Uncovering the Indicia of Fraud in Complex Cases with Incomplete Forensic Data

By Eric A. Kreuter  |  April 1, 2020

Deception is the main tool of fraudsters and the hallmark of many types of fraud. When used skillfully, deception often leads to not one incident of embezzlement, but a pattern of acts over time as recurring opportunities surface. Fraudsters discover weaknesses in internal controls and engineer ways to defeat the system, thereby siphoning funds. When this strategy pays off, there can be a narcotic effect, encouraging the fraudster to continue the behavior as an easy means of satisfying hidden financial needs or, worse, a simple appetite for greed. This article outlines some of the steps of an investigation into embezzlement before discussing in detail several cases where incomplete forensic data was ultimately not as great a hindrance to finding the truth as those who withheld that data might have hoped.

The Investigation Process

When the impact of embezzlement is discovered, business owners typically go through stages of coping with the situation. These stages, as in cases of mourning, include denial, grief, anger, and resolution. Sometimes the owners develop a sense of self-blame for allowing the situation to occur. The resolution phase can involve termination of the embezzler, engagement of legal counsel, reporting the criminal activity to law enforcement, and the retention of a forensic accountant. Recovery for provable damages, when feasible, could come from insurance coverage for employee dishonesty or from restitution from the embezzler (either ordered by the court as part of sentencing or agreed to by the parties). Sometimes there are no available funds from which to gain restitution, so the ultimate judgment, while good for many years, may never be fully collected.

Once a team of professionals is in place, planning of the investigation begins. During this stage, the forensic specialist outlines the details of the history of the suspected fraud and starts to profile the persons involved. After a survey of available business records is created, there is a discussion with legal counsel and the client on the need and options for securing and protecting physical evidence, including electronic devices such as computers, cellphones, hard drives, email, and paper documents. Establishing protocols for tracking chain of custody is an essential component of this stage. Developing a timeline of activities is also very helpful. Discovery of fraudulent activity many years prior is much more difficult to investigate, as records and witnesses may no longer be available.

Missing Information

In the discovery period, additional business records and other relevant financial and nonfinancial documents are requested. At this early stage, it is wise to consult legal counsel and the company’s in-house IT personnel or outside consultant to image hard drives, preserve data, and take control of cellphones used by the suspected fraudsters. Subpoenas are sent out to solicit documents from third parties, which are considered superior evidence to those obtained directly. Frequently, there are reported numbers. Usually a party who is willing to commit tax fraud is unbothered about cheating a business partner, employer, or spouse. Furthermore, in damages cases, this author routinely questions the owner-plaintiff or bookkeeper whether the tax returns will show the reporting of all taxable revenues and whether the expenses clamed are only for legitimate business purposes. While the plaintiff may truly have been harmed economically by another party, proving loss likely requires examining filed federal income tax returns. Counsel for such plaintiffs should be advised very early on in the case whether there is blatant underreporting of taxable income. Judges can and sometimes will report suspected tax crimes to the IRS or the state taxing authority.

Considerations in Group Frauds

Where there are multiple defendants (individuals or business entities) with numerous transactions between them, examining the bookkeeping of each side of each transaction is critically important. Tracing to bank statements, financial statements, and tax returns is also necessary to detect schemes involving the movement of assets within a group. Understanding the ownership and control relationships of each entity will help forensic accountants focus specifically on areas likely to indicate avenues that the fraudster can manipulate in order to commit hard-to-detect fraud schemes.

In a recent case, the defendants were shown to have transferred substantial monies to business entities owned or controlled by them with no relation to the company that owned the funds. These transfers were made under the guise of approved loans, with very few carrying any interest. Forensic investigation revealed that the vast majority of the approximately two dozen purported loans were unapproved and undocumented, and did not carry interest, leaving the rightful owner exposed to collection risk.

In this case, the expert for the defendants testified that because the total monies paid back equaled the total of monies taken, there was no impact on the plaintiff. The plaintiff’s expert countered with evidence to not only show that all of the funds were not repaid; the total interest paid was minimal as well. Furthermore, there was considerable concealment involved with most of the transactions; financial analysis thus could lead to a claim that the party might be perpetrating fraud that is easily established when looking at specific transactions but is glossed over when considering the larger group as a whole. In this kind of case, looking at a group of transactions in their entirety instead of individually serves to mask the true nature of misuse of funds.

When preparing an expert report and then testifying in cases like the above, making a flowchart is quite useful. In such a case, showing the gross dollars flowing in chronological order helps the reader (and the trier-of-fact) to assess either the presence of a proper rationale for some or all of the flows or to form the impression of indicia of fraud. In this author’s experience, evidence of a large amount of transfers between accounts or entities is, on the surface, very suspicious. For example, where funds transferred for a legitimate business purpose are moved to other accounts for illegitimate reasons, tracing these movements by matching them to bank records and books of original entry can supplement the narrative explanations of how such monies are used. Ultimately, the forensic conclusions reached can refer to these charts and tables, proving a more dramatic method of presentation of findings. It also makes it far more challenging for the opposing expert or party to refute the movements so defined in the records.

Where the flowchart reaches an impasse due to lack of records (usually at the entity level), the forensic specialist must write about the lack of an audit trail. For example, clear commingling of funds can infer potential misuse, which the forensic accountant can articulate. Though imperfect, using the available evidence to show what happened to assets serves to put the opponent on the defense to prove something other than fraud caused the transaction. Often this cannot be done, and the perpetrator is caught in the act.

Finding the Truth

The first step of any robust forensic examination is to determine which records are available and trustworthy, then compile an annotated list of additional information that should be reasonably available. From this step, legal counsel is in a very strong position to issue demands, either in the form of a formal petition in court or at a court conference. Where there is cooperation amongst the attorneys, it is possible to have a global conference concerning business records to streamline the process and avoid the expense and delay of fighting over these issues in court.

---

This article originally appeared in the March 2020 issue of The CPA Journal.

About Eric A. Kreuter