LEARNING UNIT 1
PRE-INVESTIGATION ACTIVITIES
Topic 1.1
Before starting an investigation
Learning outcomes
At the end of the topic you should be able to:
 explain the difference between the work of the statutory and
the forensic auditor with reference to the most common
distinctions in a practical scenario
 determine if predication exists in a practical scenario
 provide advice on who to include in an investigation team, as
well as give reasons for your advice in a practical scenario
 apply the fraud theory approach in a practical scenario
 develop a fraud response plan in a practical scenario
 develop a list of questions to ask a source in order to obtain
all required information
 develop an investigation plan in a practical scenario
1.
INTRODUCTION
1.1
Forensic investigations (forensic audits) and statutory auditsi
While their responsibilities sometimes overlap, traditional auditors (statutory auditors) and
forensic-accounting investigators (or forensic auditors), approach financial fraud from different
perspectives, usually using different information that is documented in different ways for
different purposes. Statutory auditors try to develop new techniques to reveal more indications
of fraud. When the indications of fraud surface, they may consider calling upon trained and
experienced forensic auditors to aid in developing and implementing investigative procedures
that will help resolve the concerns or prove or disprove the allegations of fraud.
There is some common ground between the forensic auditor and the statutory auditor, although
there are some vast differences as well.
Statutory auditors are charged with performing an examination of a company's financial
statements in accordance with International Auditing Standards, while forensic auditors
principally tackle two broad categories of financial fraud:
1


fraudulent accounting and reporting
misappropriation of assets
Much of the forensic auditor's work involves the retrieval, interrogation and analysis of relevant
information in order to answer specific questions about the what, why, when, how and by whom
regarding allegedly improper behaviour.
Some of the areas where the two disciplines differ are as regards:






















the reasons why the audit is performed
the objectives and outcomes of the audit
the time taken to complete the audit
the scope of the audit and the procedures involved
the audience
the format of the report
the findings and opinions
the focus
the level of scepticism
the nature of the audit, that is, whether it is conducted openly or undercover
the degree of disruption of the business
the level of consistency in execution, and in performance and documentation
the degree of frequency and regularity with regard to communications with management
staffing requirements
sampling
whether or not attorney privilege exists
indemnification
Requests for information
the complexity of interviews and the need for counsel
evidence (chain-of-custody requirements)
the amount and nature of documentation required
the level of presentation skills required.
2.
BEFORE STARTING AN INVESTIGATION
2.1
Predication
Predication must exist before an investigation is undertaken.
Predication is the totality of circumstances that would lead a
reasonable, professionally trained and prudent individual to believe
fraud has occurred, is occurring or will occur. Predication is the basis
for undertaking a fraud investigation. It would be inappropriate to begin
an investigation without sufficient predication.
2.2
The right of private persons to investigate crime
The increase in white collar crime in South Africa has placed great strain on the ability of the
South African Police to investigate such crime. This inability has resulted in an increase of
forensic auditors investigating white collar crime. In State vs Botha and other (1) 1995 (2) SACR
598 (W) and State vs Dube 2000 (1) SACR 53 (N) the High Court expressed its acceptance of
the fact that private and corporate investigations occur. Equally, important is to note that there
2
is an obligation to report the criminal conduct under investigation to the SAPS. Such an
obligation is mandated by the Prevention and Combating of Corrupt Activities Act No 12 of 2004
(“the PCCA Act”) which introduced a positive duty to report certain criminal conduct. The PCCA
Act obliges any person who holds a “position of authority” who knows of or ought reasonably to
have known or suspected that another person committed a corrupt activity or the offence of
theft, fraud, extortion, forgery or uttering (involving an amount of R100 000 or more) to report
such knowledge or suspicion or cause such knowledge or suspicion to be reported to any police
official. The National Head: DPCI issued instructions regarding the prescribed manner in which
the report must be taken down and the acknowledgement of receipt thereof as per Government
Gazette no 35949 vol 570 dated 7 December 2012.
A failure to comply with this obligation is an offence punishable by a fine or imprisonment for a
period not exceeding 10 years. For further reading see The PCCA Act No 12 of 2004 available
at: http://www.justice.gov.za/legislation/acts/2004-012.pdf.
As a forensic investigator/auditor you will most likely be mandated by a client to investigate a
fraud case in which the amount is in excess of R100 000. The question that arises is “who is
responsible to report in terms of the PCCA Act No 12 of 2004”? The Act places the onus on a
“person who holds a position of authority”. Such persons may include the financial director,
managing director, chief executive officer or any person in authority who has been delegated
with such responsibility by an organisation. It is however incumbent that you as the
investigator/auditor bring to the attention the requirements of the duty to report in terms of the
PCCA Act No 12 of 2004 to any such person in authority.
An investigator needs to understand the rules and regulations that govern an investigation. He
or she cannot proceed with an investigation without obtaining the authority to do so. Such
authority within the corporate environment manifests itself in the form of a mandate. The
discussion below will discuss the mandate that authorises a private person to investigate crime.
Take note that the relevant legislation, PCCA may be amended in the near future. An
Amendment Bill is currently open for comments. This Amendment Bill can be found at:
www.justice.gov.za/legislation/bills/20171114-PRECCABill(B).pdf
2.3
Mandate
Before starting an investigation, the investigator must make sure that he or she has the
necessary mandate or authority to perform the investigation. The mandate must always be in
writing and can take one of many forms. For the external investigator, the mandate can take
the form of an engagement letter from the client, whereas, for an internal investigator, the
mandate can be a letter of instruction from the company signed by the appropriate person with
authority to do so. In the case of an investigation under a specific Act, the Act will determine
who is responsible for issuing such a mandate. In the latter case, it is important for the
investigator to ensure that there are sufficient and appropriate grounds for issuing the mandate,
regardless of the fact that he or she has received a mandate. This might prevent the case from
being dismissed by the court after the investigation has been completed.
The mandate is issued not only for the protection of the investigator, but also to clarify the scope
of the investigation. The mandate can also be presented to other persons to prove the
investigator has the authority to investigate the matter.
2.4.
MULTIDISCIPLINARY APPROACH
3
White collar crimes are often complex to investigate and the nature of the crime and the
methods used have become more sophisticated. In certain cases the forensic auditor/
investigator may not have specialised training or knowledge and would therefore be required to
approach various specialist to assist in an investigation. Alternatively, the magnitude of the case
being investigated can only be done by a team with different skills. A cooperative effort among
different disciplines is therefore a requirement. A multidisciplinary approach in the investigation
of complex fraud cases may consist of computer experts, internal and external forensic
auditors/investigators, accountants, police and legal advisors.
3.
PRELIMINARY INVESTIGATION
This usually starts when the client contacts the forensic auditor/investigator to conduct an
enquiry on a suspicion of fraud. The conduct of the enquiry is determined by the preliminary
allegations communicated to the forensic auditor/investigator by the prospective client and is
dependent on:



The number of persons suspected of being involved in the alleged fraud;
The company resources available at your disposal (for example, documents, computer
access, staff availability etc.);
The budget available to conduct a preliminary investigation;
Based on the results of the preliminary investigation it is incumbent that as a forensic
auditor/investigator you advise the client on the best possible way forward, for example,
whether to proceed with criminal, civil or internal action. Your findings in terms of the preliminary
investigation will determine your mandate which will be formalised in the form of an engagement
letter.
4.
PLANNING OF THE INVESTIGATION
4.1
The importance of strategic goals
When drawing up an investigation plan it is important to keep in mind the overall expectations
and goals of the investigation. In order to do so the starting point should be to identify the
complainant’s goals. Is it reimbursement, the institution of disciplinary steps in order to only get
rid of possible crooked employees; do they just want to stop further occurrences of the criminal
conduct or is it to bring the offenders to book in a criminal trial? It is important to decide on
obtainable results and acceptable outcomes. Sometimes monetary and time constraints do not
allow for instance, that the complainant will recover all its losses and that all the persons
involved in a syndicate would be brought to justice and sentenced to the maximum period of
imprisonment and that all the systems and procedures in place would be reviewed and
improved to such an extent that this type of fraud will never again occur. Especially in the case
of financial crimes, it is imperative to plan. The cliché “failing to plan is planning to fail” still holds
true in our current milieu.
4.2
What does an investigation plan seek to achieve?
The main goal of an investigative plan is to prevent reactionary decision –making.
Developing an investigation plan generally seeks to achieve the following supplementary goals:
4
Its focus should be in line with the overall objectives of the investigation as agreed with the
management of the client. It is no use to pursue other goals which are not in line with the initial
general objectives. Should a change in circumstances necessitate the review of these goals, it
should be confirmed with the management of the client before embarking on further
investigations.
Another goal of the investigation is to prevent duplication. This is especially the case when
other agencies, such as the police are conducting a parallel investigation. It goes without saying
that an investigation heads for disaster if the same witnesses are approached by different
investigators about the same issue. Duplication also creates the risk of conflicting versions
which may impact on the credibility of a witness should the matter go on trial. Serious problems
can also occur when a person is treated as a suspect by one set of investigators, but as a
witness by another set of investigators. It is furthermore obviously a waste of resources. It is
therefore important not only to coordinate efforts where more than one firm or agency
investigate a matter, but also within one team should efforts be coordinated. For instance,
investigator A should not decide by himself/herself to approach a witness without first clearing
it out with the other members of the investigating team, since it is conceivable that the specific
witness has already been approached or it may not be strategically proper to approach the
witness at this stage of the investigation.
A third goal is to prevent an oversight of leads. Regular planning meetings may prevent an
oversight of leads, especially when all the team members are active participants in the
investigation and planning meetings. The investigation plan should therefore make provision
for planning meetings where the evidence obtained are evaluated and reviewed on a regular
basis so that potential oversight of leads are minimised.
A fourth goal is to retain control over the investigative process. As alluded to supra, we
want to avoid duplication of investigative activities. It is furthermore, imperative to keep track of
the whereabouts of documentation or other exhibits. It is therefore recommended that the
investigative plan emphasises the principle that the chain of custody of exhibits should be
maintained in a specific manner for example everybody should be clear that the exhibits should
be kept under lock and key (at least) in a secure location where it cannot sustain damage or
otherwise be destroyed or improperly removed. The investigation plan could also designate
specific team members to make copies of important documents and to keep the same secure
at a different location. Lastly, the plan should also require that if a team member requires a
specific exhibit, it should be recorded who took the exhibit, when and where it will be kept in the
interim.
An important final goal of the plan is that it should be adaptable. Sometimes it may be
useful to spell out alternative means to obtain the desired result should the first option fail. Once
again, it is important to review and adapt the initial investigation plan as new avenues for
investigation opens up, or a change in the strategy is necessitated by the change in
circumstances.
4.3
How to develop an investigation plan

It is a good idea to firstly fully debrief all available informants and witnesses before
drawing up an initial plan.

Identify the indicators of fraud/irregularity. What policies and procedures were in place
at the time that the fraud took place? Were there any deviations from these established
procedures? If so, can we establish by whom? Were there any innocent reasons why
5
the procedures were not followed or were the procedures in any event inadequate from
the start?

Develop a fraud theory. We will do a scenario hypothesis. A fraud theory is then to be
developed. In order to do so, certain assumptions will have to be made. According to this
theory these assumptions are then tested to determine whether it can be proved. These
assumptions generate the investigative plan.

Consider negligence as a possible explanation.
4.4
What is a good investigation plan?

Time frames should be agreed on and adhered to.

Clear and detailed decisions should be made. Every team member should know exactly
what is expected from him/her.

It should be established who is ultimately responsible. If a task consists of various
components, each member should know exactly what he/she is ultimately responsible
for.

Accountability is another characteristic of a good investigation plan. Members should
adhere to the time frames. If they do not adhere their failure should not be simply ignored.
The team leader should enquire as to the reasons for the failure and address the same.
The development of a good team spirit usually breeds a culture of responsibility in the
team and it would seldom be necessary to address the failure to complete allocated
tasks.

It is also vital to improve on the plan on a regular and on-going basis.

A good plan also involves all team members. Members should as far as possible have a
say in the task that is allocated to them, taking into account the member’s strengths,
weaknesses, abilities and workload.
4.5
Issues that can be addressed in the investigative plan

Financial Planning

Proper financial planning will help save the complainant money

How much money do we have available? We may have to compromise on more
expensive investigative techniques and consider alternative techniques.

Personnel planning.

Early identification of the right persons inside organisations who may assist in
obtaining the relevant documents and information may ensure an efficient
investigation. The same applies within the investigation team itself.

Consider the use of outside experts such as handwriting and computer forensic
experts to attend to some aspects of the investigation. In certain circumstances it
might be advisable to enter into a confidentiality agreement with outside sources in
order to protect the integrity and confidentiality of the investigation.

Technology planning.
6

What investigative techniques will we pursue? Is the equipment available or should
we obtain the required equipment? Are we going to outsource some aspect of the
investigation, for instance the imaging of computers, surveillance etc.? Is it
necessary for computer upgrades?

Always consider worst case scenario. What if we cannot complete a specific task
or objective in time? How will it impact on the rest of the investigation?

Decide on what our first step should be, ideally we want to make an impact and
surprise the suspects so that they are more inclined to confess their crimes and
return the proceeds of their frauds (this can include: to catch the perpetrator in the
act, the search of premises where incriminating evidence is kept, interrogate the
suspects with strong incriminating evidence, the monitoring & interception of phone
calls and the use of a trap etc.)

Consider internal controls in place at the client

How strong are these controls?

Any deviations? Why? Who is involved?

Recommendations regarding improvement in controls (this should be attended to
on an on-going basis).

Identification of witnesses and suspects

Decide on an interview strategy.

Can co-perpetrators be kept apart after their arrests? Have we made arrangements
in this regard?

Consider whistle-blowing provisions in the legislation and internal policies in this
regard.
5.
EXECUTION PHASE
The execution phase of an investigation involves gathering all evidence necessary to prove all
the elements of an offence for a successful prosecution. In this stage persons with different
skills and expertise in the related disciplines will perform investigations specific to their
discipline, for example computer experts will retrieve electronic data so as to be able to assess
and affirm the integrity of electronic data. In Fraud cases evidence manifests itself in the form
of documents. The documents that an auditor/investigator will examine may include general
ledgers, audit reports, computer systems and security systems reports, e-mails, purchase
orders, vendor information, accounting journals etc. It is therefore critical that as an
auditor/investigator you are alert to indicators that the documents being examined may be
suspicious, incomplete or not authentic. You must therefore be alert to identifying ‘red flags’
when examining documents, such as:





Use of erasures;
Use of correction fluid;
Photocopies of the original document;
Incomplete printing;
Missing pages.
The execution phase may at times be affected by budgetary constraints which may result in the
inability to gather all evidence, for example a situation may present itself wherein you are unable
to image data stored in all the computers. You will then have to make a choice as to which
7
computers with the electronically stored information will have the best evidence to prove your
case. You will then image the specific computers identified.
During any investigation it is important that the chain of custody is maintained. This can be
achieved by ensuring that documents are identified, marked, inventoried and preserved to
maintain the chain of custody. Of critical importance is to ensure that original documents of
evidentiary value are not tampered with. This can be achieved by making copies or imaging of
the document and placing the original in a transparent envelope or in the case of multiple
documents in boxes which must be labelled correctly and sealed. The duplicate copies can be
used for further investigation. It is imperative that the original document is not tampered with,
for example, making notes on the document or using a pen or pencil to underline the
irregularities identified. It is also important that the handling of documents be confined to the
smallest number of persons in order to ensure the unassailable continuity of possession.
6.
REPORTING
This topic will be dealt with in module AUE4801: Forensic Audit Reporting.
7.
INVESTIGATION DIARY
It is imperative to keep a detailed investigation diary for every investigation. This diary must be
kept from day one and must be updated daily. The following types of information must be
entered in the diary: details of all telephone calls made or received, the time of the call, who
you spoke to, the reason for the call, and what was discussed; details of all documents or other
evidence received, a file reference where these were filed, who these were obtained from;
details of all investigative work performed; etc.
Investigation diaries can sometimes be admitted in court as evidence to prove or disprove a
specific fact in dispute. It is for this reason that they must be kept up to date, paying particular
attention to detail. Also, avoid making statements of a personal nature in the diary, as this might
save you from embarrassment later on.
Study



the content discussed in this study guide
pages 3.101-3.124 of the ACFE Manual
pages 3.127 to 3.147 of the ACFE Manual
Assessment Activity
You are a forensic investigator attached to RMS Forensic Services (Pty) Ltd. You are
approached by EastBank Ltd., a Bank incorporated in terms of the RSA legislation. They
request you to investigate the ongoing fraudulent activities of, what they surmise, an
8
international syndicate. Persons would purchase luxury vehicles from dealers, and then apply
for finance from EastBank. After the finance had been granted and a hire-purchase agreement
signed, the vehicles would be delivered. The purchaser would pay the first two instalments, but
later the purchaser would disappear. EastBank managed to trace two vehicles in Zambia where
it is in the possession of a Mr Clement.
Mr Clement e-mailed the bank and informed them that he lawfully purchased the vehicles from
Oupa and paid him the equivalent of R60 000 in respect of each of the two vehicles, A BMW
X5, 2013 model and a Nissan 4x4, 2012 model. He expressed his intention not to return the
vehicles.
EastBank informed that they lose about 3 vehicles a month as a result of this type of fraud and
they have not recovered any other vehicles.
A perusal of the two hire-purchase agreements in respect of the vehicles traced in Zambia
revealed that both these vehicles were sold by a dealer in Durban, Docrat Used Car Sales
(“Docrats”). Attempts by EastBank to obtain the original documents that accompanied the
application for finance (the application form, certified copies of the identification document of
the purchaser and proof of residence) proved fruitless and cannot be found. Scanned copies
are however available.
A breakthrough came when an anonymous envelope arrived at the offices of EastBank
containing a copy of an identification document of a certain Mr Gibson. The photograph on the
copy of the identity document matches the photos depicted on the scanned copies of the
identification documents handed in when the purchaser of the two vehicles traced in Zambia
applied for finance from EastBank, but different names appear on those identity documents,
namely that of Mr. Simba (in respect of vehicle A) and Mr. Leo (in respect of vehicle B).
EastBank enlisted the assistance of the SA Police Service. The police request you to be
involved in the investigation and to advise them as to how to further investigate the matter.
Assume furthermore that the case has passed the case-initiation phase and that there are
sufficient facts to substantiate a reasonable suspicion that fraud had indeed been committed.
REQUIRED
50 MARKS
Draw up an investigation plan. You may make certain assumptions, as long as these
assumptions are clearly stated in your answer.
Guidelines for acceptable answers
From the case study it appears that EastBank desires police investigation. It is advisable to
confirm this objective after the other possible objectives have also been put forward to the
complainant, since a complainant sometimes does not consider other possible objectives. Even
where criminal prosecution may be the end-goal other ancillary or sub-objectives should
also be considered and evaluated.
It must be established with what results EastBank will be reasonably satisfied.
9
A sample investigation plan in respect of this specific case study case.
The following are guidelines that may be followed. It is definitely not all-encompassing. All
issues relating to financial, personnel and technology are not canvassed in detail. Furthermore
it is important to note that the sequence of the investigative steps may change as the
circumstances encountered in the course of the investigation changes. The investigation plan
is static and should furthermore be complemented with regular planning meetings to address
further developments as the investigation develops.
In the first place it is important to obtain a mandate/ engagement letter in which the terms of
appointment are recorded.
We can assume that EastBank’s management and RMS decided that the main goal is to ensure
that all perpetrators are successfully prosecuted in a court of law. They also desire the recovery
of losses and they want to ensure that there are no crooked employees in the employ of
Eastbank. It was also decided that the matter is investigated as far as possible with the
assistance of law enforcement.
The next vital step should be to assemble an investigation team.
The police will lead the investigation and attempts should be made to appoint experienced, but
also keen, investigators in this regard. It must also be decided who the team leader would be.
Due to legal implications one should also consider to approach the National Prosecution
Authority to appoint a member of the NPA (prosecutor) to the team to deal with legal issues that
may arise. It is advisable to get the cooperation of a prosecutor at an early stage of the
investigation to give legal guidance and to be familiar with the details of the case when an
application for bail is made by the accused, when applications for search warrants are made by
the State, the drafting of charge sheets and when the trial is conducted.
The ideal is to include trustworthy employees of EastBank (to obtain relevant documentary
evidence which may be kept at different locations/branches of EastBank). A handwriting expert
(to show who completed the application forms etc., if in dispute) and a computer forensic expert
(to deal with the seizure and analysis of digital evidence).
The team should then decide on an investigation plan. Care should be taken to involve all the
team members as far as possible at this stage. The team should decide on the investigative
steps and issues which should be prioritised and strategize the investigation. The investigation
plan is the heart of the investigation and should be within the parameters of the agreed
objectives and aims of the investigation. The team can, for instance, decide to:
1.
Debrief the person from EastBank who provided the initial information.
2.
Identify person(s) who can act as a nodal point within EastBank. This will facilitate the
procurement of documentary evidence held by EastBank. This person should be able to
give us an indication as to who in EastBank can be trusted and how we can obtain the
documentary evidence, without alerting any possible suspects within EastBank.
3.
Obtain the scanned copies of the original documentation received by EastBank in
respect of the two vehicles traced in Zambia and compare the copies of the identity
documents with that of Gibson.
10
4.
Secure all the documentation in respect of all the other matters where vehicles
disappeared after finance had been granted. Also compare these copies of these identity
documents with that of Gibson.
5.
Peruse all the available documentation. Establish links between the documents. We can
look for the following links between the various documents:

Similarity in names, identity numbers and photos appearing on copies of the identity
documents;

Dealerships where vehicles were acquired from;

Cell-and other contact numbers provided by purchasers;

Addresses provided;

References and their contact details.
Computer software (such as Analyst Notebook) may be a valuable tool in this regard.
6.
Assume that a perusal of the documentation shows the following:

36 vehicles whereabouts cannot be traced in respect of all vehicle hire-purchase
applications submitted within the last year. The cell phone number (0824486452),
provided by the purchaser in respect of 5(five) of these vehicles (A, B, C. D and E)
correspond but the names of the purchasers are different.

In respect of both the hire-purchase applications for vehicles A and B the
references (that is the person who EastBank will contact in order to confirm the
applicant’s identity) is Mr. Lebese with cell phone number 0842381999 and land
line number 012-4303802.

The photos on the identity documents supplied as part of the substantiating
documents in respect of vehicles A, B and E is identical and furthermore
corresponds to the photo on the identity document anonymously received of Mr.
Gibson.
7.
Establish the internal threat, for instance, which EastBank employees dealt with the
respective matters.

Assume that the said documents show that in respect of vehicles A, B, C, F, G, H
and I, the same person at EastBank was responsible for completing the
applications for finance, namely Mr. Bradley.
8.
Based on this information we can make the following assumptions:

It appears that fraud did indeed take place in respect of a number of vehicles;

A syndicate is involved;

Mr Gibson is likely to be intimately involved in the syndicate;

Mr Bradley may also be involved, unless if he was only negligent in his dealings;

The syndicate will continue with its operations unless we can put a stop to it;

The syndicate may resort to violence in order to sabotage the investigation;

The members of the syndicate may have links overseas and may very well flee the
RSA if they suspect an investigation (to be taken into account when deciding on
whether or not to oppose bail).
This hypothesis should be continually evaluated and re-evaluated as new facts
come to light in the course of the investigation.
9.
A number of further steps can be taken at this stage:

Do an ITC check on Mr Gibson; since we have his identity number (appears on
the copy of the identity document provided by the anonymous source. This will
11
give us an indication as to whether this person is actually existing or whether the
identity document is also a fraud , if so, an ITC check can indicate where we can
get hold of him, what his financial position might be and show what assets may
be listed under his name.
The ITC check reveals that his latest address is 386 Milner Street, Stellenbosch
and his cell phone number is 075234566.

Perform an ITC check on the other persons who applied for finance in respect of
all the other 36 vehicles?
This will serve the following purposes:
It will assist in establishing whether the relevant EastBank employees did indeed
conduct a thorough credit worthiness check as prescribed in EastBank procedures.
Secondly it will indicate if any of these transactions have been disputed, which may
in turn be an indication that the actual persons whose identity had been used, were
victims of identity theft.
Finally if the names and identity numbers had been blacklisted on the ITC check,
the respective entities can be contacted and valuable information shared which
may lead to more cases being investigated against the suspects. For instance, if
we contact some of these entities and obtain the documentation completed by
these suspects, it may show important links with our case. It may very well be that
copies of the identity documents kept by these entities indicate that Gibson’s photo
appears on the copies but different names had been used. The documentation may
provide links with other syndicate members as well.
In the event it is established on the ITC check that another bank, namely WestBank,
listed 10(ten) of the names which corresponds to the names which appear on the
(East Bank’s) list of 36 suspicious transaction as persons who failed to honour their
financing agreements.
10.
At this stage one could also start taking steps to obtain evidence that takes time to
procure:

Banks and other financial institutions can be subpoenaed in terms of section 205
of the Criminal Procedure Act 51 0f 1977 to provide the following documentation:
(a)
Firstly, it is clear that EastBank receives the first two instalments. It must be
established from which banks these payments had been made. The bank
history statementsii and opening documentation for these entities must be
obtained.
The opening documentation for these accounts will provide the details of the
account holders. It must also be established whether Mr Gibson and/or other
syndicate members opened these accounts. The documentation submitted at
the time when the account had been opened should be scrutinised. The
copies of the accountholder’s identity documents may prove invaluable in this
regard. Further details on the opening documentation (including references,
contact details etc.) should be analysed and linked where possible to other
details appearing on other pieces of fraudulent information and/or other
evidence for example cell and telephone records of Gibson and other
syndicate members.
12
(b)
Secondly, all financial records, including bank opening documentation and
history statements of all known suspects must be obtained in order to
establish what they did with the proceeds of the crimes, whether payments
were made to other parties such as EastBank employees or other syndicate
members. The evidence obtained may also be indicative of money laundering
and may therefore form the basis of further charges. This type of evidence is
also important for purposes of asset recovery. Depending on how the
investigation unfolds, one can also extend the application for these types of
records to immediate family, relatives and known accomplices of the
suspects.

It would bolster the investigation to have a person on the inside to tell exactly how
the frauds are committed, who is involved and so forth. This however entails the use
of agents and under-cover operatives. One of the initial steps would include
identifying suitable persons to act as agents. In order to use agents it is advisable to
inform the relevant Director of Public Prosecutions in whose jurisdiction the undercover operation will be conducted of the intended operation, as envisaged by Section
252A of the Criminal Procedure Act 51 of 1977iii.

The targets’s cell-and contact numbers should be obtained. The relevant service
provider and/or Telkom should then be summonsed for the list of incoming and
outgoing calls on an on-going basis. This will provide the team with valuable
information as to who the other role-players in the scheme are, who assist in
laundering the funds, the identity of crooked employees and, in general, to have a
better understanding of the modus operandi of the syndicate.
These service providers can also provide important evidence as to the geographical
location of the handset when calls are made. It goes without saying that important
circumstantial evidence can be levelled against Mr Gibson (or any of the other
syndicate members) if it can be shown that he made or received a call when in the
immediate vicinity of the relevant EastBank branch when an application for finance
was made, when delivery of the vehicle took place and/or during other important
moments in the investigation. If this occurs repeatedly and/or when contact can be
established with other syndicate members the inference that he was involved in the
crimes becomes inescapable.

Once the suspect’s contact details is obtained, forensic investigators (forensic team)
can draft an application for an Interception and Monitoring Direction in terms of
section 3 read with section 16 of the Regulation of Interception of Communications
and Provision of Communication Related Information Act No. 70 of 2002. By
monitoring the conversations of the main suspects the investigation team will be able
to procure overwhelming evidence against the suspects for use in the subsequent
criminal trial. It may also result in ascertaining the identity of further suspects and
accomplices, who can in turn at a later stage be approached to give evidence against
the main suspects. By listening to the conversations the team can conduct the
investigation in a pro-active fashion. The team can, for instance, be alerted to
important meetings that are to be held between syndicate members. Surveillance to
be conducted can therefore be arranged timeously. The team can also be alerted if
the suspects get information of the investigation and plan to evade justice, destroy
evidential material or assets.
13
11.
The covert investigation techniques are in place which allows the team to concentrate
on the more usual investigative techniques with the knowledge that the investigation
would probably not be compromised if the existence of the investigation is leaked to the
targets by persons approached during the course of the investigation. At this stage the
agents would have infiltrated the business and would be providing the team with valuable
information.
12.
The next step is to approach witnesses whose reliability is beyond question. They
have no personal links with the targets. The following persons are likely to fall within this
category and can safely be approached to depose of affidavits and include:

the employees who dealt with the suspects;

under-cover agents, Bank officials;

The persons who dealt with the surveillance of the targets and the persons
involved in the interception and monitoring of the conversations of the
suspects.
13.
Depending on the circumstances one may proceed to interview other witnesses as well.
It is however advisable to rather apply for Search and Seizure warrants at this stage.
The reason being, that the risk exist that a witness may alert the suspects about the
investigation and that valuable evidence may be altered or destroyed.
14.
Before the team applies at Court for the warrants, the team should first confirm the
addresses of the suspects both business and residential.
15.
The following documents or items should appear on the search warrants:
(a) All books and records relating to any of the businesses owned by the
suspects.
(b) All cheque stubs, paid cheques, deposit slips etc. (documentation that
indicate hidden receipts and/or the money laundering of the proceeds of the
fraud. Who received it and how was it placed back in the system for use by
the suspects).
(c) Any document which may prove the existence of any other bank accounts,
investment accounts, insurance policies, retirement annuities or any other
assets which may have been bought with the proceeds of the crimes. Any
indications of loans to the suspects should be seized as the granting of
fictitious loans is one of the methods launders use to bring the money back to
the criminal.
(d) All the computer equipment, hard drives, software and other forms of digital
evidence which may be the instrument of the crime, or which may contain
evidence of the commission of these crimes. It is also likely that members of
the syndicate may have contacted each other or other accomplices in order
to arrange the disbursement or laundering of the proceeds of the crimes.
16.
Before the search it is advisable to obtain affidavits from the persons who had been the
victims of the identity theft, namely Simba and Leo, in order to show that they that they
had indeed applied for finance from EastBank.
17.
Corroborative witnesses who can corroborate the facts relating to the specific crime
should now be interviewed.
18.
Shortly before the search and seize operation potential co-conspirators can be
interviewed. Persons suspected of complicity are generally interviewed in order of least
to most culpable. At this stage the sales person at Docrats may be approached.
14
19.
At this stage the search and seizure operations have been conducted and the next
step is to arrest the suspects and to oppose bail. One can conclude that one has
sufficient evidence against Gibson in order to arrest him when the team search his
premises. Given the nature of the case we (the team) do not want to give him the
opportunity to evade his arrest. Depending on the strength of the case against the other
suspects they too may be arrested.
20.
Suspects. At this stage a clearer picture would have emerged as to the roles each of the
suspects played. They have been arrested and should immediately be interviewed with
a view to get admissions/confessions from them.
21.
It is important to keep in mind that the workings of the syndicate should be eliminated.
In order to do so the kingpins behind the operation should be arrested. If the minor
players in the scheme committed crimes indemnity may be offered to them, should they
provide reliable information against the kingpins?
22.
The records of previous cases, civil or criminal, should be obtained from the
respective Courts. This might indicate a propensity to commit crimes. It is also possible
that relevant information may appear from those records for use in our investigation.
23.
The investigation does not grind to a halt when the suspects are arrested. During the
prosecution phase the investigators should be available to follow up on any allegation
made or version forwarded by the accused persons in order to enable the prosecutor to
lead rebutting evidence where required. This also applies when the suspects applies for
bail.
24.
During the Reflection Stage the investigating team should:

Celebrate successes;

Where did we go wrong?

What did we do right?

What should have been done differently?

How can EastBank and ourselves as investigators improve systems and close
loopholes;

What have we learnt?
i
Skalak, S.L., Golden, T.W., Clayton, M. & Pill, J. 2011. A guide to forensic accounting investigation. 2nd edition.
New Jersey: John Wiley & Sons. Inc.
ii
See Robertson supra at 216 as to what information can be obtained by perusing cheques and bank statements
iii
Criminal Procedure Act no.51 of 1977
15