Predication or not?

The net revenue for a textile plant was significantly lower than projected even though sales had increased. The company couldn’t find evidence of fraud and didn’t detect unusual trends in financial data, so it attributed the cause to accounting errors. There were some minor inconsistencies in procurement of plant supplies, but the plant manager enforced strict controls, and validated purchases and requisitions each month. He hadn’t found any outliers. Though nobody discovered evidence on the surface, Charles Washington, CFE, wasn’t convinced. His continued investigation into the small procurement inconsistency led to the identification of a major vendor fraud committed by the supply supervisor who maintained duplicate ledgers to conceal his crimes from the plant manager and other executives. (Washington is now the senior director, global fraud and asset protection at Pfizer.)

According to the ACFE Fraud Examiners Manual (FEM), “predication” is the totality of circumstances that would lead a reasonable, professionally trained and prudent individual to believe that a fraud has occurred, is occurring or will occur. (See the FEM, Act on Predication.)

In other words, predication is the basis upon which a fraud examination — and each step taken during the examination — is commenced. The CFE Code of Professional Standards reads, “Certified Fraud Examiners shall establish predication and scope priorities at the outset of a fraud examination and continuously reevaluate them as the examination proceeds.”

However, the basis for predication can vary. In the opening case, despite no apparent evidence, Washington felt that something was amiss. And he was correct.

There’s nothing magic about the word “predication”; fraud examiners worldwide go through similar processes even if they don’t call it that.

“In Europe, we tend to talk about ‘suspicion’ of fraud and ‘justification’ for our actions,” says Regent Victoria Meyer, CFE, FCAA, director of financial crime consulting at the Swiss International Business Academy.

John Gill, J.D., CFE, ACFE’s vice president – education, says that when he teaches the CFE Exam Review Course, he tells students, “Predication is just a fancy word for having a justifiable, business reason for doing what you are doing.”

Fraud Magazine recently consulted with CFEs who work for diverse organizations — public and private — to understand how they determine when it’s time to begin fraud examinations or at least preliminary investigations.

We asked what they normally look for to determine if a fraud “has occurred, is occurring or will occur.” We also asked if they sometimes determined predication via informed “gut checks” or methodical fact finding, about cases in which they had to reevaluate predication as they discovered more evidence and determining if cases were prosecutable. Here are their answers. Agree or disagree, but please offer your views in our online community.

What you look for when establishing predication

Your resources are limited. And you surely don’t want to waste them burrowing down rabbit holes. What do you pursue and what do you leave alone?

“My rule of thumb [for determining predication], most simply put is ‘one of these things is not like the other,’ ” says Regent Bethmara Kessler, CFE. “Whether a potential fraud is identified by a tip, proactive data analytics or some other method, it is important to understand the ‘usual’ to be able to spot or identify the ‘unusual.’ ” (Kessler is a lecturer and consultant and a member of the ACFE Faculty.)

“The source of an allegation in establishing predication is very critical,” says Francis Njiru, CFE, CPA. “Allegation sources range from media reports, whistleblower reports, data analytics, audit reports, management review, exception reports, among many others,” he says.

Njiru says that when we’re tasked with conducting a preliminary investigation to offer insights on whether to proceed to a full investigation, it’s crucial to first determine how close the alleging party is to the alleged misconduct. “Second, the ability of the party alleging to corroborate evidence is critical,” he says. “Anonymous sources, for example, who may not be willing to provide more specific information raise the level of doubt on the authenticity of their claims. The veracity of data sources used in an allegation or the data integrity of data sources analyzed is also important in establishing predication.”

(Njiru is an anti-fraud and compliance consultant. He previously worked as a manager – forensic & integrity services at EY.)

“The overreach is a predictable tell that you are desperate, hungry or too risk-tolerant,” Hetherington says. “It’s okay to be ‘young and hungry,’ and if you are transparent to the client that you are ready to go for gold, then they understand their investment. But if you are saying you are old money, blue chip, with historical value at the same time, you are behaving like a 1999 tech stock bubble company,” she says. “We see your fraud and raise you more due diligence. Or in other words, yes, these companies are predictably and obviously behaving fraudulently."

Regent Ken Dieffenbach, CFE, says he looks at the scope and scale of an issue, the quality of evidence (for example, one anonymous source versus multiple independent reports), known areas of risk that could increase likelihood the reporting is accurate and if anyone has audited and closely inspected this program recently. (Dieffenbach is the special agent in charge of the Fraud Detection Office in the U.S. Department of Justice Office of the Inspector General.)

“We begin each engagement as an assessment,” says Kelly Todd, CFE, CPA. “Depending on the strength of the evidence, tip, etc. that we are provided at the outset, our assessment may be a mere formality, or it may be extensive,” she says. “The assessment is designed to move from the general to the specific, including the evaluation of the initial evidence provided and the identification of fraud exposures and symptoms.” (Todd is a managing member of Forensic Strategic Solutions LLC.)

Todd says predication processes includes identifying:

• Exposures through an understanding of processes and procedures.
• Exposures and trends through the analysis of the financial statements and transactional data from the financial reporting systems.
• Susceptibility of assets to fraud, waste and abuse.
• Evaluation of fraud symptoms in the areas where exposures are identified.

Todd’s teams also consider pressures and motivations of possible subjects to commit fraud, she says.

“When we’re considering the totality of the circumstances to determine if sufficient predication exists to commence a fraud examination, we generally classify fraud symptoms in several categories, including analytical, accounting and employee symptoms; internal control deviations; tips; and complaints,” Todd says.

“Our methodology allows us to create decision points — specific to the totality of the facts and circumstances moving from general to specific — as to whether we should recommend carrying the development of our work and evidence further,” she says.

Regent Emeritus Jonathan Turner, CFE, says fraud examinations have always been a blend of art and science. “CFEs should have a good-faith basis to begin an examination, so there needs to be clear and objective elements that can be demonstrated,” Turner says. “For example, are there objective actions or inactions that implicate a policy? Do those activities present an opportunity to personal gain? If these actions could be fraudulent, who else would you expect to see or not see? Do those elements appear?”

Turner says we should consider an allegation worthy of further investigation if it’s specific, credible and testable. (He’s the global head of compliance, privacy and governance at Zoll Medical Corporation and a member of the ACFE Faculty.)

Washington says we must look for the loss and the corresponding lie supporting the loss. “But then there are times when you might identify the lie first, and the loss won’t be too far away. Opportunity sets the stage for the fraud to occur, so the discovery of weak or lax controls will be a lead to identifying the loss,” he says.

Jeff Matthews, CFE, CPA, says fraud examiners should maintain an attitude of skepticism and objectivity when looking at any situation. “We are trained to understand the specific frauds that are perpetrated and how each fraud scheme is usually committed,” he says.

“We will look for signs of the fraud and carefully examine evidence that suggests the situation is more than an error or mistake. These include failure to cooperate with an investigation, destruction of evidence immediately before or after a request, an abrupt resignation when difficult questions arise or other unusual personal behavior. Red flags can also stem from abnormal trends in financial data, such as unusual journal entries or unsupported transactions.” (Matthews is a partner of StoneTurn and adjunct accounting professor at The University of Texas at Arlington.)

Gut check, methodical fact-finding or both?

Sometimes predication for cases can seem to go either way. Fraud examiners might depend on experienced intuition based on previous cases or depend solely on the hard facts in front of them. Or a combination of both.

“I have had a few cases in my career where the fraudsters were very careful in covering tracks such that the evidence of the activity related to the fraud mirrored activity that could have happened in the normal course of business,” Kessler says. “In those cases, I trusted my gut and dug just a bit deeper. It is important in those situations to really allow yourself to think like a fraudster to creatively think about the direction to look towards.”

Turner says gut checks are helpful to fraud examiners, but we can’t rely on them. “So, if you feel there is something in your gut, find the factual and objective information to open the case, then begin the investigation. There is a reason the alphabet goes a, b, c. The order of things matters,” he says.

Dieffenbach says our guts are terrible predictors of most things. “We see many issues on the line and might do some initial work to further develop the facts,” he says. “The decision to investigate is not an all-or-nothing endeavor. We can generally stop anytime we think it’s prudent. We also must consider the opportunity cost: If I investigate this thing what am I not going to investigate?"

Regent Emeritus Tiffany Couch, CFE, CPA/CFF, says we should pay attention to our gut feelings but not rely solely on them in sum. “Most of the huge fraud cases I’ve investigated had few red flags. And too many have had lots of red flags and no fraud,” she says. (Couch is founder, CEO and principal of Acuity Forensics.)

Suzette Stevenson, CFE, says she saw a situation in which gift card transactions were increasing in a specific location. “During that same time frame, there was a sales contest going on,” she says.

“Although I knew that the sales contest could have attributed to the gift cards sales increase, I also knew the increase in this specific location was not because of the contest.” Her experienced gut told her that fraud was occurring even though red flags weren’t necessarily flying. (Stevenson is manager of compliance and ethics at Giant Food.)

“We often start a private-sector investigation without knowing exactly what we are investigating,” Meyer says. “We keep an open mind as to whether the root cause could be fraud, incompetence or systems failure. We’d likely start out calling it a ‘review’ rather than an investigation. The exact point at which it becomes an investigation is not clear cut because we will be gathering evidence of any fraud alongside ruling out other causes.”

Meyer says it’s important to maintain evidence-handling protocols even before you’re sure you’re investigating fraud so that a possible prosecution isn’t compromised when you’ve ruled out non-fraud reasons.

Reevaluating predication

Few fraud examinations are simple endeavors. Many are projects complicated by conflicting or vague testimonies, and inconclusive evidence. Sometimes fraud examiners must change direction mid-stream or cease an investigation.

“We were hired by a municipality to investigate allegations by a bookkeeper that the head of a department was cooking the books,” says Todd. “Numerous hard drives were imaged and held to preserve evidence while we sought to identify and understand numerous suspicious transactions. As our analysis of the questionable transactions was understood in the larger context of supporting transactions and business operations, we quickly reevaluated predication and recommended to our client that they cease further investigation.”

Initial sources of allegations can eventually prove unreliable. Matthews says he was recently engaged to investigate potential FCPA violations involving a project in China. “The initial predication was based on a lawsuit sent to an inspector general by a former, disgruntled employee, who alleged bribery,” he says. “The company took the allegations seriously and allowed us to expand the scope to include other potential related parties and projects.

“We identified certain emails and documents that were puzzling. However, after reviewing thousands of email correspondence, journal entries, contracts and extensive interviews, it became clear that the company never made payments to the Chinese business partner that it was supposedly bribing or any other contractor involved in the particular project,” Matthew says. “A closer inspection of the complaint also proved other allegations false. If we had only considered the complaint, and a few out-of-context emails, any opinion reached would have been incomplete and premature."

Couch says that she and her team often have to reevaluate predications. “I once combed over the books of a medical practice where we had all red flags,” she says. “One employee, who had access to everything, wouldn’t turn over basic reports and got mad when we asked her questions. Everyone loved her, but one doctor was convinced she was stealing.

“I was concerned, but all patient funds made it to the bank, all checks were for business purposes, and her payroll was pristine. No fake vendors or employees. The doctor was so convinced he had me look further back in time. No fraud found at all,” Couch says.

Walt Manning, CFE, says he worked an investigation which involved allegations that an employee was using his company computer to send a tremendous volume of spam to a person in Australia. “The accuser contacted the company’s chief legal officer to complain and threaten legal action against the employee and the company,” Manning says. “Our digital forensics analysis found no evidence of this type of activity. Further investigation revealed other occasions where the accuser had made false allegations against other people who had upset him with comments on social media in order to cause problems for his targets with their employer.” (Manning is president of Techno-Crime Institute.)

Prosecutable cases?

A CFE’s job is to discover facts for their organization or client, regardless of where they might lead. According to the ACFE FEM, “If fraud is discovered, the fraud examiner will also have to discuss it with the relevant individuals and determine whether the case should be presented to criminal prosecutors.” (In the FEM, see Presenting the Case for Prosecution.)

Fraud Magazine asked the CFEs if they hadn’t proceeded on a possible case because an organization or client didn’t believe it was prosecutable.

Matthews recalls when a large global organization suspected it was the victim of a vendor kickback scheme. “The company had purchased 10 semi-trucks and trailers, yet, claimed the rigs were never shipped,” he says. “There were no signed receipts or bills of lading indicating the company-specific location had received them, which happened to be in a foreign country. When questioned, the general manager of the location abruptly resigned. The company launched an investigation with the intention of filing a fraud claim with its insurance carrier.

“However, our review of the company’s fixed inventory identified rigs with similar descriptions of those believed missing, located in other countries,” Matthews says. “Therefore, we could not determine with reasonable certainty that fraud had occurred without obtaining further details, such as VIN numbers, dates of purchase, receipts and source vendors. We also needed a better understanding of how fixed-asset transfers were documented between countries or if shipping addresses were occasionally altered. Unfortunately, the relevant fixed asset log was outdated and incomplete. The procurement and transfer process was largely undefined and very inconsistent.”

Matthews says that when they sought additional information, some locations weren’t cooperative; others were completely non-responsive. “Despite having initial predication, we determined that the cost of conducting a full investigation through obtaining third-party documentation and various vendor records — and the situation could simply be sloppy accounting and paperwork error — far outweighed the potential for proving fraud and obtaining recovery for the company,” he says.

Kessler says she never gave up on an investigation based on whether it was prosecutable or not. “If there is predication, I believe that we have the responsibility to follow the threads wherever they lead,” she says. “In the end, there should always be consequences for fraudsters even if the fraud isn’t big enough to warrant a criminal action. Consequences can include, but not be limited to, paying the organization back or some other clawing back of the ill-gotten gains. Termination options should also be considered.”

Turner says private-sector entities simply don’t know if a case is prosecutable until the investigation is complete. He agrees with Kessler that the private sector can have more objectives than just prosecution.

Predication to establish truth

The CFEs agree that they must establish predication or strong suspicion of fraud and justification for their actions. But, above all, as Njiru says, they don’t solely conduct fraud examinations just to confirm existence of fraud but to establish the truth. “Demonstrating facts as a fraud examiner, whether fraud exists or not, is critical in addressing various parties’ concerns, saving organizations from reputational damage and creating high-performing teams,” he says.

Dick Carozza, CFE, is editor-in-chief of Fraud Magazine. Contact him at dcarozza@AFCE.com.