How to Conduct An Internal Investigation
D. Larry Crumbley, CPA, CFF, Cr.FA, MAFF, FCPA
KPMG Endowed Professor
Department of Accounting
Louisiana State University
Room 2833, Business Education Complex
Baton Rouge, LA 70803
225-578-6231
225-578-6201 Fax
dcrumbl@lsu.edu
Dr. Crumbley is the
Editor of the Journal of Forensic & Investigative Accounting.
Former editor of the Journal of Forensic Accounting: Auditing,
Fraud, and Risk,
Former chair of the Executive Board of Accounting Advisors of
the American Board of Forensic Accountants,
Former member of the NACVA’s Fraud Deterrence Board, and
On the AICPA’s Fraud Task Force (2003-2004).
A frequent contributor to the Forensic Examiner and Value
Examiner, Professor Crumbley is an author of more than 55
books and 350 articles. His latest book entitled Forensic and
Investigative Accounting, 5th edition, is published by Commerce
Clearing House (800-224-7477). Some of his 13 educational
novels, e.g., Trap Doors and Trojan Horses and The Big R: A
Forensic Accounting Action Adventure, have as the main
character a forensic accountant. His goal is to create a
television series based upon the exciting life of a forensic
accountant and litigation consultant.
1
Wide Variety of Investigations















Fraud investigation
Tracing assets
Damages calculations
Valuation calculations
Witness location
Employment investigations
Worker compensation claims
Private family investigations
Homicide
Suicide
Missing person investigation
Personal background checks
Corporate investigations
Civil investigations
Negligence or criminal investigations
Source: Erik Laykin, Investigative Computer Forensics, Hoboken, N.J.: John Wiley, 2013, p.130.
2
SAS No. 99: SKEPTICISM



An attitude that includes a
questioning mind and a critical
assessment of audit evidence.
An auditor is instructed to conduct
an audit “with a questioning mind
that recognizes the possibility that
a material misstatement due to
fraud could be present, regardless
of any past experience with the
entity and regardless of the
auditor’s belief about
management’s honesty and
integrity.”
“Things are not always as they
appear, sonny boy.” James
Patterson, Honeymoon, Warner
Books, 2006.
3
Mind-Set: SKEPTICISM
Ronald Reagan said with respect to Russia,
“Trust, but verify.”
FA’s motto should be “Trust no one; question
everything; verify.”
As Charles Manson said, “Total paranoid is total
awareness.”
----------------------------------------------------Ron Durkin says auditors must go beyond
skepticism to “thinking forensically.” [More than
skeptical ]
----------------------------------------------------This ain’t my first rodeo
I didn’t make it all the way through school.
But my mama didn’t raise no fool.
I may not be the Einstein of our time.
But honey, I’m not dumb and I’m not blind.
Vern Gosdin
4
Predication




The ACFE group indicates that
in the private sector, a fraud
investigation should not be
conducted without proper
predication.
Examples: Anonymous tips,
complaints, audit inquires,
conflict of interest.
Thus, predication is the basis
for undertaking a fraud
investigation.
Without predication, the target
might be able to sue for real or
imaginary damages.
5
Be An Investigator
“Because I was an investigator,” he said.
“O.K.,” she said. “Investigators investigate.
That, I can follow. But don’t they stop
investigating? I mean, ever? When they know
already?”
“Investigator never know,” he said. “They
feel, and they guess.”
“I thought they dealt in facts.”
“Not really,” he said. “I mean, eventually
they do, I suppose. But ninety-nine percent of
the time it’s ninety-nine percent about what
you feel. About people. A good investigator
is a person with a feel for people.”
Lee Child, Echo Burning, N.Y.: Jove Books, 2001, p. 281.
6
Investigative Technique
“You know how it goes,” I said. “You get a case. You
just keep poking around, see what scurries out.” p.
144.
-----------------------------------------------------------“How,” Susan said, “on earth are you going to
unravel all of that?”
“Same way you do therapy,” I said.
“Which is?”
“Find a thread, follow it where it leads, and keep on
doing it.”
“Sometimes it leads to another thread.”
“Often,” I said.
“And then you follow that thread.”
“Yep.”
“Like a game,” Susan said.
“For both of us,” I said.
Susan nodded. “Yes,” she said, “tracking down of a
person or an idea or an evasion.”
pp. 270 – 271.
-------------------------------------------------------------------------------Source: R.B. Parker, Widow’s Walk, Berkley Books, 2002.
7
Fraud Detection Process
Discuss facts and objectives with client/attorney (e.g.,
conflict of interests).
2.
Evaluation whether to accept the engagement.
3.
Prepare a work program.
4.
Develop time and fee schedule.
5.
Obtain approval of work program, staff assignments,
and fee estimates.
6.
Obtain an engagement letter.
7/8.
Identify fraud exposures and symptoms.
9/10.
Evaluate evidence obtained and determine if more
evidence is needed.
11/12. Search for and evaluate additional evidence.
13.
Discuss preliminary findings with client/attorney.
14.
Draft a final report.
15.
Review the report and work papers.
16.
Resolve professional disputes.
17.
Clear review points and open items.
18.
Communicate report or findings.
19.
Help attorney prepare court case/testify.
20.
Perform follow-up procedure.
21.
File work papers/report.
1.
Source: Carmichael et. al, PPC Fraud Detection, Vol.1, Ch. 2 (2002).
8
Wandering Around
• Informal observations while in the
business.
• Especially valuable when assessing
the internal controls.
• Observe employees while entering and
leaving work and while on lunch
break.
• Observe posted material, instructions,
job postings.
• Observe information security and
confidentiality.
• Observe the compliance with
procedures.
• Appearance is not necessarily reality.
Man of La Mancha
9
Investigative Techniques
“Facts weren’t the most important part of
an investigation, the glue was. He said
the glue was made of instinct,
imagination, sometimes guesswork and
most times just plain luck.” (p. 163).
-------------------------------------------------“In his job, he [Bosch] learned a lot
about people from their rooms, the way
they lived. Often the people could no
longer tell him themselves. So he
learned from his observations and
believed that he was good at it.” (p. 31).
-------------------------------------------------Michael Connelly, The Black Ice, St. Martin’s
Paperbacks, 1993.
10
Investigative Techniques and Evidence



•
•
•



Documentary evidence – written evidence
on paper or computer medium.
Testimonial evidence – testimony of
individuals.
Observational evidence – evidence, actions,
or observations seen by an investigator.
Physical examination of evidence (e.g.,
counts or inspections).
Fixed point observations of activities (e.g.,
watching a scene and recording).
Moving observations.
Invigilation – strict temporary controls are
imposed so that fraud virtually impossible.
Keep detailed records.
Covert observations.
Forensic document examination.
Source: D.R. Carmichael et.al., Fraud Detection, Vol. I,
Practitioners Publishing Co., 2002, pp. 3-1 to 3-4
11
Documentation
The forensic accountant needs to track
and document the steps in any
investigation process, including:
• Items maintained as privileged or
confidential.
• Requests for documents, electronic
data, and other information.
• Memoranda of interviews
conducted.
• Analysis of documents, data, and
interviews and conclusions drawn.
Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA,
ACFE; http://www.acfe.com/documents/managing-business-risk.pdf,
12
2008, p. 43.
Chain of Custody





Just as in the movies or on a television
show such as CSI, forensic accountants
must safeguard evidence through a
financial chain of evidence (e.g., fraud in
a computer).
There must be a way to show that the
evidence has not been tampered with or
damaged.
If documents are seized, the forensic
accountant should put his or her initials
and date of the seizure on the back of
each document.
Or put the document in a transparent
envelope and write a description on the
envelope.
Store the original and work only with a
copy.
13
Enforcement Manual
Enforcement Manual
History and Custody of Documents
U.S. Department of Labor
Pension and Welfare Benefits
Administration
Date _______________________________
Case Number________________________
Case Name __________________________
22. How were the documents obtained?
____ By consent (note any significant comments of the principal or third party witness
and any unusual circumstances which occurred)?
____ By legal process (describe).
2.
What is the relationship between the documents and the person submitting them?
22. Were manual transcripts or facsimile copies made of any of the documents
either in whole or in part?.
______ Yes ______No
If Yes, list documents copies. Manner of reproduction
22. Have all copies been compared with the original documents and identified?
_____Yes _____No
If No, why not?
22. Were the original documents described herein under your control or
supervision at all times prior to their return to the principal, third party witness, or
representative?
_____Yes _____No
If No, set forth circumstances of any transfer in control.
22. Did the principal, third party witness, or a representative request access to the
documents during your custody?
___ Yes ___ No
If Yes, who requested access and what action was taken?
Signature ___________________
Title ________________________
PWBA 219
(May 1987)
14
Principles of Investigation
Documentation
1.
2.
3.
4.
5.
Take notes on everything you do.
Document every effort to contact a witness and
all surveillance in the running resume.
Prepare a report whenever there is a possibility
you will have to testify.
Take verbatim statements from hostile or
unhelpful witnesses; obtain declarations from
friendly witnesses.
Provide all of the case’s documents to the client
at the conclusion of the case – or have a
document retention policy that decrees the
maintenance of most records for at least five
years.
P.A. Becnel, IV and S.J. Krischke, Principles of Investigative Documentation, Springfield, IL: C. C. Thomas
Publisher, 2012, 172 pp.
15
Scienter Necessary
To prove any type of fraud,
prosecutors must show that scienter
was present.
 That is, the fraudster must have
known that his or her actions were
intended to deceive.
------------------------------------------------The allure of numbers to most of us, is
like the excitement of settling sand--a
narcoleptic surety. Crafty criminals
prey on this boredom. They pile on the
numbers, spewing meaningless
records in the false books.

Cory Johnson
16
Two Major Types of Fraud Investigations


Reactive: Some reason to
suspect fraud, or occurs after a
significant loss.
Proactive: First, preventive
approach as a result of normal
operations (e.g., review of
internal controls or identify
areas of fraud exposure). There
is no reason to suspect fraud.
Second, to detect indicia of
fraud.
Source: H.R. Davia, “ Fraud Specific Auditing,” Journal of
Forensic Accounting, Vol. 111, 2002, pp. 111-120
17
Proactive Is Beneficial

The threat of a future investigation reduces
the occurrence of fraudulent behavior from
75% to only 43%.

The larger the pay-off, the more likely a
person will commit fraudulent behavior.

Give the fox a key to the hen house and he/
she is going to eat hens.
Source: S. L. Tate et. al, “The Small Fraud Paradigm: An
Examination of Situational Factors That Influence the
Non-Reporting of Payment Errors,” J. of Forensic
Accounting, Vol.7, 2006, p. 406.
---------------------------
The greater the risk of detection, the less
likely a person is to violate the law.
Jeremy Bentham
18th Century Philosopher
18
Proactive vs. Reactive Approaches
Proactive approaches include
 Effective internal controls,
 Financial and operational
audits,
 Intelligence gathering,
 Logging of exceptions, and
 Reviewing variances.
Reactive detection techniques
include
 Investigating complaints and
allegations,
 Intuition, and
 Suspicion.
Jack Bologna and Robert Lindquist, Fraud Auditing and Forensic Accounting, 2d
Edition, New York: John Wiley, 1995, p. 137.
19
Proactive Is Best



When the IRS began requiring banks
to issue Form 1099s reporting interest,
the reported interest income increased
by $8 billion (even though for 3 years
the IRS did not have computer
matching capacity).
When the IRS began to require
taxpayers to list a social security
number for dependents, the next year
the number of reported dependents
dropped by seven million. More than
11,000 of these taxpayers claimed
seven or more dependents in 1986, but
they claimed none in 1987.
When the IRS began to require
taxpayers to list a name, address, and
social security number for babysitters,
two years later 2.6 million babysitters
disappeared.
20
Fraud Deterrence Better Than Fraud
Investigation
1.
2.
3.
4.
5.
Fraud deterrence less
expensive.
Deterrence is more
comprehensive.
Fraud deterrence produces
greater savings.
Deterrence is faster.
Fraud deterrence promotes
better customer relations.
Daniel Finnegan, “Deterring Fraud,” Quality Planning
Corporation, 1991.
21
Fraud Deterrence Review
Analysis
of selected records and
operating statistics.
Identify operating and control
weaknesses.
Proactively identify the control structure
in place to help prevent fraud and operate
efficiently.
Not an audit; does not express an
opinion as to financial statements.
May not find all fraud especially where
two or more people secretively agree to
purposely deceive with false statements
or by falsifying documents.
[Always get a comprehensive, signed
engagement letter defining objectives.]
22
Financial Fraud Detection Tools



Interviewing the executives
Analytics
Percentage analysis




Horizontal analysis
Vertical analysis
Ratio analysis
Using checklists to help detect fraud




SAS checklist
Attitudes/Rationalizations checklist
Audit test activities checklist
Miscellaneous fraud indicator checklist
“Objectively obtaining and evaluating evidence is the
essence of auditing.”
(AAA, Committee on Basic Auditing Concepts, 1973, 2)
23
Analytical Procedures
Analytical procedures involve the study or
comparison of the relationship between
two or more measures for the purpose of
establishing the reasonableness of each
one compared. Five types of analytical
procedures help find unusual trends or
relationships, errors, or fraud:
 Horizontal or Percentage Analysis
 Vertical Analysis
 Variance Analysis
 Ratio Analysis or Benchmarking
 Comparison with other operating
information
Source: D.L. Crumbley, J.J. O’Shaughnessy, and D.E.
Ziegenfuss, 2002 U.S. Master Auditing Guide,
Chicago: Commerce Clearing House, 2002, p.
592.
24
Financial Statement Fraud Audit
1.
2.
3.
4.
5.
6.
7.
8.
Obtain current year’s financial
statements.
Obtain prior 3 years’ financial
statements.
Perform vertical/ horizontal analysis
of the 4 years, plus all current
quarters.
Pay attention to footnotes.
Analysis of %s and footnotes by senior
auditors.
Nonsense %s and footnotes inquire
explanations from financial
management.
Interview lower level financial
employees who approved
questionable journal vouchers.
Combine explanations with visits to
accounting records/ source
documents.
25
Horizontal Analysis
Suppose advertising in the base year
was $100,000 and advertising in the
next three years was $120,000,
$140,000, and $180,000. A
horizontal comparison expressed as
a percentage of the base year
amount of $100,000 would appear
as follows:
Dollar
Amount
Horizontal
Comparison
Year 4
Year 3
Year 2
Year 1
$180,000
$140,000
$120,000
$100,000
180%
140%
120%
100%
26
Red Flags with Horizontal Analysis




When deferred revenues (on the balance sheet)
rise sharply, a company may be having trouble
delivering its products as promised.
If either accounts receivable or inventory is rising
faster than revenue, the company may not be
selling its goods as fast as needed or may be
having trouble collecting money from customers.
For example, in 1997 Sunbeam’s revenue grew
less than 1% but accounts receivable jumped 23
percent and inventory grew by 40 percent. Six
months later in 1998 the company shocked
investors by reporting a $43 million loss.
If cash from operations is increasing or decreasing
at a different rate than net income, the company
may be being manipulated.
Falling reserves for bad debts in relation to
account receivables falsely boosts income (cookie
jar accounting).
27
More Red Flags








Look for aggressive revenue recognition
policies (Qwest Communication, $1.1 billion
in 1999-2001). Beware of hockey stick
pattern.
Beware of the ever-present nonrecurring
charges (e.g., Kodak for at least 12 years).
Check for regular changes to reserves,
depreciation, amortization, or comprehensive
income policy.
Related-party transactions (e.g., Enron).
Complex financial products (e.g.,
derivatives).
Unsupported top-side entries (e.g.,
WorldCom).
Under-funded defined pension plans.
Unreasonable management compensation
Source: Scott Green, “Fighting Financial Reporting Fraud,”
Internal Auditor, December 2003, pp. 58-63.
28
Ink Analysis





Martha Stewart was undone by a blue
ballpoint pen.
Stockbroker belatedly inserted a note to
help cover up Ms. Stewart’s improper
stock trading. Blue ballpoint ink used is
different from ink elsewhere on the
trading worksheet.
Prosecutors used forensic ink analysis in
Rite Aid case to show that certain
documents were backdated (ink used to
sign letter was not commercially available
until 3 months after the letter was dated).
Xerox laser printers now encode the serial
number of each machine in tiny yellow
dots in every printout, nestled within the
printed words and margins. It tracks
back to you like a license plate.
Advice for fraudsters: use pencils.
Source: Mark Maremont, “In Corporate Crimes, Paper Trail
Often Leads to Ink Analysts’ Door,” Wall Street J., July 1,
2003, p. A-1.
29
Invigilation




Invigilation is a rather expensive
investigating technique that can be
used in potential fraud situations to
discover the fraud and can later be
used in the courtroom.
Here detailed records are kept
before and after the invigilation
period to determine the amount of
fraud.
During the invigilation period strict
controls are imposed (e.g., cameras)
so that the fraud is virtually
impossible.
Or the invigilation period could be
while the suspect is on vacation.
30
Invigilation Technique
No controls
Controls or
vacation
No controls
14 days
14 days
14 days
$67,000 lost
$0 lost
$62,000 lost
31
When Fraud Is Discovered
1.
2.
3.
4.
Notify management or the board when the
incidence of significant fraud has been
established to a reasonable certainty.
If the results of a fraud investigation
indicate that previously undiscovered
fraud materially adversely affected
previous financial statements, for one or
more years, the internal auditor should
inform appropriate management and the
audit committee of the board of directors
of the discovery.
A written report should include all findings,
conclusions, recommendations, and
corrective actions taken.
A draft of the written report should be
submitted to legal counsel for review,
especially where the internal auditor
chooses to invoke client privilege.
32
E-ZPass Catching Cheaters




E-ZPass and similar electronic toll collection
systems are emerging as a new and powerful
means to prove infidelity.
Generally mounted inside a vehicle's windshield
behind the rearview mirror, the remote-sized, EZPass devices communicate with antennas at toll
plazas, automatically deducting money from the
tag-holder's prepaid account and recording when
and where the vehicle crossed the toll.
Many states provide electronic toll information in
response to court orders for criminal and civil
cases, including divorces, which are used to
prove the defendant was not where he or she
claimed to have been.
"E-ZPass is an E-ZPass to go directly to divorce
court, because it's an easy way to show you took
the off-ramp to adultery," said Jacalyn Barnett, a
New York divorce lawyer who has used E-ZPass
records a few times.
Chris Newmarker, “E-ZPass records out cheaters in divorce court.” AP, 2007.
33
Seven Investigative Techniques
1.
2.
3.
4.
5.
6.
7.
Public document review and
background investigation (nonfinancial documents).
Interviews of knowledgeable
persons.
Confidential sources.
Laboratory analysis of physical
and electronic evidence.
Physical and electronic
surveillance.
Undercover operations.
Analysis of financial transactions.
Source: R.A. Nossen, The Detection, Investigation and Prosecution of
.
Financial Crimes, Thoth Books, 1993
34
Investigation Tasks
1) Interviewing, including:
a) Neutral third-party witnesses.
b) Corroborative witnesses.
c) Possible co-conspirators.
d) The accused.
2) Evidence collection, including:
a) Internal documents, such as
i) Personnel files.
ii) Internal phone records.
iii) Computer files and other electronic devices.
iv) E-mail.
v) Financial records.
vi) Security camera videos.
vii) Physical and IT system access records.
b) External records, such as
i) Public records.
ii) Customer/vendor information.
iii) Media reports.
iv) Information held by third parties.
v) Private detective reports.
3) Computer forensic examinations.
4) Evidence analysis, including:
a) Review and categorization of information collected.
b) Computer-assisted data analysis.
c) Development and testing of hypotheses.
Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE;
http://www.acfe.com/documents/managing-business-risk.pdf, 2008, pp. 42-43.
35
Some Important Stuff
• Once a USB has been imaged, a forensic
accountant should use a read-only copy
and investigate the file structure for
evidence of financial fraud.
• MD5 hashes verified that two files are
exactly the same.
• Hash values allow forensic accountants to
determine if two financial files are exactly
the same.
• The hash calculator can be downloaded
for free.
• Disk Investigator can be used to discover
what is hidden on a hard drive and help
recover lost data.
36
Evidence Requests
• Once legal requests for electronic evidence are
received, such normal business practices need
to be stopped and hard drives need to be
imaged.
• Evidence requests likely to include all e-mails;
e-mail headers; e-mail logs; all data files
created with word processing, spreadsheet,
accounting software, sound recordings, or
presentation software; network activity logs;
task lists; databases; and e-calendars. All such
requests encompass the data on servers,
workstations, laptops, floppy disks, only
repositories, tapes, voice messaging systems,
CDs, DVDs, memory sticks, cell phones, iPads,
and all stored backups of data.
• After this request and until the pertinent drives
are imaged, new files should not be saved to
working computers.
37
So You Find Fraud
•
Criminal referral — The organization may refer the
problem to law enforcement voluntarily, and, in some
situations, it may be required to do so. Law enforcement
has access to additional information and resources that
may aid the case. Additionally, referrals for criminal
prosecution may increase the deterrent effect of the
organization’s fraud prevention policy. An appropriate
member of senior management, such as the chief legal
counsel, should be authorized to make the decision as to
whether pursuing criminal prosecution is appropriate.
• Civil action — The organization may wish to pursue its
own civil action against the perpetrators to recover funds.
• Disciplinary action — Internal disciplinary action may
include termination, suspension (with or without pay),
demotion, or warnings.
• Insurance claim — The organization may be able to
pursue an insurance claim for some or all of its losses.
Source: Managing the Business Risk of Fraud: A Practical Guide, IIA, AICPA, ACFE;
http://www.acfe.com/documents/managing-business-risk.pdf, 2008, pp. 43-45.
38
KPMG provides 10 steps to follow when an
organization finds or suspects fraud:
1.
2.
3.
4.
5.
Shut the door! Keep assets secure until
you can provide appropriate long-term
security.
Safeguard the evidence. Ensure that all
records and documents necessary for an
investigation remain intact and are not
altered by you or anyone else.
Notify your insurer. Failure to notify may
negate your coverage.
Call a professional. Do not confront or
terminate the employment of a
suspected perpetrator without first
consulting your legal advisor.
Prioritize your objectives. What’s most
important: punishment, loss recovery,
prevention, detection of future
occurrences?
39
KPMG’s 10 steps to follow contd..
6.
7.
8.
9.
10.
Consider prosecution. Before you make
the call, weigh the plusses and minuses
and determine if your insurance
company requires prosecution.
Terminate business relations. If the fraud
is external, business relations with the
suspect individual or organization should
be terminated.
Seek advice and assistance. An
important consideration is whether you
have the knowledge and resources
necessary to effectively manage the
process.
Prepare a witness list. It is important that
statements be taken before a “party line”
can develop.
Consider the message. Whatever you do
will affect future situations. Now may be
the time to change the way your business
operates.
40
Where Details Communicated
Internally
Source: Who is the Typical Fraudster (2011)
KPMG
41
Where Details Communicated
Externally
Source: Who is the Typical Fraudster (2011)
KPMG
42
Outcomes & Responses
Source: Who is the Typical Fraudster (2011)
KPMG
43
Interview vs. Interrogation
Interview-non-accusatory
process
where person asks questions to
develop factual information (e.g.,
who, what, when, where, how).
Interrogation-accusatory interview
to obtain an admission of guilt.
-----------------“Doubt leads to inquiry, and inquiry
leads to the truth.”
Saint Thomas Aquinas
44
Selecting the Right
Interviewees
“Someone knows what is going on. If you tune in,
you will get a feel for it.”
Lorraine Horton, Kingston, R.I.
-------------------------------------------------------------“It is important that you select the right person to
interview, and be conversant in interviewing
techniques. For instances, pick someone from
customer complaints or an employee who didn’t
get a raise for two years, as they would be likely
to provide the needed information.”
R.J. DiPasquale, Parsippany, N.J.
Source: H.W. Wolosky, “Forensic Accounting to the Forefront,” Practical
Accountant, February 2004, pp. 23-28
---------------------------------------------------------------------------------------------
Listen to rouges and whistle-blowers who
complain.
45
Differentiate Between the Two
Interview
Interrogation
Involves a witness
Involves a suspect
Involves a victim
Involves custody
No Miranda rights
Requires Miranda rights
General information
Specific facts
Less demanding
More demanding
Casual
Highly structured
Interview in the field
Interrogate at the office
Information not known
Confirm known information
Scattershot approach
Pin-down approach
Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press,
1992, p.5.
46
Moving from Unwilling to Willing Chair
Ask general questions.
Win them over.
Make them feel that this is what’s
best for them.
Take away the foundation.
Gain their confidence.
Explain the facts.
Relate to them.
Deescalate the crisis.
Give them a way out.
Explain the advantages of
cooperation.
Give them a change to explain.
Lie to them.
Downplay the disadvantages of
cooperation.
Understand them.
Hang it on them.
Use deception.
Put it on them.
Play on their sympathy.
Threaten them.
Play on their conscience.
Get them to trust.
Determine their frame of mind.
Mimic their manner.
Talk to them.
Empathize.
Know how far to push.
Show them what they’re looking
at.
Get on their level.
Show them acceptance.
Speak their language.
Develop a rapport.
Show them.
Tell them.
Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press,
47
1992, p.8.
Advantage and Disadvantages
 Advantages
accusatory)
of an interview (non-
 Facilitates
the development of
cooperation.
 Easier to develop rapport.
 More effective way of developing usable
information.
 Disadvantages of
interrogation
 Interviewee
may be alienated and refuse
to speak to anyone later.
 If interviewee will not speak to anyone,
ability to obtain information or admission
is diminished.
Source: John E. Reed Associates, Inc.
48
Interview Room Layout
49
Room Layout with Witness
50
Room Arrangement Details
Establish a sense of privacy.
 No locks or physical impediments.
 Room plain color (e.g. no pictures,
etc.)
 Lighting should provide good, but
not excessive or glaring
illumination of interviewee’s face.
Same for interviewer.
 No telephones, cell phones, or
beepers.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 28-33.
51
Room Arrangement Details
Chairs about 4 feet apart. Straightback. No rollers. Facing each
other.
 Both chairs at the same level (both
at same eye level).
 Observation room arrangement if
possible (or video). Record it, no
video.
 In case of a female, another
female should be present.
 Not at suspect’s home or office
 No bad breath odor.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 28-33.
52
Interviewer’s Demeanor
Civilian clothes. No uniform.
Conservative suit, jacket, or dress.
 Relaxed and comfortable.
 No smoking.
 Questions in conversational tone.
Non-accusatory.
 Keep eye contact. Neither person
should wear dark glasses.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 41-43.
53
Interviewer’s Demeanor
Take written notes (but not in an
interrogation).
 Use simple language.
 Never scold or reprimand if the
suspect is caught in a lie.
 Do not pace around the room.

F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 41-43.
54
Make Interviewee Comfortable
He puts a strong hand on my shoulder. “I
appreciate you helping us out, Michael." Unlike
the FBI polo crew, he's wearing a gray suit with a
small stain on his right lapel. His tie is pulled
tight, but the top button on his stark white shirt is
open. The effect is the most subtle hint of
casualness in his otherwise professional
demeanor.
"Quite a day, huh, Michael?" It's the third time
since we've met that he's said my name, which I
have to admit sets off my radar. As my old crime
law professor once explained, name repetition is
the first trick negotiators use to establish an
initial level of intimacy. The second trick is
physical contact. I look down at his hand on my
shoulder.”
Source: Brad Meltzer, The First Counsel, Grand Central
Pub. NY., 2001, p.86
55
The Reid Nine Steps of
Interrogation
1.
2.
3.
4.
5.
The investigator directly and
positively confronts the suspect.
The investigator introduces an
interrogation theme.
The investigator handles the
initial denials of guilt.
The investigator overcomes the
suspect’s objections.
The investigator gets and retains
the suspect's attention and
clearly displays sincerity in what
he says.
F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 125.
56
6.
7.
8.
9.
The Reid Nine Steps of
Interrogation
The investigator recognizes the
suspect’s passive mood.
The investigator uses an
alternative question- a suggestion
of a choice to be made by the
suspect concerning some aspect
of the crime.
The investigator has the suspect
orally relate the various details of
the offense that will serve
ultimately to establish legal guilt.
The verbal confession is converted
into a written or recorded
statement.
F.E. Inbau, “Essentials of the Reid Technique: Criminal Interrogation and Confessions,”
Sudbury, MA: Jones & Bartlett Publishers, 2005,
pp. 125.
57
Some Persuasive Techniques
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
Indirect Approach.
Complete-file approach.
I-know-everything approach.
Utility technique.
Quick questioning approach.
Incentive approach.
Repetition technique.
Silent approach.
Change-of-scene technique.
Emotional approach.
Psychological technique.
Good-guy, bad guy approach.
Cold shoulder approach.
Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic
Press, 1992, p.8.
58
Verbal and Nonverbal Behavior
Verbal behavior includes not only
words, but timing, pitch, rate, and
clarity of the responses.
Nonverbal behavior includes body
movement, position changes
gestures, eye contact, and facial
expressions.
See “Interviewing & Interrogation,” The Reid Technique,
John E. Reid Associates, Inc., L.E.R.C Law Enforcements.
59
Nonverbal Language
 60%
of communication is nonverbal.
 Previous contact with person helpful.
 During President Bill Clinton’s testimony
he touched his nose several times when
he was lying, but did not touch his nose
during truthful testimony.
 Two-thirds of truth interviewees cross their
legs.
Source: “Lying 101: There May Be Nonverbal Indicators of
Lying,”
http://members.tripod.com/nwacc_communication/id25.htm.
60
Posture Language
 Truthful
 Frontally
aligned.
 Upright or forward.
 Open (perhaps crossed legs).
 Dynamic, comfortable changes.
 Deceptive
 Non-frontally
aligned.
 Slouched, retracted or leaning.
 Barriers (crossed arms, purse in lap).
 Frozen and rigid.
Source: John E. Reid Associates, Inc.
61
Some Lying Signs




















Covering mouth with hand.
Rubbing nose.
Frequent blinking.
Biting lip.
Moving or tapping foot.
Crossing arms.
Leaning forward.
Handling objects (e.g., pencil, pen).
Avoiding eye contact or averting eyes.
Clearing the throat.
Closing and opening coat.
Picking at lint on clothing.
Playing with collar.
Moving away.
Shrug gestures.
Slow response.
Higher pitch.
Long answer.
Gap between words becomes longer.
Non-words such as uh.
Source: “Lying 101: There May Be Nonverbal Indicators of
Lying,”
62
http://members.tripod.com/nwacc_communication/id25.htm
.
Deception Indicators
1.
2.
Dryness of mouth
Restlessness
A.
B.
C.
D.
E.
F.
G.
3.
4.
5.
6.
7.
8.
9.
Frequent changes in position
Tapping of feet
Fidgeting
Gripping arms of the chair
Elbows held close to the body
Running hands through the hair
Chewing of fingernails, pencils, or other
objects
Excessive sweating
Pulsation of the carotid artery
Pallor, flushing, or change in complexion, color
Excessive swallowing
Avoiding direct gaze
Appearance of being disturbed and/or very tense
Audible turbulence in the stomach.
Don Rabon, Interviewing and Interrogation, Durham: Carolina Academic Press,
1992, p.139.
63
Establishing a Baseline
Dance continued to ask about his life [the bad guy] in
Seaside and in prison, observing him the whole while: how
he behaved when she asked the questions and how he
behaved when he answered. She wasn’t doing this to get
information-She’d done her homework and knew the
answers to everything she asked-but was instead
establishing his behavioral baseline.
In spotting lies, interrogators consider three factors:
nonverbal behavior ( body language, or kinesics), verbal
quality ( pitch of voice or pauses before answering) and
verbal content (what the suspect says). The first two are
far more reliable indications of deception, since it’s much
easier to control what we say than how we say it and our
body’s natural reaction when we do.
The baseline is a catalog of those behaviors exhibited
when the subject is telling the truth. This is the standard
the interrogator will compare later with the subject’s
behavior when he might have a reason to lie. Any
differences between the two suggest deception.
Finally Dance had a good profile of the truthful Daniel
Pell and moved to the crux of her mission.
Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder & Stoughton,
2007, p.8.
64
Establishing a Baseline (cont.)
Still relaxed. The body language wasn’t any different from
his baseline. He was showing only emblems-common
gestures that tended to substitute for words, like shrugs and
finger pointing. There were no adaptors, which signal
tension, or affect displays-signs that he was experiencing
emotion.
‘Not Really.’
Which wasn’t an answer to a yes-or-no question; it was
even more slippery than ‘I don’t recall.’ Dance noticed too
that pell had put his hands, tipped with long, clean nails, on
the table at the word ‘ relatives’. This was a deviation from
base-line behavior. It didn’t mean lying, but he was feeling
stress. The questions were upsetting him.
Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder &
Stoughton, 2007, p.9-11.
65
Studying and Mirrors



He was in no hurry [the bad guy]; interviewers and
interviewees share mutual curiosity. (She told the
students in her interrogation seminars, “They’re studying
you as hard as you’re studying them-usually even harder,
since they have more to lose.”
Mirrors weren’t placed in interrogation rooms to hide
cameras and witness-there are far better high-tech ways
to do so –but because people are less inclined to lie
when they see themselves.
Dance gave a faint smile. ‘ And you understand that you
can withdraw from this interview anytime you want and
that you have a right to an attorney?’
Source: Jeffrey Deaver, The Sleeping Doll, London: Hodder
& Stoughton, 2007, p.6-7.
66
Conducting Effective Interviews
Preferable to use copies of
documents rather than originals.
 Interview one person at a time.
 Location to be chosen to ensure
privacy and to minimize
interruptions.
 Use of cell phones is discouraged.
 Interview may be protected by
legal privilege if the forensic
accountant has been hired by
counsel.

Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
67
Interviewer










Ideally have two interviewers.
Encourage long answers.
Initial contact polite and professional.
Lead interviewer should focus on
questions. Maintain eye contact.
Interview partner take detailed notes.
Close on a positive note.
Prepare record of interview as soon as
possible.
If traveling away from office, let
someone know where you are
interviewing the person.
Conducted in business location.
Ask for a business card.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
68
Recording Interviews




If the decision is made to record interviews,
proper and reliable equipment is required and
a chain of custody for the recordings will be
necessary.
If recorded statements are used in a later
proceeding, the recordings will have to be
authenticated and any transcriptions will have
to be reviewed for accuracy.
While most recording equipment uses a digital
format, the digital recordings can easily be
altered. Therefore, the original recordings
must be retained where a proper chain of
custody and retention can provide assurances
that the original recoding has not been
changed.
Extreme care should be taken when making
copies of the original recording.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
69
Recording Interviews




When considering recording other
persons, most state laws require the
consent of one person to the
conversation, but other states require
the consent of all parties in the
conversation.
Surreptitious recordings also are
fraught with significant legal issues.
Consideration should be made to
address a situation where a person
may bring their own recorder to an
interview and insist on making their
own recording.
Proper planning of the investigation
with counsel should address these
issues.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
70
Upjohn Warning




In cases where illegal behavior is
suspected, interviews should not be
conducted until the client’s counsel has
been consulted.
If it is decided that an attorney will be
present during the interview, typically
the attorney will begin by giving the
witness an Upjohn warning.
An Upjohn warning is a disclaimer
issued by an attorney for a company to
an employee of the company.
In the Upjohn warning, the employee is
advised that the attorney does not
represent the employee, but rather
represents the company as a legal
entity.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
71
Do’s of Interviewing
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
Consult counsel once allegations are made.
Prepare and discuss an interview plan or theme.
Conduct one interview at a time, unless the
situation dictates otherwise.
Arrange a safe and private interview location.
Gather and organize pertinent documents before
the interview.
Obtain information concerning the person being
interviewed before the interview.
Exhibit courteous and professional appearance
and behavior at all times.
Be punctual.
Conduct the interview with more than one person.
Establish rapport during initial contact.
Maintain control in the interview.
Close on a positive note for future contacts.
Prepare reports as close as possible to interview.
Listen to you instincts.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
72
Don’ts of Interviewing
1.
2.
3.
4.
5.
6.
7.
8.
9.
Conduct interview without a plan of
action.
Fail to discuss the interview with partner.
Argue with interviewee.
Lose objectivity during the interview.
Become judgmental during a confession.
Include personal opinions in notes or
written reports.
Provide promises or assurances.
Threaten interviewee with disclosure of
interview results, discipline, or job
security.
Discuss interviews with anyone outside
the investigation.
Source: AICPA Forensic and Valuation Services Section, Conducting Effective
Interviews.
73
Lying: James R. Brown Style
“I
lied in person to investors when I met
them. I lied in company’s filings. I lied in
the company’s press releases.” Adelphia
Communications vice-president of
finance.
 He had no formal training in accounting
and finance.
 Adelphia began manipulating its
financial reports soon after the company
went public in 1986.
 We regularly fabricated statistics on the
number of subscribers, cash flow, cablesystem upgrades, and other closely
followed metrics.
74
Lying: James R. Brown Style (cont.)
 Top
executives would meet on Saturdays
to determine if we were meeting loan
agreements. If not, we would make other
types of manipulations of either arbitrarily
moving expenses between companies or
adding invented affiliate income or
interest income from one internal
company to another.
 For more than 10 years we kept two sets
of books.
Source: Chad Bray, “Adelphia Witness Lays Out Lies,” WSJ, May 19,
2004, pp. C-1 and C-2.
----------------------------------------------------I swear on my heart
I was telling the truth
at the time.
Baby I lied. Baby I lied.
Deborah Allen
75
Fewer People Lie in E-mail
•
People tell fewer lies in e-mails
than in phone calls and face-toface conversations.
•
Possible reason: Most people
know that e-mails leave a record.
J. T. Hancock, Corporate Human Interaction
-------------------------------------------------
I got one thing to tell you,
I…oooo, I ain’t tryin’ to sell ya’,
No lies.
Grand Funk Railroad
76
Interviewing Techniques
“Bosch didn’t say anything. He
knew that sometimes when he
was quiet, the person he needed
information from would eventually
fill the silence.” (pp. 5-6).
-------------------------------------------“Just listen. You are a detective.
Detectives are supposed to listen.
You once told me that solving
murders are getting people to talk
and just listening to them.” (pp.
92-93).
-------------------------------------------------Source: Michael Connelly, The Black Ice, St. Martin’s
Paperback, 1993.
77
Progression of Interpersonal Communication
Investigative
Communication
Type
Investigative
Conversation
Structured
Investigative
Interviewing
Basic Forensic
Interrogation
Advanced
Forensic
Interrogation
Time
Requirements
Flexible
Thirty
minutes to
one hour
Three to
six hours
Three to
six hours
Required
Environment
Flexible
Private
setting
Intimate
setting
Intimate
setting
78
Progression of Interpersonal Communication
Skill/
Training
Requirements
Minimal
training
required.
Preferable to
have training
in active
listening
skills,
question
formulation
and basic
behavior
analysis as
well as
psychology
of
investigative
discourse.
Minimum
fifteen
hours
training in
structured
interview
formats
and
behavior
analysis.
Minimum
fifteen hours
interviewing
training plus
thirty hours
of training in
Reid Nine
Steps.*
Minimum
standards
for
structured
formats and
basic
interrogation
as well as
minimum ten
hours of
advanced
training.
*Inbau, F.E., Reid, J. E. & Budkley, J.P. (1986) Criminal Interrogation and
Confessions, third edition (Baltimore, Williams and Wilkins).
Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.I.
02911.
79
Progression of Interpersonal Communication
Appropriate Use
and
Restrictions
When you
are looking
for direction
in an
investigation
. Result is a
gamble
rather than a
predictable
outcome
When you
have
established
the need for
a formal
investigation
and are
interacting
with
witnesses,
victims,
complainant
s or
suspects.
Must accept
information
as it is
presented
without
confrontatio
When you are
interacting
with an
uncooperativ
e suspect
and require a
truthful
account of
that person’s
guilt. Make
use of
perception
manipulation
and as such
requires
comprehensive
quality
control.
Most desirous
form for
uncooperative
suspects of
severe
offences or
suspects who
may be
emotionally
unstable. Does
not use
perception
manipulation
and therefore
beneficial
when you need
to identify true
motivation for
the offense.
n.
Source: William Morrisette, Intuition, 21 Garden Avenue, North Providence, R.I.
02911.
A Thousand Lies
What is a man that stays true to the game
But has to cheat a little to get by
Well that is a person that I know too well
What if a man doesn’t stay true to the game
Don’t care for no one, only cares for his greed.
Machine Head
80
Chance of Confession
John Baldwin found in 600
investigative interviews that 35.7
percent of suspects confessed from
the outset and an additional 16.2
percent confessed initially to part of
the allegation.
“Police Interviewing Techniques,” British Journal of
Criminology, Vol. 33, 1993.
William Morrisette believes that
“an investigator who properly
identifies and implements the
appropriate investigative
communication type should be able to
achieve an 85 percent confession
rate through basic interrogation and a
95 percent rate by way of advanced
interrogation.”
81
Deception Variables
Some variables in the management
discussion and analysis section of annual
report can provide early fraud prediction rate
from 56% to 65%.
The presence of deceptions are
1. Less terms indicating positive emotions.
2. Less present tense verbs.
3. Presence of an increased number of words.
4. Fewer colons.
5. Fewer semicolons.
6. Lower use of “for example.”
7. Lower lexical diversity.
C.C. Lee, N. T. Churyk, and D.D. Clinton, Validating Early Fraud Prediction Using Narrative
Disclosures, JFIA, Vol. 5, No. 1, January – June, 2013.
82
Better Whistleblower Letters

Self-reference, indicating first-hand knowledge of the
incident.

A higher level of writing.

As many examples (numeric lists, quantifiers, causal
relationships, citations, and explanations) requiring the
use of various styles (commas, semi-colons,
parentheses, and quotations) as possible documenting
the incident.
Source: Pope and Churyk, The Anatomy of A Whistleblower Letter: A Descriptive Study,
forthcoming, J. of Forensic & Investigative Accounting
Fraud Detection Questions
Question # 1 –
Reason Why? Do you know why you
are here today?
Principle: Innocent subjects will
acknowledge the reason for the
interview, while the guilty subject
will generally avoid indicating
knowledge of the issue.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s
Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4,
2005.
84
Fraud Detection Questions
Question #2 –
Know/Suspect: Who do you think
may have taken that $5,000 from
the safe?
Principle: Innocent subjects are
more likely to volunteer a name or
offer a suspicion.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s
Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4,
2005.
85
Fraud Detection Questions
Question #3 –
Vouch: Is there anyone that you work
with that you feel would not have taken
that $5,000 from the safe?
Principle: Innocent subjects will vouch for
others, while the guilty will vouch for
themselves or no one.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth
Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.
86
Fraud Detection Questions
Question #4 –
Think: Do you think that the $5,000
was actually stolen?
Principle: Innocent subjects will
generally agree that the money
was actually stolen.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s
Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4,
2005.
87
Fraud Detection Questions
Question #5 –
Opportunity: Who do you think would
have the best opportunity to take that
$5,000 from the safe?
Principle: Innocent subjects will usually
offer a name of an individual or named
position who would have had the best
opportunity.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth
Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.
88
Fraud Detection Questions
Question #6 –
Happen: What do you think should
happen to the person who stole
that missing $5,000?
Principle: Innocent subjects will
generally offer harsher
punishment than the guilty.
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s
Twelfth Annual Consultants’ Conference, Philadelphia, June 1-4,
2005.
89
Fraud Detection Questions
Question #7 –
2nd Chance: Would you be inclined to give
someone a second chance?
Principle: Innocent subjects generally
continue to offer harsh punishment,
while the guilty are more likely to offer
a second chance.
See Porter and Crumbley, Teaching Interviewing Techniques to
Forensic Accountants Is Critical, J. of Forensic & Investigative
Accounting, Vol. 4: No, 1, January – June 2012, pp. 122-126
Wayne Hoover, “Non-Confrontational Approach to Interviewing,” NACVA’s Twelfth
Annual Consultants’ Conference, Philadelphia, June 1-4, 2005.
90
Differences
Ronald L. Durkin suggests the
following differences in a forensic audit
versus a traditional audit:
•Not limiting the scope of the
engagement based upon materiality.
•Not accepting sampling as evidence.
•Not assuming management has
integrity.
•Seeking the best legal evidence.
•Melding the requirements of the
evidential matter standard with the
rules of evidence.
Source: R.L. Durkin, “Defining the Practice of Forensic
Accounting,” CPA Expert, Special Edition, 1999.
91
Inexperienced Forensic Auditors

Find out who did it. Do not worry about
all the endless details.

Be creative, think like the fraudster, and
do not be predictable. Lower the
auditing threshold without notice.

Take into consideration that fraud often
involves conspiracy.

Internal control lapses often occur during
vacations, sick outages, days off, and
rest breaks, especially when temporary
personnel replace normal employees.
H. R. Davia, Fraud 101, New York: John Wiley & Sons, 2000, pp.
42-45.
92