Forensic Accounting using IT

Forensic Accounting using IT

IntroductionUnder contemporary conditions of business activity, securing reliable financial information through disclosing financial statements is considered a generally accepted objective. Numerous financial frauds from the past and the beginning of the century have seriously disrupted the trust of numerous users in financial information contained in financial statements. Forensic accounting is hardly a new field, but in recent years, financial organizations, banks, insurance companies and even police agencies have increased the use of these experts. In the wake of high-profile corporate scandals as well as new regulations worldwide, many business leaders are increasingly aware of the need to create company-specific antifraud measures to address internal corporate fraud and misconduct. The system of internal control, internal auditing and audit committee are the key elements for preventing frauds that are created through property misuse as well as those that use financial statements as instruments of fraud. External auditing and forensic accounting perform retrospective control of financial data with the aim of detecting omissions and frauds and the aim of securing the reliability and credibility of financial statements.

Forensic Accounting"Forensic" means "suitable for use in a court of law", and it is to that standard and potential outcome that Forensic Accountants generally have to work. Forensic accountants, also referred to as forensic auditors or investigative auditors, often have to give expert evidence at the eventual trial.

“Forensic Accounting is the application of accounting principles, theories and discipline to facts or hypothesis at issues in a legal dispute and encompasses every branch of accounting knowledge”- AICPA.

“Forensic Accounting is a science that deals with the relation and application of finance, accounting, tax and auditing knowledge to analyse, investigate, inquire, test and examine the mater in civil law, criminal law in an attempt to obtain the truth from which to render an expert opinion”- Horty.

Forensic Accounting encompasses the use of accounting/ auditing, investigative skills, data mining and the use of computer as an audit tool. It emphasizes a forensic approach in place of a risk management/ control approach to the analysis of corporate governance. It entails a check-up for cyber frauds, prevention and detection.

Forensic Accounting ProfessionDue to spate of corporate failures all over the world in recent times, accounting and finance professionals have greater responsibilities to equip themselves with advanced skills to identify and act upon the indicators of poor corporate governance, mismanagement, fraud and other wrongdoings.

Forensic accounting is the practice of utilizing accounting, auditing, and investigative skills to determine whether fraud has occurred. In this capacity, the forensic accountant quantifies damages sustained by parties, whether or not involved in legal disputes and can assist in resolving disputes, even before they reach the courtroom. If a dispute reaches the courtroom, the forensic accountant may testify as an expert witness.

Forensic Accounting and Fraud Detection involves extensive use of CATT/GAS, Data Mining and other computer tools as most data is now processed through computer, in short, forensic accounting requires the most important quality a person can possess: the ability to think. Chartered Accountants, with their sound grounding in accounting/ auditing/ business requirements/ legal requirements, are the most appropriate professionals to offer Forensic Accounting and Fraud Detection services.

Neha Gupta | 1

Forensic Accounting using IT

Role of Forensic AccountantsForensic accounting consists of a broad area of financial statement investigation and litigation support. Various positions including consultants, internal auditors, bankruptcy specialists, bank examiners, and valuators of closely held businesses, as well as lawyers and professors, can be held by forensic accountants. Among the many services offered by forensic accountants are: Litigation Support Investigative AccountingFraud Detection Computer ForensicsExpert Witness Engagements Divorce Business Valuations Lost Earnings Engagements

Some of the other areas in which the Forensic Accountants are involved are:Criminal InvestigationsShareholders' and Partnership Disputes Personal Injury Claims / Motor Vehicle Accidents Business Interruption / Other Types of Insurance ClaimsBusiness/Employee Fraud Investigations Matrimonial DisputesBusiness Economic LossesProfessional NegligenceMediation and Arbitration

What characteristics should a Forensic Accountant possess? A capable Forensic Accountant should have the following characteristics:CuriosityPersistenceCreativityDiscretionOrganizationConfidence Sound professional judgment

Techniques in Forensic AccountingThe conventional accounting and auditing with the help of different accounting tools like ratio technique, cash flow technique, a standard statistical tool examination of evidences are all part of forensic accounting. In cases involving significant amounts of data, the present-day forensic accountant has technology available to obtain or source data, sort and analyze data and even quantify and stratify results through computer audit software applications and various other techniques. Some of the techniques involved in Forensic Accounting are:

Benford’s LawIt is a mathematical tool, and is one of the various ways to determine whether variable under study is a case of unintentional errors (mistakes) or fraud. On detecting any such phenomenon, the variable under study is subjected to a detailed scrutiny. The law states that fabricated figures (as indicator of fraud) possess a different pattern from random (or valid) figures. It states that the leading digit in some

Neha Gupta | 2

Forensic Accounting using IT

numerical series follows an exponential rather than normal distribution. It applies to a wide variety of figures: financial results, electricity bills, street addresses, stock prices, population numbers, death rates, lengths of rivers.

Theory of relative size factor (RSF)It highlights all unusual fluctuations, which may be routed from fraud or genuine errors. RSF is measured as the ratio of the largest number to the second largest number of the given set. In practice there exist certain limits (e.g. financial) for each entity such as vendor, customer, employee, etc. These limits may be defined or analyzed from the available data-if not defined. If there is any stray instance of single transaction that is way beyond the normal range, then there is a need to investigate further into it. It helps in better detection of anomalies or outliners. In this method the records that fall outside the prescribed range are suspected of errors or fraud. These records or fields need to relate to other variables or factors in order to find the relationship, thus establishing the truth.

Computer Assisted Auditing Tools (CAATs)CAATs are computer programs that the auditor uses as part of the audit procedures to process data of audit significance contained in a client’s information systems, without depending on him. CAAT helps auditors to perform various auditing procedures such as:

• Testing details of transactions and balances;• Identifying inconsistencies or significant fluctuations;• Testing general as well as application control of computer systems;• Sampling programs to extract data for audit testing,• Redoing calculations performed by accounting systems.

Data Mining techniquesData mining has also been called database reporting, data analysis, and other similar names but generally can be defined as "the automated extraction of hidden predictive information from databases." It is a set of computer-assisted techniques designed to automatically mine large volumes of data for new, hidden or unexpected informations or patterns. Data mining techniques are categorized in three ways: Discovery, Predictive modeling and Deviation and Link analysis. It discovers the usual knowledge or patterns in data, without a predefined idea or hypothesis about what the pattern may be, i.e. without any prior knowledge of fraud.

The two recognized tools of data mining are: • Use of Spreadsheets

Data mining in its simplest form may take the form of a "sorted" Excel spreadsheet where the fraud examiner tries to identify the largest suppliers or customers. A further development of this is to track expenditure with the largest suppliers over time. This can be achieved using pivot tables in Excel followed by the charting function.

• Use of DatabasesThe next stage in data mining is the use of databases to run complex queries. Microsoft Access is an extremely powerful tool which many fraud examiners will be able to use. More complex databases include ACL and WinIdea. These may require specialist knowledge. However, they can analyze large amounts of data and produce complex queries that can be automated.

Neha Gupta | 3

Forensic Accounting using IT

Database basicsA database is an organized collection of information that can be easily accessed, managed, and updated. A database management system (DBMS) such as Access, FileMaker Pro, SQL Server, or Oracle provides software tools to organize data in a flexible manner. It includes facilities to add, modify, or delete data from the database, ask questions (or queries) about the data stored in the database and may have internal tools to produce reports summarizing selected contents.

Relational databases organize data in multiple related tables. Relational databases are NOT "super" spreadsheets but have some similar functionality. A relational database may be made up of hundreds of tables that organize different types of information. For instance, in a typical retail operation there are tables that keep track of customers and others that keep track of orders, but there's not a single table that contains all customer information. One table has basic customer information such as names, addresses, and phone numbers, another tracks customers' credit histories, and yet another tracks individual contact information such as the name of the contacts, the types of discussion, and customers' special requests. These tables are tied together using a key field such as a customer number.

Designing databases is a detailed science that's outside the scope of this article. But suffice it to say that a database administrator has techniques that make it easy to pull up information quickly and keep "normalized" data in tables in specific locations. One rule of normalization dictates that data should be stored in only one place within a database. Imagine the confusion if a customer's credit limit was stored in two separate tables or could be updated by multiple processes. It would be hard to determine that customer's actual credit limit if the data didn't match exactly.

Transactional databases, which have relatively simple record structures, allow many users to read and make changes. It's easy to quickly pull up on computer screen standard information on a transactional database such as a customer's order history or other business application. But it's difficult to reconstruct historical or trend information. Most entities' systems record virtually all transactions, but the data isn't typically located in one single, comprehensive location.

For mining purposes, data can be pulled from these transactional tables just as if they were stored in a single table by linking them together through fields that are common to both tables. Fields to be linked should be of the same data type, and the string/text fields should be the same length. These links are created through the use of keys.

By using data mining tools, users connect remotely to their database through a method of Open DataBase Connectivity (ODBC). After the data has been connected through one of the reporting tools and linked correctly, one needs to narrow the data down to the information that will be most helpful. A query is a set of criteria that you specify to identify and retrieve data records that meet those criteria. Structured Query Language (SQL) is a standard interactive and programming language for obtaining information from databases and updating them. SQL allows users to access data in relational database management systems, such as Oracle, Sybase, Informix, Microsoft SQL Server, Access, and others by allowing users to describe the data that the user wants to see.

Some IT tools that help mine for goldPlenty of third-party reporting tools can help you analyze large amounts of data. But here we'll discuss some of the important tools which are easy to use, relatively inexpensive, and perform well.

• Crystal Reports

Neha Gupta | 4

Forensic Accounting using IT

Crystal Reports has been the gold standard for database reporting. It has the flexibility to connect to almost any data source with a user-friendly interface that makes the digging much easier. Crystal Reports can graph the data visually at the same time the query returns. It's a tenth-generation reporting tool originally developed by Seagate Software and now owned by Business Objects. Crystal Reports can connect to virtually any data source through ODBC or PC data connections. Most importantly, the connection is read-only when connecting through ODBC. This means that no matter what is done in the Crystal report, there's no possible way one can corrupt or change the data.

Crystal Reports allows the creation of reports quickly by dragging fields onto a blank report, group and sort based on database fields or calculated fields, and format a presentation quality report in a matter of minutes. The report can be quickly refreshed as data is added.

• Microsoft Access Microsoft Access provides users with one of the simplest and most flexible database solutions on the market today. Access’ three major components that most database miners require are tables, queries, and reports. Unlike Crystal Reports, MS Access allows to update the source data and change the data through queries and manual data entry into tables. In MS Access, one can intentionally or accidentally change the data. Therefore, while Crystal Reports is purely a reporting and analysis tool, MS Access is actually a database application that can contain other features to control data rather than a simple connection to it.

• Outlier DetectionOne of the primary methods of detecting fraud is discovering data values that are outside the normal course of business. The simplest method of outlier detection is the statistical zscore calculation. This formula, given as (value mean)/ standard deviation, provides a simple and compact method of measuring outliers. The numerator shifts each point to a zerobased scale, and the denominator adjusts the distribution to a standard deviation of one. Once the data are transformed into this standardized scale, generalized statements can be made.

• Advanced Statistical TechniquesThese are advanced methods for fraud detection in statistical and computer science field. These methods include Bayesian Networks, genetic algorithms, state transition analysis, rule matching, and cluster analysis. Though most of these advanced technical methodologies are not generally used in typical business systems, they are most often used in highly specialized areas like credit card fraud, health care claims, and voter fraud.

Investigation toolsForensic accounting in conducting investigation in this internet era uses many investigation tools. Ranging from data mining software to data analysis and sometimes the same tools that used by hackers. Here some of those tools used by forensic accountants:

HelixHelix is “an internal tool to provide the ability to acquire forensically sound images of many types of hard drives and partitions on systems running unique setups such as RAID arrays”. However, Helix is different from many other software imaging because, Helix is developed based on Knoppix (one variant of Linux) which are open source and free. Helix offers six main options to examine the system under investigation. These options are described below:

Neha Gupta | 5

Forensic Accounting using IT

• Preview System Information• Acquire a “live” image of a System using dd• Incident Response tools for Operating Systems• Documents pertaining to Incident Response, Computer Forensics, & Computer Security• Browse contents of the CD-ROM and Host OS• Scan for Pictures from a system

ACL DesktopAudit Command Language (ACL) is the market leader in computer-assisted audit technology and is an established forensics tool. ACL provides immediate visibility into transactional data critical to organizations enabling to analyze entire data populations for complete assurance; identify trends, pinpoint exceptions and highlight potential areas of concern; locate errors and potential fraud; identify control issues and ensure compliance with organizational and regulatory standards; age and analyze financial or any other time sensitive transactions; and cleanse and normalize data to ensure consistency and accurate result.

UltraBlockUltraBlock is a brand name for forensic write blocker hardware. The purpose of this hardware is to prevent the digital forensic accounting to modify the data that they accessed. It is very important for digital forensic accounting to maintain the data submitted to a court as evidence remain authentic. Therefore when they access and analyse the evidence they have to be very careful not to modify, change or alter the data. UltraBlock is compatible with all leading software imaging application including Helix, EnCase or other software imaging.

Advance Hash CalculatorMaintaining integrity of evidence is one of the most things that should be concerned by forensic accounting. Once the integrity of evidence is questionable, the evidence will lost its power in the court. The worst case, the admission of evidence in the court will be rejected. One method that can be used to maintain integrity data in terms of digital forensic is by using hash value. The common hash value methods are MD5 and SHA-1. These hash value program, are include in forensic software imaging such as Helix and EnCase. However, Advance Hash Calculator offers more than MD5 and SHA-1 method to calculate hash value.

Passware Kit ForensicPassware Kit Forensic is a tool for evidence discovery solution reports all password-protected items on a computer and gains access to these items using the fastest decryption and password recovery algorithms. Passware can recovered many password in all files including difficult and strong type password. Passware Kit Forensic includes a Portable version that runs from a USB drive and finds encrypted files, recovers files and websites passwords without modifying files or settings on the host computer. Passware Kit Forensic also able to decrypts BitLocker and TrueCrypt of hardisk. Passware Kit Forensic is suitable for forensic purpose and maintain the authenticity of evidences.

Other toolsSome other IT tools used by Forensic Accountants are: Encase, FTK, PTK Forensics, The Sleuth Kit, The Coroner’s Toolkit, COFEE, Selective File Dumper

Neha Gupta | 6

Forensic Accounting using IT

Evaluation of Digital Forensic ToolsThe investigation tools describe above may help forensic accountant to detect, deter and resolve fraud faster. Golden, Skalak and Clayton (2006) state that handling digital evidence requires establishment chain of custody as with documentary evidence. Further Golden, Skalak and Clayton (2006) propose the ways to establish chain of custody such as: by keeping documentation on all procedures and/or applications performed on the digital evidence, by storing the electronic media in a secure location, by making bit-by-bit image copy of the hard drive rather than a file system copy, by analysing the copy rather than the original, and by using forensic software to prove the integrity of the original contents. Most of forensic tools used by forensic accounting can maintain the data integrity so the authenticity of evidence can be protected. The authentic evidences are admissible in the court and that is the goal of forensic accounting engagement.

ConclusionUnder contemporary conditions of business activity, frauds and omissions appear as causes of inaccurate financial statements. Frequent omission are created because of the wrong application of accounting principles in relation to amounts, types and ways of presenting and publishing certain data with no intention whatsoever to do the same .In contrast to omissions, frauds represent acts undertaken with the intention to falsify financial statements. Corporate management, systems of internal control, internal auditing and audit committee represent the forefront of defense against financial frauds. External auditing and investigations by forensic accountants represent the second defense line against frauds. It goes without saying that performing the above defined task presumes the building of a proper system where each segment-institution would have its place and role.

By applying accounting principles, auditing skills and investigative procedures in solving certain legal problems, forensic accountants help lawyers, courts, regulatory bodies and other institutions in investigating financial frauds. Therefore, in order to perform tasks efficiently and compose reports on undertaken investigation, forensic accountants must possess solid knowledge and skills in the area of accounting and auditing.

References:- Wiley: Fraud Auditing and Forensic Accounting, 4th Edition- By Tommie W. Singleton, Aaron J. Singleton, G.

Jack Bologna, Robert J. Lindquist Forensic Accounting and Fraud Investigation for Non-Experts- By Howard Silverstone, Michael Sheetz- http://www,kpmg.com- http://www.ey.com - http://www.indiaforensic.com - http://www.all-about-forensic-science.com - http://www.acfe.com

Neha Gupta | 7