Principles of Fraud Examination

Building a Culture of Fraud Prevention and Detection

Responding to Discovered Fraud

1. Does your organization have formal procedures for responding to discovered frauds? Who is responsible for investigating such frauds? Are identified instances of fraud within your organization always reported to the authorities?

2. You are an internal auditor who has just uncovered significant evidence that an employee in the accounting department has been embezzling money from the company. What steps do you take in response to this discovery?

. Understand what to do when an organization receives fraud allegations and how to determine whether to undertake an investigation. . Know how to develop a fraud investigation plan and form a fraud investigation team. . Understand the steps and techniques involved in conducting a fraud examination.

. Consider the risks that arise during a fraud examination and how best to manage those risks. . Determine how and to whom to report the results of a fraud examination. . Consider necessary follow-up steps after the conclusion of a fraud examination.

. An effective anti-fraud program includes formal and consistent procedures for: • Receiving and handling reports of fraud allegations • Thoroughly investigating identified instances of fraud • Swiftly and appropriately punishing perpetrators • Remediating weaknesses that allowed fraud to occur

. Potential fraud can come to management’s attention in many ways: • Tips from employees, customers, or vendors • Internal audits • External audits • By accident

Confirm the Define the Categorize validity of severity of issues. allegation. allegation.

Refer issues Escalate issue as Conduct the outside the scope appropriate. investigation. of program.

Resolve or close the investigation.

. Identify information to be kept confidential. . Define how investigation will be documented. . Manage and retain documents and information. . Log allegations received. . Track and manage cases.

. Does alleged act involve violation of law, rules, or company policy? . Do any other departments need to be consulted? . Should external auditors be advised? . Is allegation required to be disclosed to the board, audit committee, or any other party?

. More than 40% of frauds are detected by a tip. . Not all tips are valid.

. Factors to consider: • Time-sensitivity • Notification • Confidentiality • Legal privileges • Compliance • Securing evidence • Objectivity • Goals

Computer forensics Accountants or specialists forensic accountants

Security or loss Internal prevention personnel auditors

IT External personnel auditors HR personnel

. Cases are generally handled in a uniform fashion. . Work from general to specific. . Assume case will end in litigation.

Making observations

Gathering physical evidence Examining documents Computer forensic examinations

Conducting interviews

Analyzing evidence

Documenting the findings and quantifying losses

. Failure to consider and successfully navigate several legal issues and constraints during an investigation can undermine the entire case.

. Need to identify rights affected by investigation • Employees • Union employees • Third parties . May have responsibility to investigate based on duties of officers and directors

. Some evidence must be voluntarily provided or subpoenaed: • Banking records • Tax returns and related documents • Credit reporting agency records • Telephone records • Credit card account records

. Civil litigation • Can be costly and time consuming • Can be critical to obtaining information and compensation for fraud loss

Advantages of criminal prosecution: • Save litigation expense • Government has greater investigatory power • Criminal cases move more quickly • Conviction can establish facts to use in a civil trial

Disadvantages of criminal prosecution: • Less control over case decisions • Cannot request or control sentence • Criminal penalties might render defendant insolvent

. Investigation information might be sought by government agencies and civil litigants. . Understand and use protection provided by applicable legal privileges

. Report findings to party overseeing the investigation. • In general, the party to whom the report is made will determine the appropriate form of the report. . Retain reports for use in future fraud risk assessments.

. Might be better to voluntarily disclose a violation to law enforcement than waiting for the agency to discover the violation and take action . Voluntary disclosure can result in leniency

. Preserve evidence. . Maintain confidence. . Mitigate losses. . Punish the perpetrators. . File insurance claim. . Undertake extended investigation. . Remediate business processes and internal controls.