Memorable cases, part 2

ACFE members who are educators all want one thing for their students: case histories. Why is that? Because actual stories of how fraud examiners interviewed subjects, discovered evidence, scrutinized the books and used their intuitive abilities are instructive.

I'm guessing that just because you've graduated you haven't lost your desire to read about how other practitioners conducted their fraud examinations — you might just pick up a tactic that could turn the corner in your next case.

So we embark on a few more case histories from our ACFE faculty members. Enjoy.

Forged signature leads to much more

A vice president at a publicly traded company, and probably the CEO's heir apparent, was caught forging the CEO's signature on his expense reimbursement forms on Jan. 21, 2014. "The company hired my firm on Jan. 31 of that year to look at processes and procedures to ensure this wouldn't happen again," says Tiffany Couch, CFE, CPA/CFF, principal at Acuity Forensics. (She teaches Principles of Fraud Examination for the ACFE.) "They didn't think any malfeasance had happened but had asked that I verify that this was an error in judgment — not fraud," she says.

"We discovered the fraud the first day of onsite procedures," says Couch, an ACFE Regent. "First, we had asked for the vice president's calendar, to match up the alleged travel on the reimbursement forms. We found discrepancies. The case was blown open when I called a vendor to confirm the $8,610 in marketing materials he had claimed as purchased. I knew we had a problem when the vendor representative said, 'Ma'am, we don't sell anything for $8,610 … and we don't have materials with that name and description on any of our sales lists.' "

'Bad judgment' call

Couch's initial interview with the CEO revealed the vice president's lifestyle, background and sequence of events but also the biggest clue of all, she says. "You know, Ms. Couch," the CEO said, "I just don't understand why David would do this when he could authorize transactions up to $50,000 through the accounts payable system without any additional approvals. All of these marketing-related expenses could have gone through A/P without needing my signature. I just don't get it. I'm so disappointed that he made such a bad judgment call."

The vice president had submitted more than $1.6 million in expense reimbursements in 10 years, Couch says. "We itemized each and every receipt. We found that he used the same vendors over and over again to submit marketing lists, conferences, etc. as expenses," she says. "We used an audit technique — 'confirmation letters' — to confirm if the expenses were real. For the initial vendor I had called, the vice president had turned in $290,000 in receipts," Couch says. "The vendor's confirmation said that he had only purchased $1,500 in goods and services in the same time frame. Most vendor results were similar."

Couch says she sent copies of the receipts to the vendors, and they were all "extraordinarily helpful in walking us through" how the vice president's documents were forgeries.

His laptop and company-issued phone were important pieces of evidence, Couch says. "We found evidence of his forgeries, copies of 'budgets' showing his shortfall of cash at home and always plugging those shortfalls with the next fraudulent expense reimbursement on his computer."

Emails were important in proving the wire fraud for the federal government, she says. "He had processed some of his expense reimbursements through email exchanges with accounts payable. As a result, he was indicted on wire fraud."

Working with the FBI early in case

"Our client gave us the green light to finish the fraud examination and hand it over to the FBI," Couch says. "We showed the FBI our work, confirmations from vendors and our plan to wrap up the investigation in a matter of weeks — with the promise of a deliverable reporting losses greater than $1 million and a marked evidence binder."

The FBI agent took Couch's materials to the assistant U.S. attorney and gave him the green light to investigate. Couch's March 17, 2014, report plus a marked evidence binder reported losses of $1,447,553 between 2003 and 2014. The vice president was indicted for wire fraud for the full amount reported three weeks later on April 9, 2014.

He pleaded guilty to one count of wire fraud on June 12, 2014 — five months after the CEO discovered the questionable signature. The vice president is serving a 46-month prison sentence in a federal penitentiary. The court ordered him to pay back the more than $1.4 million. "The judge told the defendant that when he was called a crook, a liar, a cheat, and a forger by his former colleagues, he had 'earned each of those titles,' " according to an Oct. 2, 2014, FBI release.

"The timing of the fraud examination, report to the FBI, indictment and conviction were truly remarkable," Couch says. "I would like to see more cases worked in this way — teaming with law enforcement early on to get results."

Lessons learned for application to future cases

Couch recommends the following:

• Interviews early in a fraud examination are key to gaining background and providing clues. Let the interviewees express their feelings and tell their stories uninterrupted.
• Use all the tools in your tool belt. "Confirmations" is an audit technique, but it was the perfect method for discovering the needed evidence to prove our case.
• Follow your hunches. Your instincts exist for a reason.
• Get law enforcement involved early, and provide them with solid evidence and information they can use to hit the ground running. 
• Provide a remarkable deliverable. A detailed report with marked evidence assists law enforcement in understanding the case and "selling it" to the prosecuting attorney's office.

Ironic ending

According to an Oct. 15, 2014, FBI release, the day after the vice president's sentencing his attorneys told prosecutors that he co-owned a property with an associate. He requested that only 50 percent of the sale proceeds of that property be applied to his restitution obligation with the other 50 percent to go to his associate.

Prosecutors discovered that his associate wasn't listed in country property records, so they refused the request. The vice president then gave the court an "ownership contract executed in March 2005" between him and his associate. But then his supposed associate told the government that he had approached him just days after his sentencing and asked him to sign and backdate a forged "ownership contract."

The judge revoked his's pretrial release and said that he didn't "trust him farther than I can spit."

"One week after being sentenced and allowed to spend the holidays with family," Couch says, "The vice president was brought back into court, cuffed and hauled off to local detention, where he had to stay until January when he was transferred to a federal prison."

Shaking down three branches of the Fraud Tree

Seldom does a case yield crimes from all three branches of the ACFE's Fraud Tree, but that's what Gerry Zack, CFE, CPA, CIA, found when he investigated fraud in a large nonprofit organization.

In 2011, a whistleblower revealed that six years earlier, the organization's COO — a close relative of the CEO — had embezzled $575,000. "But the CEO — who knew about the embezzlement — she had hidden the crime from the board of directors. He settled for the family member's agreement to repay the funds and to remove herself from future financial oversight duties," says Zack, a managing director in the Global Forensics practice of BDO Consulting and a former chair of the ACFE Board of Regents. (He teaches numerous courses for the ACFE.)

"The board brought me in to determine whether the family member — the COO — had committed any additional financial improprieties since the initial embezzlement," Zack says.

The board also suspected that the controller — whom the COO hired after the initial embezzlement as part of removing herself from financial oversight duties — had followed in the COO's footsteps and cheated on his expense report. Zack also investigated this allegation.

"Much of the earlier $575,000 embezzlement involved personal expenditures on the organization's corporate credit card," Zack says. "So, our initial focus in this investigation was to determine if the COO had continued to misuse the corporate credit card after the initial embezzlement. Our analysis determined that no further suspicious transactions appeared on her corporate credit card."

Zack says the fraud examination involved numerous interviews; document analysis; review of email communications; and forensic analysis of data extracted from general ledger, general journal and credit card data.

More abuse and misuse

Although Zack and his team didn't find any additional credit card abuse by the COO, they did find several additional instances of her inappropriate financial oversight (a violation of the terms of her agreement with the CEO) and misuse of organizational funds. These included improper use of funds restricted by donors and grantors for specific programs and inappropriate transfers of funds among various affiliated entities, which she disguised as legitimate transactions.

"In some cases, the COO would provide incorrect instructions to the accounting department on how to account for these transfers and purchases," Zack says. "For example, in one transfer from the nonprofit organization to a for-profit affiliate used to purchase real estate in the name of yet another affiliate, the family member directed accounting to account for the transaction as a 'contribution' expense."

The former COO also used $75,000 of organization funds for her personal defense in legal battles unrelated to the nonprofit organization. She disguised this fraudulent expenditure as "corporate legal expenses."

Of course, the CEO and the COO hid all of these transactions from the board of directors.

The CEO never properly accounted for the $575,000, and the COO never fully repaid it to the organization. From an accounting perspective, the CEO transferred the amount due to the organization from the COO among multiple affiliates, and ultimately he misrepresented it as a prepaid expense — rather than an amount receivable from the COO — on the organization's audited financial statements.

"Again, the CEO did this so he wouldn't have to disclose the embezzlement or the true nature of this account to the board of directors while the family member continued to work for the organization as COO," Zack says.

"We found additional surprises. The controller — whom the COO hired — used his corporate credit card for personal gain," Zack says. "We found he had made several different types of inappropriate charges — totaling about $18,000 confirming the board's suspicions."

Zack also found that the organization had reimbursed the crooked controller for other inappropriate charges totaling $20,000, including some items that the corporate credit card had already paid for, which brought the total expense reporting fraud to $38,000.

"But things were even worse than the board had imagined," he says. "I also found that the controller — in collusion with an employee from the human resources department — had arranged for inflated and duplicate payroll amounts to be paid to him plus about $45,000 in payments that were improperly accounted for as payroll advances (assets). Of course, he never repaid the advances."

Zack also discovered significant evidence that the controller and the colluding HR employee had developed an inappropriate personal relationship and charged $10,000 to $15,000 for supposed business trips but actually were for vacations they took together.

"The corrupt culture at the top of the organization might have led to the controller's easy rationalization of his frauds," Zack says. "Apparently he knew about the COO's embezzlement cover-up."

The organization didn't prosecute, but the CEO resigned because of his failure to disclose the family member's embezzlement. And the organization terminated the COO — the CEO's family member. The organization never prosecuted the crooked controller, and he's now a controller at another nonprofit.

Researching processes before fraud examination pays off

Zack says the case reiterated a basic truth: A fraud examination can yield so much more than the initial allegation.

"Also, performing a proper risk assessment and learning relevant processes are important parts of a fraud examination," he says. "When we were investigating allegations of the controller charging personal expenditures on the corporate card, we could have simply looked at charges on the card and stopped there," Zack says. "But that would've found only that part of the fraud and not the payroll fraud or the connection to the corrupt human resources employees. However, by first learning how the corporate card and expense reimbursement processes were supposed to work, we identified an anomaly in the data — unexpected user ID of the person entering his expense report — that led to discovery of the relationship between the controller and HR employee."

Challenges of a global digital forensics analysis

Digital forensic expert, Walt Manning, CFE, president of Investigations MD, vividly remembers one case because it defined the global nature of fraud. "This case was memorable for me due to the challenges of conducting a forensic search involving multiple languages," says Manning, who teaches "Obtaining, Managing and Searching Electronic Evidence" for the ACFE.

"Documents and other communication required that we search for any responsive data in three languages: Portuguese, Spanish and English," he says. "This required the assistance of professional translators to identify all responsive evidence and to provide accurate translations for the investigators to review."

In this case, which was from 2000 through 2003, the CEO of a Brazilian subsidiary of a U.S. Fortune 500 company, Manning's client, helped create a company in his wife's name that entered into direct competition with his employer, Manning says. "At the same time, he and others in the organization also became involved with organized crime members to illegally buy and sell tax credits," he says.

"By using the knowledge of the parent company operations, he could ensure that the competing company could steal a large volume of business," Manning says. "There was also no oversight related to the transactions involving tax credits. The client never revealed an exact amount of the total losses, but it was millions of dollars.

Manning says his client initially suspected some type of small-scale fraud. "Due to email and other documents recovered during the digital forensics analysis, investigators were stunned that the size of the fraud scheme was several orders of magnitude larger than they had ever suspected," he says.

The company investigators coordinated with a Brazilian law firm to conduct all interviews and local evidence, Manning says. "Due to the volume of evidence, my company also assisted the investigators in developing a case management plan to inventory and track all of the digital evidence."

Manning says his client never informed him if the perpetrators were prosecuted, but the victimized company did manage to recover most of their losses through civil actions in the Brazilian court system.

Challenge of multiple languages

"Of course, with the increased globalization of business, fraud examiners should not be surprised to see documents and communications in other languages," Manning says. "They might want to consider identifying trusted resources to consult with and provide interpreting and translation services. Multiple languages can cause challenges for both digital forensics and e-discovery searches of electronic data.

"Companies with foreign subsidiaries should ensure that they conduct adequate oversight of those operations with possible background checks of the other companies with which they do business," Manning says.

Dick Carozza, CFE, is editor-in-chief of Fraud Magazine. His email address is: dcarozza@ACFE.com.