Business Financial
Crime: Introduction to
Forensic Accounting
Definition

The word forensic means used in or
pertaining to law

Accounting is the recording, classifying
and summarising economic events in a
logical manner for the purpose of providing
financial information for decision making
2
Definition

Forensic accounting is the application of investigative
and analytical skills for the purpose of resolving financial
issues in a manner that meets standards required by
courts of law.
Hopwood, Leiner and Young (2007)

Forensic accounting is the application of accounting
principles, theories and disciplines to facts or hypotheses
at issue in a legal dispute…
Technical Working Group for Education in Fraud and
Forensic Accounting USA (2007)
3
Broad Base
Forensic accounting is broader than fraud
examination.
 It also includes services that could involve
investigation related to the purchase of
businesses, valuation of divorce assets,
determination of damages and calculation
of lost profits

4
Forensic Accountant Role
A mix of accountant and private
investigator
 With a strong financial intuition and an
ability to think laterally
 Strong knowledge of professional
accounting standards

5
Knowledge and skills
Auditing skills – information collection and
verification nature of role. Produce
evidence.
 Investigative knowledge and skills, such
as surveillance tactics and interviewing
and interrogation skills.
 Criminology particularly the study of the
psychology of criminals ie. Motives and
rationalisation

6
Knowledge and skills





Accounting knowledge helps the forensic
accountant analyse and interpret the financial
information necessary to build a case.
Knowledge of internal controls related to
corporate governance.
Legal knowledge and understanding of court
procedures to be able to identify type and quality
of evidence necessary to meet legal standards
A good appreciation of IT skills.
Communication skills to convey the results.
7
Audit vs. Forensic engagement
Audit:
 Event transpires PRIOR
to issue of FS
 No assumption that
fraud has taken place.
 Purpose is to assist the
reader in reaching a
financial decision.
Forensic:
 Event transpires
FOLLOWING issue
 Assumption that fraud
has taken place
 Purpose is to assist the
reader in reaching a
legal decision.
Auditing Procedures







Confirmation – external source
Observation – examine activities
Physical examination – examine assets
Re-performance – perform a task to test how
well completed
Analytical procedures
Inquiry of client – reasonableness of answers
Documentation – examine source documents
9
Forensic Engagement - Investigation Plan
An investigation plan should be drawn up. This is to ensure
you have a structure to your investigation. The plan
could include the following:
 what are the facts to date;
 what is the best strategy to investigate this matter;
 what is the contravention/internal concern;
 who are the targets;
 who are the witnesses;
 what documents should be obtained;
 who should be interviewed;
 who will be of assistance;
 who will not be of assistance;
 where to keep documents/control procedures;
 relevant bank accounts;
Forensic Engagement - Investigation Plan









paper trail;
phone records;
computer records;
need for outside expertise – forensic
accountant/computer analysis;
can documents be destroyed;
how to secure documents;
need for surveillance;
need to tape interviews; and
what questions need to be asked.
Understanding the environment:



Identify the personnel and
their roles;
Develop a general
understanding of the business
and a specific understanding
of the accounting cycle;
Access industry expertise:
competitors or regulatory
agencies
FLOW CHART



Summary of
transactions
Source and destination
of funds
Conversion of assets
NET WORTH

Basic Balance Sheet
composition: Assets,
Liabilities against
known income
30

Acquisition of assets
requires explanation
through liabilities or
legitimate income
source;
25
20
Assets
Liabilities
known income
U/K income
15
10

Unexplained income
is assumed to be
proceeds of crime
5
0
Year 1
Year 2
TIME LINE


Organizes data in chronological fashion for better
understanding of how events unfolded
Provides corroboration between financial and nonfinancial evidence.
Techniques in Financial
Statement Fraud Cases

Analytical procedures
 Horizontal
analysis
 Vertical analysis
16
Analytics Inc.
17
Analytics Inc.
GP Margin increase 87.5% - valid pricing
or fictitious sales
 Other expenses increase 63.64% - check

18
Skimming
The act of taking cash receipts before
being deposited or reflected in the
financial records.
 Difficult to detect by horizontal analysis if
has been a long term practise
 Could be revealed by vertical analysis if
compare margins across the industry

19
Benford Analysis
Another technique for analysis based on
Benford’s law
 Based on the statistical probability that the
sequence of numbers 1,2,3,4,5,6,7,8,9 will
appear as the first digit in a number.
 The number 1 is more likely than the
number 2 and so on.
 Benford analysis can be used to test a
sample of invoices for risk of fraud.

20
Benford Analysis

Applies to such data as invoice numbers
as well as monetary figures
21
Symptoms of Fraud
Record related symptoms – unusual
source documents or relationship among
financial data
 Person related symptoms – based on
human behaviour

22
Indicators of Fraud in Documents
23
Document investigation:




Consider the following:
The “source” of the document (who
created it);
The “context” of the document (what
is the purpose of the document);
The “reliability” of the document (can
the information be corroborated
elsewhere).
Secure records
Symptoms of Fraud
Record related:
 Unusual relationships among financial
data include unreasonable amounts of
revenue or expenses
 Unexpected levels of inventory on the
balance sheet
 Large purchases that seem unreasonable
given normal levels and frequent late
charges
25
Symptoms of Fraud
Person related
 Changes in behaviour can signal
underlying problems – weight loss,
dependency of drugs or alcohol, fidgeting,
aggressiveness to the point of arguing,
inability to look others in the eyes.
 Key whether this behaviour differs from
actions in the past
26
Symptoms of Fraud
Person related
 Levels of spending that exceed apparent
level of income
These symptoms could indicate that fraud
could have occurred
Forensic accountant will ascertain the
reasons for the behaviour to determine
outcome

27
Sources of Evidence

Public records eg
 Land
registry
 Court records
 Business names
 Credit status
 Voter registrations
 Business licences
 Bankruptcy and divorce filings
28
Sources of Evidence

Restricted sources
 DVLA
 Local
authority council tax records
 Vehicle dealers records
 Credit card records
 HM Customs and Revenue
 Banks records
29
Link Analysis
Process that allows information in a variety
of databases to be evaluated and
integrated to test for associations
 Produces an association matrix

30
Invigilation





Used for testing existence of skimming or theft.
The presence and purpose of the forensic
accounting is announced to employees.
After some time an announcement is made that
the investigation has ended
Forensic accountant then compares the data
from the three periods – pre, during and post
adjusting for any seasonal impact.
Assessment of theft can then be made.
31
Surveillance

Covert activity
 Stationary
– following
 Electronic
 Rubbish can be scrutinised if not within
curtilage of property.
 Active
32
Statement types and
analysis:

Free form: Allows the witness to recount events
without interruption. Suspect/witness will often
“avoid” detail surrounding sensitive topics.

Q & A: Question and Answer format which allows
investigator to direct course of the interview. Greater
detail will be obtained but interviewer may miss what
is motivating the suspect/witness to talk.
Interview and Interrogation
Interview is usually non-confrontational
information seeking technique of a person
who is not believed to have committed a
crime
 Interrogation is an information seeking
technique involving people in custody.
More likely to be confrontational

34
Interview and Interrogation


Interviewing skills are of paramount importance to the
forensic accountant.
Prepare and build profiles of individuals









Position in firm
Job functions
Length of service
Salary and benefits
Any promotions expected not received
Relationships with co-workers
Age and marital status
Interest and hobbies
Credit status including recent purchases of cars etc
35
Interview and Interrogation





Assess fraud triangle perspective ie suspect’s
pressures, opportunities and rationalisation.
Formulate a strategy for the interview
Maintain active scepticism
During initial interview subject should be asked –
if he knows the purpose of the interview – who
he believes committed the fraud and why .
Interviewer should endeavour to establish a
rapport with the subject.
36
Interview and Interrogation

Subject responses
 People
who are not trying to hide anything usually
provide direct answers to questions without hesitation
 They do not seem distracted and may even appear
interested in helping


Exceptions to this do occur – eg if the subject
knows that the fraud is being carried out by their
supervisor – may even give deceptive answers
Might attempt to treat the crime as unimportant
37
Interview and Interrogation


May be an attempt to reduce severity of
punishment
A subject’s verbal attack on the interviewer may
be caused by fear
fight or flight response – when cornered
 Interviewer should respond calmly re-establishing
rapport
 If not possible could terminate interview until another
time
 ie

Interviewer should not become angry as this
transfers control to the subject
38
Interview and Interrogation
Verbal cues – conscious and subconscious
 Use of words such as you, your and they
rather than I and my to describe their own
behaviour can be a attempt to shift
responsibility to others

39
Interview and Interrogation


Also by this approach the subject could be trying
to engender sympathy
Suspects can attempt to deceive by responding
to questions with their own questions
 eg
“did you take the money?”
 “why would I do something as foolish as that?”
 This attitude implies they did not take the money
 But did not answer the question
 May follow up with “I am a well respected member of
the management team” to provide a reason to drop
the question
40
Interview and Interrogation
Qualifiers
 Words that modify the meaning of a sentence
 Eg

if a suspect has not followed the internal control
procedures
 “we prepare a listing of the checks almost all the time”
 Note the word almost which qualifies the response
and avoids making an untrue statement
 Care needed as if innocent may use the qualifier to
be more precise
Other times the suspect may use phrases like “to the
best of my knowledge” which allows them to later
improve their memory
41
Interview and Interrogation




Other qualifiers are that’s about it, sometimes, often,
maybe, possibly, typically and normally
They all represent ways of hedging enabling the suspect
to avoid making definite statements that could be shown
to be untrue.
At time s the suspect may use qualifiers to enhance their
credibility the truth is, to be perfectly honest, as God is
my witness – may be truthful in the midst of falsehoods
Sounds such as “ah” or “um” can provide extra time to
think of plausible responses – signpost here is change or
lack of it in suspect’s method of speaking
42
Interview and Interrogation



Another indication of deception is a response that is
overly specific.
Response may be after the suspect has had time to
consider their story
Non verbal clues



Can include failure to deny an allegation as well as failure to
answer questions.
Two major areas here eye movements and body language
Major point here is looking for changes in suspect’s behaviour
43
Eye Movements

Can be clues to truthfulness
 If
a suspect has made direct eye contact up until the
point the interviewer brought the crime up. The lack
of eye contact may be an important indicator of guilt
 When asked a question that requires a memory
response a subject who is primarily sight
oriented will usually look up and to the left,
straight ahead or both when truthful
44
Eye Movements

A subject must visually construct an image that
has not occurred to avid the truth
 Eg
“at the time of the theft where were you”
 A sight dominated person will look up and then to the
right
 Prior to this interviewer should ask questions which
she knows the answer of to test typical behaviour
45
Eye Movements


A subject who is auditory dominated ,exhibits
truthful memory recall by either looking down
and to the left or horizontally and to the left.
Change of behaviour, say looking horizontally to
the right can indicate an untruth.
46
Eye Movements

A subject who is dominated by feeling or touch
will normally either look downward and to the
right, look downward, blink rapidly or close the
eyes when being truthful (or a combination)
47
Body Language


Subject’s body language can communicate non
verbal signals
Shifting or making almost any discernable
change, particularly when the topic is crime, can
signal subtle yet revealing clues to the
truthfulness of the subject’s responses.
 For
example significant pauses before answering
 Reaching for nearby objects, scratching, adjusting
clothing or picking lint can also indicate deception
48
Body Language


Swallowing, biting lips and perspiring can also indicate
untruthful responses
A person who usually experiences the world through
feelings exhibits certain characteristics when she is
receptive to questions


For example deep breathing accompanied by relaxation of the
major muscle groups (arms legs, abdomen and chest)
A change in behaviour whether from or to a more relaxed
position indicates the subject’s receptiveness
49
Body Language




Mirroring is a process by which the interviewer can
attempt to establish rapport by mimicking the subject’s
body language – appear similar and identify with subject
If subject crosses left leg over right – interviewer crosses
right over left
In short friends confide in friends
Mimicking is used to produce the emotional feeling of
closeness
50
Question Types
Closed end – forced choice – open ended
– connecting – positive reaction –
clarifying – confrontational – secondary
 Closed end – yes or no answers
 Forced choice – similar but give limited 2
or 3 choices eg “when you took the money
was it because of something your
employer did?”

51
Question Types



Open-ended encourages the subject to respond
with more detail
Connecting questions – connect detail and
events eg “you mentioned you were in the office
on Monday. Was that the day you overheard
the conversation?”
Positive reaction questions are used to elicit an
agreement eg “you saw the person who took the
money didn’t you”
52
Question Types


Clarifying questions used to clear a particular
point. “you said you had difficulties what type of
problems were they?”
Confrontational questions or statements are
used to highlight contradictory evidence eg “you
said you were at work from 9:00 am. Is that
correct?” if confirmed the interviewer continues
“A witness saw you come in at 10:30 am”
 This
confrontation is to study speech and behaviour
changes
53
Question Types

Secondary questions – obtain an expanded response.
Typically repeat of subject’s sentence to encourage
elaboration



Subject “the accounts receivable were not correct”
Interviewer “ the accounts receivable were not correct”
Interviewer should avoid questions that allow the subject
to respond with vague answers. One example would be
a compound question bringing several issues into one
question


Leading questions designed to elicit a predetermined response
should not be used
Negatively phrased questions should also not be used as the
responses may not be clear
54
Interviewing Plan





Interviewers should prepare a plan for the interview to
use their knowledge of verbal/no verbal cues and types
of questions
First five minutes are most critical
Must assess subject’s willingness to co-operate,
personality and mood.
If willing then can use inductive approach by asking
question about details and then generalising.
If unwilling use a deductive approach working from
general questions to put the subject at ease before
moving on to detail.
55
Persuasive Approaches
56