Ch2 write work

‘‘How many individuals work within the division?’’ The human resource director stated that six people, including the controller and office manager, worked in that location. She continued by telling us that the controller and officer manager were very close, and that they both work full-time mainly on weekdays. As for the other four employees, two worked full-time and two were part-time, and their schedules varied by position. I asked who was at the division today, and who would be there tomorrow if we needed to interact with them. The human resource director said the controller, office manager, and two others would be there today and tomorrow, and the others would be coming in later in the week as usual.

‘‘Describe the controller and office manager, and tell me what their personalities are like.’’ Tim indicated both individuals were quite difficult to work with and had attitudes. Tim stated the controller wasn’t afraid to curse during heated discussions. Tim also said the office manager put on a front as being a tough guy, but in the absence of the controller, he is a pushover and utterly incompetent. The only reason he still had a job was because the controller liked him and kept him in that position, and that the controller has the authority to hire or fire his division’s employees. Tim said he would love to see both terminated from the organiza- tion, and has for years. The human resource director concurred with Tim’s description, and said if we could get the office manager away from the controller, he would cave in and give us anything we requested, unknowingly building a case against himself and the

notice provided, tipping off the potential targets. However, you would be reckless if you failed to consider the potential consequences of a ‘‘shock and awe’’ approach. Individuals beyond those involved in the potential fraud will be equally affected by the disruptions likely to occur due to your actions. Some individuals may become angry or supportive of the targeted individ uals, while others may break down and become a resource drain requiring consoling. Often, phones will still need to be answered, transactions and activity will still need to be completed, and answers to questions will need to be provided and there will be many individuals with many questions both within and external to the organization. Equal emphasis should be placed on potential consequences and solutions to those identified risks as on investi gative issues.

The Importance of Planning (Maximizing Desired Outcomes) 17

controller. She stated the source of his power and direction came from the controller.

‘‘Who has computers, and where are they located?’’ Once again the human resource director answered that she had been at the division recently to update personnel files. She remembered there were computers on each desk, with a laptop in use by the controller in his office. To the best of her memory, all the other computers were desktop computers with big monitors. She was unaware if the computers were connected to a centralized file server.

LEARNING POINT Why would it be important to know what the individuals looked like and to solicit details regarding their personalities in advance? First of all, it would be good to recognize the individuals on the first visit to ensure you are talking with the correct individuals. Beyond identifying the right person, knowing as much as possible about any individual will prove extremely helpful when talking and dealing with him. If someone has a very hostile or angry demeanor, where and how you interact with him will likely be very different from where and how you interact with staff members who are very emotional. One interaction may be very private and need to be handled delicately to minimize the emotional breakdowns (crying), while the other may be best handled initially out in plain view with resources available in the event that the person becomes hostile toward you.

First and foremost, just as in working my weekend job driving ambu lances, personal safety for yourself and the safety of all others involved in the investigation is the most important aspect to consider in any investigation. If there is any risk or potential risk that could jeopardize the safety of any individual, then a plan needs to be considered to ensure everyone’s safety. No one needs to get injured or worse when investigating fraud matters. There are always multiple ways to accomplish measures and procedures, and if one could lead to a potential safety issue, then an alternative way needs to be identified and implemented to avoid the potential safety risk altogether. Ideally, if the investigation is planned properly with safety considerations discussed during the planning stage, anything that actually occurs involving safety concerns should have been contemplated and considered along with an identified plan to deal with each potential risk.

18 Anatomy of a Fraud Investigation

‘‘Do we have a forensic computer specialist available to image and secure the electronic information, including images of each com- puter hard drive?’’ The group just looked at me, and their stares told me they had not considered that aspect of the investigation. I told them that I had a firm that I had used successfully on other matters and that with a phone call I could put them on notice that their assistance would be needed in this matter. Tim and outside counsel thought that it would be a good call to make, so I excused myself to the corner of the room and called the firm from my cell phone.

I was successful in connecting with my contact, and quickly brought him up to speed. I asked him if they had capacity to react to this matter, and he indicated they were ready and available. I told him I would get right back to him once a plan had been identified. He said he would be waiting for my call.

I returned to the table and let the group know that the computer forensics firm was ready to go on my call.

‘‘When do you want to make this happen, and who is available to accompany me on the visit?’’ I asked. Tim stated he wanted to

LEARNING POINT Having technically competent resources available as part of the investigative team will maximize the effectiveness and thoroughness of any fraud investi gation. Identifying professionals with experience and expertise within spe cific fields such as computer forensics will prove invaluable both during the investigation as well as during the resolution of the findings, including testifying at trial if needed. Electronically maintained information needs to be handled properly to ensure it is completely and accurately captured and stored. A simple mistake of booting a computer that was turned off could change files forever, as could shutting down a running computer. Experts who specialize in this field know best how to image drives and capture the information in a reliable and defendable manner, as well as how to recover deleted or hidden information once the systems have been properly imaged. Assembling a team of resources to call upon if needed is likely the best way to approach a fraud investigation. Finding the best specialists to use in each field is always the challenge.

The Importance of Planning (Maximizing Desired Outcomes) 19

execute a plan as quickly as possible, to minimize the risk that evidence would be deleted or destroyed if too much time passed. He added that he would be available to make the trip to the division accompanied by his senior finance person. The human resource director also stated she would be available to make the trip tomorrow to deal with any personnel issues on the spot, as they occurred. Outside counsel discussed the pros and cons of being on site during the visit and, after much discussion, decided it would be best to remain back at the office but available all day as needed by phone. A phone call would be all it would take to make the short drive to the division if it became necessary to have outside counsel on site. Everyone wrote down outside counsel’s phone numbers to have with them, if needed.

The last to speak was the executive director. Acting as the voice of reason, he asked if it was absolutely necessary to barge into the division unannounced and commence performing procedures, and wanted to know if there was any other way this could be completed in a less disruptive manner. Tim first responded to the question and discussed again the risks posed if any notice was provided to the controller or office manager. Then, Tim discussed what procedures and costs would be involved if the controller and/or office manager were in fact committing a material fraud and destroyed all the evidence supporting their illegal activities. Once Tim finished, I corroborated what Tim said, and concurred that if the desired goal was to ensure any and all evidence was identified, controlled, and collected, then an unannounced visit was likely the only way to accomplish that goal.

Next, we discussed the logistics of executing an unannounced visit to the division. The controller and office manager knew Tim and the human resource director. If both of them showed up at the division and were spotted, evidence could be deleted or destroyed prior to gaining access to the individuals. Further, due to their personalities, it was likely that the controller would become a problem and a potential threat to safety in response to the unscheduled and sudden visit by ‘‘auditors,’’ creating a scene in front of the other employees at a minimum and posing a potential safety concern to our team at worst. I indicated the best scenario would be to get the controller out of the office at the time of our arrival, leaving the office manager to fend for himself and deal with our unplanned arrival. That is when Tim came up with a brilliant suggestion. If the executive director called the

20 Anatomy of a Fraud Investigation

controller in the morning to come to a meeting at the main office, the controller would likely comply and attend the meeting. If the exec- utive director were to then call Tim on his cell phone to indicate the controller arrived at the main building, it would signal the team that it was clear to go to the division and interact directly with the office manager without interference from the controller. Only then, after the call was made, would the executive director inform the controller of the unplanned procedures being performed at his division.

! ! !

All that was left to complete the meeting was to ensure we had the appropriate supplies and materials needed to execute the plan, and select a place and time to meet in the morning. I drafted a list of supplies to be obtained, and provided the list to Tim’s senior financial person. Banker storage boxes, Sharpie markers, labels, legal pads, pens,garbagebags,andclipboardswereneeded,andlotsofthem.The human resource director would bring all the necessary forms and personnel files with her tomorrow should it become necessary to place any individuals on paid administrative leave.

Tim, the human resource director, and I would drive our vehicles to the neighborhood where the division was located for 12:00 the next day, then call each other to find a location in the area to meet and wait for the call from the executive director. The location would need to be close by but far enough away to not be seen from the division.

A plan was forged. We would arrive at the division once we received the signal, and take total control of the division location. Any individuals working at the division at the time of our arrival would be asked to come into the conference room, leaving their work areas immediately and in the exact condition as when we arrived. The human resource director and I would interview sepa- rately the office manager and any other employees on site, and have them identify where all financial information was maintained throughout their location. The office manager would then be placed on immediate paid administrative leave, and escorted out of the building without returning to his work area. Based on information provided during interviews of any other employees present, each would either be placed on paid administrative leave or at least be asked to leave for the remainder of the day, and return to work in the

The Importance of Planning (Maximizing Desired Outcomes) 21

morning. Once the executive director informed the controller of the procedures being performed, the controller would also be placed on paid administrative leave and would not be permitted to return to the division’s location.

Tim was to spend the rest of the afternoon identifying local resources in the area of the division, to be able to change locks on doors and reconfigure alarm system codes if needed after arriving at the division.

Tim also needed to draft letters to each of the banks that were known to have bank accounts in the name of the division, instructing each bank to freeze the activity within each account upon the delivery of the letter. The goal for tomorrow was to gain control of the division, and then lock down the bank accounts so that no further transactions could occur until further notice. Tim planned to leave the division once we arrived and things were under control, and deliver each letter to the banks to ensure the controller or office manager could not clear out any of the accounts.

LEARNING POINT We have a motto in emergency medicine when responding to calls. I am sure other fields use the same motto. ‘‘Plan for the worst, and hope for the best.’’ It is always better to have contemplated all possibilities and have plans available, than to have to react unprepared. On most medical calls my crew brings all the resources into the house on a call, often knowing most of the stuff won’t likely be needed. But every so often a call goes in a different direction than expected, and it is extremely fortunate that the very things we need are sitting right next to us in the house. Other crews have adopted a lesser standard, and every so often they get caught without needed equip ment, delaying care to the patient.

In many cases, locks will need to be changed, access to the alarm systems and computer systems will need to be changed, and other physical safeguards will need to be implemented. Access to bank accounts and post office boxes will often need immediate changing as well. In order to preserve the integrity of the investigation as well as the business, these measures often need to be imple mented immediately, leaving little time for planning. Knowing what resources are available in the geographical area will aid in soliciting the resources, as well as minimize the amount of time you need to spend at the site.

22 Anatomy of a Fraud Investigation

I needed to call the computer forensics firm back and provide them with a brief version of the plan, so they could plan to be available at the site tomorrow once access had been gained. I knew I wasn’t going to get a good night’s sleep in anticipation of the unknown with tomorrow’s plan.

LEARNING POINT It is common for targets of investigations to access and/or withdraw funds from known and unknown bank accounts even after an investigation has been initiated. Monthly bank statements and other bank provided infor mation can also be redirected by an authorized signer on the account, preventing the investigator from gaining easy access to the statements and correspondence. Worse, though, is that once the target removes the funds from the account, it becomes a negotiation issue with the target, who is now holding the funds hostage, to get the funds returned. In the meantime, bills and payroll of the victim organization still need to be funded, and without access to the withdrawn funds, alternative means to maintain the organiza tion’s cash flow must be implemented.

The target’s electronic access to banking and bank accounts must also be considered to ensure the target doesn’t access the bank accounts after being removed from employment, even if only temporarily placed on paid leave.

Therefore, planning to take control over all known bank accounts, restricting who has access to the accounts, turning off any online access and telephone banking access, and providing new instructions to each bank identifying where bank statements and other bank information are to be mailed are all important measures to ensure the funds and reporting of the accounts remain intact.

The Importance of Planning (Maximizing Desired Outcomes) 23

2C H A P T E R THE IMPORTANCE OF PLANNING (MAXIMIZING DESIRED OUTCOMES)

We were returning from dinner early Sunday evening when my cell phone rang. Since it was so late in the weekend and I hadn’t heard from Tim since noon yesterday, I wasn’t expecting it to be Tim calling me again. As soon as I looked at the number flashing on the display, I knew.

Tim apologized for calling, but wanted to let me know that the executive director would be unavailable to meet until tomorrow afternoon. Tim indicated all the other individuals could move the meeting into the afternoon, and now it was down to my schedule. I had already cleared the day and the following day knowing that, I would likely be out at the division at least one if not both days.

I told Tim the later time would be fine, and asked if anything new had been learned since yesterday’s call. Tim said nothing new was identified but that counsel had been working with the human resource director reviewing the policies and employee handbook to prepare for the meeting. I was encouraged to know such docu- mentation existed for this matter. I told Tim I would see him Monday afternoon at his office.

Monday morning’s routine ran as usual. Up and showered, fed the kids breakfast, lunches packed, backpacks loaded, and off to their school we went. When I arrived at my office I called Tim to see if anything had changed, and to find out what time we were meeting. Tim indicated the meeting was at 2:00, and that if I wanted to get to

11

his office earlier I could review the information and credit card statement prior to the meeting.

I focused on other client matters for the morning, and com- pleted what I could knowing I would likely be consumed with Tim’s matter for at least a few days during this week. I had a full schedule of meetings and client projects to address during the week, but as it happens when a new potential fraud case is identified, my schedule has to change to address the immediate concerns of the new fraud matter. After a few phone calls and e-mails, my schedule was cleared through Thursday.

It seemed like the morning dragged on forever, waiting in anti- cipation for the afternoon meeting. Finally at 12:00, I had reached my limit and headed out the door. I stopped at a sandwich shop on the way to Tim’s office to ensure I had eaten before the meeting. Many previous times I skipped eating a meal only to have to perform immediate procedures, causing me to go without food for a long stretch of time. I have become more intuitive in my planning and bring snacks to ensure I get some form of nourishment in the event the meeting turns into a marathon day’s worth of procedures ending late in the night.

! ! !

I arrived at Tim’s office, well fed and ready to get into the details. Tim was on the phone discussing late details with someone in preparation for the meeting. He motioned for me to sit in the chair in front of his desk, and he slid across to me a folder containing some documents. I put my briefcase down and sat as instructed, and reached for the folder.

Inside the folder was a copy of a United Alliance credit card statement. The card was in the target’s name and included the mailing address of his division. The statement was limited to three pages in length, with individual charge transactions listed only on the first two pages. The third page was simply the reverse side of the second page and contained the small-font legal and account contact information found on the back of virtually every credit card statement. I scanned the charges and quickly noted that the charges were very likely personal in nature with no business purpose. The card account had a balance of about $23,000 at the beginning of the month. After one payment and many charges

12 Anatomy of a Fraud Investigation

during the month, it had an ending unpaid balance of about $30,000. I noted the account had a significant balance, higher than most individual credit card owners’ balances, but not even close to the much-higher dollar levels I had seen with other cases.

There was nothing further for me to look at. Three pages, and one was pretty much useless. I stared at the statement while waiting for Tim to complete his call, but nothing further came to me from my staring at the statement.

When Tim finished his call, we shook hands and he thanked me for coming over early to discuss the matter. He got up from his desk and walked over to close his office door. Then he returned to his desk, sat down, and reached for a folder from his lower desk drawer. Tim started flipping through the papers and began to tell me that he had dealt with this controller on other issues in the past. Tim indicated that their last issue involved the division’s budget and their reporting, and Tim stated he thought the controller was not a credible individual.

Tim described the division and the four or five individuals who worked at the division. Tim stated the employees had been together for many years, and many if not all of the staff maintained a loyalty to their division’s controller. Tim told me about the layout of their offices, and that they had desktop computers on each desk, net- worked together to form a peer-to-peer network environment. Tim also stated he believed the controller had a new laptop that he used as his workstation. Tim provided me with the names of the individ- uals working in the division, as well as a brief job description for each identified staff member.

It was amazing how quickly the time went by, and before I knew it we needed to head down to the conference room, as the others to be involved in this matter would likely be arriving. Sure enough, as we rounded the corner, the others were just getting to the conference room.

! ! !

Everyone was present and accounted for at the table, with one surprise attendee added for good measure. Seated around the table were outside counsel, the executive director, the human resource director, Tim, myself, and a senior finance person who reported to Tim. Everyone looked to Tim to start the meeting.

The Importance of Planning (Maximizing Desired Outcomes) 13

Tim started out by reminding us that the matter about to be discussed was to be held absolutely private, and that everyone outside the assembled group with the exception of the informant had no knowledge about what was happening. Tim then scanned the table to ensure everyone acknowledged what he had said.

Tim distributed copies of the credit card statements to each person and allowed a minute or so to pass for review. Then he stated that he was unaware that the division even had a credit card. None of the other divisions had credit cards, and the only cards he was aware of were issued to and restricted to himself and the executive director. Tim stated that he retrieved and reviewed the detailed general ledger report for the division for the last fiscal year, and was unable to identify any payments being made to credit cards. Tim said he had had several private confidential conversations with the person who brought this credit card activity to his attention over the weekend, and the individual feared it would become known that they were the source of the investigation.

Tim shared with us that the individual still worked within the division, and was terrified of the controller and his office manager. Tim said that according to the informant, the controller had been skimming funds somehow through the division and funding a private bank account he had established at a bank separate from where the division maintained their accounts. Tim stated the individual believed the funds from that account were used to pay the credit card balance each month, and that the office manager was aware of the activity as he recorded all the activity for the division into the accounting system. Tim said the individual also stated the office manager received and reconciled the bank statements, and performed much of the other bookkeeping activity for the division at the direction of the controller. Tim ended by reminding us that how the information came to his attention would have to be crafted into a plausible story to avoid disclosing that an informant from the division provided the tip.

Ideas and suggestions were discussed around the table, and none of the stories seemed plausible. The credit card was in the name of the controller and included the division’s mailing address. Any calls or mail from the card company would have been directed to the division, and we could not come up with a way to identify a link as to how we came upon the one-month statement in our possession. Then we started thinking of other storylines beyond the credit card statement. After much discussion, it was decided that we would go

14 Anatomy of a Fraud Investigation

with a story involving the division’s financial activities. We were instructed that if anyone asked how the matter was identified for investigation, we would indicate the information was confidential, and direct all inquires to Tim to handle. Otherwise none of us were to provide any response beyond sending the individual to speak with Tim. Tim and outside counsel arranged to discuss the story in further detail after the group meeting, to ensure what Tim provided was consistent with counsel’s requirements.

With that completed, Tim turned his attention to me and asked me how we should proceed in investigating the provided informa- tion. Needless to say, I had many questions to be answered before I would propose a plan for the fraud investigation. Here are the questions I raised, along with the information I was provided.

LEARNING POINT Specific laws exist to protect whistleblowers and confidential sources of tips, complaints, and information. One must be familiar with these laws and requirements, or run the risk of suffering unintended consequences that could cause more damage to the organization beyond the impact of the fraud itself being investigated. Retaliation lawsuits have had devastating financial impacts on organizations that failed to comply and protect the identity of individuals who brought matters to management’s attention. Personal safety considerations are equally important for the confidential informant. Targeted individuals may lose their employment at the least, or be arrested and prosecuted at the most, based on information the infor mant provided to management. It is not uncommon for informants to fear physical harm through retaliation against themselves or their families. Death threats and harassment are not uncommon, and all efforts should be made to eliminate or at least minimize the risk of these consequences due to improper disclosure of the informant. In many cases in which I was personally involved, the true source of the information that initiated the investigation was never learned by the target or disclosed to anyone. It is amazing how many individuals have fallen victim to ‘‘random audits’’ of their financial accounts, only to have their fraudulent activity revealed through these random audits. In many cases, they are nothing but a ruse to protect how the information was actually learned.

The Importance of Planning (Maximizing Desired Outcomes) 15

‘‘What will happen if we simply provided notice to the division that we would be conducting some internal audit procedures, and would be looking for financial information to be provided based on their records?’’ Tim immediately responded that it was likely the controller would realize something was up, as the organization had never completed anything even remotely close to any internal audit procedures. Tim continued by stating that the controller would likely ask for time to locate requested information, and would use that time to ensure any and all information pertaining to the potential fraudulent activity would be removed, destroyed, or deleted prior to our commencing of the procedures. Tim and the human resource director agreed that any advance notice provided to the controller or the office manager would likely tip them off, and any evidence in their possession would be gone.

As we discussed how we should approach the matter to collect evidence to minimize any notice to the controller and office man- ager, we identified that the best route to take to ensure evidence would not be destroyed or deleted would likely be accomplished through a surprise visit to the division on an unannounced, un- planned basis. I continued with my questions.

FRAUD FACTS Laws have been enacted at the federal level and state level within several states protecting

whistleblowers. As a fraud professional, one must be knowledgeable of the applicable

laws. Much information about these laws exists through the Internet. One site in particular,

www.whistleblowerlaws.com, is promoted as ‘‘the Internet’s most comprehensive re-

source center for whistleblowers, the media, policy makers and members of the academic

community seeking information on the False Claims Act and other whistleblower law and

policy.’’1

LEARNING POINT There are pros and cons to performing unplanned, unannounced (‘‘sur prise’’) visits to locations. The benefits of this approach include catching individuals in the act and minimizing the risk that information that would have been available becomes missing or no longer found due to advance

(Continued)

16 Anatomy of a Fraud Investigation