1 How to Conduct An Internal Investigation D. Larry Crumbley, CPA, CFF, Cr.FA, MAFF, FCPA KPMG Endowed Professor Department of Accounting Louisiana State

1

How to Conduct An Internal Investigation

D. Larry Crumbley, CPA, CFF, Cr.FA, MAFF, FCPAKPMG Endowed ProfessorDepartment of AccountingLouisiana State University

Room 2833, Business Education ComplexBaton Rouge, LA 70803

225-578-6231225-578-6201 [email protected]

Dr. Crumbley is the

Editor of the Journal of Forensic & Investigative Accounting.

Former editor of the Journal of Forensic Accounting: Auditing, Fraud, and Risk,

Former chair of the Executive Board of Accounting Advisors of the American Board of Forensic Accountants,

Former member of the NACVA’s Fraud Deterrence Board, and

On the AICPA’s Fraud Task Force (2003-2004).

A frequent contributor to the Forensic Examiner and Value Examiner, Professor Crumbley is an author of more than 55 books and 350 articles. His latest book entitled Forensic and Investigative Accounting, 5th edition, is published by Commerce Clearing House (800-224-7477). Some of his 13 educational novels, e.g., Trap Doors and Trojan Horses and The Big R: A Forensic Accounting Action Adventure, have as the main character a forensic accountant. His goal is to create a television series based upon the exciting life of a forensic accountant and litigation consultant.

http://www.jobsmart.com/

2

Wide Variety of Investigations

Fraud investigation Tracing assets Damages calculations Valuation calculations Witness location Employment investigations Worker compensation claims Private family investigations Homicide Suicide Missing person investigation Personal background checks Corporate investigations Civil investigations Negligence or criminal investigations

Source: Erik Laykin, Investigative Computer Forensics, Hoboken, N.J.: John Wiley, 2013, p.130.

3

SAS No. 99: SKEPTICISM

An attitude that includes a questioning mind and a critical assessment of audit evidence.

An auditor is instructed to conduct an audit “with a questioning mind that recognizes the possibility that a material misstatement due to fraud could be present, regardless of any past experience with the entity and regardless of the auditor’s belief about management’s honesty and integrity.”

“Things are not always as they appear, sonny boy.” James Patterson, Honeymoon, Warner Books, 2006.

4

Mind-Set: SKEPTICISM

Ronald Reagan said with respect to Russia, “Trust, but verify.”

FA’s motto should be “Trust no one; question everything; verify.”

As Charles Manson said, “Total paranoid is total awareness.”-----------------------------------------------------Ron Durkin says auditors must go beyond skepticism to “thinking forensically.” [More than skeptical ]----------------------------------------------------- This ain’t my first rodeo I didn’t make it all the way through school. But my mama didn’t raise no fool. I may not be the Einstein of our time. But honey, I’m not dumb and I’m not blind.

Vern Gosdin

5

Predication

The ACFE group indicates that in the private sector, a fraud investigation should not be conducted without proper predication.

Examples: Anonymous tips, complaints, audit inquires, conflict of interest.

Thus, predication is the basis for undertaking a fraud investigation.

Without predication, the target might be able to sue for real or imaginary damages.

6

Be An Investigator

“Because I was an investigator,” he said.

“O.K.,” she said. “Investigators investigate. That, I can follow. But don’t they stop investigating? I mean, ever? When they know already?”

“Investigator never know,” he said. “They feel, and they guess.”

“I thought they dealt in facts.”

“Not really,” he said. “I mean, eventually they do, I suppose. But ninety-nine percent of the time it’s ninety-nine percent about what you feel. About people. A good investigator is a person with a feel for people.”

Lee Child, Echo Burning, N.Y.: Jove Books, 2001, p. 281.

7

Investigative Technique

“You know how it goes,” I said. “You get a case. You just keep poking around, see what scurries out.” p. 144.------------------------------------------------------------“How,” Susan said, “on earth are you going to unravel all of that?”“Same way you do therapy,” I said.“Which is?”“Find a thread, follow it where it leads, and keep on doing it.”“Sometimes it leads to another thread.”“Often,” I said.“And then you follow that thread.”“Yep.”“Like a game,” Susan said.“For both of us,” I said.Susan nodded. “Yes,” she said, “tracking down of a person or an idea or an evasion.”pp. 270 – 271.--------------------------------------------------------------------------------Source: R.B. Parker, Widow’s Walk, Berkley Books, 2002.

8

Fraud Detection Process

1. Discuss facts and objectives with client/attorney (e.g., conflict of interests).

2. Evaluation whether to accept the engagement.

3. Prepare a work program.4. Develop time and fee schedule.5. Obtain approval of work program, staff

assignments, and fee estimates.6. Obtain an engagement letter.7/8. Identify fraud exposures and symptoms.9/10. Evaluate evidence obtained and determine if

more evidence is needed.11/12. Search for and evaluate additional

evidence.13. Discuss preliminary findings with

client/attorney.14. Draft a final report.15. Review the report and work papers.16. Resolve professional disputes.17. Clear review points and open items.18. Communicate report or findings.19. Help attorney prepare court case/testify.20. Perform follow-up procedure.21. File work papers/report.

Source: Carmichael et. al, PPC Fraud Detection, Vol.1, Ch. 2 (2002).

9

Wandering Around

• Informal observations while in the business.

• Especially valuable when assessing the internal controls.

• Observe employees while entering and leaving work and while on lunch break.

• Observe posted material, instructions, job postings.

• Observe information security and confidentiality.

• Observe the compliance with procedures.

• Appearance is not necessarily reality. Man of La Mancha

10

Investigative Techniques

“Facts weren’t the most important part of an investigation, the glue was. He said the glue was made of instinct, imagination, sometimes guesswork and most times just plain luck.” (p. 163).--------------------------------------------------“In his job, he [Bosch] learned a lot about people from their rooms, the way they lived. Often the people could no longer tell him themselves. So he learned from his observations and believed that he was good at it.” (p. 31).--------------------------------------------------Michael Connelly, The Black Ice, St. Martin’s Paperbacks, 1993.

11

Investigative Techniques and Evidence

Documentary evidence – written evidence on paper or computer medium.

Testimonial evidence – testimony of individuals.

Observational evidence – evidence, actions, or observations seen by an investigator.

• Physical examination of evidence (e.g., counts or inspections).

• Fixed point observations of activities (e.g., watching a scene and recording).

• Moving observations. Invigilation – strict temporary controls are

imposed so that fraud virtually impossible. Keep detailed records.

Covert observations. Forensic document examination.

Source: D.R. Carmichael et.al., Fraud Detection, Vol. I, Practitioners Publishing Co., 2002, pp. 3-1 to 3-4

12

Documentation

The forensic accountant needs to track and document the steps in any investigation process, including:

• Items maintained as privileged or confidential.• Requests for documents, electronic data, and other information.• Memoranda of interviews conducted.• Analysis of documents, data, and interviews and conclusions drawn.

Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; http://www.acfe.com/documents/managing-business-risk.pdf, 2008, p. 43.

13

Chain of Custody

Just as in the movies or on a television show such as CSI, forensic accountants must safeguard evidence through a financial chain of evidence (e.g., fraud in a computer).

There must be a way to show that the evidence has not been tampered with or damaged.

If documents are seized, the forensic accountant should put his or her initials and date of the seizure on the back of each document.

Or put the document in a transparent envelope and write a description on the envelope.

Store the original and work only with a copy.

14

Enforcement ManualEnforcement ManualHistory and Custody of Documents U.S.

Department of Labor Pension and

Welfare Benefits

Administration Date _______________________________

Case Number________________________Case Name __________________________ 22. How were the documents obtained? ____ By consent (note any significant comments of the principal or third

party witness and any unusual circumstances which occurred)?____ By legal process (describe). 2. What is the relationship between the documents and the person

submitting them? 22. Were manual transcripts or facsimile copies made of any of

the documents either in whole or in part?. ______ Yes ______No If Yes, list documents copies. Manner of reproduction 22. Have all copies been compared with the original documents and

identified? _____Yes _____No

If No, why not? 22. Were the original documents described herein under your control or supervision at all times prior to their return to the principal, third party witness, or representative?

_____Yes _____No If No, set forth circumstances of any transfer in control.

22. Did the principal, third party witness, or a representative request access to the documents during your custody?

___ Yes ___ No If Yes, who requested access and what action was taken?

Signature ___________________Title ________________________

PWBA 219 (May 1987)

15

Principles of Investigation Documentation

1. Take notes on everything you do.2. Document every effort to contact a witness and

all surveillance in the running resume.3. Prepare a report whenever there is a possibility

you will have to testify.4. Take verbatim statements from hostile or

unhelpful witnesses; obtain declarations from friendly witnesses.

5. Provide all of the case’s documents to the client at the conclusion of the case – or have a document retention policy that decrees the maintenance of most records for at least five years.

P.A. Becnel, IV and S.J. Krischke, Principles of Investigative Documentation, Springfield, IL: C. C. Thomas Publisher, 2012, 172 pp.

16

Scienter Necessary

To prove any type of fraud, prosecutors must show that scienter was present.

That is, the fraudster must have known that his or her actions were intended to deceive.

-------------------------------------------------

The allure of numbers to most of us, is like the excitement of settling sand--a narcoleptic surety. Crafty criminals prey on this boredom. They pile on the numbers, spewing meaningless records in the false books.

Cory Johnson

17

Two Major Types of Fraud Investigations

Reactive: Some reason to suspect fraud, or occurs after a significant loss.

Proactive: First, preventive approach as a result of normal operations (e.g., review of internal controls or identify areas of fraud exposure). There is no reason to suspect fraud. Second, to detect indicia of fraud.

Source: H.R. Davia, “ Fraud Specific Auditing,” Journal of Forensic Accounting, Vol. 111, 2002, pp. 111-120

18

Proactive Is Beneficial

The threat of a future investigation reduces the occurrence of fraudulent behavior from 75% to only 43%.

The larger the pay-off, the more likely a person will commit fraudulent behavior.

Give the fox a key to the hen house and he/ she is going to eat hens.

Source: S. L. Tate et. al, “The Small Fraud Paradigm: An Examination of Situational Factors That Influence the Non-Reporting of Payment Errors,” J. of Forensic Accounting, Vol.7, 2006, p. 406.

---------------------------

The greater the risk of detection, the less likely a person is to violate the law.

Jeremy Bentham18th Century Philosopher

19

Proactive vs. Reactive Approaches

Proactive approaches include

Effective internal controls, Financial and operational

audits, Intelligence gathering, Logging of exceptions, and Reviewing variances.

Reactive detection techniques include

Investigating complaints and allegations,

Intuition, and Suspicion.

Jack Bologna and Robert Lindquist, Fraud Auditing and Forensic Accounting, 2d Edition, New York: John Wiley, 1995, p. 137.

20

Proactive Is Best When the IRS began requiring banks

to issue Form 1099s reporting interest, the reported interest income increased by $8 billion (even though for 3 years the IRS did not have computer matching capacity).

When the IRS began to require taxpayers to list a social security number for dependents, the next year the number of reported dependents dropped by seven million. More than 11,000 of these taxpayers claimed seven or more dependents in 1986, but they claimed none in 1987.

When the IRS began to require taxpayers to list a name, address, and social security number for babysitters, two years later 2.6 million babysitters disappeared.

21

Fraud Deterrence Better Than Fraud Investigation

1. Fraud deterrence less expensive.

2. Deterrence is more comprehensive.

3. Fraud deterrence produces greater savings.

4. Deterrence is faster.5. Fraud deterrence

promotes better customer relations.

Daniel Finnegan, “Deterring Fraud,” Quality Planning Corporation, 1991.

22

Fraud Deterrence ReviewAnalysis of selected records and operating statistics.

Identify operating and control weaknesses.

Proactively identify the control structure in place to help prevent fraud and operate efficiently.

Not an audit; does not express an opinion as to financial statements.

May not find all fraud especially where two or more people secretively agree to purposely deceive with false statements or by falsifying documents.

[Always get a comprehensive, signed engagement letter defining objectives.]

23

Financial Fraud Detection Tools

Interviewing the executives Analytics Percentage analysis

Horizontal analysis Vertical analysis Ratio analysis

Using checklists to help detect fraud SAS checklist Attitudes/Rationalizations

checklist Audit test activities checklist Miscellaneous fraud indicator

checklist

“Objectively obtaining and evaluating evidence is the essence of auditing.”

(AAA, Committee on Basic Auditing Concepts, 1973, 2)

24

Analytical Procedures

Analytical procedures involve the study or comparison of the relationship between two or more measures for the purpose of establishing the reasonableness of each one compared. Five types of analytical procedures help find unusual trends or relationships, errors, or fraud:

Horizontal or Percentage Analysis

Vertical Analysis Variance Analysis Ratio Analysis or Benchmarking Comparison with other

operating informationSource: D.L. Crumbley, J.J. O’Shaughnessy, and D.E. Ziegenfuss, 2002 U.S. Master Auditing Guide, Chicago: Commerce Clearing House, 2002, p. 592.

25

Financial Statement Fraud Audit

1. Obtain current year’s financial statements.

2. Obtain prior 3 years’ financial statements.

3. Perform vertical/ horizontal analysis of the 4 years, plus all current quarters.

4. Pay attention to footnotes.5. Analysis of %s and footnotes by

senior auditors.6. Nonsense %s and footnotes

inquire explanations from financial management.

7. Interview lower level financial employees who approved questionable journal vouchers.

8. Combine explanations with visits to accounting records/ source documents.

26

Horizontal Analysis

Suppose advertising in the base year was $100,000 and advertising in the next three years was $120,000, $140,000, and $180,000. A horizontal comparison expressed as a percentage of the base year amount of $100,000 would appear as follows: Year 4 Year 3 Year 2 Year 1

DollarAmount

$180,000

$140,000 $120,000 $100,000

Horizontal Comparison 180% 140% 120% 100%

27

Red Flags with Horizontal Analysis

When deferred revenues (on the balance sheet) rise sharply, a company may be having trouble delivering its products as promised.

If either accounts receivable or inventory is rising faster than revenue, the company may not be selling its goods as fast as needed or may be having trouble collecting money from customers. For example, in 1997 Sunbeam’s revenue grew less than 1% but accounts receivable jumped 23 percent and inventory grew by 40 percent. Six months later in 1998 the company shocked investors by reporting a $43 million loss.

If cash from operations is increasing or decreasing at a different rate than net income, the company may be being manipulated.

Falling reserves for bad debts in relation to account receivables falsely boosts income (cookie jar accounting).

28

More Red Flags

Look for aggressive revenue recognition policies (Qwest Communication, $1.1 billion in 1999-2001). Beware of hockey stick pattern.

Beware of the ever-present nonrecurring charges (e.g., Kodak for at least 12 years).

Check for regular changes to reserves, depreciation, amortization, or comprehensive income policy.

Related-party transactions (e.g., Enron). Complex financial products (e.g.,

derivatives). Unsupported top-side entries (e.g.,

WorldCom). Under-funded defined pension plans. Unreasonable management compensation

Source: Scott Green, “Fighting Financial Reporting Fraud,” Internal Auditor, December 2003, pp. 58-63.

29

Ink Analysis Martha Stewart was undone by a

blue ballpoint pen. Stockbroker belatedly inserted a

note to help cover up Ms. Stewart’s improper stock trading. Blue ballpoint ink used is different from ink elsewhere on the trading worksheet.

Prosecutors used forensic ink analysis in Rite Aid case to show that certain documents were backdated (ink used to sign letter was not commercially available until 3 months after the letter was dated).

Xerox laser printers now encode the serial number of each machine in tiny yellow dots in every printout, nestled within the printed words and margins. It tracks back to you like a license plate.

Advice for fraudsters: use pencils.

Source: Mark Maremont, “In Corporate Crimes, Paper Trail Often Leads to Ink Analysts’ Door,” Wall Street J., July 1, 2003, p. A-1.

30

Invigilation Invigilation is a rather

expensive investigating technique that can be used in potential fraud situations to discover the fraud and can later be used in the courtroom.

Here detailed records are kept before and after the invigilation period to determine the amount of fraud.

During the invigilation period strict controls are imposed (e.g., cameras) so that the fraud is virtually impossible.

Or the invigilation period could be while the suspect is on vacation.

31

Invigilation Technique

No controlsControls or

vacation No controls

14 days 14 days 14 days

$67,000 lost $0 lost $62,000 lost

32

When Fraud Is Discovered

1. Notify management or the board when the incidence of significant fraud has been established to a reasonable certainty.

2. If the results of a fraud investigation indicate that previously undiscovered fraud materially adversely affected previous financial statements, for one or more years, the internal auditor should inform appropriate management and the audit committee of the board of directors of the discovery.

3. A written report should include all findings, conclusions, recommendations, and corrective actions taken.

4. A draft of the written report should be submitted to legal counsel for review, especially where the internal auditor chooses to invoke client privilege.

E-ZPass Catching Cheaters E-ZPass and similar electronic toll

collection systems are emerging as a new and powerful means to prove infidelity.

Generally mounted inside a vehicle's windshield behind the rearview mirror, the remote-sized, E-ZPass devices communicate with antennas at toll plazas, automatically deducting money from the tag-holder's prepaid account and recording when and where the vehicle crossed the toll.

Many states provide electronic toll information in response to court orders for criminal and civil cases, including divorces, which are used to prove the defendant was not where he or she claimed to have been.

"E-ZPass is an E-ZPass to go directly to divorce court, because it's an easy way to show you took the off-ramp to adultery," said Jacalyn Barnett, a New York divorce lawyer who has used E-ZPass records a few times.

33

Chris Newmarker, “E-ZPass records out cheaters in divorce court.” AP, 2007.

34

Seven Investigative Techniques

1. Public document review and background investigation (non-financial documents).

2. Interviews of knowledgeable persons.

3. Confidential sources.

4. Laboratory analysis of physical and electronic evidence.

5. Physical and electronic surveillance.

6. Undercover operations.

7. Analysis of financial transactions.

Source: R.A. Nossen, The Detection, Investigation and

Prosecution of Financial Crimes, Thoth Books, 1993.

35

Investigation Tasks

1) Interviewing, including:

a) Neutral third-party witnesses.

b) Corroborative witnesses.

c) Possible co-conspirators.

d) The accused.

2) Evidence collection, including:

a) Internal documents, such as

i) Personnel files.

ii) Internal phone records.

iii) Computer files and other electronic devices.

iv) E-mail.

v) Financial records.

vi) Security camera videos.

vii) Physical and IT system access records.

b) External records, such as

i) Public records.

ii) Customer/vendor information.

iii) Media reports.

iv) Information held by third parties.

v) Private detective reports.

3) Computer forensic examinations.

4) Evidence analysis, including:

a) Review and categorization of information collected.

b) Computer-assisted data analysis.

c) Development and testing of hypotheses.

Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; http://www.acfe.com/documents/managing-business-risk.pdf, 2008, pp. 42-43.

Some Important Stuff

• Once a USB has been imaged, a forensic accountant should use a read-only copy and investigate the file structure for evidence of financial fraud.

• MD5 hashes verified that two files are exactly the same.

• Hash values allow forensic accountants to determine if two financial files are exactly the same.

• The hash calculator can be downloaded for free.

• Disk Investigator can be used to discover what is hidden on a hard drive and help recover lost data.

36

Evidence Requests

• Once legal requests for electronic evidence are received, such normal business practices need to be stopped and hard drives need to be imaged.

• Evidence requests likely to include all e-mails; e-mail headers; e-mail logs; all data files created with word processing, spreadsheet, accounting software, sound recordings, or presentation software; network activity logs; task lists; databases; and e-calendars. All such requests encompass the data on servers, workstations, laptops, floppy disks, only repositories, tapes, voice messaging systems, CDs, DVDs, memory sticks, cell phones, iPads, and all stored backups of data.

• After this request and until the pertinent drives are imaged, new files should not be saved to working computers.

37

38

So You Find Fraud

• Criminal referral — The organization may refer the problem to law enforcement voluntarily, and, in some situations, it may be required to do so. Law enforcement has access to additional information and resources that may aid the case. Additionally, referrals for criminal prosecution may increase the deterrent effect of the organization’s fraud prevention policy. An appropriate member of senior management, such as the chief legal counsel, should be authorized to make the decision as to whether pursuing criminal prosecution is appropriate. • Civil action — The organization may wish to pursue its own civil action against the perpetrators to recover funds. • Disciplinary action — Internal disciplinary action may include termination, suspension (with or without pay), demotion, or warnings. • Insurance claim — The organization may be able to pursue an insurance claim for some or all of its losses.

Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE; http://www.acfe.com/documents/managing-business-risk.pdf, 2008, pp. 43-45.

39

KPMG provides 10 steps to follow when an organization finds or

suspects fraud:

1. Shut the door! Keep assets secure until you can provide appropriate long-term security.

2. Safeguard the evidence. Ensure that all records and documents necessary for an investigation remain intact and are not altered by you or anyone else.

3. Notify your insurer. Failure to notify may negate your coverage.

4. Call a professional. Do not confront or terminate the employment of a suspected perpetrator without first consulting your legal advisor.

5. Prioritize your objectives. What’s most important: punishment, loss recovery, prevention, detection of future occurrences?

40

KPMG’s 10 steps to follow contd..

6. Consider prosecution. Before you make the call, weigh the plusses and minuses and determine if your insurance company requires prosecution.

7. Terminate business relations. If the fraud is external, business relations with the suspect individual or organization should be terminated.

8. Seek advice and assistance. An important consideration is whether you have the knowledge and resources necessary to effectively manage the process.

9. Prepare a witness list. It is important that statements be taken before a “party line” can develop.

10. Consider the message. Whatever you do will affect future situations. Now may be the time to change the way your business operates.

41

Where Details Communicated Internally

Source: Who is the Typical Fraudster (2011) KPMG

42

Where Details Communicated Externally


43

Outcomes & Responses


44

Interview vs. Interrogation

Interview-non-accusatory process where person asks questions to develop factual information (e.g., who, what, when, where, how).

Interrogation-accusatory interview to obtain an admission of guilt.

------------------

“Doubt leads to inquiry, and inquiry leads to the truth.”

Saint Thomas Aquinas

45

Selecting the Right Interviewees

“Someone knows what is going on. If you tune in, you will get a feel for it.”

Lorraine Horton, Kingston, R.I.

--------------------------------------------------------------

“It is important that you select the right person to interview, and be conversant in interviewing techniques. For instances, pick someone from customer complaints or an employee who didn’t get a raise for two years, as they would be likely to provide the needed information.”

R.J. DiPasquale, Parsippany, N.J.

Source: H.W. Wolosky, “Forensic Accounting to the Forefront,” Practical Accountant, February 2004, pp. 23-28

---------------------------------------------------------------------------------------------

Listen to rouges and whistle-blowers who complain.

46

Differentiate Between the Two

Interview InterrogationInvolves a witness Involves a suspect

Involves a victim Involves custody

No Miranda rights Requires Miranda rights

General information Specific facts

Less demanding More demanding

Casual Highly structured

Interview in the field Interrogate at the office

Information not known Confirm known information

Scattershot approach Pin-down approach

Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press, 1992, p.5.

47

Moving from Unwilling to Willing Chair

Ask general questions.Win them over.

Make them feel that this is what’s best for them.

Take away the foundation. Gain their confidence.

Explain the facts. Relate to them.

Deescalate the crisis. Give them a way out.

Explain the advantages of cooperation.

Give them a change to explain.Lie to them.

Downplay the disadvantages of cooperation.

Understand them.Hang it on them.

Use deception. Put it on them.

Play on their sympathy. Threaten them.

Play on their conscience. Get them to trust.

Determine their frame of mind.

Mimic their manner.

Talk to them. Empathize.

Know how far to push. Show them what they’re looking at.

Get on their level. Show them acceptance.

Speak their language. Develop a rapport.

Show them.

Tell them.Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press,

1992, p.8.

48

Advantage and Disadvantages

Advantages of an interview (non-accusatory)

Facilitates the development of cooperation.

Easier to develop rapport. More effective way of developing

usable information.Disadvantages of interrogation

Interviewee may be alienated and refuse to speak to anyone later.

If interviewee will not speak to anyone, ability to obtain information or admission is diminished.

Source: John E. Reed Associates, Inc.

Interview Room Layout

49

Room Layout with Witness

50

51

Room Arrangement Details

Establish a sense of privacy. No locks or physical

impediments. Room plain color (e.g. no

pictures, etc.) Lighting should provide

good, but not excessive or glaring illumination of interviewee’s face. Same for interviewer.

No telephones, cell phones, or beepers.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 28-33.

52

Room Arrangement Details

Chairs about 4 feet apart. Straight-back. No rollers. Facing each other.

Both chairs at the same level (both at same eye level).

Observation room arrangement if possible (or video). Record it, no video.

In case of a female, another female should be present.

Not at suspect’s home or office

No bad breath odor.F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 28-33.

53

Interviewer’s Demeanor

Civilian clothes. No uniform. Conservative suit, jacket, or dress.

Relaxed and comfortable. No smoking. Questions in conversational

tone. Non-accusatory. Keep eye contact. Neither

person should wear dark glasses.


54

Interviewer’s Demeanor

Take written notes (but not in an interrogation).

Use simple language. Never scold or reprimand if

the suspect is caught in a lie. Do not pace around the

room.


55

Make Interviewee Comfortable

He puts a strong hand on my shoulder. “I appreciate you helping us out, Michael." Unlike the FBI polo crew, he's wearing a gray suit with a small stain on his right lapel. His tie is pulled tight, but the top button on his stark white shirt is open. The effect is the most subtle hint of casualness in his otherwise professional demeanor. "Quite a day, huh, Michael?" It's the third time since we've met that he's said my name, which I have to admit sets off my radar. As my old crime law professor once explained, name repetition is the first trick negotiators use to establish an initial level of intimacy. The second trick is physical contact. I look down at his hand on my shoulder.”

Source: Brad Meltzer, The First Counsel, Grand Central Pub. NY., 2001, p.86

56

The Reid Nine Steps of Interrogation

1. The investigator directly and positively confronts the suspect.

2. The investigator introduces an interrogation theme.

3. The investigator handles the initial denials of guilt.

4. The investigator overcomes the suspect’s objections.

5. The investigator gets and retains the suspect's attention and clearly displays sincerity in what he says.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 125.

57

The Reid Nine Steps of Interrogation

6. The investigator recognizes the suspect’s passive mood.

7. The investigator uses an alternative question- a suggestion of a choice to be made by the suspect concerning some aspect of the crime.

8. The investigator has the suspect orally relate the various details of the offense that will serve ultimately to establish legal guilt.

9. The verbal confession is converted into a written or recorded statement.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”Sudbury, MA: Jones & Bartlett Publishers, 2005,pp. 125.

58

Some Persuasive Techniques

1. Indirect Approach.2. Complete-file approach.3. I-know-everything approach.4. Utility technique.5. Quick questioning approach.6. Incentive approach.7. Repetition technique.8. Silent approach.9. Change-of-scene technique.10. Emotional approach.11. Psychological technique.12. Good-guy, bad guy approach.13. Cold shoulder approach.


59

Verbal and Nonverbal Behavior

Verbal behavior includes not only words, but timing, pitch, rate, and clarity of the responses.

Nonverbal behavior includes body movement, position changes gestures, eye contact, and facial expressions.

See “Interviewing & Interrogation,” The Reid Technique, John E. Reid Associates, Inc., L.E.R.C Law Enforcements.

60

Nonverbal Language

60% of communication is nonverbal.

Previous contact with person helpful.

During President Bill Clinton’s testimony he touched his nose several times when he was lying, but did not touch his nose during truthful testimony.

Two-thirds of truth interviewees cross their legs.

Source: “Lying 101: There May Be Nonverbal Indicators of Lying,” http://members.tripod.com/nwacc_communication/id25.htm.

http://www.ashcraftandgerel.com/whistleb.html

http://www.ashcraftandgerel.com/whistleb.html

61

Posture Language

Truthful Frontally aligned. Upright or forward. Open (perhaps crossed legs). Dynamic, comfortable changes.

Deceptive Non-frontally aligned. Slouched, retracted or leaning. Barriers (crossed arms, purse in

lap). Frozen and rigid.

Source: John E. Reid Associates, Inc.

62

Some Lying Signs

Covering mouth with hand. Rubbing nose. Frequent blinking. Biting lip. Moving or tapping foot. Crossing arms. Leaning forward. Handling objects (e.g., pencil, pen). Avoiding eye contact or averting eyes. Clearing the throat. Closing and opening coat. Picking at lint on clothing. Playing with collar. Moving away. Shrug gestures. Slow response. Higher pitch. Long answer. Gap between words becomes longer. Non-words such as uh.

Source: “Lying 101: There May Be Nonverbal Indicators of Lying,” http://members.tripod.com/nwacc_communication/id25.htm.

http://www.tnwinc.com/

http://www.tnwinc.com/

63

Deception Indicators

1. Dryness of mouth2. Restlessness

A. Frequent changes in positionB. Tapping of feetC. FidgetingD. Gripping arms of the chairE. Elbows held close to the bodyF. Running hands through the hairG. Chewing of fingernails, pencils,

or other objects3. Excessive sweating4. Pulsation of the carotid artery5. Pallor, flushing, or change in complexion,

color6. Excessive swallowing7. Avoiding direct gaze8. Appearance of being disturbed and/or

very tense9. Audible turbulence in the stomach.


64

Establishing a Baseline

Dance continued to ask about his life [the bad guy] in Seaside and in prison, observing him the whole while: how

he behaved when she asked the questions and how he behaved when he answered. She wasn’t doing this to get

information-She’d done her homework and knew the answers to everything she asked-but was instead

establishing his behavioral baseline.

In spotting lies, interrogators consider three factors: nonverbal behavior ( body language, or kinesics), verbal quality ( pitch of voice or pauses before answering) and verbal content (what the suspect says). The first two are far more reliable indications of deception, since it’s much easier to control what we say than how we say it and our

body’s natural reaction when we do.

The baseline is a catalog of those behaviors exhibited when the subject is telling the truth. This is the standard

the interrogator will compare later with the subject’s behavior when he might have a reason to lie. Any differences between the two suggest deception.

Finally Dance had a good profile of the truthful Daniel Pell and moved to the crux of her mission.

Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.8.

65

Establishing a Baseline (cont.)

Still relaxed. The body language wasn’t any different from his baseline. He was showing only emblems-common gestures that tended to substitute for words, like shrugs and finger pointing. There were no adaptors, which signal tension, or affect displays-signs that he was experiencing emotion.

‘Not Really.’

Which wasn’t an answer to a yes-or-no question; it was even more slippery than ‘I don’t recall.’ Dance noticed too that pell had put his hands, tipped with long, clean nails, on the table at the word ‘ relatives’. This was a deviation from base-line behavior. It didn’t mean lying, but he was feeling stress. The questions were upsetting him.

Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.9-11.

66

Studying and Mirrors

He was in no hurry [the bad guy]; interviewers and interviewees share mutual curiosity. (She told the students in her interrogation seminars, “They’re studying you as hard as you’re studying them-usually even harder, since they have more to lose.”

Mirrors weren’t placed in interrogation rooms to hide cameras and witness-there are far better high-tech ways to do so –but because people are less inclined to lie when they see themselves.

Dance gave a faint smile. ‘ And you understand that you can withdraw from this interview anytime you want and that you have a right to an attorney?’

Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton, 2007, p.6-7.

Conducting Effective Interviews

Preferable to use copies of documents rather than originals.

Interview one person at a time.

Location to be chosen to ensure privacy and to minimize interruptions.

Use of cell phones is discouraged.

Interview may be protected by legal privilege if the forensic accountant has been hired by counsel.

Source: AICPA Forensic and Valuation Services Section, Conducting Effective Interviews.

67

Interviewer

Ideally have two interviewers. Encourage long answers. Initial contact polite and

professional. Lead interviewer should focus on

questions. Maintain eye contact. Interview partner take detailed

notes. Close on a positive note. Prepare record of interview as

soon as possible. If traveling away from office, let

someone know where you are interviewing the person.

Conducted in business location. Ask for a business card.


68

Recording Interviews

If the decision is made to record interviews, proper and reliable equipment is required and a chain of custody for the recordings will be necessary.

If recorded statements are used in a later proceeding, the recordings will have to be authenticated and any transcriptions will have to be reviewed for accuracy.

While most recording equipment uses a digital format, the digital recordings can easily be altered. Therefore, the original recordings must be retained where a proper chain of custody and retention can provide assurances that the original recoding has not been changed.

Extreme care should be taken when making copies of the original recording.


69

Recording Interviews

When considering recording other persons, most state laws require the consent of one person to the conversation, but other states require the consent of all parties in the conversation.

Surreptitious recordings also are fraught with significant legal issues.

Consideration should be made to address a situation where a person may bring their own recorder to an interview and insist on making their own recording.

Proper planning of the investigation with counsel should address these issues.


70

Upjohn Warning

In cases where illegal behavior is suspected, interviews should not be conducted until the client’s counsel has been consulted.

If it is decided that an attorney will be present during the interview, typically the attorney will begin by giving the witness an Upjohn warning.

An Upjohn warning is a disclaimer issued by an attorney for a company to an employee of the company.

In the Upjohn warning, the employee is advised that the attorney does not represent the employee, but rather represents the company as a legal entity.


71

Do’s of Interviewing

1. Consult counsel once allegations are made.

2. Prepare and discuss an interview plan or theme.

3. Conduct one interview at a time, unless the situation dictates otherwise.

4. Arrange a safe and private interview location.

5. Gather and organize pertinent documents before the interview.

6. Obtain information concerning the person being interviewed before the interview.

7. Exhibit courteous and professional appearance and behavior at all times.

8. Be punctual.9. Conduct the interview with more than one

person.10. Establish rapport during initial contact.11. Maintain control in the interview.12. Close on a positive note for future

contacts.13. Prepare reports as close as possible to

interview.14. Listen to you instincts.


72

Don’ts of Interviewing

1. Conduct interview without a plan of action.

2. Fail to discuss the interview with partner.

3. Argue with interviewee.4. Lose objectivity during the

interview.5. Become judgmental during a

confession.6. Include personal opinions in notes

or written reports.7. Provide promises or assurances.8. Threaten interviewee with

disclosure of interview results, discipline, or job security.

9. Discuss interviews with anyone outside the investigation.


73

74

Lying: James R. Brown Style

“I lied in person to investors when I met them. I lied in company’s filings. I lied in the company’s press releases.” Adelphia Communications vice-president of finance.

He had no formal training in accounting and finance.

Adelphia began manipulating its financial reports soon after the company went public in 1986.

We regularly fabricated statistics on the number of subscribers, cash flow, cable-system upgrades, and other closely followed metrics.

75

Lying: James R. Brown Style (cont.)

Top executives would meet on Saturdays to determine if we were meeting loan agreements. If not, we would make other types of manipulations of either arbitrarily moving expenses between companies or adding invented affiliate income or interest income from one internal company to another.

For more than 10 years we kept two sets of books.

Source: Chad Bray, “Adelphia Witness Lays Out Lies,” WSJ, May 19, 2004, pp. C-1 and C-2.

-----------------------------------------------------

I swear on my heart I was telling the truth

at the time. Baby I lied. Baby I lied.

Deborah Allen

76

Fewer People Lie in E-mail

• People tell fewer lies in e-mails than in phone calls and face-to-face conversations.

• Possible reason: Most people know that e-mails leave a record.J. T. Hancock, Corporate Human Interaction

-------------------------------------------------

I got one thing to tell you,I…oooo, I ain’t tryin’ to sell ya’,No lies.

Grand Funk Railroad

77

Interviewing Techniques

“Bosch didn’t say anything. He knew that sometimes when he was quiet, the person he needed information from would eventually fill the silence.” (pp. 5-6).

--------------------------------------------

“Just listen. You are a detective. Detectives are supposed to listen. You once told me that solving murders are getting people to talk and just listening to them.” (pp. 92-93).

--------------------------------------------------

Source: Michael Connelly, The Black Ice, St. Martin’s Paperback, 1993.

78

Progression of Interpersonal Communication

Investigative Communication

Type

Investigative Conversation

Structured Investigative Interviewing

Basic Forensic Interrogation

Advanced Forensic

Interrogation

Time Requirements

Flexible Thirty minutes to one hour

Three to six hours

Three to six hours

Required Environment

Flexible Private setting

Intimate setting

Intimate setting

79


Skill/Training

Requirements

Minimal training

required. Preferable to have training

in active listening

skills, question

formulation and basic behavior

analysis as well as

psychology of

investigative discourse.

Minimum fifteen hours

training in structured interview formats

and behavior analysis.

Minimum fifteen hours interviewing training plus thirty hours of training in

Reid Nine Steps.*

Minimum standards

for structured

formats and basic

interrogation as well as

minimum ten hours of

advanced training.

*Inbau, F.E., Reid, J. E. & Budkley, J.P. (1986) Criminal Interrogation and Confessions, third edition (Baltimore, Williams and Wilkins).

Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.I. 02911.

80


Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.I. 02911.

Appro-priate Use

and Restrictions

When you are looking for direction

in an investigation. Result is a

gamble rather than a predictable

outcome

When you have

established the need for

a formal investigation

and are interacting

with witnesses,

victims, complainant

s or suspects.

Must accept information

as it is presented

without confrontatio

n.

When you are interacting

with an uncooperativ

e suspect and require a

truthful account of

that person’s guilt. Make

use of perception

manipulation and as such

requires compre-hensive quality control.

Most desirous form for

uncooperative suspects of

severe offences or

suspects who may be

emotionally unstable. Does

not use perception

manipulation and therefore

beneficial when you need to identify true motivation for the offense.

A Thousand LiesWhat is a man that stays true to the game

But has to cheat a little to get byWell that is a person that I know too well

What if a man doesn’t stay true to the gameDon’t care for no one, only cares for his greed.

Machine Head

81

Chance of Confession

John Baldwin found in 600 investigative interviews that 35.7 percent of suspects confessed from the outset and an additional 16.2 percent confessed initially to part of the allegation.“Police Interviewing Techniques,” British Journal of Criminology, Vol. 33, 1993.

William Morrisette believes that “an investigator who properly identifies and implements the appropriate investigative communication type should be able to achieve an 85 percent confession rate through basic interrogation and a 95 percent rate by way of advanced interrogation.”

82

Deception Variables

Some variables in the management discussion and analysis section of annual report can provide early fraud prediction rate from 56% to 65%.

The presence of deceptions are

1. Less terms indicating positive emotions.

2. Less present tense verbs.

3. Presence of an increased number of words.

4. Fewer colons.

5. Fewer semicolons.

6. Lower use of “for example.”

7. Lower lexical diversity.

C.C. Lee, N. T. Churyk, and D.D. Clinton, Validating Early Fraud Prediction Using Narrative Disclosures, JFIA, Vol. 5, No. 1, January – June, 2013.

Better Whistleblower Letters

Self-reference, indicating first-hand knowledge of the incident.

A higher level of writing.

As many examples (numeric lists, quantifiers, causal relationships, citations, and explanations) requiring the use of various styles (commas, semi-colons, parentheses, and quotations) as possible documenting the incident.

Source: Pope and Churyk, The Anatomy of A Whistleblower Letter: A Descriptive Study, forthcoming, J. of Forensic & Investigative Accounting

84

Fraud Detection Questions

Question # 1 –Reason Why? Do you know

why you are here today?Principle: Innocent subjects

will acknowledge the reason for the interview, while the guilty subject will generally avoid indicating knowledge of the issue.

Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.

85


Question #2 –Know/Suspect: Who do you

think may have taken that $5,000 from the safe?

Principle: Innocent subjects are more likely to volunteer a name or offer a suspicion.


86


Question #3 –Vouch: Is there anyone that you

work with that you feel would not have taken that $5,000 from the safe?

Principle: Innocent subjects will vouch for others, while the guilty will vouch for themselves or no one.


87


Question #4 –Think: Do you think that the

$5,000 was actually stolen?Principle: Innocent subjects

will generally agree that the money was actually stolen.


88


Question #5 –Opportunity: Who do you think

would have the best opportunity to take that $5,000 from the safe?

Principle: Innocent subjects will usually offer a name of an individual or named position who would have had the best opportunity.


89


Question #6 –Happen: What do you think

should happen to the person who stole that missing $5,000?

Principle: Innocent subjects will generally offer harsher punishment than the guilty.


90


Question #7 –2nd Chance: Would you be inclined

to give someone a second chance?

Principle: Innocent subjects generally continue to offer harsh punishment, while the guilty are more likely to offer a second chance.

See Porter and Crumbley, Teaching Interviewing Techniques to

Forensic Accountants Is Critical, J. of Forensic & Investigative

Accounting, Vol. 4: No, 1, January – June 2012, pp. 122-126


91

Differences

Ronald L. Durkin suggests the following differences in a forensic audit versus a traditional audit:

•Not limiting the scope of the engagement based upon materiality.

•Not accepting sampling as evidence.•Not assuming management has integrity.

•Seeking the best legal evidence.•Melding the requirements of the evidential matter standard with the rules of evidence.

Source: R.L. Durkin, “Defining the Practice of Forensic Accounting,” CPA Expert, Special Edition, 1999.

92

Inexperienced Forensic Auditors

Find out who did it. Do not worry about all the endless details.

Be creative, think like the fraudster, and do not be predictable. Lower the auditing threshold without notice.

Take into consideration that fraud often involves conspiracy.

Internal control lapses often occur during vacations, sick outages, days off, and rest breaks, especially when temporary personnel replace normal employees.

H. R. Davia, Fraud 101, New York: John Wiley & Sons, 2000, pp. 42-45.