#aicpafvc

The State of the Union

of Forensic Accounting From

Both Sides of the 49th Parallel

AICPA

Forensic and Valuation Services Conference

November 11, 2013

Las Vegas, Nevada

#aicpafvc

AGENDA

Moderator/Speaker Introductions

Computer Forensics and Fraud Investigations: File Attributes and Meta Data…Why Should I Care?

Current Fraud Schemes

Canadian HR Law: Investigating Employee

Misconduct

Evaluating Forensic Accountant’s Qualifications

as an Expert Witness

Summary

Contact Information

#aicpafvc

Edward Nagel

Principal and Founder of nagel +

associates, Forensic and Investigative

Accountants

Practice areas: Forensic

investigations, anti-fraud consulting

and anti-fraud training

CPA, CA, IFA, CBV

Practice focuses primarily on North

America (with some Caribbean work)

Co-author of the Canadian CPA’s

“Conversations about Forensic

Accounting”

Brad Sargent

Managing Member of The Sargent

Consulting Group, LLC.

Practice areas: Forensic accounting,

financial investigations and expert

witness

CPA/CFF, CFE, CFS, Cr.FA, FABFA

Co-author of the Canadian CPA’s

“Conversations about Forensic

Accounting”

Moderator Biographies

#aicpafvc

Steve Rogers

President

Digital Evidence International Inc.

Practice Areas: Forensic computer

analysis; internet investigations;

electronic discovery; major case

management database development

Credentials: EnCase Certified

Examiner, A+ Certified Professional,

Certified Novell Administrator

Eric S. (Rick) Rein

Partner at Horwood Marcus & Berk

Chartered

Practice Areas: Creditor's rights, loan

enforcement, creditor bankruptcy

representation and international asset

recovery

Bar Admissions—Illinois and Florida; Court

Admissions—1st, 4th and 7th Courts of

Appeal, US District Courts of the Northern

District of Illinois and Eastern District of

Michigan

Speaker Biographies

#aicpafvc

Stuart Rudner, Esq.

Founding Partner, Canadian

Employment Lawyer

Firm: Rudner MacDonald LLP

Practice Areas: Employment Law,

Human Rights, Litigation

Credentials: B.A., LL.B.

Jurisdictions: Canada

Jordan Bolton, Esq.

Partner in the Litigation Practice Group

of Clark Hill PLC

Broad-based outside general counsel

and commercial litigation practice, with

substantial experience in fraud and RICO

actions

Based in Michigan, with admissions in a

number of federal courts of appeal and

district courts throughout the country

Speaker Biographies

#aicpafvc

Computer Forensics and Fraud

InvestigationsFile Attributes and Meta Data…Why Should I Care?

Steve Rogers

#aicpafvc

How many would agree that during a

fraud investigation the date of a

record often requires authentication?

#aicpafvc

FILE ATTRIBUTES

Viewable from Windows Explorer

Created date changes on copy

• Last modified date can be earlier than created date

Last accessed doesn’t mean it was accessed

#aicpafvc

META DATA

Data about the data

Is different than file attributes

• MS Word: author, last saved by, revision number,, total editing

time, paragraphs

Not every file type contains meta data

• Text files, xml, exe, dll

Most meta data can be changed

Databases

#aicpafvc

CASE EXAMPLE #1

For the Plaintiff

Theft of intellectual property

• 2500 CAD drawings

From 1999, bankrupt the plaintiff

Subjects denied the theft

Acquired their computers/removable media

Proved continual use

Testified in Superior Court

Favourable decision

#aicpafvc

CASE EXAMPLE #2

For the Defendant

1996 Breach of contract

Contract not available

Alleged destruction of accounting evidence

Data recovered from unallocated space

#aicpafvc

CASE EXAMPLE #3

For the Plaintiff

Issuance of shares, agreements etc

Alleged 1993 corporate documents

Nearly 150 MS Word documents

Analysis shows created in 2007

Settled

#aicpafvc

CASE EXAMPLE #4

For the prosecution

Harassment in the workplace

Policeman downloaded internet content and gave it to

a female subordinate

Deleted and wiped content

Fragments were recovered

Vive Voce Evidence

Convicted

#aicpafvc

INTERNET RECORDS

Google Docs, SkyDrive, DropBox, SugarSync

Online Payment Processors – PayPal, Payza,

ClickBank, PayDotCom

E-Commerce databases

Covert accounts: EntroPay

#aicpafvc

WHAT NOT TO DO

#aicpafvc

THIS WILL WORK!

#aicpafvc

#aicpafvc

#aicpafvc

Current Fraud Schemes

Rick Rein

#aicpafvc

How many of you have been involved in

investigating a multi-jurisdictional or

international fraud scheme?

#aicpafvc

Current Fraud Schemes

Forged International Bank Transfer ScamFraudulent organization purchases via internet relevant company

information with pre-paid credit cards.

Fraudulent organization obtains email addresses, fax and telephone

numbers without persons communicating finding out organization's

location (if the target is foreign subsidiary of a French company, the

telephone and fax numbers purchased will begin with French dialing

code).

Fraudster pretends to be Senior Manager of Company (usually CFO) of

foreign subsidiary of targeted company, and tries to persuade victim to

transfer funds on a foreign account because of imminent tax and/or

stock transaction.

Funds then transfer through multiple countries:

• First to BVI as base where fraudsters operate by telephone;

• Next to France as country where targeted company is located; and

• Finally to Hong Kong as location for bank transfers.

#aicpafvc

Penny Stock Scheme

Fraudsters control worthless stock in 11 public

companies which are thinly traded with minimal

assets and no business operations.

Fraudsters pump up share prices by fraudulent sales

campaign, including distributing false press

releases, announcing non-existent business

ventures and false mergers, posting false

information on social media sites.

Fraudsters use “throwaway phones”.

“Investment” in stocks are transferred to Isle of Man,

Singapore and India.

#aicpafvc

Life Settlement Insurance

Life settlement is an investment where insured sells life

insurance policy for cash payment, which is a percentage

of the face value or death benefit.

To keep policy in place life settlement company must pay

premiums.

Investors realize profit if purchase price and additional

premium costs are less than death benefit.

BVI fund created to purchase policies.

Investment in fund sent through administrator whose

accounts were in Canada and England.

Funds are never used to purchase policies or to maintain

premiums.

Funds further transferred to Singapore, Hong Kong,

Cayman Islands

#aicpafvc

Obstacles to Recovery

Legal – procedural obstacle. Usually primary. Asset recovery involves

working across borders, which is tough at best of times. There are reasons

why it is hard to find and seize someone’s assets: individuals have rights

and amongst them, in most societies, are rights to privacy, due process,

protection of private property and equal and fair treatment under the law.

Informal and financial obstacle. Investigators are trying to find money that

has been deliberately concealed by a disciplined, well-funded, well-

informed individual with access to state power, global banks and smart

lawyers. And money can be moved very rapidly. It is becoming harder to

hide money because of changes in the way secrecy jurisdictions are

regarded, because of the spread of due diligence, and because of the trend

towards greater transparency. Though domestic financial institutions are

often used to hide money, the vast majority of asset recoveries involve

overseas accounts, trusts and companies. In particular, offshore

jurisdictions frequently have regulatory set-ups that are perfect to obscure

links to money, with shell companies, nominee directors, and secrecy.

#aicpafvc

Obstacles to Recovery (cont.)

Political obstacle. In countries where assets have been transferred, there will

also be politics. Some country’s governments are more supportive of private

action than others. Depending upon the targets of the investigation, the

political process could be a difficult barrier to overcome.

#aicpafvc

Asset Recovery Procedure• The case may start with a claim, complaint or judgment.

• Investigators trace assets via documents, electronic data, informants,

accounting, and information from banks and other third parties. Some may be

available locally or via open sources; much will require help from foreign

courts. It is important that this be done discreetly and fast.

• Once the assets have been located, they must be frozen in place by a court.

Different jurisdictions have different rules. Again, it will be critical to maintain

confidentiality until the freeze is in place.

• The assets must now be taken through a confiscation or seizure order. There

are different routes depending on jurisdiction and circumstances. Again,

requires working with other jurisdictions to get orders and to enforce them.

• Assets must be transferred back to where they came from. This raises a

number of issues, like costs to other jurisdictions, compensating those who

may have lost out in other ways, and ensuring that the proceeds go to the right

place (and do not get embezzled again).

Instigating:

Start the progress:

Locating : Where are the assets?

Freezing: Stop assets from moving.

Seizing: Take the assets:

Repatriating: Bring back the assets.

#aicpafvc

Stuart Rudner

Canadian HR Law:

Investigating Employee Misconduct

#aicpafvc

How many of you have employees in

Canada?

Of those, how many have had to address

employee misconduct?

#aicpafvc

Dismissals

2 types: With Cause or Without Cause

If with cause, no further obligation to employee

Otherwise, need to assess employee’s

entitlements to notice/pay in lieu/severance

No “near cause”

#aicpafvc

For Just Cause

“Capital Punishment of Employment Law”

No absolute rules

Employer must prove:

1. that the alleged misconduct took place, and

2. that the nature or degree of misconduct warranted

dismissal, bearing in mind all relevant circumstances

Has trust been destroyed? Has relationship been

irreparably harmed?

#aicpafvc

The Contextual Approach

Employer must consider all circumstances, not just

alleged misconduct

• Length of service

• Disciplinary history

• Nature of position

• Mitigating Factors

Same set of facts can yield different results

#aicpafvc

The Importance of the Investigation

Always investigate first

Ensure fairness, objectivity, thoroughness

Give accused opportunity to respond

Use trained investigator

Often, employee response is critical factor in

determining appropriate discipline

#aicpafvc

Vernon v. British Columbia (Ministry of Housing

and Social Development) (Liquor Distribution Branch)

30 year employee accused of bullying/harassment

Known as “The Little General”

Investigators:• Pre-judged

• Attacked accused and those who supported her

• Misled decision-makers in report

Result• 18 months’ notice

• $35k in “The Damages Formerly Known as Wallace”

• $50k punitive damages

#aicpafvc

Plester v. Polyone Canada Inc.

Flawed investigation

all notes should have been retained — most were, but some

summaries were done and original notes shredded

interviews should all be done separately

initial report included term “wilful misconduct,” suggesting

tunnel vision or preliminary conclusion

initial draft substantively same as final report, suggesting

decision reached without full discussion

no apparent review of similar situations or comparable

outcomes

once possibility of dismissal for cause was seen as a

potential outcome, Plester should have been given an

opportunity to give a more complete statement

Dismissal not upheld

#aicpafvc

Jordan Bolton

Evaluating Forensic Accountant’s

Qualifications as an Expert Witness

#aicpafvc

How many have had an interesting

deposition/trial experience?

#aicpafvc

How is the Transcript From Your

Deposition Going to be Used Against You?

Daubert Motion (exclude or limit your testimony)

Dispositive motion practice

Impeach you at trial

#aicpafvc

Point of Attack

Absent gaping holes in education/experience, focus

will NOT be on general qualifications

Rather, focus will be on:

• (i) industry experience

• (ii) engagement type experience

#aicpafvc

Most Common Areas of Focus for Attorneys

Attempting to Discredit Forensic Accountant

Methodology

Not tested

Not peer-reviewed

Not published

Not generally accepted

Nothing “expert” about it (i.e., expensive calculator)

#aicpafvc

Bias

Typical (i.e., you say you’re independent, but

plaintiff/defendant is paying you $XXX/hour)

You formed your opinion over time working with

counsel for plaintiff/defendant (you could have

consulted with other side/their lawyers, but you

chose not to do so)

Most Common Areas of Focus for Attorneys

Attempting to Discredit Forensic Accountant

#aicpafvc

Common Questions What assumptions did you make?

What is the factual basis for this opinion, and how do these facts

lead to your conclusion?

What information have you relied on that was provided by counsel

or your client?

What have you relied on that was provided by me or my client?

How many times did you communicate with the attorney/party that

hired you before forming your opinion?

How many times did you communicate with me/my client before

today?

What concerns do you have regarding your conclusions?

Under what circumstances would you use a different

methodology?

What alternative hypotheses could explain what you observed?

What other work would you have liked to have performed?

#aicpafvc

Common Mistakes Made During Deposition

Not asking for breaks when needed

Not seeking adequate preparation

Answering questions about a document you do not have in front

of you

Volunteering information

Fearing the words “I don’t know"

Not listening to objections

Getting totally boxed-in on opinions

#aicpafvc

Summary – File Attributes and Meta Data

File attributes not always what they appear on the

surface

Meta data is data about the data – most can be changed

and differs from file attributes

Case examples highlighted the power of computer

forensics, including:

• Proving ‘continual use’ of doc’s in theft of IP matter

• Data recovered from “unallocated space” (notwithstanding

alleged destruction of accounting evidence)

• Alleged 1993 corporate documents were found to be

created in 2007

• Harassment matter involved recover of fragments of data

that was deleted and wiped

#aicpafvc

Summary – Current Fraud Schemes

Forged international bank transfer scam – involving BVI,

France and Hong Kong

Penny Stock Scheme – fraudsters controlling ‘worthless’

publicly traded co’s and pumping up stock

Life settlement insurance – BVI fund set up to purchase

life settlement policies, never purchase policies

Obstacles to recover includes legal (procedural),

informal and financial and political obstacles

Asset recovery involves instigating, starting the

investigation, locating, freezing, seizing and repatriating

funds

#aicpafvc

Summary – Dismissals

Can be dismissed ‘with cause’ (no further obligation)

and ‘without’ (consider entitlement) – no ‘middle’

Cause – prove alleged misconduct took place and

nature/degree of misconduct warranted dismissal

The Contextual Approach – i.e. looking beyond the

alleged misconduct

Investigation must be fair and objective – employee has

opportunity to respond

Case: Vernon v. British Columbia (M. of Housing)–

resulted in significant damages to ‘harassing’ employee

due to apparent bias of investigation

#aicpafvc

Summary – Evaluating Forensic Accountants

Qualifications as Expert Witnesses

Transcript from your deposition could result in your

testimony being excluded or limited (including possible

impeachment)

Focus will be industry and engagement experience

Attacking various aspects of forensic accountant’

methodology

Looking for potential ‘bias’

Common mistakes during deposition include not being

prepared, being “boxed in” and not acknowledging

when you simply “don’t know”

#aicpafvc

Thank you for your attention!

QUESTIONS?

#aicpafvc

Jordan BoltonClark Hill

151 S. Old Woodward

Suite 200

Birmingham, MI 48009

jbolton@clarkhill.com

Stuart RudnerRudner MacDonald LLP

First Canadian Place

100 King Street West

Suite 5600

Toronto, Ontario M5X 1C9

srudner@rudnermacdonald.com

Contact Information

Rick ReinHorwood Marcus &

Berk Chartered

500 West Madison Street

Suite 3700

Chicago, IL 60661

rrein@hmblaw.com

Edward Nagelnagel + associates

First Canadian Place

100 King Street West

Suite 5700

Toronto, Ontario M5X 1C7

edward@nagel-forensics.com

Brad SargentThe Sargent Consulting Group, LLC.

9550 Bormet Drive

Suite 204

Mokena, IL 60448

bsargent@scgforensics.com

Steve RogersDigital Evidence International Inc.

400 Queens Ave

London, Ontario

steve.rogers@dei.ca