LEARNING POINT Space is often a commodity, especially secured space, such as within an evidence room. Often a significant amount of information is collected in the field, and unless the information is sorted to segregate the pertinent evidence from everything else, a few investigations will consume all your space. In many cases, much of the collected information will not be needed to support the goals of the investigation. Why consume the precious space with this un needed information? Segregate the information, document how it was segregated, and prepare to return or otherwise provide alternative storage means for the collected information that won’t be required to support the engagement. This will reduce the amount of space required to maintain the pertinent evidence in the secured environment. 54 Anatomy of a Fraud Investigation pertinent contents to enable a complete tracking of the contents of each box and bag. Once completed, we stacked all the boxes and bags to be returned to the division tomorrow, and matched the stacked boxes and bags to the spreadsheet inventory. We then moved the original boxes, one by one, back into the storage room, once again matching the remaining boxes to the spreadsheet inventory. The storage room was shut and secured for the night, and I placed a piece of evidence tape across the doorjamb to ensure no one went into the room until I returned late tomorrow, or the following day. As we were preparing to end our day, my cell phone rang. I found my phone and recognized the number. It was the computer forensic specialist calling. Reviewing the Evidence (The Day After) 55 4C H A P T E R REVIEWING THE EVIDENCE (THE DAY AFTER) That night I had a late supper and tried to unwind as I spent time with my family. The day was fresh in my mind, and I knew that once they went to bed I would have more time to work on the case. Many things happened during the day’s events, and I have learned it is best to capture as many details as possible while they are still fresh in my mind. I found my notebook from the day. I also retrieved my Dictaphone, a mini–voice recorder I used to capture information for memos and documents. Flipping through my notes, starting from the beginning of the notebook, I recorded the day’s events as best I could recall using my notes and my memory (albeit a very tired memory). I was able to dictate two complete tapes, both sides, before completely running out of energy (about 60 minutes’ worth of information). The morning came amazingly fast, and I knew I wanted to get to my office to drop off the tapes with my administrative assistant so that she could type them into memos the same day. As I planned my day, I realized that there was no way I was going to be at the building by 8:30 after dropping off the tapes unless I managed to get the morning routine accelerated a bit. I completed the morning drop-off at school earlier than usual, and then ran to my office. As luck would have it, I hadn’t thought about needing my laptop, but seeing it on my desk reminded me to bring it along. I was back on the road in a flash, and was pleasantly surprised when the traffic was lighter than usual. I pulled into the parking lot with five minutes to spare. As I went to the trunk to retrieve my laptop, I grabbed a note- book, a new tape for my Dictaphone, and a box of permanent 45 markers. Although collecting all the boxes and bags of potential evidence yesterday was exciting, I was now dreading having to look through 26 boxes and 4 bags of information. ! ! ! I met Tim in his office, and we walked down the hall to retrieve the senior accountant. Tim indicated that the senior accountant would be working with me to go through the boxes and bags. We walked to the storage room, and the tape was still intact as we left it last evening. I noted the date and time in my notebook, and then cut the evidence tape to allow Tim to open the door. As the door opened and he flicked on the lights, I noticed the rather large collection of boxes, and could only imagine how long it would take to go through the contents of each and every box and bag. Tim had reserved a large meeting room right around the corner from the storage room, and told us both rooms would be available as long as needed to complete the investigation. One by one we carried the boxes and bags from the storage room into the meeting room and placed the boxes and bags on the floor in numerical order. After several trips, all of the boxes and bags were lined up on the floor of LEARNING POINT A key to a successful investigation is the ability to maintain complete and accurate detailed notes. It would be best to record them along the way as things occur, rather than relying on your memory to recollect the details and documents at a later date. While writing in a notebook would be an efficient means, there may be other ways to memorialize the details as they occur, and later have them put into a more permanent format, such as your notebook. Having a pocket dictating device, whether digital or tape, could prove invaluable when you need to capture details but can’t write them down in your notebook. An advantage to using electronic recordings is that it allows you to record as it occurs, and also allows you to capture details while doing other things, such as driving back at night from a meeting. The taped notes can be transcribed later into your written notes without losing the rich details. As a rule of thumb, I try and capture sufficient details to allow me to recollect what happened, when, where, and why, three years from when the notes were taken. It is not uncommon for a case, especially the civil aspects of a matter, to be heard and resolved two to three years or more down the road. 46 Anatomy of a Fraud Investigation the meeting room. Tim left us to begin the task of inventorying and documenting the contents. The senior accountant brought his laptop into the meeting room. We dragged a table over to be close to the area of the boxes and the senior accountant launched Excel on his laptop. The senior accountant stated that he would create an Excel table to be used for inventory purposes to track the contents, and if I were to go through each box in order and describe what each box contained, he would capture the information within the spreadsheet. We started with the four numbered garbage bags that contained the contents of the trash bins out at the division. I opened the first bag and emptied the contents onto a table. Then I put on a pair of latex gloves to ensure I didn’t get anything on my hands. The senior accountant captured the bag number and location where the bagged contents originated, and watched as I sifted through the trash contents. The bag came from the bin adjacent to the woman’s desk, and contained no financial information. Plenty of dirty tissues, food wrappers, used coffee cups with empty sugar packets, and other delightful things, but nothing financial that would help us identify if and how funds were being diverted. With all the contents placed back into the garbage bag, I resealed the bag and placed it back on the floor. The senior accountant documented ‘‘nothing financial’’ within the spreadsheet. One bag down, three more to go. LEARNING POINT What’s in your audit bag? Think about the procedures you may need to perform in a financial investigation, such as sifting through the contents of garbage pails or a dumpster (hopefully not that often). How prepared would you be if you needed to perform these types of procedures? For instance, do you have disposable rubber gloves in your bag? Would you want to sift through others’ garbage contents with your bare hands? And what if you find something in that garbage collection? How will you collect it, and how will you secure it? A pair of forceps would be handy to keep you from having to touch it, and help keep your fingerprints off the evidence, as would large, clear plastic bags to allow the evidence to be collected and preserved, and even be photocopied through the bag if needed. Think about the types of evidence you may be required to collect, secure, and preserve, both docu ments and electronic information, and be prepared out in the field. Reviewing the Evidence (The Day After) 47 Bag number two came from the office manager’s desk area. We alreadyknewtherewasfinancialinformationpertainingtotheopening of a new bank account in his trash, as it was identified during the collection process yesterday. I emptied the contents onto the table and sifted through the trash. There was much more financial information inthistrashbin,includingablankdepositslipandanenvelopefromthe new bank. Deposit receipts dated within the last few days were also found,along with paperwork and offers commonly found in envelopes containing vendor invoices. The only interesting items found in the bagrelatedtothenewbankaccount,especiallywhentheofficemanager had stated yesterday that there were no new or other known bank ac- counts. I placed the bank-related items into a clear protective sleeve, and labeled the sleeve with an evidence label, identifying the bag num- ber and location where the items originated. I put the remaining trash items back into the bag, sealed the bag, and returned it back to its spot on the floor. Two bags down and nothing earth shattering found yet. Bag three, collected in the conference room area, was much like the first bag. A whole lot of food-type trash but nothing financially related. Bag four, however, contained the contents of the controller’s garbage bin. As I emptied the contents onto the table, I saw portions of a credit card statement in the pile. I also saw vendor invoices and other financial information. I carefully sorted the contents between financial and non-financial, and returned the non-financial items back into the bag. Then I sorted through the financial items, and the senior accountant came around the table to watch over my shoulder. Credit card offers torn in half, many empty used envelopes, and a piece of a credit card statement with the last four digits of the account number identified (the beginning portion contained all asterisks). I placed the credit card statement into a clear protective sleeve, marked the sleeve with an evidence label, and returned the remain- ing items into the bag. I sealed the bag and returned it to the floor, a bit disappointed that I didn’t find more in the contents of the four trash bins. I set the credit card statement aside to later match the account number, or at least the last four digits of the account number, to the credit card statement Tim had provided me with at the onset of the investigation. I left the senior accountant alone in the room with the boxes and bags, and walked over to Tim’s office. I waited in his open doorway until he finished his phone call. Then I asked if I could ask him a question regarding his closed-door meeting with the controller 48 Anatomy of a Fraud Investigation yesterday at the division. I asked Tim to describe what happened with the controller from the time he was escorted to his office until he left the building. Tim said the controller wanted to retrieve his personal items and information from his office, and indicated he maintained personal items in his desk. Tim said he escorted the controller back to his office, closed the door and stayed with him the entire time. Tim stated the controller worked at his desk and sorted through piles of papers that he had retrieved from the desk drawers. Tim said he made a stack of papers on the top of his desk, and as he flipped through the papers, he put some into a separate pile. He also put some items back into the drawers, and threw others away in his trash bin. Tim said he watched as the controller removed papers from envelopes, ripped the envelopes in half, and threw them into the trash bin. When the controller was finished, he put the stack of papers from his desk into his briefcase, and walked over to the shelves on the wall. He flipped through the stacks of papers on the shelves, and went through the papers much faster than when he went through his desk. Tim said when he finished looking through the shelves, the controller walked out of the office with his briefcase full of papers, with Tim following right behind. I asked Tim if he saw or recognized any of the papers the controller put into his briefcase. Tim said the controller said he kept personal bank account statements in his desk, and that the papers he was taking with him related to his personal accounts. I asked Tim if he flipped through the papers the controller was taking to verify what the controller was saying. Tim recognized someone should have reviewed the papers before allowing the controller to leave, in order to ensure they were in fact the personal bank statements for his accounts, and not critical evidence regarding the credit cards or undisclosed bank accounts. In retrospect, someone should have reviewed everything the controller was taking. We both realized that the papers the controller frantically reviewed and removed were likely related to this potential schemethatheperpetrated,andthathetooktheveryevidencewewere seeking out the door with him in his briefcase. ! ! ! I returned to the meeting room. The senior accountant was still in the room, typing on his laptop. I now needed to focus my efforts on the 26 boxes that waited to be inventoried, knowing the information relating Reviewing the Evidence (The Day After) 49 to the potential fraud was likely not in any of the boxes. It likely left with the controller as he walked away from the building, never to be seen again. It also made me wonder why the controller spent so much time going through the papers in his desk, and then leaving his laptop behind. I figured if there was any evidence remaining, it likely wasn’t on his laptop, or he would have taken it with him. I opened and reviewed the contents of each box, following them in sequential order, while the senior accountant captured information for each box. One by one, I went through each box, finding deposit details for several fiscal years, paid invoices, payroll records, and financial reports of various types. I knew from Tim that the division utilized the QuickBooks accountingsystemfor their bookkeeping, and the reports I found had that familiar QuickBooks look and feel to them. I also knew from personal experience that QuickBooks was one of the easiest accounting packages in existence to manipulate at ease, to reflect whatever activity and results were desired. It remains one of the only systems to allow an unrestricted user to change or delete transactions atvirtually any time,leaving little ornothingin the form of an audit trail. Even a basic-level user who spent just a little time with the system could figure out how to delete the audit logs, removing any possible discovery of changed or deleted transactions. LEARNING POINT QuickBooks, especially the later versions, includes some great tracking logs and audit trails. Most unsophisticated users do not even know these files exist, tracking user transactions, changes, deleted transactions, and voided transac tions. The logs and trails, though, can be disabled or turned off by a sophisticated user. The files can also be purged, permanently deleting the contents of the logs and trails. The first thing to look for is the existence of the information. If present, then the user likely never knew about the tracking, or didn’t have a chance to delete the contents. However, if the target was tipped off before access to QuickBooks had been gained, all may still not be lost. This is when you hope the organization has backups of the drive containing QuickBooks. You may have to go back a week or even further, but if a decent backup strategy is in place, you may find that you can gain access to the QuickBooks files at a date prior to when the files were purged or deleted. If no backups exist before the deletion occurred, you are likely out of luck. That’s another reason why the element of surprise is important in these types of cases. 50 Anatomy of a Fraud Investigation