Knowledge and Insights

In many cases the forensic accountant is engaged too late. This usually results from lack of knowledge of the critical importance of discovery during the first five days of an investigation. Unless the forensic accountant is engaged at the time fraud is discovered, there is a high probability of the loss of critical evidence and of increased cost to establish whatever evidence may be recoverable. It must be kept in mind that one objective of the person committing a fraud is to hide or destroy evidence. The more time they have to do that, the more effective they will be. Some of the challenges we have to overcome when joining a case too late are:

• Not having passwords to access data files;
• No data location maps for the servers;
• Limited or no access to employees with knowledge of the target or allegations. Employee access is needed to conduct informal interviews to obtain information about operational procedures relating to the investigation and their perspective on the matter under investigation; and
• No employee assistance for locating documents and data files relevant to the investigation.

In order for us, as forensic accountants, to use our broad experience in investigative techniques, business operations, accounting principles and data processing knowledge to assist attorneys in collecting and organizing financial data to establish facts and draw conclusions as evidence in court, we must first go through the following processes:

• Understand the goal of the investigation and identify the key issues;
• Identify the key officers, employees, banks and professionals in the matter, understand their roles and interview them when appropriate;
• Identify support needs, such as internal/external counsel, eDiscovery specialist, internal audit and  IT support;
• Establish a plan to preserve the documents required to perform the investigation and give notice to parties to preserve evidence when required;
• Provide assistance during discovery in the analysis of the factual circumstances to obtain documentation required to analyze the data and support the conclusions reached;
• Coordinate the procedures for the collection of data;
• Create forensic images, preserve back-up and collect server-based information;
• Locate IT manuals mapping out the location of data on servers and provide the passwords to access data files and accounting records;
• Establish an inventory and summary of data preserved;
• In cases of fraud or defalcation, determine when and how to report the matter to law enforcement; and
• Provide assistance in the preparation of deposition questions, attend trial, hear the testimony of the opposing expert and assist with cross examination.

Unless procedures are immediately established to prevent such actions, the delay in engaging forensic accountants in a timely manner allows time for files with intellectual property of the company to be copied; for emails to be deleted; for passwords to be changed; and for paper documents to be shredded. It has been our experience that the first five days after the discovery of a fraud are a critical period. During that time, it is important to estimate, if possible, the amount of the fraud and to put into place procedures and controls to preserve evidence.

It is also important to decide during this period when, how and if the matter will be reported to law enforcement and/or insurance companies. When a matter is reported to law enforcement, the investigation is usually taken over by law enforcement. As a result, the company loses control of the matter, both in terms of investigating and in establishing what action will be taken. It is difficult to conduct a civil and criminal investigation at the same time. Therefore, a decision should be made early on as to the advisability of conducting and completing a civil investigation before reporting the matter to law enforcement. We have conducted a number of investigations involving civil and criminal matters and would be pleased to consult with you on any such matter.