Learning the art of fraud examination

CFEs love fraud examinations that move in a linear fashion — from the general to the specific, gradually focusing on the perpetrator through evidence analysis. But life, of course, seldom moves in a straight line.

Consider a case worked by Robert Hogan, CFE, who owns a fraud examination and forensic accounting practice, Hogan Consulting Group.

“Because my clients typically do not have formal fraud response policies and procedures in place, I often run into situations where the initial response to suspicions or allegations of fraud may be mishandled,” Hogan says.

“For instance, a branch of a large company received an anonymous report that an accountant in the branch was overcharging clients and then diverting those overages to a personal account when clients made their payments,” he says. “Upon receiving the tip, the branch manager confronted the accountant, which lead to an argument in front of staff. The branch manager disengaged and contacted corporate HR, which gave the accountant time to return to his office and destroy accounting records that included evidence of the fraudulent activity.

“The accountant then quit before HR and legal were able to intervene, and in doing so removed a company-issued laptop and other records,” Hogan says. “My immediate task when retained by the company was to attempt to recreate the missing and destroyed records to preserve what evidence may have been included within.”

Flexibility and adaptation

Few fraud examinations follow desired patterns. But that’s okay. Trained fraud examiners can deftly adapt principles around messy situations to develop investigations that can lead to satisfactory conclusions.

Fraud Magazine recently interviewed some experienced CFEs to get their thoughts on fraud-theory approaches, their anti-fraud radar, evidence gathering, learning from mistakes and lessons they can give to the rest of us.

The opening case, Hogan says, is a good example of conducting an examination in a non-linear fashion. “Essentially, rebuilding accounting records required an iterative process of reverse engineering individual transactions,” he says. “I started with the information I did have — deposit receipts of client payments and hard copies of invoices sent to customers — and then worked backward through the transaction process to get to the purchase order originations.

“In this way I was able to take a net payment, break it out to the individual orders, and then break those orders out to the itemized billings,” Hogan says. “Only then did I have the ability to see the full details of all billings so that I could analyze where fraudulent billing items were added to specific invoices.”

Jeff Matthews, CFE, CPA, remembers when a case also didn’t begin in textbook fashion. “While it is desirable to advance from general to the specific, sometimes the response needed is more urgent, or coming face-to-face with the perpetrator early on is simply unavoidable,” says Matthews, partner at StoneTurn and an ACFE Faculty member.

“One of the most important intra-personal skills of an investigator is being adaptable,” he says. “I remember one specific matter in which a senior executive was suspected of establishing a corporate bank account and embezzling funds through intercompany transfers. It was discovered when the executive took a rare vacation day — a red flag all unto itself.

“We had one day to search his office and computer. In the middle of that process, the executive unexpectedly walked in,” Matthews says. “Luckily, the perpetrator was an accountant, and the sparse information we did have was very organized. Accountants make the best fraudsters. With very little, but well-organized evidence, and certainly not far along in the process, our team had to begin our interview.”

Jala Attia, CFE, also had to quickly shift her thinking — in this case, in her initial predication. “I once worked on a case that was focused on a physician performing excessive numbers of tests,” says Attia, president and founder of Integrity Advantage, which specializes in fighting health care fraud, waste and abuse. “All information and data we obtained at that point had us convinced that we had the right subject. When we finally went to visit the physician’s office, there was no trace of him. His name wasn’t displayed, and he didn’t have an office within the building. As we toured the office, we found another name that we had never heard or seen in any of the data we reviewed, which lead us to a chiropractor. We later found that the chiropractor had hired the physician in order to use the physician’s professional license to attract patients. We took two steps back and reviewed the data we started with to see if the services we believed were being performed by the physician were actually performed by the chiropractor. We found that the chiropractor was acting outside the scope of his license — conducting and billing these tests inappropriately.”

Fraud-theory approach

The fraud-theory approach normally consists of analyzing available data, creating a hypothesis, testing the hypothesis, and refining and amending the hypothesis. Hogan, Matthews and Attia have diverse clients that vary widely in their fraud-fighting capabilities. Jennifer Weber, CFE, who works for the public sector, has a more predictable (if that’s possible) line of work.

Weber is a special agent with the New Mexico Office of the Attorney General. (She’s also president of the ACFE New Mexico Chapter.) “As a law enforcement officer, focusing on financial crimes exclusively for the last eight years, I have developed a routine to approach my investigations,” Weber says.

“My investigations always begin with the initial allegation. I review the allegation, brainstorm what evidence could be available, where to find it and how to obtain it. After the initial review, I conduct interviews of the complainant, the victim and potential witnesses. I almost always wait to interview the suspect. I want to learn as much as possible before confronting the suspect,” Weber says.

“Developing a fraud-theory approach for a case is important, but it isn’t a one-time process. A brief overview of the common steps of an investigation I take are: review the allegation, determine the scope of the investigation, initial interviews, obtain evidence, review and analyze evidence, interview the suspect and prepare a case report to document findings. I find it’s important to identify intent to defraud,” Weber says.  “I then finalize the case findings and prepare a case for closure — with recommendation for criminal prosecution or, sometimes, closed due to insufficient evidence.”

While it is desirable to advance from general to the specific, sometimes the response needed is more urgent, or coming face-to-face with the perpetrator early on is simply unavoidable.

“I almost missed a huge fraud scheme once because I was so focused on the first scheme found by the client — a fraudulent disbursement scheme,” Couch says. “A simple bookkeeping question asked by the office manager unraveled a much-larger cash skimming scheme.”

David Wall, J.D., CFE, CPA, a forensic accountant in the Riverside County District Attorney’s Office, previously worked in fraud examination roles in the private sector. He says he’d develop an initial theory through a brainstorming process with technical experts in the functional department or business unit along with experienced examiners and/or auditors.

“We undertake initial evidence collection in a manner not to arouse suspicion,” Wall says. “This will sometimes entail ad hoc searches of a subject’s work area or office after hours, review of her emails and other materials on her company computer and/or portable device.

“Assuming we observe a predication, detailed testing of the theory will usually involve export and analysis of accounting information and other transactional data contained within an ERP system and review of source materials, among other procedures,” he says. “The data-gathering process is often conducted under a pretext of a performance audit or process improvement engagement.

“Refining and amending occurs continuously as analysts communicate daily with supervisors and managers. Regular discussions are conducted with upper management or outside counsel, who are the consumers of the investigative work product,” Wall says.

Bret Hood, CFE, director of 21st Century Learning & Consulting and an ACFE Faculty member, says he’s learned that “framing” is important to his hypothesis. “Whereas I used to simply frame the hypothesis in a manner such as, ‘Could the allegations support that a fraud has occurred and what evidence do I need to find to confirm my theory of what happened?’ I have since changed my approach, and I use two very different frames to try and counteract the effects of bias,” Hood says. “I also ask, ‘Could the allegations of fraud be erroneous? What evidence could I find to support this theory?’ In this manner, I’m not only looking for evidence of a violation but I remind myself to also look for evidence that could support innocence.”

Anti-fraud radar

Anti-fraud professionals pick up tips via hotlines, email complaints, office gossip and accounting clues, among other means. But experienced fraud examiners often use their inner radar — the hunch in the gut — to find fraud.

Couch says she once was asked by a client to conduct an internal-control assessment involving the processing of expense reimbursements after a long-term, trusted employee was caught forging a signature on his reimbursements. “It was understood that the only issue was the forgery,” she says. “I kept asking, ‘Why would an extremely well-paid employee on the path to CEO do such a thing?’ It bothered me. I was looking at a particular expense reimbursement and decided to call the vendor on the receipt to confirm the purchase.

“I cannot explain this hunch,” she says. “I cannot explain why I called. But, I did. I asked the person on the phone for help. That I was conducting an audit and needed to confirm this expense. They had no record of the expense. That call unraveled the fact that he had forged that entire receipt and most of the receipts he had submitted. That one hunch led to the discovery of an expense fraud scheme in excess of $1 million."

I almost missed a huge fraud scheme once because I was so focused on the first scheme found by the client — a fraudulent disbursement scheme. A simple bookkeeping question asked by the office manager unraveled a much-larger cash skimming scheme.

Gathering that evidence

After a CFE has determined the predication is sufficient and has developed a fraud theory, the next step, of course, is discovery. Finding evidence differs for different sectors and industries, of course. “In the health care field, we deal a lot with providers of medical services and supplies,” says Attia. (Attia is also an Accredited Healthcare Fraud Investigator.) “They have some of the evidence we need in addition to the data from the health payers that were billed.

“Requesting information directly from the subject is difficult at times because usually in a fraud investigation you want to gather as much evidence as possible without notifying the subject that they are under investigation,” she says. “In health care, the subject of the investigation can be alerted to the investigation as soon as you request records. The good news is that when requesting records, we always attempt to get an attestation indicating that the information they provided is complete and accurate to the best of their knowledge,” Attia says. “This way the subject has a harder time saying that they didn’t provide the complete set of records once they understand the type of investigation being conducted.”

“Always obtain the evidence directly from the source,” says Frank Wisehart, CFE, CPA, partner, Baker Tilly Virchow Krause LLP. “For example, insist on getting bank records directly from the bank. I have had multiple instances where bank records were altered to conceal fraudulent schemes.”

Weber says she always backs up information from the victim with the best source of evidence — from unrelated third parties. “Think of financial institutions as unrelated third parties. They are simply the holder of the records; they don’t care what is contained within them,” Weber says. “Although uncommon, victims will sometimes give you altered records to hide their own actions. Usually that indicates a much larger problem!

“I also use a compulsory process, such as grand jury subpoenas or search warrants to obtain documents of evidentiary value. One downfall to obtaining evidence using a grand jury subpoena is that it cannot be used for a civil process. So, if you are conducting an investigation that you are unable to prove beyond a reasonable doubt but you have the ability to pursue the case in a civil venue, the information gathered via subpoena may not be used.

“I also look for open-source information,” Weber says. “Many relevant records are available to the public; it’s just a matter of knowing where to look. Lastly, I ask for permission to get the records. In some cases, I have the business, person or entity give an authorization to release the records, which is then provided to the record holder.”

Mistakes … I’ve made a few

Try as hard as we can (and CFEs are known for working long hours), we’re going to have plenty of instances to learn from our slip-ups.

Hogan says he’s learned to not be overconfident. “There is a lot I know, but there is a lot more I do not know,” he says. “The role of a CFE covers a wide breadth of knowledge domains and industry verticals. I have had to learn the hard way to be self-critical in judging my own abilities and to embrace the opportunities to call on and work with peers who have knowledge and abilities in places where I have gaps or weaknesses. More often than not, the opportunities lead to fun collaborations and great learning experiences.”

Attia says she’s made the mistake of trusting other people’s work instead of verifying the information she was given. “As investigators, we get cases that have been reassigned,” she says. “I would say to any investigator, verify the information before you move forward with the investigation.”

Matthews says it’s easy to underestimate the time it will take to complete an investigation. “From the initial conversation, an investigator has high hopes that relevant information will be somewhat available, that it will reflect what is represented and that individuals are available to explain the data and diligently obtain what’s missing,” he says. “A complication in any of those three components can derail the most conservative time and expense estimates. Also, the investigation into one allegation can uncover even larger, unrelated problems. You simply never know what you’ll encounter or find when you’re out there shaking the bushes.”

Hood said that he recalls an interview in which he says he refused to believe any of the subject’s answers. “Prior to the interview, I obtained counterfeit checks made out to this individual, a copy of his driver’s license submitted to bank tellers when he cashed these checks, video surveillance showing that he was the one who cashed these checks, and I was in the process of verifying what I believed to be his thumb prints on the checks,” Hood says.

“Although he claimed innocence, I refused to accept it. Three days after this interview, an informant came forward and gave me information indicating that the suspect I interviewed had nothing to do with the crime,” he says. Apparently, this individual had a doppelganger who had obtained his driver’s license and used it to cash counterfeit checks.

“I learned that even though things may seem obvious, you have to keep at least a small part of your mind open to the possibility that the evidence may say something different than what you are interpreting,” Hood says.

Lessons for us all when tackling fraud examinations

“The biggest and most crucial lesson is to not take on a case you’re not ready for,” Couch says. “Get appropriate professional experience before doing this. Ensure you have proper supervision over yourself and proper supervision over anyone working for you. Don’t rely on anyone’s statement. Ensure that you have sufficient, relevant evidence to support any claims made.”

Attia says it’s important to be open to different types of investigations and examinations. “We tend to want to stay where we are comfortable, but having broader experience in the industry helps you look at investigations through a different lens,” she says.

Matthews, who also teaches forensic accounting and fraud investigations at  the University of Texas at Arlington, says fraud examiners can’t assume information will exist in meaningful fashion to assist in supporting or refuting allegations. “My career has been filled with cases in which clients provided data that was less than desirable and not as represented — although occasionally, I’m sure it was unintentional, many times it was intentionally destroyed, corrupted or otherwise unreliable,” he says.

“As such, you can never underestimate the importance of forming a multi-disciplinary team with data collection and analytical capabilities. And, if all else fails, we have to be capable of obtaining information through interviews and surveillance, either physically or electronically. Experience in those three areas — data extraction, interviews and surveillance — can be lacking in forensic accountants and fraud examiners,” Matthews says. “Obtaining information through data extraction, interviews and surveillance, despite lack of proper training, can lead to enormous legal risk. An organization should address this risk and incorporate training in these ‘non-traditional’ areas.”

Art of fraud examination

Though we can quantify fraud examination techniques, we can’t make them into a science. Evidence can be incomplete, misleading or missing. Interview subjects can be unreliable, untruthful or clueless. However, predications and fraud-theory approaches can be so solid that you can professionally work with most anything you encounter.

We’ve just scraped the surface here on planning and conducting fraud examinations. Please respond to this article in its comments section on Fraud-Magazine.com or begin a conversation in the online community at Connect.ACFE.com/home.