Forensic Audit
Case studies
ICAI Vadodara 2013
Chetan Dalal
Thank you to Vadodara Branch and
members of ICAI
From Chetan Dalal

All case studies / exhibits / example are
adaptations of real life situations, and any
resemblance or use of any name, logo or
symbol of any entity is purely for academic
purposes and to facilitate better understanding.
Case studies discussed in the seminar are
imaginery and at no point is there any direct or
indirect implication of fraud in or by any entity
referred to anywhere.
1.
2.
3.
4.
5.
Forensic Audit: introduction and traits of a
forensic accountant and forensic accounting
and examples of some unusual frauds in
business world
Fraud and manipulations in excel reports
Simple forensic tests which can be
conveniently used to detect fraud
Red flags and early warning bells of possible
fraud
Unusual methods of investigating
1. FORENSIC AUDIT: WHAT IT MEANS
AND WHAT ARE THE TRAITS OF A
GOOD FORENSIC ACCOUNTANT OR
AUDITOR?
Forensic Audit-
Technical definition-Wikipedia, the free encyclopedia
Forensic accounting is the specialty practice area of
accountancy that describes engagements that result
from actual or anticipated disputes or litigation.
"Forensic" means "suitable for use in a court of law",
and it is to that standard and potential outcome that
forensic accountants generally have to work.
Forensic accountants, also referred to as forensic
auditors or investigative auditors, often have to give
expert evidence at the eventual trial.
-Accounting
-Auditing
-Investigating


-
Forensic audit is issue based or related to a specific problem
It has several components and could include any or all of the
following:
Financial and accounting review
Digital forensic analysis
Field investigations
Data mining at an advanced level
Application of Interviewing skills
Technical assistance such as handwriting, specimen
signatires, QC evaluation etc
Audit relies on documentary evidence, whereas a forensic audit
actually examines the reliability of documentary evidence
itself
Forensic accounting emphasizes the need to look for other
evidence available as well.



Distrust the Obvious
Think differently and Develop an open
mind
Look from different angles and all sides.
You will get a different revelation
1.
2.
3.
4.
Fraudsters/ deceivers are Intelligent
Technology
Stale procedures syndrome
Lack of perseverance


Use of desktop internet investigation (useful
in audit too)
Use of the theory of impossibility and
absurdity to detect fraud.
If an investigator habitually applies these his
success rate will increase phenomenally.


This is a technique you must use to conduct
verifications, research and information
regarding vendors, products, third parties,
and almost anything you are auditing or
investigating
Do this as frequently as possible to spot
forgeries or establish the authenticity of third
parties, entities, documents such as invoices,
letters, agreements, wills, old records, title
deeds, letters of guarantee, LCs, and on rare
occasions forgeries in passports, treasury
bonds, fixed deposit receipts from banks etc



When you identify what is not possible or very
unlikely, the fallacy or deceit in given
submissions will be exposed.
Also, in investigations evidence is often
destroyed or changed or altered or hidden.
To find the supporting evidence is therefore
practically difficult.
Make it a habit to think of what is not
possible or impossible or unreasonable
2. MANIPULATIONS AND FRAUD
IN SPREADSHEETS
Example using Excel Sheets




Consider a spreadsheet containing some
data of two years’ comparisons
The CEO wanted to show a good
performance….Excel-Book1_cd.xlsx
Excel Forensic.xls
Star-Contest-Result.xlsx
3. SOME SIMPLE FORENSIC TESTS
- Juxtaposition test for testing authenticity of documents
format and content
- Test of reasonableness or absurdity
- Test of replication of content
- Test of impossibility
- Scrutiny of suspicious documents particularly those
having alterations
For example: Can be applied on volume of
stocks in a warehouse or production with
actual machine capacity
Forensic study of alterations – try and discern
consistency of cancellations, smudges,
spaces and overwritings

In simple words it means placing side by side
for comparison and spotting differences,
where there should be none. This can be very
effective in spotting manipulations






Document comparisons: Contracts agreements –
copies lying with different departments
Vendor letterheads, bills and letter formats- all
bidders’s documents and search for common
addresses, telephone numbers, fax numbers, fax/tel
numbers, email addresses?
HR frauds- Juxtapose degree certificates, signatures
on certificates, multiple reference letters, etc
Fictitious Expense or purchase bills. Juxtapose bills
from large volume vendors
Documents lying in multiple departments- eg copies
of minutes of meetings or letters or memoes issued
to different departments
Signatures on important documents –
Think of events which may be
possible but not probable. Can a
person arrive and depart at exactly
the same time every day ? If
smart/swipe card analysis shows
such a pattern it is likely to be a
phantom employee
4. EARLY WARNING BELLS AND RED FLAGS





Close nexus with suppliers, customers and third parties
Missing records, details, etc
Discrepancies in inventories, cash, and assets
Behavioural indicators- chronic late sitting, arrogance and known
bad habits like gambling, alcoholic traits etc
Too much of power and authority in one or few individuals
 Mismatch between standard of living and known sources of income

Arrears and sloppiness in bookkeeping, reconciliations etc






Cash Contras
Stock in transit
Accounting favours to debtors
Non reversal of stale cheques to create secret
reserves
Not redepositing unpaid cash expenses such
as wages, reimbursements etc
Recycling of petty cash advances or IOUs
Bombay Br
Purchases
Delhi Br
2076689
Kolkatta
1427286
Staff Recruitment & Training
Chennai
BOM-ser
Lucknow
Pune
1041919
1972854
1017578
1723652
1993621
576109
501215
365887
547304
282293.4
Travelling Exp - Foreign
493068
428969
313147
468415
241603.3
409246
473345
Repairs & Maint
437968
381032
278153
875936
214604.3
363513
420449
Printing & Stationery
379100
329817
240766
360145
185759
314653
363936
Travelling Exps
301765
262536
191651
286677
147864.9
250465
289694
Tel / Mobile / Internet
116954
101750
74277.5
111106
57307.46
97071.8
112276
Electricity Charges
120000
104400
76212
114000
58800
99600
115200
Communication - FBT
106953
93049.1
67925.9
101605
52406.97
88771
102675
Discounts given
105873
92109.5
67239.9
100579
109023
87874.6
101638
Discounts on sales
206902
180005
131403
196557
101382
171729
198626
249529
217090
158476
237053
122269.2
91072.7
250000
136229
70265.51
119021
137663
Vehicle Running & Main - R
Subscription Charges
Funds transferred- Kolkatta
143399
Funds transferred- Pune
Funds transferred- Chennai
124757
125000
1437477
Stock in transit to Kolkatta
500000
Security Charges
139543
121402
88623.8
132566
68376.07
115821
133961
stocks in transit
209488
182255
133046
199014
102649.1
173875
201108
800000
696000
508080
760000
392000
Postage / Telegram
273491
237937
173694
259816
134010.6
226998
262551
Membership Fees
174086
151455
110562
165382
85302.14
144491
167123
Insurance Prem - FBT
187524
163146
119096
178148
91886.76
155645
180023
214218
186369
136050
203507
104966.6
Housekeeping Services
159191
138496
101102
151231
78003.59
132129
152823
Facility Management
175044
152288
111170
166292
85771.5
145286
168042
Conference/Seminar Fees
499233
434333
317063
474271
244624.2
414363
479264
1427286
1241739
906469
1355922
699370.2
1184647
1370195
901195
784040
572349
856135
441585.6
747992
865147
Stock in transit to Bom_ser
Insurance Prem - Clinical Trials
Computer Maint
AMC
Others
HO account
Funds transferred from Bom
250000
Funds transferredfrom Delhi
Funds transferred from chennai
Funds transferred from Pune
125000
1437477
Stocks in transit from Bom
Stocks in transit from Bom
2
50000
Funds transferred- Delhi
Sales
5
800000
500000
7
2
5. UNUSUAL METHODS OF
INVESTIGATING
Components of a Typical Fraud
Investigation Plan
Defining the objective & Crystallization of the terms of reference
Evidence Collected Directly:
Documentary Tests & Interviews
Evidence Collected Indirectly:
Field Audit & Physical Checks
(Optional)
Digital Analysis of Relationships & Trends
Sting Operations / Decoy Traps / Investigators' Bluff
(Optional)
Confrontation Interviews
(with legal clearance)
Evaluation of Evidence
Reporting
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
Secret reserve search
Mirror image evaluation approach to find inconsistent results
Relative Size Factor in stocks, debtors, creditors to detect error or
manipulation
Illogical events- loans taken when huge liquid assets are available
such as fixed deposits
Impossibility of certain results based on events known
Duplicate Numbers- could stem from error or fraud
Cash /stock shortages indicated by illogical
withdrawing/purchasing
Negative asset / expense balances could be errors or fraud
Ghost workers search
Use Test Packs to check software bugs where audit train is invisible
Benford’s theorem test results
Spreadsheet forensics and Ratio Analysis for trends
Physical verifications of assets, processes, and walk through tests,
including tiger team tests
The excel UFSRD method
U- unhide
F- font coloration
S-Show Formula
R- rectify and replace
D-duplication
check..\collections\financialsA.xls

BOTH SPACE AND TIME OFFER TESTING
YARDSTICKS FOR AUDIT PURPOSES.
 e.g. How much quantity can be stored in a
warehouse, container, truck, box can be very useful
for corroborative tests of inventory, sales, purchases.
 Time can be used in several ways, time of
transaction, time taken for the transaction, time
difference between two events etc.
Case Study
A robbery took place in a mall in January
2006
 Thieves broke in through
the door
 They stole case worth
more than Rs. 40 lacs
 Police complaint lodged
 Police made inquiries with
staff, neighbourhood
Findings of the Police
 They concluded that this was the work of a local gang
of thieves operating in the area and this mall was the
latest victim
 They suspected that some employee may have helped
but could not get specific clues against anyone
 They recommended better locks and greater security.
Case virtually closed
Management appointed auditors who
were specialised investigators more
for
studying
controls
and
recommending preventive measures
Auditors spot red flags
The time element indicated that the thieves had only 20
minutes to complete the robbery while the patrolling
guards were circling the mall.
 How could they throw about all contents of all drawers?
 Where did they have time to steal a few cell phone handsets
which were on a different floor?
 The alarm had been switch off. Therefore it was certain that
someone had helped them
 The door that was broken was done with crude tools- not
the work of a professional gang
 Out of two safes only one was broken into and robbed. The
second was left untouched?
Findings good but inadequate to
point out any means of recovery
Auditors try a new approach
 The use the space time dimension approach

IDEA_DATA.xls
 Amazing findings- Late night sales
The log in id was traced – the store manager.
On being questioned he confessed
 There was no robbery- it was a stage managed robbery to
cover up stock shortages
 The shortages were built up over a period of time. The
store manager panicked when he was told that a stock
taking was to take place
 He converted the stock shortages into ‘artificial’ sales by
entering sales at midnight along with his accomplice the
head cashier during the previous two nights. This
resulted into stock shortages being converted into cash
shortages.
 This shortage was then palmed off as robbery by breaking
open the door and throwing papers and documents in the
cash room to make it look like a robbery
Use of mathematical tools
39
Relative Size Factor
(RSF)
Relevance
40
 Scrutiny
of individual parties
account is humanly ineffective.
 It
highlights
all
unusual
fluctuations
which
may
be
stemming from frauds or errors
What is RSF ?
41
 RSF is the ratio of Largest Number to the Second
Largest Number of a relevant set.
RSF =
Largest Number
Second Largest Number
42
43
RSF- Relative Size Factor
RSF= highest value divided by the second highest
value in a ledger account of debtors, or creditors
Even a comparison of prices, quantities or values in
an inventory
If the RSF > 10, chances of error or fraud are great
How does RSF Work ?
45
 Any set of transactions take place in certain range. E.g. A
vendor XYZ may have normal pattern of bill value range of
Rs. 13k to 50k.
 If there is any stray instance of single transaction which is
way beyond the normal range than that ought to be looked
into. E.g. in above case, if there is bill of Rs. 5 lacs.
 RSF is above case will give a ratio of 10 (I.e. ratio of Rs. 5lac
to Rs. 0.50 lacs)
 These single instances could be cases where there is some
foul play.
Types of frauds
that RSF can unearth
 Data entry mistakes
 Alterations in decimals
 Wrong coding with masters (vendors, customers,
employees, etc.)
 Revenue items charged to capital accounts and vice
versa
 Excess payments in payroll
Luhn’s algorithm
For verifying correctness of credit cards and
other cards which have been generated using
the check sum digit
Tests used to assess the robustness
of a system by actually carrying out
penetration tests or walk through
tests of processes as in ethical
hacking for IT process testing


Surprise tests lose their sting when an auditee
can predict an auditor’s plan
Timing is very effective: one way to throw a
suspected auditee completely off guard is to
repeat a test in quick succession.
Complacency, cover-ups and even frauds are
likely to be exposed in the repeat test.


-
Tests of processes, operations and controls
across similar units
Anomalies should be explained, else
something is amiss:
Case of discounts in chocolate shops
Case of repairs to moulds in two identical
processing units
www.chetandalal.com
cd1@chetandalal.com