[Chapter In Litigation Services Handbook, Third Edition]
THE ROLE OF THE FORENSIC ACCOUNTANT IN
INTERNAL CORPORATE INVESTIGATIONS
Jonny J. Frank, J.D., LL.M.
Michael D. Carey FCA, CFE*
Contents
1 Introduction
2 Categories of Fraud
3 Whether to Conduct an Investigation
4 The Accountant's Role In The Investigation
5 The Investigative Plan
6 The Planning Phase
6.1 Role of the Accountant
6.2 Assembling the Investigative and Legal Team
6.2.A Independence
6.2.B Experience and Abilities of Team
6.2.C Familiarity with Employee
6.2.D Investigative Resources
6.3 Scope of the Investigation
6.4 Legal and Business Implications
6.4.A Legality of Investigative Techniques
6.4.A.1 Electronic Surveillance
6.4.A.2 Workplace Searches
6.4.A.3 Polygraphs
6.4.A.4 Restrictions on Employee Interviews
6.4.A.5 Corporate Miranda Warnings
6.4.A.6 Defamation
6.4.B Business Implications
6.4.B.1 What To Do With The Employee
6.4.B.2 Informing The Troops and Others
6.4.B.3 Disclosure of Allegations of Law Enforcement Authorities
6.4.B.4 Third Party Liabilities
6.5 The Engagement Letter
7 The Covert Phase
7.1 Role of the Accountant
7.2 Investigative Techniques
7.2.A Forensic Accounting
7.2.B Commercial Databases/Internet/Public Records
7.2.B.1 Commercial Databases vs. The Internet
7.2.B.2 On-Line Media Sources
7.2.B.3 On-Line Public Records
-1-
7.2.B.4 Other On-Line Sources
7.2.B.5 The Internet
7.2.C Computer Forensics
7.2.D Workplace Evidence
7.2.E Field Interviews
7.2.F Surveillance
7.2.G Undercover Operations
8 The Transition Phase
8.1 Role of the Accountant
8.2 Who Confronts The Subject
8.3 Location of the Confrontation
8.4 Confrontation of the Subject
8.5 Contingency Planning
9 The Overt Phase
9.1 The Investigative Mentality
9.2 Advice to Employees
9.3 Document Gathering and Examination
9.4 Interviews
9.5 The Investigative Report
10 The Remedial Phase
11 Conclusion
12 Notes
1. Introduction
It happens eventually to almost every company. An anonymous letter, a phone
call or perhaps an audit tips the company off to serious employee wrongdoing.
Sometimes the wrongdoing exposes the company to civil or criminal liability.
More frequently, the wrongdoing involves theft of company assets, including
proprietary or confidential information critical to the company’s financial well
being. In either event, the company must investigate the allegations.1
Nobody instructs you on conducting corporate criminal investigations when you
go to school to become an accountant. Yet corporate clients routinely turn to
accountants for guidance when these situations arise. This chapter discusses
the issues that face an accountant when allegations arise of misconduct by or
against the corporate client.
2.
Categories of Fraud
The potential for fraud and misconduct reaches far and wide within any company,
including procurement2, sales and marketing3, finance and accounting4,
operations5, foreign and domestic subsidiaries, portfolio companies, joint
ventures, merger and acquisition targets.
Generally, the categories of corporate fraud and misconduct include:
-2-



External Fraud and Misconduct
External/Internal Fraud: Collusion With Insiders
Internal Fraud and Misconduct
Within each of these categories, the accountant and investigative team must
distinguish fraud/misconduct, which exposes the company to potential criminal or
civil liability from fraud/misconduct, which victimizes the company. Sometimes,
the company can simultaneously lose money and face potential liability to third
parties.
Examples of external fraud and misconduct include (i) procurement fraud, (ii)
theft of inventory and property, (iii) theft of intellectual property and proprietary
information and (iv) false statements of acquired companies and strategic
relationships.
Examples of frauds involving collusion between outsiders and insiders include (i)
conflicts of interest schemes, (ii) commercial bribery and (iii) accounts payable
fraud schemes.
Examples of internal frauds include (i) travel and expense schemes, (ii) phantom
vendors, (iii) misappropriation of corporate assets, and (iv) theft of trade secrets.
3.
Whether to Conduct An Investigation
The client may first ask for counsel as to whether even to initiate an investigation.
One of the most important factors in deciding whether to conduct an investigation
are the circumstances giving rise to the allegations. Has the company learned of
the allegations from the commencement of legal proceedings such as the
execution of a search warrant or receipt of a grand jury subpoena? Typically, if a
prosecutor is conducting an investigation or has served a subpoena or executed
a search warrant, a company has no choice but to conduct an internal
investigation and assess the viability of the allegations.
The more difficult decision is when the company is aware of internal allegations
of wrongdoing, but no private lawsuit has been filed, or the government has not
initiated an investigation. Should the company investigate claims, which, if true,
may subject the company to civil or criminal liability? Should the company throw
good money after bad when it has been the victim of a fraud? Is it better to
ignore the problem and hope that the allegations will never become public?
While there is no hard and fast rule, generally the law, good business judgment
and common sense favor conducting an investigation. Knowledge of the facts
will enable management to examine options and respond effectively, and enable
the company to decide whether it is necessary to disclose the allegations and the
company's findings in response to the government. An internal investigation
-3-
enables management to fulfill its duty of care and receive the protection of the
business judgment rule.
The disadvantage of conducting an internal investigation must also be
considered. For example, an investigation may yield damaging information that
may be subject to discovery in litigation. In addition, the cost of conducting the
investigation, of both the actual expenditures as well as lost in management and
employee time can be quite high. Further, the company must be aware and be
prepared to deal with the consequences if what begins as a narrow, focused
inquiry leads to discovery of deeper, broader-based corporate misconduct.
Notwithstanding the potential disadvantages of conducting an internal
investigation, on balance the advantages of commencing an investigation clearly
outweigh the disadvantages in most circumstances. When confronted with
allegations of wrongdoing, an internal investigation is necessary to uncover the
facts so the viability of the claim can be assessed, and appropriate remedial
action taken.
4.
The Accountant's Role In The Investigation
The accountant's role in the investigation will depend upon the nature of the
allegations, the resources of the accounting firm, and the relationship with the
client. The accountant frequently will assume a primary role with responsibility
for managing the investigation. This typically occurs where the allegations
involve a crime or fraud against the company. As the project manager, the
accountant will devise the investigative plan, supervise the investigation and
advise the client regarding the business implications as well as the short-term
and long-term consequences of the investigation.
In many instances, the accountant will serve in a supporting role. For example,
where the allegations involve allegations of misconduct by the company, it is
likely that in-house or outside counsel will be leading the investigation. In these
instances, the accountant typically will be performing forensic accounting and
auditing either in relation to determining the ultimate facts and/or quantifying
damages. The accountant likely will be assisting to develop controls to prevent a
recurrence of the misconduct. These tasks are discussed separately in this
chapter as well as other chapters of this book.
5.
The Investigative Plan
Investigative engagements are generally organized into progressive phases,
namely, the planning phase, a covert phase, a transition phase, an overt phase,
and a remedial phase. The role of the accountant in these phases is discussed
below.
-4-
The planning phase requires both short-term and long-term planning and
involves an evaluation of the investigative needs and objectives. The covert
phase consists of investigative activity taken before the subject of the
investigation becomes aware that an investigation has been implemented. The
transition phase occurs just immediately before or contemporaneous to the
subject's learning of the investigation. The overt phase, which occurs after the
subject is aware of the investigation and typically is the most extensive phase for
the accountant, involves more traditional investigative and audit techniques. The
remedial phase involves both financial recovery and/or settlement of criminal and
civil liabilities as well as the development of controls to ensure that the
misconduct does not recur. While these phases generally follow one another, in a
larger internal investigation the investigative plan must allow for the flexibility to
switch back and forth between phases; that is, changing the circumstances may
require the investigative team to return to the covert or transition phases even
though the investigators and accountants are already conducting an overt
investigation.
6.
The Planning Phase
There will be a natural tendency and almost immediate and irresistible impulse to
confront and/or suspend the individuals alleged to have engaged in wrongdoing.
Understandably, management will want to get to the bottom of the problem as
quickly as possible. Where internal fraud is alleged, the prospect of having a
criminal continue his employment, and perhaps his wrongdoing, is intolerable.
Indeed, management must consider the prospect of criticism from regulators, law
enforcement authorities and civil attorneys if immediate, aggressive action is not
taken, especially if the illegal conduct continues. Accordingly, management will
frequently opt to confront and/or suspend the suspected employee(s) and
confront third parties at the outset of the investigation.
While such a decision may appear to be entirely appropriate and perhaps
necessary under the circumstances, it must be balanced against the extent to
which critical fact-finding will be impeded at an essential stage in the
investigation. Pre-confrontation investigation will frequently uncover important
facts reflecting the nature and extent of the misconduct, enabling the company to
assess the harm it has suffered. Facts directly or circumstantially implicating the
subject may also be uncovered, thereby enhancing the likelihood of a successful
confrontation. Additionally, prior to the confrontation, the company must consider
and evaluate the legality of certain investigative techniques, the subject’s rights
and the business implications of the employee’s possible dismissal. Moreover, in
situations where substantial funds are stolen, the company should determine if it
can recover a portion or all of the funds through asset searches and legal
process.
In short, when serious allegations of misconduct arise, a company and its
management must address a myriad of investigative, legal and business issues
-5-
that have both short-term and long-term consequences. Only by carefully
considering these issues in advance can a company effectively design a strategy
for confronting the employee, remedying the damage caused by the wrongdoing
and instituting measures to prevent it from happening again.
6.1
Role of the Accountant
The accountant should seek a major role in the planning phase regardless if
serving a primary or support role in the investigation. Invariably, there will be a
financial aspect to the alleged wrongdoing. The accountant's advice will be
necessary regarding the staffing of the investigative team, defining the scope of
the investigation, devising an investigative plan, and counseling on the business
consequences of the investigation.
6.2
Assembling the Investigative and Legal Team
The decision as to who will participate in the investigation is crucial and merits
considerable thought and discussion. Corporate counsel and management have
a number of options to choose from: in-house resources such as legal, human
resources or security departments, and/or outside resources, such as law,
investigative and accounting firms. If the allegations are significant, the company
must assemble a multi-disciplinary team. Professionally trained investigative
resources will be needed to develop the facts and evidence. Experienced legal
counsel may be necessary to manage the various legal issues affecting the
investigation, including issues of labor law and corporate civil and criminal
liability. Among the factors that must be considered in making this determination
are:

Independence
The issue of independence must be considered in determining who conducts the
investigation. An in-house investigator may have difficulty maintaining his or her
independence when interviewing employees and providing the employees with
legal advice. Further, an in-house investigator’s judgment may be affected or
criticized by previous biases or political considerations, whether real or not. For
example, it may not be desirable for an in-house professional to investigate the
conduct of his or her superiors. Also, in-house professionals who have
witnessed the underlying conduct should not participate in an internal
investigation.
Lastly, in-house professionals must be cognizant of appearances should litigation
ensue. The objectivity and independence of an “insider,” may be questioned by
the employee’s counsel or in legal actions initiated by other interested parties
such as shareholders or investors. These parties will invariably claim that the inhouse investigative team was partial and attempted to scapegoat an employee to
cover up more serious corporate misdeeds.
-6-

Experience and Abilities of the Investigative and Legal Team
The ability to investigate and interview effectively is an acquired skill. Only
through experience and training can one prepare and execute an investigative
plan designed to gather evidence logically and efficiently. Such a plan may
encompass obtaining information from internal sources such as employee
interviews, financial records, computers, travel and expense reports records and
personnel files, as well as external sources such as former employees, vendors,
industry sources, on-line databases and public records. Specialized resources
and expertise will be required to conduct the investigation, including access to
and experience in database research, computer forensics and electronic
surveillance.
In addition to the “nuts and bolts” of the investigation, the investigative team must
be mindful of the various legal and business implications of the investigation and
the techniques used to gather evidence relevant to the allegations. Structuring
an interview to obtain maximum information, either through careful questioning or
through exploiting the weaknesses in an interviewee’s story requires substantial
preparation and analysis of all available evidence. The company must consider
the circumstances of the interview and the backgrounds of the interviewees in
selecting the interviewer.

Familiarity with Employee
The working relationship between an in-house corporate investigator and
suspected employee may create an awkward investigative atmosphere.
Investigations led by in-house representatives may create or exacerbate morale
problems. In the event the allegations are not proven, the future working
relationship with the employee(s) may well be strained. The hiring of outside
consultants to respond to allegations may be viewed as responsible corporate
conduct rather than politically or personally motivated acts if led by corporate
insiders.

Investigative Resources
Outside firms are generally better equipped to investigate allegations of
misconduct by or against a corporation, having substantial staff dedicated to and
experienced in corporate fraud investigations. Depending upon the nature of the
allegations, the company must consider the geographic resources as well as the
industry expertise in assembling the investigative and legal team. Moreover,
sophisticated computer database research is now the norm, with detailed
background information readily available on individuals and entities, including,
asset ownership, civil litigation, criminal convictions, bankruptcy filings and
business relationships. Outside firms also provide services such as forensic
-7-
accounting and computer data retrieval which are frequently necessary to learn
the particulars of a fraudulent scheme.
6.3
Scope of the Investigation
The company will have more flexibility if the company if the company learns of
the allegations of wrongdoing before the government has initiated an
investigation, or a private lawsuit has been filed. The company will need to
investigate all plausible allegations of misconduct and ensure that the
investigative leads are followed. All potential witnesses should be interviewed,
and potentially relevant documents should be reviewed.
But there are limits. Credibility and common sense are determinant. The
company should not finance a wild goose chase or investigate baseless or
frivolous allegations. It must, however, be prepared to expand the investigation
as needed and to justify any limitations placed on the investigative team.
6.4
Legal and Business Implications
The investigative advisers must carefully consider and plan for a host of legal
and business implications. Chief among these concerns is the propriety of the
investigative techniques, the rights of the suspect employee, the company’s
relationships with third parties and the company’s ability to function in the wake
of the investigation.
A recent addition to the list of issues that must be addressed concerns whether a
report will be produced following the investigation. Although companies
frequently request a report, especially if negative employment action or referral to
law enforcement agencies is contemplated, a recent Federal Trade Commission
(“FTC”) staff opinion letter concluded that outside attorneys or investigators might
be considered “consumer reporting agencies” under the Fair Credit Reporting
Act, thereby obligating the employer to notify employees under investigation and
furnish them with copies of the investigative report.
Following publication of the staff letter, a number of commentators and
practitioners expressed concern that the staff letter would inhibit companies’
ability to hire experienced attorneys and investigative firms to fully investigate
allegations of wrongdoing. In response, the FTC issued a letter that sought to
“clarify, and perhaps soften,” the implications of the staff opinion letter. The
letter, however, did not suggest that the staff letter was incorrect in its
interpretation of the FCRA; instead, it merely provided advice for dealing with the
FCRA’s provisions. For example, the letter recommended that employers obtain
employee consent at the start of employment to procure consumer reports,
thereby relieving the employer of the duty to disclose. Although the FTC’s
opinions regarding the FCRA do not have the force of law, its interpretation of the
FCRA must be considered prior to issuing an investigative report.
-8-
 Legality of Investigative Techniques
In most circumstances, an aggressive investigation is necessary to uncover the
full extent of the wrongdoing and damages sustained by the company. As
described below, investigators must be familiar with statutory and common-law
prohibitions or restrictions on certain investigative techniques.

Electronic Surveillance
Tapping telephones is perilous – the federal wiretap statute, commonly known as
Title III, makes it a crime to “intentionally intercept any wire, oral or electronic
communication.”6 An employer, however, may use an extension telephone to
monitor employee calls made in the ordinary course of business.7 Criminal
conduct overheard during the course of monitoring could be used by the
employer to take remedial employment action and would be admissible in court.
However, it is important to note that the recording must be related to legitimate
business interests and cannot be used merely as a pretext for conducting an
investigation into suspected wrongdoing.8
Title III also permits the taping of telephone conversations as long as one of the
parties to the conversation has consented.9 However, state laws vary, with
twelve states requiring approval by all parties to the conversation prior to
taping.10

Workplace Searches
Generally, the workplace is under the control of the employer, and property
provided by the employer to the employee, such as lockers and desks, typically
may be searched without the employee’s consent.11 Computer hard drives and
networks, as well as e-mail, are generally subject to search12, although
companies in at least two states, Maryland and Florida, cannot monitor e-mail
absent employee consent.
However, the ability to search work areas and items within those areas is not
absolute. Searches may be limited depending upon the employee’s privacy
expectations and the employer’s express or implied recognition of those
expectations. For example, allowing employees to use personal locks on lockers
may restrict an employer’s ability to search for evidence of wrongdoing. 13 Unless
the employer has written policies concerning unannounced searches, and
obtains signed waivers by employees, careful consideration should be given to
the scope of searches conducted in the course of the investigation.

Polygraphs
-9-
In anticipation of the suspected employee’s denial of wrongdoing, consideration
should be given to a polygraph examination. Although the use of polygraphs in
the workplace was severely restricted by the Employee Polygraph Protection Act
of 1988 (“EPPA”)14, polygraphs are permitted if their use is related to the
investigation of a specific incident. Employers may request that an employee
submit to a polygraph examination if: (1) the test is part of an ongoing
investigation involving economic injury; (2) the employee had “access” to the
property that is the subject of the investigation; (3) the employer has a
reasonable suspicion that the employee was involved in the activity under
investigation, and (4) the employer executes a statement detailing requirements
(1) through (3).15
Although evidence obtained from the polygraph may not, in itself, constitute the
basis of an adverse employment action16, the results may, when taken with other
evidence, justify suspension or termination. The employer has little recourse,
however, should the employee refuse to take a polygraph examination. Many
states prohibit employers from requiring that employees take polygraphs as a
condition of continued employment, and frequently grant employees the right to
counsel if a polygraph examination is sought.17 Lastly, the Department of Labor,
which administers the EPPA, can assess civil penalties of up to $10,000 against
the employer and seek remedial relief for the employee. The employee is also
authorized to file suit.18

Restrictions on Employee Interviews
Although employees of private entities do not, in the context of an internal
investigation, enjoy constitutional protections such as the right to counsel, they
may possess contractual rights that must be respected during the course of the
investigation. For example, a union member may be entitled to have a union
representative present during an interview that may lead to disciplinary action. 19
The collective bargaining agreement may contain other employee rights and
benefits and should be reviewed prior to interviewing union members.
Notwithstanding any bargained for rights, employees are obligated under state
statutes or common law to cooperate in the employer-employee relationship,
including complying with reasonable requests during an internal investigation.20
If the employee refuses to cooperate, the company generally may terminate the
employee. It is prudent, however, to review all aspects of the employeremployee relationship, including company policies, contractual relationships and
prevailing law in plotting the investigation’s course.

Corporate Miranda Warnings
If an attorney for the company interviews the employee, the attorney must advise
the employee that the interview is being conducted on behalf of the company and
that the attorney represents the company, not the employee. Further, the
- 10 -
employee should be told that the information obtained from the interview will be
protected within the company’s attorney-client privilege, but that the company
may choose to waive the privilege and disclose the contents of the interview
without the employee’s consent. In sum, there should be no confusion on the
employee’s part as to which counsel is representing in the investigation.

Defamation
The threat of defamation lawsuits always looms overhead when accusations of
wrongdoing are leveled at employees. Assuming the employee can establish
that defamatory statements were made and “published,” i.e. communicated to at
least one other person, the most frequently raised defense is that of qualified
business privilege. This privilege requires that the statement (1) was made in
good faith; (2) concerned a subject in which the person making the statement
had an interest or duty; and (3) was made to a person having a corresponding
interest or duty. Accordingly, statements made in the context of an internal
investigation generally will be protected, provided the investigation is conducted
properly and discreetly.
 Business Implications
Allegations of criminal conduct frequently result in a disruption of the company’s
business, as senior management directs its energies toward the problem and
away from company’s daily operations. Moreover, a host of issues concerning
the ongoing business in the wake of the allegations must be considered prior to
confronting the employee.

What To Do With the Employee
When serious allegations of misconduct are directed toward an employee, the
company must react. Absent the rights and benefits accorded union members,
the company may generally choose to suspend the employee with or without
pay, terminate him or allow him to continue working. Because of the tremendous
impact this decision will have on the course of the investigation, management
should consult with its investigative team before taking any action.
Generally, suspending or terminating an employee will severely limit the
investigator’s ability to confront the employee under conditions carefully designed
and structured to maximize the likelihood of a confession. In other words, it is
vitally important for the investigator to control the environment in which the
interview is to take place. The element of surprise is critical, as the employee will
not have had an opportunity to plan and rehearse an explanation for the conduct.
Moreover, the interviewer will be able to gauge the employee’s reaction to
particular questions, and will be prepared to present contradictory evidence if
necessary.
- 11 -
If the employee is alerted to the allegation, which is inevitable if he is suspended
or terminated, the likelihood of a successful confrontation is diminished,
especially if counsel is retained. In addition, proactive efforts to obtain damaging
evidence against the employee through surveillance or sting operations will, in all
likelihood, are lost. Lastly, the employee may make efforts to influence
witnesses or third parties with knowledge of the misconduct, or destroy
documents or other evidence relevant to the investigation.
Of course, there will be circumstances in which the company will have no choice
but to suspend or terminate an employee. For example, if the company will
suffer irreparable harm by allowing the employee to continue working, even for
one day, suspension is appropriate. These situations arise most frequently in the
intellectual property area, where disclosure of trade secrets or other confidential
information can spell financial ruin for the company. In the absence of a genuine
threat to the company’s financial well being, the better course is to wait until the
confrontational interview has taken place.

Informing the Troops and Others
If the employee performs an important function, the company must prepare
contingency plans to deal with his possible departure. A temporary or permanent
replacement should be waiting in the wings to ensure minimal business
interruption. Statements should be prepared informing company personnel of the
termination and assuring them that the situation is under control. Although
perhaps ineffective, personnel should also be instructed not to discuss the matter
further amongst themselves or with third parties. Plans to contact and inform
customers and third parties affected by the misconduct must be developed. If
called for, the company should consider hiring a crisis management team to
advise it during this period.

Disclosure of Allegations to Law Enforcement Authorities
At the outset of the investigation, the company must begin its evaluation of
whether or not it will disclose the misconduct to law enforcement authorities. If
there is no legal obligation to report the misconduct, voluntary referral requires
careful consideration of the effect disclosure may have on the company’s
business operations.
Generally, absent a statutory reporting requirement, such as in the case of
federally insured financial institutions or publicly traded companies21, a company
is not required to report knowledge or evidence of criminal conduct to law
enforcement authorities.22 The misprision of felony statute is violated only if an
individual, having knowledge of the commission of a felony both fails to notify
authorities and deliberately takes and affirmative step to conceal the crime.23
Mere silence is insufficient to establish the affirmative step element of the
crime.24
- 12 -
Although the company may not be required to report criminal conduct, it must
consider voluntarily disclosing the conduct to the authorities. In determining
whether voluntary disclosure is appropriate, the company must first assess any
liability it may incur through the criminal behavior of its employee. For example,
if the conduct appears isolated, aberrant and restricted to a lower-level
employee, it is unlikely that a prosecutor would pursue criminal sanctions
against the company.
If, on the other hand, the criminal activity is pervasive and implicates senior
management, or if it victimizes the government, law enforcement authorities may
very well consider prosecuting the organization. Under these circumstances it
may be prudent for the company to voluntarily disclose the conduct and take the
opportunity to present mitigating circumstances, possible defenses and
exculpatory evidence. Coming forward before any government investigation is
initiated, coupled with evidence that the company promptly responded to the
allegations and instituted remedial measures, may persuade the prosecutor to
proceed against the individual wrongdoers and not the company. In the event
the company is prosecuted, enters a guilty plea, cooperates and accepts
responsibility for its wrongdoing, it will benefit from its voluntary disclosure under
the United States Sentencing Guidelines.25
Lastly, if the company does business with the federal government, a number of
agencies, including the Department of Defense and the Internal Revenue
Service, have created formal voluntary disclosure programs. Again, promptly
disclosing the improper activity may enable the company to argue persuasively
that declination of prosecution is appropriate.
Another factor the company must consider in determining whether or not to
report the allegation is the effect a government investigation will have on its
business. Government prosecutors and agents are very busy, with many matters
under investigation and prosecution. Unless the magnitude of the misconduct at
issue is such that prosecutor and investigator deem it a priority, the investigation
will proceed at a deliberate pace, leaving an ominous cloud hanging over the
company for an extended period of time.
A lengthy law enforcement investigation will also distract employees and result in
workplace inefficiencies and morale problems. Most important, the existence of
a criminal investigation may have serious business implications for the company,
including, restrictions on third-party financing, vendor reluctance to supply
materials other than on a C.O.D. basis, customer concerns about timely shipping
and receipt of products, and reputation damage in the business community.
In most circumstances, the decision as to whether or not to report the conduct to
criminal authorities, and when, is complex and requires a weighing of many
- 13 -
factors. It is important to evaluate these factors at the earliest stages of the
investigation.

Third-Party Liabilities
The company must also evaluate whether any potential liabilities exist with
respect to its suppliers and customers. If, for example, customers were
defrauded, efforts must be made to make the customers whole and restore
confidence in the business relationship. Other times the company will be the
victim, and consideration must be given to the manner in which remedies will be
pursued, if at all, against third-parties.
6.5 The Engagement Letter
The accountant should not participate in an active investigation until an
engagement letter has been executed. Issues to be addressed in the
engagement letter include:






7.
The Scope of Services
Timetable
Fees
Confidentiality
Ownership of Working Papers
Liability and Indemnification
The Covert Phase
The initial confrontation of the suspect individual(s) is critical. A company
frequently has only one opportunity to confront an officer, employee or third
party. Oftentimes, the company enjoys the benefit of the element of surprise,
which enables management to obtain information and gauge an individual's
reaction and responses when confronted. Accordingly, great care should be
taken to ensure that that opportunity presented by the confrontation is not
squandered. Obtaining accurate information about the wrongful conduct at an
early stage of the investigation enables the company to immediately deal with the
problem, remedy damage caused by the wrongdoing and institute measures to
prevent its reoccurrence.
Initially, facts should be developed discreetly to avoid possible obstructive
conduct such as document destruction, records’ alteration and witness
tampering. A variety of investigative techniques have been developed to gather
facts before the subject of the investigation becomes aware that an investigation
has been implemented.
7.1
Role of the Accountant
- 14 -
An accountant generally performs a very limited role in the covert phase of the
investigation with the exception of analysis of records and the preparation of a
visual link analysis. It is essential, however, that an accountant be familiar with
the availability of covert techniques so that he can advise the client as needed.
Moreover, the accountant needs to work in tandem with the covert investigative
team.
7.2
Investigative Techniques
 Forensic Accounting
Forensic accountants piece together financial data and search for anomalies and
irregularities that are the hallmarks of fraud. Depending upon the circumstances,
the client may be about to furnish the forensic accountant with key data without
jeopardizing the secrecy of the investigation. Financial transactions that directly
implicate the subject or corroborate evidence obtained through other
investigative techniques constitute powerful ammunition with which to confront
the alleged wrongdoer.
 Commercial Databases/Internet/Public Records
The explosion of information sources available on the Internet and through
commercial online services has revolutionized the investigative process. Virtually
every business investigation now begins with some form of online research. In a
matter of hours, a skilled investigator can develop information, which can provide
critical leads and make connections that may never be found through traditional
field investigation.
As a practical matter, an accountant will probably not be trained in these various
database sources. The accountant, however, needs to be familiar with the
sources of information that are available so that he can bring the proper
resources to the investigation. The subject is discussed at some length because
this investigative resource has become so crucial.

Commercial Databases vs. the Internet
For certain types of information, the Internet cannot match the offerings of
commercial services. For others, the Internet is the best and only place to find
information. Knowing when to use the commercial databases and when to use
the Internet is key to developing a comprehensive and thorough investigative
strategy.
Whether to rely on the Internet or commercial databases will depend on the
nature and extent of the information you are seeking. Before going online, the
- 15 -
investigator will need to identify which databases or Internet sites are most likely
to contain information most relevant to the target of your investigation, in terms of
both geographic location and subject matter. As more information is made
available on the Internet, the best approach is to use these research tools in
tandem, and to become familiar with the best sources of information to suit the
particular needs of the investigation.

On-Line Media Sources
Whether retrieved from commercial databases or the Internet, the most valuable
sources of information fall into two main categories, news and media sources,
and public record sources. It is usually best to start the online investigative
process with a media search, one of the key sources for historical and
background information regarding entities and individuals. These sources
include local, national and international newspapers, magazines, trade
publications, and television and radio broadcast transcripts. Often, a subject’s
legal, financial or business troubles are written about in the news media in wellresearched and thoughtful articles. Media can also be helpful in identifying a
subject’s prior employment and personal history.
When using the commercial media databases, the researcher should give careful
thought as to which databases to use. In general, Lexis-Nexis26, Dialog27,
Datastar28 and Dow Jones29 provide the most extensive news and media
coverage. Each database provides different levels and types of local, national
and international coverage. The database vendors are constantly adding new
and removing underused sources. Paying attention to content must be an
ongoing process. Researchers must check their habits and change their search
strategies accordingly.
 On-Line Public Records
After exhausting online media sources, the next stop in the online investigation is
to search the vast compilation of abstracted public record information. This
resource includes: federal and state civil court proceedings, federal criminal
records, federal bankruptcy court records, UCC filings and other asset locators,
corporate records, property records, judgment indices, motor vehicle records,
regulatory agencies actions, professional registration and licensing information,
Securities and Exchange Commission (SEC) records and other business
databases. On-line public records information is perhaps the fastest growing
area of online information and is routinely included in any business investigation.
The availability of on-line public records information varies from state to state and
covers variable time periods, so the extent of coverage in a particular jurisdiction
must be carefully considered. Another word of caution: online records are often
inaccurate and incomplete. While a great source of leads, online research
should never be exclusively relied upon. Investigators encounter situations in
which a manual search of the public record reveals significant litigation matters
- 16 -
that were not identified online, despite the fact that court records were
supposedly online for that particular jurisdiction and time period. Additionally,
many of the online records, most of which are abstracted, are likely to contain
only a portion of the information available from the original document. A
combination of online searching and onsite searching at relevant courthouses or
agencies is the best approach.
Further, in international investigations, only limited public records information is
available online. The reasons for this are twofold. First, many records, such as
lawsuits and bankruptcies, are not considered public information. Second, other
countries tend to lag behind the U.S. when it comes to automating their publicly
available information into searchable online databases. Even in those foreign
countries that do have some information available online, it is generally limited to
corporate records, some Dun & Bradstreet company reports, and varying
degrees of media. There are also CD-ROM products available that have
international corporate records. Again, it is important to know specifically what is
available in the jurisdictions you are concerned about in order to maximize the
information you can obtain from these sources.
In general, the most used public records database providers are Lexis-Nexis30,
CDB Infotek31, Information America 32, Autotrack33, Pacer34, Courtlink 35, and
Superior Information Services.36 All of the commercial database providers
provide some form of “global” search capability, which allows the user to search
simultaneously millions of records from across the country. Because there is a
great deal of overlap in the content of these databases, however, the accountant
must retain an on-line database and Internet investigator who is well acquainted
with the unique public record sources that each database provides. In cases of
overlap, an investigator may base the decision to use one over the other on cost
and search features, which differ widely across the public record databases.
In addition to the commercial vendors, many state and federal regulatory
agencies now make records available directly on the Internet.37 Some of the
commercial vendors also offer a web-based product.38
While the availability is increasing at a fast pace, presently public records
offerings on the Internet remain insignificant when compared to the commercial
services. Even though some public record information is available, the Internet is
not a viable alternative to the commercial vendors. However, used in tandem with
commercial databases, the Internet can provide valuable leads and critical
information about individuals and entities.

Other On-Line Sources
In addition to media and public record sources, several other online investigative
sources deserve mention. These include Dun & Bradstreet, which provides selfreported business and credit information on both public and private, domestic
- 17 -
and international companies39, and people locator services, which can be critical
in locating key witnesses.40

The Internet
Despite its shortcomings when compared to the commercial online databases for
purposes of media and public record searching, the Internet has spawned a
number of unique research resources. By virtue of the extraordinary pace at
which it reinvents itself, this medium demands creative thinking for use as an
investigative tool.
 Message Boards
Most search engines, as well as many Internet sites, "message boards", "bulletin
boards" or “discussion groups” locate sites where people can inquire about and
respond to various topics. Researchers can both monitor ongoing discussion or
search the vast pool of archived postings. These sites can provide a wealth of
information, particularly in a litigation context.
 Home Pages
Most companies, and even many individuals, have their own website. These
sites can provide a wealth of information relating to a company’s sales
information, geographic territory, biographical information of corporate officers,
names of joint venture partners, and updated product information. A private
company may provide a more detailed history or corporate structure on its home
page than it provided to a commercial credit reporting service. It may also
inadvertently leave outdated – but perhaps useful – information on its Web site
that a commercial vendor will delete once the information is updated.41
 Other Sites
The Internet investigator can use the Internet for other purposes. If the company
or individual being investigated does not have a website, information might be
located in other websites. Websites exist to allow the investigator to quickly
locate individuals or businesses across the country as well as conducting reverse
telephone directory services. There are even web services available, which, for
a nominal fee, will verify an academic degree and professional certifications.
The Internet is also a useful tool for locating outside experts to assist in difficult
investigations.
 Computer Forensics
Frequently, computer forensic professionals are able to retrieve deleted,
encrypted and password sensitive files, as well as e-mail, that may bear directly
on the alleged wrongdoing. Potential sources include the subject's desktop and
laptop computers, the subject's secretary's computer, the subject's electronic
- 18 -
organizer, the server, backup tapes, voicemail systems, floppy disks, and home
computers.
This data often includes "smoking gun" evidence. The investigative team must
ensure to retrieve the data in a manner that meets evidentiary requirements for
admission in subsequent legal proceedings.
 Workplace Evidence
Frequently, more traditional evidence gathering techniques can prove even more
successful than the high tech efforts described above. Desk and file searches
frequently yield incriminating evidence, as do personnel files, travel and expense
reports, telephone records and statements (including office, cellular and calling
card) and company credit card statements.
 Field Interviews
Interviews of employees, former employees and third parties such as vendors,
suppliers and customers many times provide insight into the suspected
employee’s activities and, perhaps, the alleged wrongdoing itself. However, the
risk that the suspected employee will learn of the investigation and attempt to
subvert the fact-finding process through document destruction and/or witness
manipulation must be considered.
 Surveillance
Physical, audio and video surveillance should be considered provided the activity
is ongoing and susceptible to this investigative technique. Surveillance is
generally most successful when the improper activity involves theft of physical
property or trade secrets.
 Sting Operations
If circumstances permit, sting operations should be considered as a means to
obtain unequivocal proof of misconduct. For example, in the case of ongoing
misconduct, undercover operatives may pose as willing purchasers of stolen
trade secrets or merchandise or as vendors seeking to obtain business from a
purchasing agent suspected of taking kickbacks in exchange for the awarding of
contracts.
8.
The Transition Phase
The transition phase is a critical, albeit very brief, phase of a corporate internal
investigation. It is that moment that the subject of the investigation becomes
aware that he or she is the subject of an investigation.
- 19 -
The investigator has a distinct advantage - - only he is aware that an
investigation has commenced. A skilled investigator seeks to exploit that
advantage and the element of surprise by careful planning including:

Selecting the person(s) to confront the subject

Choosing the time, order and location of the confrontation

Determining the best approach toward the confrontation
The transition phase also requires contingency planning for next steps. The
investigative team must plan and guard the preservation of documentary,
physical and electronic evidence. Additionally, the investigative team, together
with the client, must plan for the on-going operation of the business, including the
possibility of a disruption of relations with employees, vendors and customers
and, where the circumstances are newsworthy, the public.
8.1 Role of the Accountant
The accountant performs a vital role in the planning of the transition phase. The
accountant's role in the actual confrontation of the subject varies depending upon
the accountant's experience and the circumstances of the investigation.
An accountant's presence, for example, is absolutely critical in internal
investigations of finance and accounting personnel as well as in investigations of
accounting irregularities. Effective confrontation of the subject in these sort of
cases demand the technical expertise of an accountant.
Investigators and lawyers frequently, however, consider the confrontation of the
subject to be within their exclusive domain. The accountant should gauge the
facts and circumstances to determine whether his presence is essential and, if
so, be prepared to insinuate himself even if uninvited.
8.2 Who Confronts The Subject
Planning the transition phase requires careful consideration of the most effective
team for confronting the subject. Usually a two-person team is most effective.
Two people are required so that there is a witness if the subject later disavows
his or her earlier statements. More than a two person team risks being too
intimidating.
An experienced interviewer should lead the confrontation of the subject. The
more difficult decision usually concerns the second person. Depending upon the
circumstances, the second team member might include the subject's immediate
supervisor, a senior company official, a human resources representative, another
member of the investigative team, or counsel.
- 20 -
The presence of an attorney has its benefits and disadvantages. In most
situations, the attendance of counsel heightens the seriousness of the matter.
Conversely, including an attorney can have a chilling effect. Moreover, counsel
is likely to administer corporate Miranda warnings. Counsel will warn the subject
that lawyer represents only the company and not the employee.
Note that these warnings arise solely from an attorney's obligations under the
lawyers' code of ethics. The warnings are not required as a matter of law nor are
they required if a non-attorney is conducting the interview. Rather, the warnings
are designed to ensure that the subject understands that the attorney does not
represent his interests. No warnings are thus required where a non-attorney
conducts the interview.
Although it may not be desirable to have counsel present with the subject, it is
helpful to have counsel available for consultation during the confrontation. The
subject frequently will pose questions or seek guarantees concerning potential
civil/criminal liability and/or severance agreement. Legal input is necessary if
such questions arise.
8.3 The Location of the Confrontation
The confrontation of the subject ordinarily occurs in a neutral setting in the facility
where the subject is employed. The investigative team should consider whether
there would be a tactical advantage in having the subject travel to company
headquarters or to an off-site location. Occasionally, it is advantageous to
confront the subject at home.
Off-site and home visits are most useful when the investigative team is seeking
to gain the subject's cooperation to further the investigation. Maintaining the
secrecy of the confrontation enables the investigation to remain secret if the
subject agrees to cooperate. An off-site location might also be chosen if there is
any concern about violence or other disruption of the workplace as a result of
confrontation of the subject.
The investigative team should also consider the psychological impact of an offsite confrontation. Confronting a subject at home, for example, can be very
effective if the team is concerned that the employee will give false information to
protect the company. A home confrontation conversely can backfire as it might
offend the subject. The team must balance the benefits and disadvantages.
8.4 Confronting the Subject
The investigative team must plan on how best to approach and question the
subject. In this regard, there really is no substitute for investigative experience.
- 21 -
A critical question is how much information should be disclosed to the subject.
Sometimes, it is most effective simply to confront the subject with the allegation
and gauge the reaction. In other instances, it is more effective to disclose some
or all of the evidence that has been adduced in the discreet phase. The hope is
to persuade the subject to capitulate and cooperate.
There is no bright line rule or easy answer. More often than not, a subject will
admit culpability (or partial culpability) if he or she believes that the investigative
team will ultimately be successful in finding evidence of guilt.
It is essential, of course, to consider how the investigation might be affected by
disclosing information to the subject. The investigative team must strike a
balance between the effort to secure a confession with compromising the
investigation.
Other critical issues are the method and type of questioning. We address these
topics in the discussion on interviewing.
8.5 Contingency Planning
Both the investigation and the business environment will change significantly
once the investigation moves from the covert to the overt phase. The
investigative team must plan prior to the confrontation of the subject with a plan
contingent upon the results.
An effective confrontation of the confrontation usually leads to some admission of
wrongdoing by the subject. The admission, however, is likely to be partial and
frequently contains additional facts and information not previously known or
suspected.
It is common for the subject to implicate others in the company or the company
itself. A subject frequently will seek to justify his or her own misconduct by
pointing to unrelated misconduct by the company.
A succession plan needs to be established since it is likely that the subject will
resign, be dismissed or suspended following the confrontation. Additionally, the
client must take precautions to change the physical and computer security to
ensure that the subject does not have access to company property or proprietary
information.
The investigative team must also plan for the post-confrontation investigation.
Confrontation of the subject frequently involves simultaneous or almost
simultaneous physical searches of the subject's work area as well as his
personal computer, e-mail and computer network.
- 22 -
Additionally, the company must plan for external communications. Depending
upon the allegations and results of the confrontation, the company needs to be
prepared to inform employees, vendors and customers. Where the allegations
are newsworthy, it is critical that the client includes its public relations network to
respond to inquiries from the media.
9.
The Overt Phase
The overt or open phase involves more traditional investigative techniques and
typically is the most extensive phase of a corporate internal investigation. It is
during this phase that the accountant and other members of the investigative
team conduct witness interviews, analyze and reconstruct data, financial records
and other documentary evidence, examine physical evidence and issue an
investigative report.
9.1 The Investigative Mentality
Corporate internal investigations rarely require highly sophisticated technical
accounting skills. Rather, the challenge for most accountants and auditors is
developing the necessary investigative mentality. The investigative mentality will
be counterintuitive to some.
Materiality, for example, means something quite different to an investigative
accountant than to a financial auditor. Financial auditors primarily are interested
only on issues that have a potential material financial impact. An investigative
accountant maintains a much more expansive view. Even the smallest detail can
be material to an internal investigation.
An accountant who joins an investigation thus must be prepared to shake his or
her traditional orientation and assume an investigative mindset. The
characteristics of an effective investigator should include:
•
skepticism, the investigator does not assume that management or
employees are honest and telling the whole truth until the facts are
gathered and the inquiries are complete;
•
imagination, sufficient to develop theories against which to compare
factual evidence as it develops;
•
communication skills, that will enable the investigator to encourage
people to be helpful and volunteer useful information;
•
determination, to persevere until the anomalies are resolved and the
fact pattern is thoroughly understood; and, most importantly,
- 23 -
•
9.2
patience, to attend to the smallest detail that less experienced people
may overlook but that can provide that vital clue or inconsistency.
Advice to Employees
The first step in the open phase frequently involves advising company employees
of the existence of the investigation. Some practitioners believe that it is better to
refrain from announcing the investigation to corporation employees generally.
They believe that the disadvantages of making an announcement are too great.
Disadvantages include:

the possibility of starting a rumor-mill,

allowing potential witnesses to talk about the issues, compare notes
and perhaps develop positions with respect to their activities, and

danger of making unfounded or untrue allegations against the subject
of the investigation, which could result in legal actions against the
company.
While it is certainly the case that these concerns have some merit, we take the
view that, in most circumstances, the results achieved from properly
communicating the existence of an open, honest, ethically undertaken internal
corporate investigation often outweigh the potential disadvantages.
One of the benefits of an internal corporate investigation is that the company is
provided with a good opportunity to reinforce their message with respect to the
culture, integrity and ethical compass of the organization. For this benefit to be
obtained, it is vital that the conduct of the investigation itself is undertaken in a
way that employees and management alike can view as fair and equitable.
The announcement itself should probably be brief, should indicate that the
investigation is being undertaken by outside expert consultants and should
indicate that the Board of Directors or a special committee of the Board will
supervise the investigation and consider findings from the investigation. The text
of the announcement should discourage employees from internal discussion,
especially if the investigation is being done by lawyers under privileged
conditions, although it is naïve to expect there to be no conversations about the
news.
It is always a good idea in this initial announcement to advise employees that no
documentation in the relevant departments or for the relevant periods should be
destroyed. It may be necessary to be more specific about exactly what
documentation should be retained. Internally, a hold should be placed on the
normal routine of record destruction activities.
- 24 -
The extent to which the announcement of the investigation is distributed will
depend heavily on the nature and scope of the investigation itself. It is often
unnecessary to advise every employee of the company. Frequently, it is
sufficient to advise members of only the relevant departments or divisions.
Finally, the initial announcement should contain encouragement for any
employee to discuss information or concerns that might be relevant to the
investigation. It is helpful for the announcement to provide the name and
telephone number of a person to contact, under confidential conditions, in such
circumstances.
9.3 Document Gathering and Examination
Documents generally fall into two categories: paper and electronic. The
investigative accountant frequently assumes a lead role in document gathering
and examination. The process must be thorough and well documented.
The investigative team should be careful to search for all relevant documents.
The investigative team must develop an understanding of how the client
maintains and stores records. Moreover, the search should include informal as
well as formal company records. In many companies, for example, employees
maintain their own personal desk files in addition to the official company file.
These need to be included in the search.
The gathering of electronic documents, including e-mails, information stored on
networks, floppy discs, back-up tapes and personal computers, requires special
attention. Evidentiary rules and best practices for the handling of electronic
evidence change constantly. Computers frequently contain smoking gun
evidence. The company needs to ensure that such evidence is obtained in a
way that will later stand up in court.
The investigative team needs to meet with appropriate information technology
personnel to ensure that all potentially relevant sources have been searched.
The team will need to know (i) the type, make and model of computer used, (ii)
the capacity of the internal hard disk and the external disk drives, (iii) the
operating system, (iv) the applications used on the computer and where they are
stored, the network system, and (v) the computer literacy of the subject(s).
Electronic document searches frequently result in the recovery of too much data.
Using selective word searches, the investigative team can filter large volumes of
records and data into manageable amounts.
There will be multiple copies of some documents. Retain copies of every
important document - - they may include important margin notes; it may become
important to know which individuals maintained a copy in his or her files; and one
must compare versions of what appears to be the same document for alterations.
- 25 -
If possible, the investigative team should personally collect or supervise the
collection of documents. Many companies leave document collection to business
operations personnel. This can be a serious mistake.
Business operations personnel rarely appreciate the need for an exhaustive
search for documents. Important documents can be inadvertently (and
sometimes intentionally) missed. The business units rarely make a precise
record of the date and location of where documents are obtained. This
casualness can create serious problems if the matter eventually ends up in court.
The investigative team should obtain originals wherever possible. It is essential,
however, that no member of the investigative team mark an original document in
any way apart from the formal identification mark that may be employed.
Accordingly, it is very useful to photocopy a set of documents to show witnesses
and for inclusion in the investigative working papers.
The investigative report should record the document collection efforts if this later
may become an issue. The investigative working papers should include
memoranda detailing the methodology and execution of the gathering of
electronic and paper document gatherings.
The examination of the records and documents naturally will vary upon the
nature of the investigation. Specific techniques are addressed elsewhere in this
and other books.
As a general matter, the investigator needs to be observant about the details
regarding the substance as well as the context and circumstances in which
documents are prepared and maintained. Additionally, the team needs to be on
the look out for alterations, white-out areas, erased margin notes, earlier drafts
and documents that should be present but are missing.
9.4 Interviews
Because of their background and training, accountants are vulnerable to focusing
too much attention to document analysis and too little on obtaining information
from people. Our experience is that the most essential information most often
comes from interviews of current and former employees, outsiders and the
subject himself.
Witness statements generally comprise the most critical evidence in internal
investigations. Documents often serve as the corroboration for witness
testimony. Interviewees can steer the investigator to the key documents and
explain the details and nuances.
Effective interviewing is a skill that requires training and experience. There are
entire courses, textbooks and programs dedicated to the subject.
- 26 -
There is no single right or wrong method for conducting an interview. What might
work for one interviewer will be wrong for another. Following are some common
characteristics of an effective interview:

Preparation - An effective interviewer has a mental or written list of the
areas to be covered. Copies of relevant documents are prepared in
advance - sometimes with key sections highlighted. It usually is
ineffective to write out precise questions or to follow a script. The
interviewer must listen and follow whatever paths the interviewee
takes.

Order of Interviews - As a practical matter, most individuals are
interviewed only once, although key individuals can be re-interviewed.
The investigative team usually chooses between working up or down
the ladder; that is, does the team interview the most senior people first
and work down the hierarchy or does the team begin with interviews of
junior staff? An early "tell me what you know" session is often effective
where multiple interviews with the principal subjects are anticipated.
Record analysis and junior interviews should follow. The closing
interview then provides the investigator with the opportunity to
compare the subject's statement and position with the statements of
other witnesses and documents. Inconsistencies can then be
challenged.

Number of Interviews - Err on being over-inclusive rather than underinclusive. It is essential to interview all individuals with potential
knowledge. Most importantly, it is often the low-level employee and/or
former employee who provide the most valuable information. Too
many investigations do not uncover critical information because the
investigative team failed to interview secretaries, clerks, etc . . .

Number of Interviewees and Interviewers - The investigative team
should interview only one person at a time. Interviewees frequently will
request to be interviewed together to assist each other in the
recollection of the events and to avoid making inconsistent statements.
As a practical matter, interviewees can assist each to jog their
memories. Nonetheless, group interviews should be avoided,
particularly where there maybe a later concern or claim that the
evidence was manufactured.
Optimally, there should be two interviewers present. One interviewer
should take the lead. Interviews conducted alone run the risk to avoid
disputes over who said what. Moreover, it is difficult simultaneously to
conduct an interview and take effective notes. Nonetheless, many
- 27 -
clients are unwilling to bear the extra cost of having more than one
interviewer.
With critical witnesses, the problem sometimes is that too many
interviewers wish to be present. More than two interviewers should be
avoided, and rarely should there be more than three interviewers.

Skill Set of Interviewers - The combination of interviewers should be
flexible and depend upon the background, age, gender, seniority and
personality of the interviewee as well as the need for continuity among
the investigative team.

80:20 Rule - An effective interview, even of the principal subject,
ordinarily is more akin to an interview than an interrogation. The
interviewee need not like the interviewer, but should at least have
respect for the professionalism and preparedness of the investigative
team.
It essential that the interviewer remember that the purpose of an
interview is to acquire knowledge, not disclose it. As a general rule,
the interviewee should be talking 80% of the time, and the interviewer
only approximately 20%.

What To Ask - Naturally, the specific areas of interview depends upon
the nature of the allegations. A couple of general points:

Determine the interviewee's basis for information. The interviewee
does not necessarily have to have personal knowledge, and it is
acceptable to obtain hearsay information. The investigative team,
however, needs to know upon what basis information is being
provided.

With respect to events (meetings, telephone calls, etc…) try to
obtain the exact date, time, location, other attendees, and subjects
discussed.

Do not expect the interviewee to have an exact recollection of
events that occurred sometime ago. It is the interviewers'
obligation to refresh the interviewee's recollection with documents
or other information.

Avoid disclosing the sources of information received from other
interviews. If possible, confirm information by reference to
documentation and then refer to the document as a support for the
fact.
- 28 -

Types of Questions - There are several types of interview questions.
While they go under different names, the general categories include:

Open - Open questions are the most effective for eliciting
information because it is difficult to answer them "yes" or "no". One
way of ensuring to ask an open question is to begin with the words,
"who", "what", "where", "when" , "why" or "how"
Illustration: What was the weather yesterday?

Closed - Closed or leading questions, in contrast, are designed to
be answered only by the words "yes" or "no".
Illustration: Was it raining yesterday?

Confirmatory - A confirmatory question validates a prior statement
or fact.
Illustration: It was raining yesterday, correct?

Challenging - A challenging statement, in contrast, disputes a
factual assertion.
Illustration: It wasn't raining yesterday - was it?

Restatement - This type of question tends to be used toward the
end of interview session and confirms or restates what the witness
had previously stated.
Illustration: One of the subjects that we discussed was the weather
yesterday. You indicated that it was raining yesterday. [Pause to
allow interviewee to respond before moving to next topic.] You also
indicated that . . . [next topic].
There are several ways of memorializing an interview just as there are several
methods for conducting them. The most common and traditional method is for
one person to make handwritten contemporaneous notes of the interview. The
interview team then follows with a formal memorandum of interview. The
original, handwritten contemporaneous notes may or may not be maintained.
The investigative team should, however, be consistent. If contemporaneous
notes are maintained for one interview, they should be maintained for all
interviews. The investigative team will be subject to attack if handwritten notes
are preserved only for selected interviews.
- 29 -
The memorandum of interview should begin with the time, location and list of
participants at the interview. The memorandum should note if certain
participants join late or leave early. The memorandum should also record any
promises, representations or assurances provided to the witness.
The memorandum should summarize the themes and subjects discussed during
the interview. It is more important for the memorandum to contain a clear
summary of the subjects discussed than it is for it to re-state each question and
response in the order that it was asked and answered.
An interview frequently will raise the same subject more than once during the
interview. For example, the interviewer may return to a subject two or three
times during the interview both for clarification and to test the consistency of the
interviewee's statement. It is clearer if the interview memorandum discusses the
subject as a whole rather than in the actual order discussed during the interview.
Handwritten notes are preferred over notes keyed into a computer. Keying notes
into a computer discourages an informal atmosphere. From the perspective of
the interviewee, it appears that a stenographic transcript is being taken.
Moreover, interviewers who key rather than write notes by hand are vulnerable to
producing poor interview memoranda. Our experience is that keyed notes
frequently result in "blow by blow" interview memoranda rather than well thought
out discussion of the subjects.
The investigative team will need to decide whether to record (voice, video,
stenography) the interview. Recording of interviews is not recommended in most
instances. Recording discourages the development of a rapport between the
interviewer and interviewee.
Recording of interviews is recommended when formality is desired or an exact
record of what was asked and answered is needed. For example, recording the
interview can be useful for foreign speaking interviewees who may later claim
that they did not understand the question being asked. Similarly, recording the
interview can be useful if the investigative team seeks to impress upon the
interview the seriousness and importance of the interview.
Absent unusual circumstances, the investigative team should obtain the consent
of the interviewee prior to recording the interview. It certain States it is illegal to
record an interview without consent.
9.5 The Investigative Report
The organization, contents and style of the investigative report will vary from
case to case. Some clients and companies will desire no written report.
- 30 -
Some internal investigations require no more than a short letter or discussion
outline. More significant investigations often require lengthy reports including
volumes of working papers.

Discuss In Advance - Discussions concerning the content and form of the
investigative report should be discussed very early in the engagement.
Whether a report will be required will affect how the investigation is
conducted as well as the budget.

Assume That A Report Will Be Required - It is good practice to assume that
a report will be required. Companies and clients frequently request a report
even when their initial instruction is that no report will be needed.
Additionally, anticipating a report provides a good structure for organizing
the investigation and ensuring that all necessary investigative steps have
been completed and properly documented.

Begin Immediately - Many investigators make the mistake of postponing the
preparation of the report until the investigation has concluded. They believe
that the report cannot be written until all the facts have been determined.
Report writing is very time consuming and can take as long as the
investigation itself. The investigative team rarely will have the time to delay
writing the report until all the facts have been gathered. The preparation of
the report gives structure to the investigation. Experience shows that the
investigations proceed more efficiently and effectively if the investigative
report is written concurrently with the investigation. The report, moreover,
will be more thorough.

Elements of the Report - Following are various features that the accountant
should include in the preparation of the report:

Predication for Investigation - Predication refers to the basis upon which
an investigation has been initiated. There is no legal requirement that
there be a basis to commence an investigation. Nonetheless, it is useful
to document the predication if a concern exists that a party will later
allege that the company acted maliciously.

Assignment and Disclaimers- It is common for an investigative report to
begin with a summary of the scope of the assignment. The investigative
team should also consider whether any disclaimers are appropriate.
Public auditing firms, for example, frequently include the disclaimer that
investigation does not constitute an audit conducted in accordance with
generally accepted auditing standards, an examination of internal
controls, or other attestation or review services in accordance with
standards established by the AICPA. The investigative team should also
- 31 -
consider including disclaimers regarding the confidentiality of the report
and the appropriate use that can be made by third parties.

Executive Summary - An executive summary of the findings and
recommendations often is a very useful, and, in a lengthy report, essential
element of the report.

List of Acronyms and Abbreviations - It is very useful to have a single list
of acronyms and abbreviations at the front or back of the report as an
easy reference guide for the reader.

Chronology - A detailed chronology of the key events ordinarily should be
included either in the body or appendix of the report.

Methodology - A detailed summary of the investigative methodology
ordinarily should be included either in the body or appendix of the report.

Visual Link Analysis - Visual link analysis depicts connections between
and among people, entities, bank accounts, etc… A visual link analysis is
very useful in cases involving numerous parties or in funds tracing
engagements. Virtually any computer graphics presentation software can
be used.

Statement of Facts - The statement of facts can be separate from or a
part of the discussion section. It is useful, however, to have a separate
section for the statement of facts in a complex report.
The statement of facts is a neutral narrative of the key events uncovered
by the investigation. The investigative report should include exhibits to
support assertions in the statement of fact. For example, if an assertion
in the statement of facts is supported by a document, the investigative
report should include as an exhibit a copy of the relevant portion of the
document. Similarly, the investigative report should include interview
memoranda as exhibits where reliance is made upon the statements of
interviewees. Alternatively, the reader should be referred to the working
papers containing this information.

Discussion - The discussion section usually is organized around the
findings or themes. Unlike the statement of facts, the discussion section
need not be neutral. Rather, this section can be more akin to a closing
statement in a trial and explain why the investigative team has reached its
findings and conclusions.

Recommendation - The report should include the investigative team's
recommendation for additional investigation and remedial changes.
- 32 -
10.
The Remedial Phase
The remedial phase occurs either contemporaneous to or at the conclusion of the
fact investigation. The accountant participates to one degree or another in:










Quantifying damages
Negotiating subject's resignation of employment or disciplinary action
Negotiating financial recovery from the subject and other parties
Negotiating financial recovery with third party victims
Advising on business implications of investigative results
Lobbying prosecutors and other law enforcement authorities to file
criminal charges against the subject
Providing litigation support to counsel in criminal, civil and regulatory
proceedings
Conducting fraud audits of other business units for vulnerability to
similar misconduct
Developing controls to deter recurrence
Monitoring of future business activities
Many of these subjects are discussed elsewhere in the text.
11.
Conclusion
Internal corporate internal investigation are rewarding and exciting. Accountants
serve and will continue to serve major roles in these investigations. But they are
not for the faint hearted or amateur sleuth. The accountant joins a
multidisciplinary team upon which the client is relying to solve what is often the
greatest crisis that a business must overcome.
.
*
Jonny J. Frank and Michael Carey conduct corporate investigations at PricewaterhouseCoopers
LLP. Mr. Frank served as the Executive Assistant United States Attorney in the Eastern District
of New York and is a member of the law faculties of Brooklyn Law School and Fordham
University School of Law, where Mr. Frank co-founded the Fordham University Law School
International Criminal Law Center. Michael Carey was an audit partner at Ernst & Young and
Assistant Director of the Serious Fraud Office of the United Kingdom.
- 33 -
1
See generally, W. Schmidt and J. Frank, Uh-oh, Now What: Responding to Allegations of
Corporate Misconduct, Directorship, April 1997.
Common external fraud schemes include: (i)kickbacks and Illegal payments, (ii) bid rigging, (iii)
defective pricing, (iv) fictitious, false and inflated invoices, (v) product substitution, (vi)
mischarging. Common internal fraud schemes include (i) conflicts of interest, kickbacks and
illegal payments, (iii) phantom vendors and purchases for personal use, and (iv) unjustified sole
source awards.
Common sales and marketing schemes include (i)travel expense fraud, (ii) kickbacks and other
illegal payments, (iii) foreign corrupt practices act violations, and (iv) conflicts of interest schemes.
4 Common finance and accounting schemes include (i) misappropriation of cash, (ii) payroll fraud,
(iii) accounts receivable schemes, (iv) accounts payable schemes, (v) revenue recognition
schemes, and (vi) improper treatment of costs and expenses.
5 Common fraud schemes affecting operations include (i) management fraud, (ii) misappropriation
of inventory, (iii) misappropriation of intellectual property, (iv) external thefts and frauds and (v)
procurement fraud.
6
18 U.S.C. §2511(1)(a)
18 U.S.C. §2510(5)(a)
8 United States v. Murdock, 63 F.3d 1391 (6th Cir. 1995), cert. denied 116 S.Ct. 1672
(1996)
9 18 U.S.C. §2511(2)(d)
10 See, e.g., Cal.Pen.Code §§631, 632
11 O’Bryan v. KTIV Television, 868 F. Supp. 1146 (N.D. Iowa 1994), rev’d in part 64 F.3d 1188
(8th Cir. 1995).
12 Smyth v. Pillsbury Co., 914 F. Supp. 97 (E.D. Pa. 1996)(“We find no privacy interests in [e-mail]
communications”); see also, United States v. Simons, 29 F. Supp 2d 324 (E.D. Va. 1998)(Court
found that CIA employee had no reasonable expectation of privacy in Internet use nor in files
downloaded to his computer hard drive.)
13 See e.g. O’Connor v. Ortega, 480 U.S. 709 (1987)(doctor evidenced privacy interest in office
desk and file cabinets by clearly barring others from these areas)
14 29 USC §§2001-2009
15 29 U.S.C. §2006(d)(1) - (d)(4)
16 29 U.S.C. §2007(a)
17 See, e.g. N.J.S.A. 2C;40A-1
18 29 U.S.C. §2005
19 NLRB v. Weingarten, Inc., 420 U.S. 251 (1975)
20 See e.g., Cal.Lab.Code § 2856 (West 1989)
21 The Securities and Exchange Act of 1934 requires the disclosure of “material” facts in certain
filings and reports. Counsel should be consulted to determine whether facts discovered during
the investigation are material within the meaning of the statute. States and stock exchanges may
also impose similar disclosure requirements.
22 United States v. Baez, 732 F.2d 780 (10th Cir. 1984)
23 18 U.S.C. §4; United States v. Hodges, 566 F.2d 674 (9th Cir. 1977)
24 Id.
25 United States Sentencing Guidelines Manual 8C2.5(g)
26 Nexis, the news database of Lexis-Nexis, provides a massive collection of news sources, with
extensive archives of national newspapers and business and industry news sources. Nexis has
the largest archive of the New York Times, and a growing number of local newspapers. It also
offers access to the Bloomberg Newswire, a highly respected and fast growing provider of
business news. Its strong content, combined with software that make both searching and
reviewing documents quick and simple, makes this a good first source in any investigation.
7
27
In terms of news content, Dialog rivals Nexis in scope. It has various full-text local newspapers
not available on Nexis (for example, the Philadelphia Inquirer and the Detroit Free Press) and an
extensive collection of industry-specific newsletters (IAC Newsletter database, file 636), unique to
- 34 -
Dialog. In addition, Dialog, in conjunction with Dow Jones and Financial Times Information,
recently added a vast collection of international news sources (World Reporter Database, file 20).
28
International news sources, primarily from Europe, represent Datastar’s greatest strength.
Although recently merged with Dialog, many of these European news sources have not yet been
included in the Dialog database. These include unique newspapers, newswires and business
magazines from Switzerland, Germany, Italy and the Baltic States, among others. Datastar’s
search language can be a challenge to use, and requires much practice to master.
29
Dow Jones is the only database, which provides full-text access to the Wall Street Journal, the
Dow Jones Newswire and Barrons, essential sources for any business investigation. It also
boasts an extensive collection of local newspapers, industry publications, and international news
sources.
30
Lexis-Nexis provides bankruptcy filings, state and federal civil lawsuits, tax liens, judgments,
UCC filings, corporate records, and property records in most jurisdictions. Lexis-Nexis’ greatest
strength in searching public records is its “full text” search feature. For example, if you have a
post office box number used by a subject, the number could be searched in Secretary of State
records to identify other companies or Dab's associated with the subject that may not turn up
through a search of the subject’s name. This type of search cannot be conducted through other
database service providers, which limit searches to specific information fields within the database
record, such as the name of the company.
The Lexis database also contains reported legal decisions at the federal and state levels. Even
though most often used by law firms for general legal research, a search in Lexis can also be
used to find court cases relevant to an investigation. These opinions often have extensive factual
information that may not have been reported in the media.
Another feature of the Lexis-Nexis public records library is the "Finder" file, which can be used to
locate/identify individuals from over 300 million credit header and telephone records nationwide.
Other noteworthy files include the military locator file which allows one to investigate an
individual's reported military service; driver license information for 24 states; and the Social
Security Death Master File, which can quickly tell you whether your subject is using a social
security number that has already been retired.
Disciplinary actions and sanctions from various federal and state agencies including the NASD,
the SEC, HUD, state real estate regulators and other agencies are covered in the Sanctions file in
Lexis-Nexis. Additionally, the FEDSEC library in Lexis-Nexis contains civil lawsuits and
administrative proceedings initiated by the SEC.
Real property ownership and sale records can be reviewed in a global search that covers the
District of Columbia and the majority of counties in every state except Maine. These records,
which can be searched by name or address, are often very useful when quickly attempting to
identify assets in relation to a bankruptcy or other fraudulent transfers.
31
This database provides bankruptcy filings, civil lawsuits, limited criminal case information, liens,
judgments, property records, UCC filings, professional licenses, corporate records, voter
registration information and aircraft and vessel ownership records. CDB Infotek includes records
from most states in the country, and is particularly strong in California, with its inclusion of
criminal cases and municipal court civil cases. The database also has unique regional public
record search features, which allow the user to search all available records in specific groups of
states. CDB Infotek also has a feature that allows you to locate individuals nationwide; and it
has the ability to trace social security numbers.
- 35 -
32
This service provides the most extensive coverage of state-level civil lawsuits, covering
selected counties in all 50 states, the District of Columbia, Puerto Rico and the US Virgin Islands.
The vendor also provides county level records, liens, corporate records, bankruptcy filings, UCC
filings, liens, judgments and real property, some of which are not available through any other
online sources. It also provides very powerful global search features, which allow the researcher
to cover virtually all the public records on the database, nationwide.
33
AutoTrack is one of the best online resources for locating individuals anywhere in the U.S. The
national report feature provides the social security number, and month and year of birth for the
subject. It also lists all of the business and residential addresses associated to the subject within
the last 8-10 years. The report will also include a list of all individuals associated with the
addresses listed for the subject, as well as telephone numbers. AutoTrack is particularly strong in
Florida and the Eastern region of the U.S.
This online service provides critical identifying information on a subject, which then allows the
investigator to focus subsequent searches in the appropriate jurisdictions. For example, if the
subject is known to reside in New York, but AutoTrack also lists addresses in Colorado and
Florida, the investigator will know to look for property, litigation, criminal records, businesses, and
other public records in those additional jurisdictions.
For both individuals and businesses AutoTrack can quickly identify property ownership
information, boat and aircraft registration, DEA controlled substance licenses, firearms and
explosives licenses, professional licensing information, motor vehicle records, business
affiliations, bankruptcies, liens, judgments, driving records, phone listings, secretary of state
filings, and other useful records. AutoTrack, as well as CDB Infotek, maintains a service
whereby they will manually retrieve relevant public records if the information is not readily
available online. The information is then reported back to the user online, typically within a day or
two.
34
Pacer provides access to the U.S. District (criminal and civil) and Bankruptcy courts in 49
states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Unlike federal court
records that might be found in other databases, which are limited to case citations, PACER
usually provides a complete docket sheet. While PACER recently introduced a nationwide search
capability, the search is limited to identifying the court where a case is located. Each court must
then be dialed into separately to retrieve relevant court docket sheets. The ability to search the
majority of federal court indices across the country in a just a few minutes is an extremely
powerful search tool. Remember, however, that each court has a different archiving policy so
careful attention should be paid to coverage dates in each district.
35
This service also provides access to U.S. District Court and Bankruptcy cases and, like
PACER, provides full docket sheets. Courtlink’s advantage lies in its proprietary software, which
allows the researcher to more easily navigate the PACER system. For example, Courtlink allows
the user to search combinations of disparate courts simultaneously, a feature not available on
PACER. In addition to federal court records, Courtlink provides the most comprehensive access
to criminal cases and civil lawsuits in Washington and Oregon, dating back in some instances to
the 1970s, as well as limited coverage of civil suits in Texas.
36
This system provides the most comprehensive source of civil litigation, judgments, tax liens,
and foreclosures for the Mid-Atlantic region, including New York, New Jersey, Pennsylvania,
Maryland, Washington, D.C. and Delaware. Because the database gathers its information from
primary sources, it has a high degree of reliability. Superior also offers a very powerful search
engine, which returns names that are similar to the user’s search terms that may be relevant.
- 36 -
The search engine also picks up name synonyms when searching individual names (for example
Tom/Thomas; Maggie/Meg). Further, the database includes bankruptcies, UCC filings and
corporate records.
37
The SEC's website (www.sec.gov) provides instant access to quarterly, annual, and other
reports filed by public companies, as well as the adjudication of any disciplinary matters relating
to individuals or public entities. The NASD website (www.nasdr.com) allows one to research the
licensing status of any individual or firm broker/dealer, including any potential disciplinary history.
The Better Business Bureau website (www.bbb.org) provides access to business and consumer
alerts. The Federal Trade Commission website (www.ftc.com) maintains a compilation of news
briefs and warnings relating to illegal business practices. Perusing these sites can make the
investigator's job much easier as it eliminates having to spend hours on the phone with
governmental regulatory agencies.
38
For example, Information America, one of the pioneers in providing public records data, has a
website (www.knowx.com) that allows Internet users without a commercial account to search
these records and bill the costs to a credit card. The Web product, however, does not offer certain
powerful search capabilities available on the proprietary dial-in system, such as a global search
across all available public records.
39
The information available includes the names of officers and directors, the date and place of
incorporation, type of business, annual sales, and in some cases, limited public records
information such as bankruptcies, judgments, liens and UCC filings. There is often biographical
information on the officers and directors. Ownership information may also be provided. One
important item worth noting, however, is that the basic company information and biographical
information is self reported by the company and is not necessarily verified through independent
investigation.
40
Finding a witness or a former employee of an adversary in litigation can be critical. Databases
such as Autotrak, CDB Infotek, Lexis-Nexis and Metronet are powerful in this area, primarily
because of their inclusion of information provided by the credit bureaus, which is not restricted by
the federal Fair Credit Reporting Act. Autotrak and CDB Infotek provide access to personal
information such as address histories, telephone listings, neighbor listings, social security
numbers and dates of birth. Even though access to this information is limited to “qualified”
customers, this includes investigators and attorneys. Metronet provides a comprehensive
collection of telephone listings, addresses and neighbor information in the United States. A
researcher again may be tempted to use the various people locator databases available on the
Internet. In our experience, however, these fall considerably short when compared to the
commercial offerings.
- 37 -