Fraud and Forensic Audit – Role of Chartered Accountants Available

Tools and Techniques Track T 7

27th Regional Conference

WIRC of ICAI Hotel Lalit, Mumbai September 1, 2012

Chetan Dalal

Very Important to remember:

• All case studies / exhibits / example are adaptations of real life situations, and any resemblance or use of any name, logo or symbol of any entity is purely for academic purposes and to facilitate better understanding. Case studies discussed in the seminar are imaginary and at no point is there any direct or indirect implication of fraud in or by any entity referred to anywhere.

Agenda in this session

A. Forensic Audit… and fraud investigation what it is all about.

B. Cyber law – a brief discussion C. Red Flags and some simple common sense forensic

tests D. Forensic audit of spreadsheets specially for chartered

accountants E. Tools and techniques for carrying out forensic audits Open session

A: Forensic Audit… and fraud investigation

what it is all about?

Forensic accounting is the specialty practice area of accountancy that describes engagements that result from actual or anticipated disputes or litigation. "Forensic" means "suitable for use in a court of law", and it is to that standard and potential outcome that forensic accountants generally have to work. Forensic accountants, also referred to as forensic auditors or investigative auditors, often have to give expert evidence at the eventual trial.[1] All of the larger accounting firms, as well as many medium-sized and boutique firms, have specialist forensic accounting departments. Within these groups, there may be further sub-specializations: some forensic accountants

Forensic accounting defined in Wikipedia, the free encyclopedia

Forensic Audit is the application of accounting methods to the tracking and collection of forensic evidence, usually for investigation and prosecution of criminal acts such as embezzlement or fraud. Also called forensic accounting. http://www.businessdictionary.com/definition/forensic-audit.html

In simple words forensic Audit is all about examination and collection of evidence admissible in a court of law. It utilizes the following skills of CAs-

-Accounting

-Auditing

-Investigating

What distinguishes a forensic audit from a normal audit?

• Forensic audit is issue based or related to a specific problem

• It has several components and could include any or all of the following:

- Financial and accounting review

- Digital forensic analysis

- Field investigations

- Data mining at an advanced level

- Application of Interviewing skills

- Technical assistance such as handwriting, specimen signatires, QC evaluation etc

Audit relies on documentary evidence, whereas a forensic audit actually examines the reliability of documentary evidence itself

Forensic accounting emphasizes the need to look for other evidence available as well.

For example a bank manager committing suicide on desk with a

suicide note under his hand

Common reasons why fraud and fraudsters escape unnoticed

1. Fraudsters are Intelligent

2. Concealment by fraudsters

3. Stale procedures syndrome

4. Lack of perseverance- example of Japanese farmers

However, the most lethal reason for fraud to increase exponentially is

technology Intelligent Fraudsters exploit new technology to great advantage; eg

steganography

What are the traits of a good investigator and a forensic

accountant?

• Distrust the obvious • An eye for detail- three dimensional vision • Third aspect- Will discuss in the end

In the next slide view the picture as an auditor or a

forensic accountant. Do you come to different conclusions?

B: Cyber Law: A brief Discussion

What is meant by Cyber Law?

• Cyber Law is law governing Cyber space (CS). CS is a very wide term and includes computers, internets, email, sms, USB, hard disks, networks, storage, and even ATM machines, cell phones etc.

• Suggested reading: Detailed discussion by Asian School of cyber laws: website http://www.corecentre.co.in/database/docs/docfiles/india_cyber.pdf

CL encompasses laws relating to:

• Computer crimes • IPR • Data Protection and security • Electronic and digital signatures

• It would be advisable for CAs to familiarise

themselves with the foregoing. • Essentially the IT (Information Technology Act) is

relevant to the entire issue of CL

What is cyber crime? • We can say that cyber crime consists of unlawful acts

wherein the computer is either a tool or a target or both

• What is the importance of Cyberlaw ?

• Does Cyberlaw concern us as CAs ?

• Cyberlaw in India- status ? Recommended website for reading… • Information security awareness: http://infosecawareness.in/cyber-laws/cyber-law-in-india

•

What is cyber crime? We can say that cyber crime consists of unlawful

acts wherein the computer is either a tool or a target or both

Example of Computer as a Target :-using a computer to attack other computers e.g.

Hacking, Virus/Worm attacks, DOS attack etc. Examples of computer as a weapon/tool :-using a computer to commit real world crimes.

e.g. Cyber Terrorism, IPR violations, Credit card frauds, EFT frauds, Pornography etc. Cyber Crime is regulated by Cyber Laws or Internet Laws.

• The abuse of computers has also given birth to a gamut of new age crimes

that are addressed by the Information Technology Act, 2000.

C: Red Flags and some simple common sense tests useful in

forensic audit or even special audits for chartered accountants

Red Flags or early warning bells The following are some common red flags which auditors

may want to be mindful of : - Coding errors with a pattern - Cancellations, alterations, smudges on documents - Too much authority or power given to one individual or

group - Missing documents of a particular type - Close nexus with vendors or customers particularly

with purchase officers, directors - No shortages in cash counts where cash dealings are

huge as in stores, shops, malls, etc

Spotting red flags is the key to all investigations- develop and use commonsense forensic tests to spot them early

1. - Juxtaposition test for testing authenticity of documents format and content

2. Test of reasonableness or absurdity

3. Test of replication of content

4. Test of impossibility

5. Scrutiny of suspicious documents particularly those having alterations

Juxtaposition test: to juxtapose means to place side by side and compare.

This can be very effective in spotting duplicated or forged

documents

How would you spot whether two independent parties could actually be the same eg: - bidders for a contract or project - vendors for a purchase department inquiry - applicants’ references for a job See the next slide where an applicant furnished

Test of replication of content, grammatical mistakes proivides best evidence of falsification

Documents, invoices etc coming from two different sources cannot possibly make the same grammatical mistakes

2.Test of REASONABLENESS OR ABSURDITY

Is there anything in any auditable document, agreement, record, agreement which is not believable

or incredible? Can you have a letter dated 2001 with a 5 digit

telephone number in a metro city like Mumbai; or a letter written in 2012 by an age old typewriter?

3. Testing procedure in scrutiny of cancellations etc

Space between words, figures and manner of cancellations can reveal a lot about a document. Eg if the space between

two digits in a number is apparently excessive there is a chance that the numbers to the left of the space are added

afterwards by fraudsters.. Rs 1 1,456.

4.Test of IMPOSSIBILITY

Make a check list of impossible events- Eg. Production cannot be greater than installed

capacity Or..Swipe card for attendance cannot be active when

the employee is on tour outside the city

D: Forensic audit of spreadsheets useful to chartered accountants

Forensic Testing of spreadsheet data

• The DCDS methods • The excel USFRD method U- unhide S-Show Formula F- font coloration R- rectify and replace D-duplication check

Common accounting manipulations

• Cash Contras

• Stock in transit

• Accounting favours to debtors

• Accounting favours to creditors

Bombay Br Delhi Br Kolkatta Chennai BOM-ser Lucknow Pune

Purchases 2076689 1427286 1041919 1972854 1017578 1723652 1993621 Staff Recruitment & Training 576109 501215 365887 547304 282293.4 553065 Travelling Exp - Foreign 493068 428969 313147 468415 241603.3 409246 473345 Repairs & Maint 437968 381032 278153 875936 214604.3 363513 420449 Printing & Stationery 379100 329817 240766 360145 185759 314653 363936 Travelling Exps 301765 262536 191651 286677 147864.9 250465 289694 Tel / Mobile / Internet 116954 101750 74277.5 111106 57307.46 97071.8 112276 Electricity Charges 120000 104400 76212 114000 58800 99600 115200 Communication - FBT 106953 93049.1 67925.9 101605 52406.97 88771 102675 Discounts given 105873 92109.5 67239.9 100579 109023 87874.6 101638 Discounts on sales 206902 180005 131403 196557 101382 171729 198626 Vehicle Running & Main - R 249529 217090 158476 237053 122269.2 239548 Subscription Charges 143399 124757 91072.7 136229 70265.51 119021 137663 Funds transferred- Kolkatta 250000 Funds transferred- Pune 50000 Funds transferred- Chennai 125000 Funds transferred- Delhi 1437477 Stock in transit to Kolkatta 500000 Security Charges 139543 121402 88623.8 132566 68376.07 115821 133961 stocks in transit 209488 182255 133046 199014 102649.1 173875 201108 Stock in transit to Bom_ser 800000 696000 508080 760000 392000 768000 Postage / Telegram 273491 237937 173694 259816 134010.6 226998 262551 Membership Fees 174086 151455 110562 165382 85302.14 144491 167123 Insurance Prem - FBT 187524 163146 119096 178148 91886.76 155645 180023 Insurance Prem - Clinical Trials 214218 186369 136050 203507 104966.6 205649 Housekeeping Services 159191 138496 101102 151231 78003.59 132129 152823 Facility Management 175044 152288 111170 166292 85771.5 145286 168042 Conference/Seminar Fees 499233 434333 317063 474271 244624.2 414363 479264 Computer Maint AMC Others

Sales 1427286 1241739 906469 1355922 699370.2 1184647 1370195 HO account 901195 784040 572349 856135 441585.6 747992 865147 Funds transferred from Bom 250000 Funds transferredfrom Delhi Funds transferred from chennai 125000 Funds transferred from Pune 1437477 Stocks in transit from Bom 800000 Stocks in transit from Bom 500000

E: Tools and techniques in carrying out forensic audits

Methods that can be effectively used in forensic audits

• Relative Size factor- to find manipulations and errors in debtors and creditors

• Benford’s Law to determine the extent of reliability of any data for auditworthiness

• Application of non financial information such as space or time dimensions to detect wrongdoing

• Customised Physical verifications, decoy tests, tiger team tests

• Imaginative tests to suit given situations- Birbal tricks, barium test, mirror tests, etc

benf_law.xls

First Digit Probability 1 30.10% 2 17.60% 3 12.50% 4 9.70% 5 7.90% 6 6.70% 7 5.80% 8 5.10% 9 4.60%

7

RSF- Relative Size Factor

RSF= highest value divided by the second highest value in a ledger account of say debtors, or creditors

If the RSF > 10, chances of error or fraud are great

SPACE TIME DIMENSION • BOTH SPACE AND TIME OFFER TESTING YARDSTICKS FOR

AUDIT PURPOSES. e.g. How much quantity can be stored in a warehouse,

container, truck, box can be very useful for corroborative tests of inventory, sales, purchases.

Time can be used in several ways, time of transaction, time

taken for the transaction, time difference between two events etc.

A robbery took place in a mall in January 2006

• Thieves broke in through the door

• They stole case worth more than Rs. 40 lacs

• Police complaint lodged

• Police made inquiries with staff, neighbourhood

Findings of the Police

• They concluded that this was the work of a local gang of thieves operating in the area and this mall was the latest victim

• They suspected that some employee may have helped but could not get specific clues against anyone

• They recommended better locks and greater security. Case virtually closed

Management appointed auditors who were specialised investigators more for studying controls and recommending preventive measures

Auditors spot red flags

The time element indicated that the thieves had only 20 minutes to complete the robbery while the patrolling guards were circling the mall.

• How could they throw about all contents of all drawers? • Where did they have time to steal a few cell phone handsets

which were on a different floor? • The alarm had been switch off. Therefore it was certain that

someone had helped them • The door that was broken was done with crude tools- not the

work of a professional gang • Out of two safes only one was broken into and robbed. The

second was left untouched?

Findings good but inadequate to point out any means of recovery

Auditors try a new approach

• The use the space time dimension approach

• Amazing findings- Late night sales

• IDEA_DATA.xls

The log in id was traced – the store manager. On being questioned he confessed

• There was no robbery- it was a stage managed robbery to cover up stock shortages

• The shortages were built up over a period of time. The store manager panicked when he was told that a stock taking was to take place

• He converted the stock shortages into ‘artificial’ sales by entering sales at midnight along with his accomplice the head cashier during the previous two nights. This resulted into stock shortages being converted into cash shortages.

• This shortage was then palmed off as robbery by breaking open the door and throwing papers and documents in the cash room to make it look like a robbery

The perfect insurance fraud

An old lady- anita- resident of UK- Sri Lankan Origin

Widow with one daughter staying with her in London

Took a 1.4 million pound policy in 2006 January

Details of the policy and the case

• Life Insurance- beneficiary the daughter

• Medical Reports all clear in London

• No ailments, diseases

• She was from Sri Lanka now settled in London for the last 20 years

• She had siblings, relatives and friends in Sri Lanka

• She regularly visited Sri Lanka

anita- went for a holiday in January 2007 to Sri Lanka

• She stayed in a large five star hotel in Colomba

• She made her booking through her credit card on the internet

During her stay in Sri Lanka

• One evening she felt very sick and called the hotel attendant.

• The attendant called the manager who in turn called for an ambulance

• anita was moved to the hospital and admitted to the ICU

anita was declared dead within two hours

• The sister reached the hospital just in time to hear about her death

• The doctor issued the cause of death and medical certificate

Insurance Claim for 1.4 m pounds submitted

The following documents were submitted:

• Death Certificate from Sri lanka

• Funeral Parlour certificate for holding the body

• Crematorium receipt

• Obituary in local newspaper

• Hospital – cause of death certificate signed by the doctor

• Details of hotel booking through internet containing credit card number etc

Investigation launched- procedurally

• Death claim of a large amount

• Death very soon after the policy

• Death in a third world country- where verifications would be difficult

We were requested to go to Sri Lanka to verify the circumstances surrounding the

death

What we did

• Documentary verifications at all the offices where such documents were issued:

- Hospital

- Newspaper-obituary

- Crematorium

- Funeral Parlour

- Registrar of deaths

• Third party inquiries by staying at the same hotel where the insured stayed before death, and attempting to meet family member sister/ brother etc

• genuine and authentic

• Examination of documents and submissions

What we found

Documentary tests – All positive. All authorities confirmed the authenticity of the following documents:

- Death Certificate

- Crematorium Receipt

- Receipt for body kept at funeral parlour before cremation

- Hospital bill

However…Red Flags noticed

• No Post mortem report. This was a statutory requirement

• Sister was staying opposite the hotel in a posh house, all alone. Why did anita not stay with her?

• Sister refused to meet us… no reason • Doctor was missing- left Sri Lanka for good • Hotel attendants gave conflicting versions • Cause of death certificate showed diabetes as

secondary cause. (she had no diabetes per her medical reports)

Insurance Company’s response

• Red flags were interesting but not enough to repudiate the claim

• Some falsification of documentation would be needed to contest the claim

Why do most investigators/auditors miss out frauds

• They depend on documents as in this case. Since documents were OK, the claim was paid

• The Reality and truth were not important

• No effort is usually made to see if some new tool is available, some new method is available

Research Paid off

• Luhn’s algorithm did the trick

• Luhn_Algo_07.xls

The actual fraud

• The hotel bill was false and so was the booking reference and credit card number. No one had actually stayed in the hotel

• The doctor at the hospital was given a big amount to get a needy family to admit their dying mother to the hospital and give her identity to anita

• Identity fraud perpetrated at all statutory places. The patient died as expected and her body was cremated. All the statutory certificates were therefore authentic in so far as they related to the cremation, death and hospitalization, except as regards the switched identity.

• Anita had no sister. She herself was staying in the house opposite the hotel posing as the ‘sister’.

Thank you

Chetan Dalal