Download F-5 Incorporating Forensic Accounting Techniques

9/30/2015
INCORPORATING "CUTTING EDGE"
FORENSIC ACCOUNTING TECHNIQUES /
METHODOLOGIES INTO COLLEGE /
UNIVERSITY AUDITING.
Presenter : Collin A. A. Greenland
Executive Chairman
KAIZEN MANAGEMENT CONSULTANTS
Wednesday, 9/30/2015,
1:10:00 PM‐2:50:00
2015 ANNUAL CONFERENCE
Indianapolis

To Sensitize / Review the essential aspects of Forensic Accounting, Definition, Nature,
etc.

To Expose / Review the Need / Demand for Forensic Accounting Generally, and
Specifically for University Internal Auditors.

To Expose and Explain to Attendees the types of Forensic Assignments / Applications,
the Main Elements of a Forensic Audit, and How it is Conducted.

To Introduce “Cutting Edge” Forensic Accounting Methodologies, Techniques and
Technology into University Internal Auditing.
2015 ANNUAL CONFERENCE
Indianapolis
1
9/30/2015
WHAT IS FORENSIC ACCOUNTING ?
DEFINITION 1. :
The application of financial skills and an investigative mentality to
unresolved issues, conducted within the context of the rules of
evidence. As a discipline, it encompasses financial expertise, fraud
knowledge, and a strong knowledge and understanding of business
reality and the working of the legal system. (SOURCE : Fraud
Auditing and Forensic Accounting : New Tools and Techniques, by
Jack Bologna and Robert J. Lindquist, John Wiley & Sons, New York,
1987.
2015 ANNUAL CONFERENCE
Indianapolis
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
DEFINITION 2. :
Forensic accounting (or auditing) is the integration of accounting,
auditing and investigative skills in order to provide an accounting
analysis suitable for the resolution of disputes (usually but not
exclusively) in the courts.
(“Demystifying Forensic Accounting,” by Collin Greenland, The
Weekend Observer, Pg. 5, December 7, 2001).
2015 ANNUAL CONFERENCE
Indianapolis
2
9/30/2015
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
Forensic accountants are required to be familiar with legal concepts
and procedures and must be able to identify substance over form when
dealing with an issue. Forensic engagements usually require the
analysis, interpretation, summarization and presentation of complex
financial and business-related issues in a manner which is both
understandable and properly supported.
2015 ANNUAL CONFERENCE
Indianapolis
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
Forensic accountants are required to be familiar with legal concepts
and procedures and must be able to identify substance over form when
dealing with an issue. Forensic engagements usually require the
analysis, interpretation, summarization and presentation of complex
financial and business-related issues in a manner which is both
understandable and properly supported.
2015 ANNUAL CONFERENCE
Indianapolis
3
9/30/2015
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
According to the American College of Forensic Examiners Institute, (ACFEI) a group of
their educators have broken forensic accounting into 75 topics as Follows (in
alphabetical order) :
1. Accounting systems and the detection of fraud
2. Analytical procedures
3. Analyzing financial statements
4. Antitrust
5. Bankruptcy
6. Billing schemes
7. Bribery and corruption investigation
8. Business interruption
2015 ANNUAL CONFERENCE
Indianapolis
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
9. Business valuations and cost estimates
10. Check tampering
11. Civil and criminal fraud statutes and regulations
12. Common fraud schemes
13. Compliance with applicable laws and
regulations
14. Computers and computer fraud
15. Concealing fraud in accounting
16. Concealment investigative methods
17. Conflicts of interest investigative techniques
18. Conversion investigative methods
19. Corporate governance
20. Criminology and white-collar and economic
crimes
21. Cyber fraud and computer topics
22. Detecting management and employee fraud
23. Document collection and analysis
24. Elements of fraud, pressure, opportunity,
and rationalization
25. Environmental and personal red flags
26. Expert witness and expert testimony
techniques
27 Financial statement fraud
28. Financial reporting process
29. Finding assets and people
30. Forensic accounting practices
31. Forensic and general accounting
32.Forensic and general accounting
32. Fraud auditing methodology
2015 ANNUAL CONFERENCE
Indianapolis
4
9/30/2015
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
33. Fraud perpetrators and their motivations
34. Fraud prevention and fraud policies
35. Fraud schemes / 36. Fraud statistics
37. Fraud symptoms and computer-aided fraud
auditing techniques
38. Fraud symptoms / 39. Fundamentals of fraud
40. Hidden assets
41. Internal control evaluation
42. Interrogation
43. Interview principles and methods to evaluate
deception
44. Inventory and asset theft
45. Investigation of financial crimes and legal
elements
46. Kiting
47. Knowledge of the legal system
48. Legal elements of fraud
49. Litigation consulting techniques
50. Loss prevention investigation
51. Loss prevention programs
52. Money laundering
53 Occupational fraud
54. Off-book accounting and financial
statement fraud
56. Overview of ethics
57. Overview of fraud auditing and fraud
investigation
58. Overview of the legal elements of fraud
59. Payroll and expense reimbursement
60. Phases of forensic accounting
2015 ANNUAL CONFERENCE
Indianapolis
WHAT IS FORENSIC ACCOUNTING (CONTD.)?
THE NATURE OF FORENSIC ACOUNTING
61. Principles of ethics and corporate code
of conduct
62. Professional liability
63. Resolution of allegation of misconduct
64. Rules of evidence
65. Skills required of the forensic accountant
66. Statistical sampling
67. Tax consequences
68. Techniques in locating hidden assets
69. The civil justice system
70. The criminal justice system
71. Theft and skimming
72. Theft act investigative methods
73. Theory of fraud examination and
prevention
74. Trial and cross-examination
75. Who commits fraud
2015 ANNUAL CONFERENCE
Indianapolis
5
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING
• In 1999, Kessler International, who was named in 2011 as the
Forensic Accounting Firm of the Year by ACQ magazine, were
quoting (US)$300 / hour for “forensic consultations.”
• In 2002 (February 18, 2002) a U.S. News and World Report cover
story ranked forensic accounting as the number one most secure
career track. The article was entitled “Sherlock Holmes, Meet
Enron” and claimed nearly 40% of the top accounting firms were
expanding their fraud and forensic services.
2015 ANNUAL CONFERENCE
Indianapolis
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
•
In fact the journal, Accounting Today in their 2007 survey of the top
100 accounting firms revealed between 77% and 78% citing
forensic accounting growth on their radar.
2015 ANNUAL CONFERENCE
Indianapolis
6
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)

The demand for Forensic Accounting services was further confirmed when one examines the
World Statistics of fees earned in 2010 (published by the IAB in January 2011):
2015 ANNUAL CONFERENCE
Indianapolis
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)

In their “2011 Forensic and Valuation Services (FVS) Trend Survey, the American Institute of
CPAs (AICPA) predicted an increase in demand for their services in the next two to five years.
These predictions were mirrored by the IBISWorld report, reported that Profits in the
profession total $669.8 million and wages total $1.6 billion - Seventy-nine percent of Forensic and
Valuation Services professionals participating in that survey predicted an increase in demand for
their services in the next two to five years.

In 2012, both the Journal of Accountancy and CGMA Magazine senior predicted a strong
demand strong for forensic accountants in wake of financial crisis, and stated that Forensic
accounting revenue in the United States was expected to grow 6.8% annually over the next five
years.
2015 ANNUAL CONFERENCE
Indianapolis
7
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)

In 2012, IBISWorld reported revenue in forensic accounting in the United States was expected
to grow 6.8% annually from $4.3 billion in 2012 to $6.0 billion in 2017, with a 7.0% increase in
forensic accounting revenue expected for 2013 alone.

In 2014, IBISWorld confirmed that over the previous five years, demand for forensic
accounting services surged as financial regulation increased and the number of
bankruptcies and corporate restructures rose sharply. Businesses turned to the
industry for aid in assessing and correcting the damage inflicted during the recession
as well as for assistance with litigation. Though internal competition and competition
from other industries' in-house forensic accounting services were forecast to rise
over the next five years, growth continue as opportunities arise in niche and
emerging markets....
2015 ANNUAL CONFERENCE
Indianapolis
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)

Today, forensic accounting is now regarded worldwide as one of the “20 hot job tracks of the
future” and job opportunities abound in law firms, financial organizations, insurance companies,
and Government agencies like the FBI, the Internal Revenue Service, and the Bureau of Alcohol,
Tobacco and Firearms who constantly investigate everything from money laundering and
identity-theft- related fraud to arson and tax evasion;
2015 ANNUAL CONFERENCE
Indianapolis
8
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)

The consensus amongst both researchers and practitioners today, is that whilst board members,
management and other stakeholders continue to expect assurances that an organization is
adhering to industry best practices regarding governance and internal controls and that the
organization is on sound financial footing, increasingly in light of recent financial scandals,
increasingly new and more stringent legal requirements, and the increasing complexity of
financial reporting places higher demands on internal audit, and all stakeholders’ awareness for
risk management is growing.
2015 ANNUAL CONFERENCE
Indianapolis
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
THE NEED / BENEFITS TO INTERNAL AUDITORS.

Deloitte Touche for example, in their 2012 survey reported that since their last Internal Audit
Fraud Survey in 2010, the mandate and role of Internal Audit functions have continued to evolve,
in respect of both fraud risk management and investigation responsibility. Management are still
dependent on Internal Audit to provide them with assurance over the anti-fraud controls in place
across their businesses, together with the ability to detect and investigate fraud, should it occu r.
These are important pre-conditions and strong incentives for the inclusion of forensic accounting
techniques in internal audit functions.
2015 ANNUAL CONFERENCE
Indianapolis
9
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
THE NEED / BENEFITS TO INTERNAL AUDITORS.

The Deloitte report pointed out that a robust anti-fraud culture is being promoted by senior
management with 98% of respondents stating senior management endorse and offer some,
or extensive encouragement of a strong approach to fraud risk management. These are
important pre-conditions and strong incentives for the inclusion of forensic accounting
techniques in internal audit functions.
2015 ANNUAL CONFERENCE
Indianapolis
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
THE NEED / BENEFITS TO INTERNAL AUDITORS.
The Deloitte report also predicted that over the next 12 months, the three key areas of focus in
Internal Audit were to be firstly the inclusion (or continued inclusion) of fraud in the scope of
reviews undertaken (53%), secondly the increased coverage of fraud risk in the audit plan
(40%), and thirdly performing fraud risk assessments (36%). Interestingly, 28% of
respondents anticipate the implementation of fraud data mining tools, critical components in
forensic accounting. Again, these are important pre-conditions and strong incentives for the
inclusion of forensic accounting techniques in internal audit functions.
2015 ANNUAL CONFERENCE
Indianapolis
10
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
THE NEED / BENEFITS TO INTERNAL AUDITORS.
In the matter of the initial detection of frauds, internal audit has consistently been exceeded by
the categories of “Tips,” and “Management Review” according to the most comprehensive
and widely accepted survey on occupational fraud known as “Report To The Nation On
Occupational Fraud and Abuse,” researched, compiled and presented by the Association
of Certified Fraud Examiners (ACFE) in 1996, 2002, 2004, 2006, 2008, 2010 , 2012 and
2014. Below is an excerpt of the 2014 report - the inclusion of forensic accounting techniques
in internal audit functions will assist in improving its effectiveness in this area.
2015 ANNUAL CONFERENCE
Indianapolis
2015 ANNUAL CONFERENCE
Indianapolis
22
11
9/30/2015
THE NEED / DEMAND FOR
FORENSIC ACCOUNTING (CONTD.)
THE NEED / BENEFITS TO INTERNAL AUDITORS.
The need for the use of Forensic Accounting by internal auditors has been further enhanced by
the increased use of “Anti-Forensic” actions as the market has seen a flood of new Windowsbased software offering to delete files securely and inhibit their recovery by digital forensic
programs. These frustrate forensic tools, investigations and investigators by erasing or altering
information; creating “chaff,” that waste time and hide information; implicate innocent parties
by planting fake evidence; exploiting implementation “bugs” in known tools; and leaving
“tracer” data that cause computer forensic tools to inadvertently reveal their use to the
attacker.
2015 ANNUAL CONFERENCE
Indianapolis
TYPES OF FORENSIC
ASSIGNMENTS / APPLICATIONS
The Forensic accountants are engaged in a wide range of investigations, spanning many different
industries . The practical and in-depth analysis that a forensic accountant will bring to a case helps to
uncover trends that bring to light the relevant issues in various areas such as :









FORENSIC / CRIMINAL INVESTIGATIONS
SHAREHOLDERS’ AND PARTNERSHIP DISPUTES
PERSONAL INJURY CLAIMS / MOTOR VEHICLE ACCIDENTS
BUSINESS INTERRUPTION / OTHER TYPES OF INSURANCE CLAIMS
BUSINESS / EMPLOYEE FRAUD INVESTIGATIONS
MATRIMONIAL DISPUTES
BUSINESS ECONOMIC LOSSES
PROFESSIONAL NEGLIGENCE
MEDIATION & ARBITRATION
2015 ANNUAL CONFERENCE
Indianapolis
12
9/30/2015
MAIN ELEMENTS OF A
FORENSIC AUDIT
Each forensic accounting assignment is unique and accordingly the actual approach adopted and
the procedures performed would be specific to it. However, in general, many forensic audits would
include the following steps :







MEET WITH THE CLIENT
PERFORM A “CONFLICT CHECK”
PERFORM AN INITIAL INVESTIGATION
DEVELOP AN ACTION PLAN
OBTAIN THE RELEVANT EVIDENCE
PERFORM THE ANALYSIS
PREPARE AND PRESENT THE REPORT
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS
AUDIT VS. INVESTIGATION
It is essential that internal auditors realize thaiont their “mind set” in an forensic audit should be one
more of an investigation, than that of an audit. Unlike a regular internal audit that focuses mainly on
compliance of auditees to established policies / procedures, a forensic audit is more investigative
designed mainly to get the facts, find out what happened and gather sufficient evidence to allow
management / client to take corrective (or punitive) action.
Clearly this may be more adversarial than routine audits that depend most times on a consultative
approach. This is not to say however, that experienced forensic auditors do not use consultative or
cooperative approaches but the difference between their approach and that of routine auditors must
be generally understood.
2015 ANNUAL CONFERENCE
Indianapolis
13
9/30/2015
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
In conducting forensic reviews, internal auditors are well advised to utilize the traditional Seven Steps
of Criminal Investigation, a process commonly taught and applied in the USA by federal, state, and
local law enforcement authorities.
Many variations of the “Seven-Step” method are used by law enforcement authorities, some agencies
employ a three, four, or five-step criminal investigation process. However, the Seven-Step method is
preferable due to its comprehensive detail. This customization capability enables forensic
practitioners to closely interface with respective law enforcement agencies, thus matching their
approach when applying forensic accounting.
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
The Methodology In Action — Process Map
The methodology is constructed as a process map that visually guides the practitioner through the
logical actions of a forensic accounting assignment. The methodology starts at the earliest stage of an
assignment and progresses through the final stage, typically testimony delivery pursuant to
prosecution. The process map flows left-to-right, top-to-bottom within the four phases and five stages,
as shown in Exhibit 19 below (Source : The United States Attorneys’ Bulletin - May 2005, Volume 53,
Number 3, Titled “Financial Forensics II).
2015 ANNUAL CONFERENCE
Indianapolis
14
9/30/2015
MAIN ELEMENTS OF A
FORENSIC AUDIT (CONTD.)
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
Due to the two-dimensional nature of the written word, the process map appears sequential.
However, the methodology is intended to be flexible, dynamic, integrated and simultaneous, and/or
iterative, thus mirroring how information and conclusions develop. For example, interviews and/or
interrogations might not be conducted until rather late in a forensic assignment.
2015 ANNUAL CONFERENCE
Indianapolis
15
9/30/2015
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
Methodology and Linkage to Criminal Investigation
The methodology was constructed using a forensic accounting/investigative linkage to the Seven-Step
Criminal Investigation methodology.
The Seven-Step methodology is summarized as follows :
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
1.Interviews and Interrogation
Interviews and Interrogation (I&I) reflect the personal aspect of data-gathering, Obtained through
personal interviews and interrogation under law enforcement authority. It is generally considered a
source of primary data.
KEY POINTS TO NOTE:






Interview vs. Interrogation (Know difference & when to use)
Continuous process throughout an investigation
Gain additional information with each interview
Evidence from witnesses provides additional leads
May identify additional witnesses
Interview the target only after completing the interviews of the peripheral witnesses
2015 ANNUAL CONFERENCE
Indianapolis
16
9/30/2015
CONDUCTING FORENSIC AUDITS (CONTD.)
2.Background Research
Background Research (BR) is comprised of two broad categories: primary data and
secondary data. Primary data (see Interviews) is acquired by the practitioner's efforts
collecting data otherwise unavailable through secondary sources. These may include:






Public Databases
Secretary of State Websites
County Seat
Corporate Records
Internet
UYI
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
3.Electronic and Physical Surveillance
Electronic and Physical Surveillance (EP) is used to obtain evidentiary data through
Observation:


Physical

Usually done by law enforcement or PI’s

Surveillance cameras

Can also be used to verify addresses for vendors, employees, etc.
Electronic

Internet surveillance

E-mail
2015 ANNUAL CONFERENCE
Indianapolis
17
9/30/2015
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
4.Confidential Informants
Confidential Informants (CI) provide information that is considered primary data. This may include
paid or voluntary informants. These may include:







Hotlines
E-mail
Letters
Current Employees
Former Employees
Vendors & former vendors
Customers & former customers
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
5. Undercover
Undercover (UC) is used to obtain first-hand subject data.

Usually a recommendation to use in special circumstances

Can be done if carefully planned

Best left to professionals
2015 ANNUAL CONFERENCE
Indianapolis
18
9/30/2015
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
6. Laboratory Analysis
Laboratory Analysis (LA) should be done cognizant of jurisdictional rules, (eg. in the US – Federal
Rules of Evidence), plus chain of custody best practices. LA can include a wide range of investigatory
procedures, including:






Physical examination of fictitious documents
Fingerprint analysis
Forgeries
Ink sampling
Document dating
Computer Forensics (imaging, emails, digital analytics)
2015 ANNUAL CONFERENCE
Indianapolis
CONDUCTING FORENSIC AUDITS (CONTD.)
THE TRADITIONAL SEVEN STEPS OF CRIMINAL INVESTIGATION
7. Analysis of Transactions
Analysis of Transaction (AT) compares/contrasts transactional and pattern-sensitive data measures to
provide a record for forensic analysis. Full and false inclusion tests, for example, are used to
determine the appropriate "universe" of data under investigation. This ensures that no extraneous
data is included and that no appropriate data is excluded. Analysis of financials may include:






Horizontal/vertical analysis
Authorization of new vendors & employees
Comparison of employee & vendor addresses
Analysis of sales returns & allowance account
Management override of controls
Different reviews based on known industry fraud schemes
2015 ANNUAL CONFERENCE
Indianapolis
19
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES
EARLY FORENSICS ANALYSES (PRE-COMPUTER)
Forensic Accountants utilized advanced forensic financial analyses even before the proliferation of
Computers. Admittedly, these techniques and methodologies were more time consuming, required
more “elbow Grease,” and in some instances less accurate especially where large scale sampling was
unavoidable.
The analytical and investigative process usual utilized horizontal and vertical trending relationship
assessment of innumerable financial and Statistical variables. The most common of which included :
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING
EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
EARLY FORENSICS ANALYSES (PRE-COMPUTER):











Historical analyses of Balance Sheet and Income Statements
Common sizing historical statistics by percentages
Comparative analysis by Industry standards
Cash flow trending analysis trending consistency of net sales, gross profit, operating income
and net income
Benchmarking product pricing
Inventory Valuation
EBIT (Earnings before interest)
Accounts receivable / payable turnover
Net Worth changes
Debt / equity
Benford’s Law
2015 ANNUAL CONFERENCE
Indianapolis
20
9/30/2015
“CUTTING
EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
Modern day “CUTTING EDGE” Forensic Accounting however still use many of the traditional
methods mentioned above but increasingly utilize a plethora of COMPUTER ASSISTED AUDIT
TECHNIQUES (CAATs) and / or other specific tools and techniques such as , e.g., Data Mining, Fulland-False Inclusion, Genogram, Entity(s) Charts, Timeline Analysis, Link Analysis, Item Listing,
(Modified) Net Worth Method, Source and Use of Cash Method, Proof-of-Cash Method, and Digital
Analysis - such as :
– Duplicate Numbers Test
– Rounded Numbers Test
– Stratification Percentage Comparison
– Benford’s Law
et al.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
DATA MINING
In the world of forensic accounting, Data Mining provides a type of DNA assurance in evidence
gathering as auditors / investigators search for exceptions, oddities, irregularities, patterns, and
suspicious transactions.
What is Data Mining?
PricewaterhouseCoopers defines Data Mining as the “art of analyzing large amounts of data in a
Manner that detects obscure facts, trends, or inconsistencies in a complete and efficient manner utilizing
"intelligent" computer applications.”
2015 ANNUAL CONFERENCE
Indianapolis
21
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
DATA MINING (CONTD.)
A more comprehensive definition by professional journal “The Chartered Accountant” regards Data
Mining as “a technique with an objective to mine large amount of data to discover previously unknown,
action oriented, hidden trends, patterns and complex relationships. The technique studies past data,
operates on all the variables and entire population, extracts variables of importance and uncovers
patterns in the form of rules, and formulates models by using different techniques.”
Data Mining therefore can greatly assist internal auditors, investigators or analysts to discover
previously unknown and actionable trends, patterns and relationships in their company data during
routine decision making, investigations or even modeling predictions.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ACCOUNTING RATIOS
Financial statement fraud causes the biggest losses and the inescapable logic of the accounting
equation ensures that any major overstatement of assets or profits, will show up over time.
Accordingly, the main Accounting Ratios used by early days analysts are still used today and
analysed mainly on the following criteria:







Income
Profitability
Liquidity
Working Capital
Bankruptcy
Long-Term Analysis
Coverage
Leverage
2015 ANNUAL CONFERENCE
Indianapolis
22
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ACCOUNTING RATIOS
These main Accounting Ratios are used even up to today and were utilised in analytical tasks to :
RETRIEVE VALUE.
FILTER
COMPUTE DERIVED VALUE
FIND EXTREMES
SORT
DETERMINE RANGE
CHARACTERIZE DISTRIBUTION
FIND ANOMALIES
CLUSTER
CORRELATE
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ACCOUNTING RATIOS
HOWEVER, in addition to the having the benefit of computerization, modern day Forensic
Accountants, after ascertaining these fundamentals, are able to apply more complex
assessments by drawing from the over 250 or so ratios to delve more incisively into a wider
scale of concerns. Internal auditors can emulate the use of these numerous ratios which For
example, in alphabetical order, include:
Accounts Receivable Turnover,
Advertising to Net Income,
Advertising to Sales,
Age of Inventory,
Atman’s z-score (both Manufacturing and NonManufacturing),
2015 ANNUAL CONFERENCE
Indianapolis
23
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
Audit Ratio,
Average Collection Period,
AverageInventory Period,
Average Obligation Period,
Average Wage and Benefit Cost per Employee,
Bad Debts Ratio,
Breakeven Point,
Capital Acquisition Ratio,
Capital Employment Ratio,
Capital Reinvestment Ratio,
Capital Structure Ratio,
Capital to Non-Current Assets
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
Cash and Marketable Securities to Current Liabilities (Acid Test),
Cash and Marketable Securities to Working Capital,
Cash Balance,
Cash Breakeven,
Point, Cash Debt Coverage,
Cash Dividend Coverage,
Cash Flow from Operations to Net Income,
Cash Flows from Investing vs. Finance,
Cash Flow from Sales to Total Sales,
Cash Flow Ratio, Cash Flow to Debt,
Cash Flow to Long Term Debt,
Cash Flows from Investing vs. Finance,
2015 ANNUAL CONFERENCE
Indianapolis
24
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
Cash Flows from Operations to Current Portion of Long Term Debt,
Cash Flows from Operations to Total Debt and Equity,
Cash Maturity Coverage,
Cash Return on Assets (Including and Excluding Interest),
Cash Return to Shareholders, Cash Turnover,
Collection Period, Collection Period to Payment Period,
Contribution Margin, Contribution Margin Ratio,
Current Ratio, Current Liabilities to Sales,
Current Return on Training and Development,
Daily Savings in Delayed Cash Payments,
Days of Liquidity,
Debt to Assets,
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
Debt to Equity Ratio,
Defensive Interval Period,
Discretionary Costs as a Percent of Sales,
Dividend Yield,
EBIT to Sales,
Employment Change,
Equipment Replacement Ratio,
Equipment Upkeep Ratio,
Equity Multiplier,
Expenses to Current Assets,
2015 ANNUAL CONFERENCE
Indianapolis
25
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ANALYSING BALANCE SHEETS / INCOME STATEMENTS, ETC.
Internal auditors should for example become familiar with some of the most established use of
analytical tools and techniques such as Benford’s Law, Altman Z-Score, Piotroski F-Score and
Beneish’s M-Score.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENFORD’S LAW
Benford’s Law, also called the first-digit law or leading-digit phenomenon, enables you to quickly
ascertain the accuracy of the data, and can help alert auditors / investigators to possible errors,
potential fraud, manipulative biases, costly processing inefficiencies or other irregularities. It is
particularly helpful for detecting fraud in various business data such as check payment amounts and
fraudulent tax returns.
Referred to as the “DNA-equivalent technique for financial analysis,” by authoritative sources such as
the Journal of Accountancy (May 1990); accepted legally in major jurisdictions such as the United
States, where evidence based on Benford's Law has been admitted in criminal cases at the federal,
state, and local levels; and empirically tested / verified scientifically / statistically further validated by
Chi Squared, Kolmogorov–Smirnov and Kuiper tests (depending on sample size)
2015 ANNUAL CONFERENCE
Indianapolis
26
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENFORD’S LAW
Mathematically speaking, Benford's law states that the
leading digit d (d ∈ {1, …, b − 1} ) in base b (b ≥ 2) occurs
with the following probability: This quantity is exactly the
space between d and d + 1 in a log scale. In Base 10, the
leading digits have the distribution shown on the right
Where d is the leading digit and p the Probability.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENFORD’S LAW
Graphically illustrated, the law appears as follows:
2015 ANNUAL CONFERENCE
Indianapolis
27
9/30/2015
“CUTTING
EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ALTMAN Z-SCORE
In testing for example, the probability that a firm will experience bankruptcy within two years, a
formula developed by NYU Professor Edward Altman, called a “Z-Score” could be used. This “ZScore” was established to measure financial distress along a number of objective metrics which
includes five easily derived business ratios, weighted by coefficients.
The original formula, widely applicable, is as follows :
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ALTMAN Z-SCORE
Z = 1.2X1 + 1.4X2 + 3.3X3 + 0.6X4 +0.99X5.
Where;
X1 = Working Capital / Total Assets (Measure the liquidity of the
company’s asset base);
X2 = Retained Earnings / Total Assets (Measure cumulative profitability
relative to firm size)
X3 = EBIT / Total Assets (Measure how efficiently the company uses its
assets to generate earnings from its operations.
X4 = Market Value of Equity / Book Value of Total Liabilities (Consideration of
the market’s view of the company relative to its liabilities).
X5 = Sales / Total Assets (Measures asset turnover).
2015 ANNUAL CONFERENCE
Indianapolis
28
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ALTMAN Z-SCORE
To interpret the resultant Z-Score, a company would be placed in one of three categories:
1.SAFE – If with a Z-Score greater than 2.99 and thus have a relatively
remote risk of bankruptcy;
2.LESS CLEAR - With a Z-Score between 1.81 and 2.99, and existing in a grey
area where a clear statement cannot be made.
3.IN DISTRESS - With a Z-Score less than 1.81 and thus at A high risk of
bankruptcy.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ALTMAN'S Z-SCORE
Sceptics or detractors who find limitations in Altman's Z-score, may prefer to find comfort in a
companys “F-Score” developed by Joseph Piotorski in 2000 while at the University of Chicago.
Compared to Altman's Z-score which test 5 inputs, the F-score tests nine, but does not weight them.
Accordingly, Piotorski's F-Score is calculated as follows :
The F-score is the sum the scores for each of nine tests. Each test scores one for a pass and zero for a
fail.
The tests are profitability related and are as follows:
2015 ANNUAL CONFERENCE
Indianapolis
29
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
ALTMAN'S Z-SCORE
1.Net profit is positive;
2.Operating cash flow is positive;
3. Net profit ÷ total assets at beginning of year, minus the same number for the
previous year is positive;
4. Operating cash flow is greater than net profit, capital structure and debt
service;
5. Long term debt ÷ by average assets has not increased;
6. The Current ratio has increased (the change is more then zero, so even a
negligible increase asses the test!);
7. No raising of ordinary (common) equity over the previous year: this test is
passed if the company did not issues any ordinary shares;
8. Gross margin has improved over the previous year;
9. Asset turnover has increased.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENEISH M-SCORE
The more skeptics amongst us who feel that a company’s earnings may be manipulated so the above
analyses may not be valid, should also know that any possible manipulations can be tested by
applying the “Beneish Model,” a mathematical model that uses financial ratios and eight variables to
identify whether a company has manipulated its earnings.
The variables are constructed from the data in the company's financial statements and, once
calculated, create an “M-Score” to describe the degree to which the earnings have been manipulated.
The original M-Score formula is as follows:
M-Score = -4.84 + 0.92*DSRI + 0.528*GMI + 0.404*AQI + 0.892*SGI + 0.115*DEPI – 0.172*SGAI +
4.679*TATA – 0.327*LVGI
Where :
2015 ANNUAL CONFERENCE
Indianapolis
30
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENEISH M-SCORE
Where :
1. DSRI - Days' sales in receivable index
2. GMI - Gross margin index
3. AQI - Asset quality index
4. SGI - Sales growth index
5. DEPI - Depreciation index
6. SGAI - Sales and general and administrative expenses index
7. LVGI - Leverage index
8. TATA - Total accruals to total assets
Once calculated, the eight variables are combined together to achieve an M-Score for a
company and one less than -2.22 would suggests that it will not be a manipulator, whereas an
M-Score of greater than -2.22 would signal the possibility that it is likely to be a manipulator.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
BENEISH M-SCORE
Once calculated, the eight variables are combined together to achieve an M-Score for a
company and one less than -2.22 would suggests that it will not be a manipulator, whereas an
M-Score of greater than -2.22 would signal the possibility that it is likely to be a manipulator.
2015 ANNUAL CONFERENCE
Indianapolis
31
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
CATEGORIES OF FRAUD
The ACFE’s classifications of fraud has evolved as the most accepted and respected classifications of
fraud, i.e. Corruption, Asset Misappropriation and Fraudulent Statements.
Internal Auditors investigating fraud should become very familiar with these categories and the
ACFE’s procedures / techniques in deterring, preventing, detecting and reporting these categories.
The categories are as follows:
2015 ANNUAL CONFERENCE
Indianapolis
2015 ANNUAL CONFERENCE
Indianapolis
32
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
COMPUTER FORENSICS
As mentioned previously, modern day analysts still use many of the traditional methods mentioned
above, but presently they are now utilizing a plethora of COMPUTER ASSISTED AUDIT
TECHNIQUES (CAATs) pursued mainly through COMPUTER FORENSICS defined below by the
National Institute of Standards and Technology as follows :
. . . the application of science to the identification, collection, examination, and analysis of data
while preserving the of the information and maintaining a strict chain of custody for the data. Data
refers to distinct pieces of digital information that have been formatted in a specific way. . .
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
COMPUTER FORENSICS
COMPUTER FORENSICS is regarded as a branch of Digital Forensic Science, pertaining to legal
evidence found in computers and digital storage media. The goal of computer forensics is to examine
digital media in a forensically sound manner with the aim of identifying, preserving, recovering,
analysing and presenting facts and opinions about the digital information.
2015 ANNUAL CONFERENCE
Indianapolis
33
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
COMPUTER FORENSICS
Forensic investigators typically follow a standard set of procedures. After physically isolating the
computer in question to make sure it cannot be accidentally contaminated, investigators make a
digital copy of the hard drive. Once the original hard drive has been copied, it is locked in a safe or
other secure storage facility to maintain its pristine condition. All investigation is done on the digital
copy. The renowned “Forensic Magazine." delineate an eight step forensics process:
1.Search authority
2.Chain of custody
3.Imaging/hashing function
4.Validated tools
5.Analysis
6.Repeatability (Quality Assurance)
7.Reporting
8.Possible expert presentation
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
DIGITAL EVIDENCE
What is Digital Evidence?
“Digital evidence is information of probative value that is stored or transmitted in a binary form”.
This field includes not only computers in the traditional sense but also includes digital audio and
video. It includes all facets of crime where evidence may be found in a digital or binary form.
Any information can be stored electronically, and almost all new information is being created and
stored exclusively in electronic format. Background information called Metadata (inherent with
electronic data) can turn up skeletons you had no idea existed. Knowledge of the location of data,
storage methods and document types is critical.
2015 ANNUAL CONFERENCE
Indianapolis
34
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
DIGITAL EVIDENCE
Internal auditors should be aware that the inventory should include the location and storage formats
of all electronic data and any information stored and or used by computer technology is considered to
be electronic evidence discoverable in litigation. Relevant information may exist in a variety of
locations and various forms and basic categories should not be overlooked.
Digital Evidence comes in numerous form factors, and can include the following:
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
2015 ANNUAL CONFERENCE
Indianapolis
35
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
FORENSIC PROCESS
COMPUTER FORENSIC INVESTIGATIONS usually follow the standard digital forensic process or
phases: acquisition, examination, analysis and reporting. Investigations are performed on static
data (i.e. acquired images) rather than "live" systems. This is a change from early forensic practices
where a lack of specialist tools led to investigators commonly working on live data.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
FORENSIC PROCESS
TECHNIQUES
The techniques are used during computer forensics investigations include the following:
Cross-drive analysis forensic technique that correlates information found on multiple hard
drives. The process, still being researched, can be used to identify social networks and to
perform anomaly detection.
Live analysis - Examination of computers from within the operating system using custom
forensics or existing sysadmin tools to extract evidence. (A system administrator, or sysadmin, is
a person who is responsible for the upkeep, configuration, and reliable operation of computer
systems; especially multi-user computers, such as servers). The practice is useful when dealing
with Encryption Fie Systems, for example, where the encryption keys may be collected and, in
some instances, the logical hard drive volume may be imaged (known as a live acquisition)
before the computer is shut down.
2015 ANNUAL CONFERENCE
Indianapolis
36
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
FORENSIC PROCESS
TECHNIQUES (Contd.)
Deleted files - A common technique used in computer forensics is the recovery of deleted files
used by modern forensic software which have their own tools for recovering or carving out
deleted data. File carving, for example, involves searching for known file headers within the
disk image and reconstructing deleted materials.
Stochasted forensics – a method which uses stochastic properties of the computer system to
investigate activities lacking digital artifacts. (Physical systems in which we are uncertain about
the values of parameters, measurements, expected input and disturbances are termed
Stochastic Systems. In probability theory, a purely stochastic system is one whose state is
randomly determined, having a random probability distribution or pattern that may be
analyzed statistically but may not be predicted precisely. In this regard, its chief use is to
investigate data theft.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
FORENSIC PROCESS
WHICH ARE THE “BEST” TOOLS?
In many instances, companies, indeed internal auditors operate on limited budgets, so it is
unlikely that one company will invest in multiple forensic softwares.
If a “best tool” is sought however, a disk editor might be a worthwhile investment.
Understandably also, it is not feasible for forensic auditors to procure every possible data base,
spreadsheet, word processing, flow chart, or other software application on a suspect’s hard
drive or other media under investigation.
Instead, a file viewer can be obtained and products such as Jax Software’s Quick View, File
Stream Inc’s Turbo Browser 2000, and Clear and Simple Inc.’s Disk Jockey 2000 enables users
to view hundreds of file types using one tool.
2015 ANNUAL CONFERENCE
Indianapolis
37
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
FORENSIC PROCESS
WHICH ARE THE “BEST” TOOLS?
THE FOLLOWING TABLE DISPLAYS SOME OF THE BEST AVAILABLE
FORENSIC TOOLS RESEARCHED BY THIS PRESENTER:
2015 ANNUAL CONFERENCE
Indianapolis
EVIDENCE RECOGNITION, COLLECTION, AND ANALYSIS TOOLS
2015 ANNUAL CONFERENCE
Indianapolis
38
9/30/2015
EVIDENCE RECOGNITION, COLLECTION, AND ANALYSIS TOOLS (Contd.)
2015 ANNUAL CONFERENCE
Indianapolis
EVIDENCE RECOGNITION, COLLECTION, AND ANALYSIS TOOLS (Contd.)
2015 ANNUAL CONFERENCE
Indianapolis
39
9/30/2015
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
WHICH ARE THE “BEST” TOOLS? (Contd.)
My experience and research of the software brands engaged in forensic accounting work reveal
that EnCase is one of the most multifaceted, popular, effective, reputedly used by over 75% of
the world’s forensic and amongst my personal favorite.
2015 ANNUAL CONFERENCE
Indianapolis
“CUTTING EDGE” FORENSIC ACCOUNTING
METHODOLOGIES (CONTD.)
WHICH ARE THE “BEST” TOOLS? (Contd.)
ACL is very popular software used by internal auditors and they have developed forensic tools
and with innovative and creative manipulations, which have allowed internal auditors to do
impressive forensic work.
The key point to note is that using the right investigative tools can help to maximize the
effectiveness of computer forensic work, and equip internal auditors to incorporate “Cutting
Edge” Forensic Accounting Methodologies into their day to day tool kit.
2015 ANNUAL CONFERENCE
Indianapolis
40
9/30/2015
2015 ANNUAL CONFERENCE
Indianapolis
2015 ANNUAL CONFERENCE
Indianapolis
41
9/30/2015
CONTACT INFORMATION:
COLLIN GREENLAND,
EMAIL : [email protected]
2015 ANNUAL CONFERENCE
Indianapolis
42