Ch3 write work

came with the appropriate equipment, and asked them to come to the front door when they arrived.

As I ended the call I saw a man coming toward the front door. I found Tim and let him know that someone, likely the controller, was heading toward the front door. Tim moved toward the front door, and as the door opened, Tim was standing right there to intercept him. It was in fact the controller and he was pretty angry. Tim brought the controller into a private office and met with him for quite a while, and I later learned that Tim also had the executive director on his cell phone during their conversation.

I instructed the senior accountant to retrieve the supplies from his car so that we could start systematically going through all the areas of the division, collecting the evidence that needed to be preserved. While the senior accountant was gone, I retrieved my digital camera and took some pictures of the different offices and areas while no one was around. I took pictures of each area where financial records were identified as being stored by the office manager and I took pictures of every computer, including what was on each monitor.

The senior accountant returned with a stack of banker boxes and Sharpie markers, and I looked around quickly to determine an effi- cient and systematic means to search each area. We identified a box- numbering scheme, and I asked the senior accountant to record the box number and the location within the building as the contents were collected. I also asked him not to mix items from different areas and to use a separate box for each distinct area. With that, we both started to assemble banker boxes and marked the boxes in numerical order.

LEARNING POINT You need to be prepared. Collecting evidence in fraud related cases tends to be voluminous. Having the supplies on hand will prove invaluable as the information is identified, collected, and preserved. Beyond the boxes and labels needed, you need to consider how all those boxes and computers will be transported to a secure location. A small car with 20 or more boxes will become an issue. Equally important is being organized in the collection process. Numbering and labeling will help, but you will also want to keep track of where each box’s contents were collected. These things will all need to be documented in your notebook, but why not make your life easier by documenting that information right on the boxes themselves.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 31

The human resource director came out of the office with the woman, and watched her as she collected her pocketbook and keys from her desk. Then, she escorted her out the front door and watched as she got into her car and drove away. She then came and joined us in the office area. She said the woman was very upset by what had happened this afternoon, and although she didn’t believe she was involved in the finances of the division, thought it would be best to send her home for the rest of the day. She said once the woman regained her composure, she asked if she could collect her things and leave. She said the woman stated she would be willing to talk with us, but just not this afternoon.

Having no one else to interview or send home, the human resource director asked me how she could help us with our search. I provided her with an empty box and marker, explained to her the numbering scheme and location notation for the boxes, and placed her in one of the offices to go through all the areas looking for any financial records.

I let the senior accountant start in the area of the office manager’s desk. I started with the office immediately adjacent to the business office. I beganbydrawing a roughsketch of theoffice, a floorplan,and once documented I started on my left and worked clockwise around the entire office. I opened every drawer, looked at everything kept on every shelf, and went through the entire desk in the office. I retrieved a garbage bag from my case, emptied the garbage can contents into the bag, and sealed the bag. Then I wrote out a tag identifying the location of the contents within the garbage bag. I found financial documents and records in several areas in the office. I collected the information and placed it into banker boxes labeled for that office. Records included bank statements, deposit details, and payroll records.

As I searched the office, I took breaks to check on how the senior accountant and the human resource director were making out with their areas. Each had made some progress and filled several boxes, but based on that progress, I knew we would be at the division for quite some time. I collected more empty boxes for my area and continued searching to complete the area.

! ! !

A short while later I noticed another individual out on the sidewalk heading toward the front door. I recognized him as the computer

32 Anatomy of a Fraud Investigation

forensic specialist I had called. He was someone that I had worked with several times on prior matters. I greeted him as he arrived at the front door and brought him into the office area. Once I introduced him to the others, I brought him through the building and identified all the computers identified to me by the office manager. He took out his pad and made notes for each computer, and also took pictures of each computer. Once I had shown him all the computers, I left him to do what he needed to do and returned to the office that I was searching.

Once I finished collecting everything from the office I was search- ing, I returned to the business office area to help the senior accoun- tant complete that area. By far, the office manager’s area contained the most financial information, at least for the current and previous year. The remaining historical information was stored in boxes in another area of the building. I would guess it took the two of us a good hour or more together before we completed the office manager’s area.

Tim reappeared from his closed-door meeting and informed us that the controller was in the process of collecting his personal belongings and would be leaving the building shortly. Tim, then, returned to the office where he met with the controller, and a short time later both of them emerged from the office. Tim escorted the controller out the door and we watched as he loaded his things into his car and drove away. A big sigh of relief could be heard from all the team members once he had left the building.

Tim then started calling the locksmith and alarm company from his cell phone to have them come and make the changes we had already anticipated making.

LEARNING POINT As part of planning, you should have already identified locksmiths in the area, as well as whether they perform service on a 24 hour basis. Locks will need to be changed on the spot before the scene will be considered secured from unauthorized access by the target. Whether an alarm system is involved should also be determined in advance, and the contact information for the alarm system should be identified, if possible, in advance. I don’t believe either should be provided advance notice, as either could have a relationship with the target, providing a means for the target to be tipped off about the imminent investigative measures to be executed.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 33

I left the office areas to be completed by the senior accountant and human resource director and headed into another area of the building with boxes and markers. I noticed two black file cabinets on my journey through the building that had not been described by the office manager. I opened the cabinets and found historical financial records for the division, albeit older than likely needed. I docu- mented the file cabinets’ location and contents within my notepad, and considered the need to collect the older information. I decided the information was likely too old and not relevant, so I retrieved my bag and took out a roll of evidence tape. I unrolled the tape and placed a seal across the front of all the drawers in the file cabinets to ensure no one went into the file cabinets. Later I would learn that I left that roll of tape on the file cabinets and would have to buy a new one for future investigations.

I reached my planned destination area of the building and found financial records and reports, paid invoices, and other records from earlier fiscal years. The records pertained to periods two or more years ago, but because we had no idea how long the potential scheme could have been occurring, I decided all the records would need to be collected and preserved. I started making more banker boxes, placing the records into the boxes, and labeling the boxes. I finished the area some ten boxes later, and looked around to ensure I had not missed any records. I was also out of boxes.

! ! !

I met up with the computer forensic specialist who was collecting the computers throughout the building and bringing all of them to one table near the front door. I could see on his pad that he had sketched the area of each computer, as well as made notes for each computer. Once he brought the last computer to the front, he asked me if he could take possession of the laptop sitting on the controller’s desk. I found it interesting that the controller went to his desk to retrieve his personal items and left the laptop on his desk behind when he left the building.

We went and found Tim and the human resource director talking in a hallway. We asked them about the controller’s laptop left on his desk. We indicated the laptop was closed and appeared to be shut off. Tim indicated that the informant had mentioned the controller’s laptop, and thought the controller had purchased it

34 Anatomy of a Fraud Investigation

recently with his own funds. That being said, the question was whether it was the property of the organization or the controller. If it was the organization’s, then seizing and examining the laptop drive contents would not be an issue. However, if it turned out to be the controller’s personal laptop, then we would need to think through whether we should access the laptop drive without the controller’s knowledge and consent. The human resource director knew nothing about the laptop to provide any guidance regarding the organization’s technology policies.

The fact that the controller removed his personal belongings in the presence of Tim, and left the laptop behind on his desk, raised some interesting questions. Was the controller relinquishing his ownership of the laptop by leaving it behind, or could the control- ler have left it behind as a trap for the investigation? In order to ensure we did not jeopardize the entire investigation, we contacted counsel.

It was a good time to utilize counsel’s advice for the laptop issue as well as the controller’s office in general. No one had surveyed the office since the controller left the building, and it needed to be searched for any financial records. However, given the fact that the controller locked his office at night, there was a chance the controller had created some level of privacy. As with the laptop, advice on where we could search and what we could collect as potential evidence would be needed to ensure the investigation was conducted properly.

LEARNING POINT It is for exactly such issues as the laptop that it is best to have counsel on board and available to provide guidance. If we were to seize and access the laptop, only to learn it was the personal property of the controller, our actions could undermine all the other well contemplated measures and procedures in the case. If by chance there was a ‘‘smoking gun’’ in the case and it resided on the laptop, our access could prove detrimental to the entire case if it later was successfully argued that we should not have accessed the laptop in the first place. A better route would be to secure the laptop, seal it, and wait for legal guidance on a decision as to whether it can be accessed or imaged.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 35

Tim called counsel using his cell phone, and once connected, put counsel on speakerphone. Tim, the human resource director, the computer forensic specialist, and I were all in the controller’s office. Tim explained that the controller had left the building after collecting his personal belongings from his office, and left a laptop on the center of his desk. Tim asked if we were authorized to seize the laptop as evidence and allow the computer forensic specialist to image the hard drive. Counsel asked how the laptop was acquired. Tim indicated he thought the organization purchased it, but that the informant had told him he thought the controller purchased it personally. Counsel asked several more questions, and once answers were provided, counsel made a determination that we should seize and secure the laptop for the time being, but that we should hold off from accessing or imaging the hard drive until further research could be performed to determine if the organization had in fact purchased the laptop.

The computer forensic specialist drew a sketch of the laptop and location in his notebook, and then took several pictures of the laptop in its original location. Then I put an evidence seal over the opening edge of the laptop and a second one across the hard drive cover plate, to prevent anyone from opening the laptop or removing the hard drive. I then made notations in my notebook, and turned the laptop over to the senior accountant, who placed the laptop into a numbered banker box. The box was placed with all the other boxes of potential evidence collected up to that point, and a real pile of boxes was accumulating.

! ! !

We turned our attention to the controller’s office. Counsel remained on speakerphone as we described the different areas of his office. His desk was centrally located with seven drawers, three on each side and one in the center. None of the drawers were locked. There was a stack of papers and information on the top-left surface of the desk, along with other stacks on shelves on the wall. As we described each area, counsel provided permission to access the area and search for any financial information. There was a trash bin on the floor to the left of the desk, and the bin was full of discarded papers. Counsel allowed us to collect the contents in the trash as the controller had placed the information in the trash, eliminating any expectation of privacy.

36 Anatomy of a Fraud Investigation

I was responsible for the controller’s desk along with the trash bin. Tim and the human resource director worked the shelves along the wall, and the senior accountant worked within both areas by providing boxes and documenting the areas to ensure the seized information did not get co-mingled. As I went through each drawer I found nothing regarding financial matters. The trash bin, however, contained discarded envelopes, some of which included the names and logos of credit card companies. Envelopes were found, but no statements or information regarding the actual credit card accounts. Still, the envelopes told us that credit cards did in fact exist, some- thing we could now use to connect our procedures to our knowledge that credit cards likely existed. I bagged the trash bin contents in their entirety, and labeled and numbered the garbage bag.

Invoices and statements for what appeared to be personal expenditures were found in the stack on the controller’s desk, as well as within the stacks on the shelves. The invoices included cellular phone bills, insurance policies, and other non-organizational expenses. I showed Tim the insurance invoice for short-term dis- ability coverage. The invoice listed the controller and office manager as well as the controller’s father, an individual not even employed by the organization. Similar coverage was found in the invoices for health and dental coverage. The controller’s father’s insurance coverage was included within the division’s policies and premiums, and there were notations that the father’s premiums were being paid for, or reimbursed by, the controller or his father. That notwith- standing, the father should not have even been on the organization’s policies as he was not an employee. Now we knew the potential problem was likely bigger than the reported skimming and personal use of credit cards. It appeared the division was using organizational funds for personal, unauthorized purposes.

As we were finishing the controller’s office, there was a knock on the front door at the main entrance. Tim left to determine who was at the door. I walked over and watched through the window in the office. Tim answered the door and let a gentleman in. Tim looked over and said it was the locksmith. He showed the locksmith the front doors and then brought him through the location, identi- fying other doors with locks that needed to be changed. Tim asked the locksmith to change all the locks that provided access to the building, and also asked that all the locks be keyed the same to streamline and simplify controls over the keys. Under the existing

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 37

lock configuration, a different key was needed for every point of access. The locksmith indicated changing the locks and using one common key would not be an issue. He also stated it would take an hour or two, but that he could have all the locks changed today. This was good news, especially for Tim and me, in that no unau- thorized access to the building would be gained once we left, but more importantly, we would not have to spend the night in the building to ensure no one accessed the building until the locks were changed.

Within minutes of the locksmith’s arrival there was another pair of workers walking up the front walk toward the building. Tim saw them from the window, looked over at me, and said it was the alarm guys. Tim met the pair at the door, and looked back at me while nodding. It was the alarm guys he called to disable the old alarm codes and add new access codes to the system. Tim led the workers to the alarm system access panel, and left them alone to determine the system requirements.

! ! !

I returned to the business office area and helped the senior accountant complete the area. The senior accountant had com- pleted the office manager’s desk as well as the trash bin alongside his desk. As I walked into the room the senior accountant waved me over and pointed to some papers on the top of the office manager’s desk. I asked the senior accountant where he found the papers he had placed on the desk, and he indicated he had found them in the trash bin. I flipped through the few papers, and the most interesting paper was a new-account-opening confirmation with a bank located just down the street. The new-account con- firmation was dated four days earlier, and I immediately remem- bered asking the office manager if there were any new bank accounts and his response that there were none. Then we find a new-account confirmation in his trash bin dated four days earlier. Two issues came to mind regarding the found account informa- tion. First: The office manager clearly lied about not having any other accounts, but why? Second: Why was a new account opened four days earlier, when clearly the controller and office manager had no idea we would be coming to the division to perform a surprise audit?

38 Anatomy of a Fraud Investigation

We spent the entire day at the division collecting and preserving potential evidence while the locksmith changed the locks and the alarm guys modified the alarm system along with new access codes. As areas were cleared, the boxes were brought up to the business office area. The boxes were placed in numerical order, and I wrote out a listing of the boxes in my notebook. A total of 26 boxes, four computers, and four garbage bags were collected and listed.

Once completed, the computer forensic specialist carried one of the computers out to his car. Itwas still light outside, andheparked out front to shorten the walk from the building. I followed with the second computer, and we both made a second trip to bring out the remain- ing two computers. I noted in my notebook the time the computers were turned over to the computer forensic specialist, and indicated to him that I would call in the morning to see how the imaging went. I stood out front and watched him drive away for the night.

! ! !

When I walked through the front door I noticed the locksmith had put away his tools and was talking with Tim. Moments later they shook hands and the locksmith went out the front door, leaving Tim with a few shiny new keys. Tim walked over and tried each key in the front door, to ensure each worked before the locksmith left. Tim then handed one key to the human resource director, and placed the remaining keys in his pocket. I asked Tim where we were going to

LEARNING POINT When searching for evidence, you need to consider all the areas where evidence could be found, including trash bins, recycling bins, shredders, and dumpsters. In my experience, significant evidence supporting allegations has been found in these areas, as was the case in this matter. While cross cut shredders would prove to be a challenge for reconstructing shredded docu ments, the ribbon cut shredder allows a much easier piecing together of the shredded documents. The large, often blue colored shredding boxes found throughout larger organizations don’t require any reconstruction at all, as the documents are slipped into these collection bins intact for future shredding. Collect everything possible, because if it is not collected it could be lost forever. You can always sort it out later and discard what is not needed.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 39

storetheboxesandbagsforthenighttoensurecontrolwasmaintained for chain-of-custody purposes. I indicated we could transport all the boxes and bags to my office where they would be stored within the secured evidence room. However, access to the boxes and bags would be restricted unless I was there and available to provide access. Tim thought of alternative locations, and identified a private storage room within themain office.Timindicatedthestorageroomwas locked,and that access was limited to certain designated individuals. Tim said he would secure the room for the night, and have the lock changed in the morningsothat hehad the only key to access theroom. Tim also stated that due to the lateness of the hour, no other individuals with potential access would still be in the building, and he could control access until such time as the locks were changed. It was agreed that all the boxes and bags would be transported directly from the division to the main office, and secured in the locked storage room for the evening.

As I discussed with the senior accountant and human resource director how we were going to get all the boxes and bags back to the main office, Tim went to check on the status of the alarm system guys. Tim returned and indicated they would be finished within a few minutes, and that they would need to show him and the human resource director how to arm and disarm the system.

I decided we should move the boxes and bags from the building through the side entrance to minimize the risk that our stream of boxes leaving the building could bring unwanted attention to our mission. I walked down to the side entrance and looked out to see if there was room to move other vehicles to the side of the building. I asked the senior accountant to move his car around the side, and started moving boxes from the business office closer to the side door entrance. I started carrying boxes in numerical order out to my car, as did the senior accountant. Tim and the human resource director joined us once the alarm system guys had left the building, and together we filled three cars with all the boxes and bags.

LEARNING POINT Every detail should be contemplated when possible in order to ensure the goals or desires of the engagement are accomplished. In this case no media or outside attention was wanted, and the goal was to be as discreet as possible.

(Continued )

40 Anatomy of a Fraud Investigation

I updated my notebook with the time we completed the proce- dures at the division as well as the box numbers within each car. I also documented who accompanied each set of boxes and bags on their journey from the division back to the main office. Tim, the senior accountant, and I sat and waited in our cars as the human resource director shut off the lights, closed up the building, set the alarm, and locked the side door after she exited the building. I noted the time the building was locked.

The human resource director thanked us for a job well done, got into her car, and drove off for the evening. Tim pulled out next, followed by the senior accountant and myself. We drove directly from the division to the main office. When we arrived a short time later, Tim went in to open up the building, while the senior accountant and I remained in the parking lot with the cars.

Leaving with the boxes out the front door to waiting cars would have likely drawn attention to what we were doing. By using the side access, our cars were hidden by the garage from the busy street out in front. While a street ran alongside the building, there was much less auto and pedestrian traffic on that side, minimizing our exposure. Staging all the boxes near the exit of the building also allowed the quickest and most efficient means to fill the cars, minimizing the amount of time we could have been seen by anyone else.

LEARNING POINT In order to ensure the collected evidence can be presented in a case and survive scrutiny regarding the collection, handling, and maintenance of each item, each item of evidence must be properly collected, marked, tracked, and secured from the time each item is located up through the time each item is presented in court. Each item must also be preserved in the exact state and condition in which it was found.

The controlling and tracking of each evidence item from start to finish is known as preserving the chain of custody. Any potential break in the chain could lead to the evidence being ruled inadmissible, and many well known highly publicized cases have been ruled on based on the admissibility or inadmissibility of evidence. If a piece of evidence was the ‘‘key piece,’’ or

(Continued )

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 41

Tim exited the building through a door in the rear, and walked over to retrieve his car. We drove closer to the open door and parked. We carried the boxes and bags one by one to the doorway. Each box was brought directly into the designated storage room, and when the last box was placed in the room, I inventoried all the boxes and bags to ensure they were all included and properly stored. I updated my notebook describing the transport and storage, and noted the time. I then placed a small piece of evidence tape across the door to the frame to ensure no one accessed the room until I returned in the morning. Then Tim locked the door and shut the lights in the hallway. The senior accountant and I waited out in the dark by our cars as Tim locked up the building.

When Tim came around we talked in the dark about the day’s events. Tim thanked us for our efforts, and stated he was pleased that the planned measures went off without a hitch. Tim expressed his surprise that no media had been tipped off once we arrived and took control, and was pleasantly surprised that it seemed no one even noticed us carrying computers and all the boxes and bags from the building into our vehicles. Given the busy area in which the division

(Continued ) it was critical to proving or disproving the case, the entire outcome of the case could be forever changed, likely to the detriment of the party who sought to present the evidence.

Therefore, thought and consideration must be directed toward how evidence will be collected, recorded, tracked, and maintained. This could be as simple as collecting a signature stamp used by an employee for processing unauthorized check disbursements, or as complex as dealing with a ware house full of documents, ledgers, statements, and other financial informa tion. Collection, transporting, tracking, and maintenance will be distinctly different based on the two extremes. The mechanics of how this would occur will also vary greatly based on what is available and being provided.

The information to be sought as potential evidence could be in paper form, or it could be stored electronically as files. For electronically stored information, it could be on site on a hard drive of a local personal computer, or it could be maintained on a virtual file server located anywhere on the Internet. How access will be gained, how it will be authenticated and preserved, and how it will be maintained will all be dependent on the location and volume of the electronic data.

42 Anatomy of a Fraud Investigation

was located, it was contemplated that such things could have occurred. Therefore, these issues were identified during the plan- ning stages, and measures were identified to respond to the issues including directing all questions to Tim in the event of media or any other parties appearing and asking questions.

LEARNING POINT Proper planning contemplates as many potential risks and issues as possible, as well as identifies steps and measures to be taken should each risk or issue materialize. It is always the hope that as few measures as possible will actually be needed.

In this case the media could have been tipped off by any of the individuals who were removed from the building, or someone could have simply spotted the computers and boxes being carried out from the building if they happened to be passing by in the area. It would not be a stretch for an alert or nosy neighbor or passerby watching the activities to contact the media or the police, resulting in unwanted attention on the situation.

Preserving the integrity of any parties and the investigation should be of paramount concern, and little to no information should be provided unless the information to be provided has been planned and approved by the organization and counsel.

Identifying who should handle the media and what every other individ ual involved should say or do are important issues to discuss and plan prior to initiating an investigation. Preparing a statement or response for the identi fied point person to provide to the media should the media become aware of an investigation is also important.

While these are important aspects to consider in an investigation, they are often ignored or overlooked risks or issues in many investigations. This is clearly evident by the surprised and unprepared look and response of an unsuspecting individual captured by a looming camera crew and reporter at a scene.

Equally important is the consideration of a prepared statement or response when news of an investigation, or the results of an investigation, could become public information. Many times the nature and tone of the media story can be directly influenced by voluntarily releasing facts and information to the media, which could result in a much better story for the organization.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 43

It was late and time to head home. Tim said he would be in first thing in the morning when the building opened at 8:00. I asked him not to access the storage room until I arrived. I wanted to be able to document that I cut the evidence tape over the door, breaking the seal, to ensure that no one had accessed the room during the night. Due to my morning family obligations, we agreed to meet at 8:30.

44 Anatomy of a Fraud Investigation

3C H A P T E R COLLECTING THE EVIDENCE (A.K.A. ‘‘THE RAID’’)

As predicted, I didn’t get much sleep. Normal morning routine, and then I headed to my office to catch up on a few matters prior to driving out to the area of the division for 12:00. I couldn’t wait in my office much longer, and headed out at 11:00. A bit early, but I knew I had to be out in the field waiting rather than sitting behind my desk. On my drive out, I called Tim to see if anything new had happened since we last talked at 5:00 P.M. yesterday. He indicated that he was heading out into the area as well, and we decided to meet at a local diner not far from the division to have an early lunch. Tim called his senior accountant, and before long the three of us were sitting in a booth rehashing the plan one last time over hamburgers and fries. Shortly after starting to eat our lunch, Tim’s cell phone rang. The human resource director was calling to let him know she was in the area looking to meet up with the rest of the team. She indicated she was sitting in her car in a parking lot within view of the division, and that nothing unusual was happening.

We finished our lunch and headed back toward the division, looking for a place to sit and wait for the call from the executive director. Tim led the procession in his car, followed by me and the senior accountant. Tim pulled into a parking lot a few blocks from the division, and backed his car into a spot at the edge of the lot facing the business. I backed my car in next to Tim’s, the senior accountant backed his car next in to mine, and the human resource director backed in last. Then, we rolled down our windows so that we could talk without getting out of our cars.

25

As we waited for the call, I noticed that the employees had gathered in the large window facing the parking lot, and were all staring at us. At that same moment, Tim’s cell phone rang.

Tim answered his phone, and indicated to us it was the executive director calling to tell us the controller was with him, in his office. With that, Tim gave the thumbs-up sign and pulled his car out of the space. I followed Tim out of the parking lot, with the senior accoun- tant and the human resource director directly behind me. As I looked back, I watched the employees follow our four cars with their stares as we left their lot. A big sigh of relief for them, I am sure.

I followed Tim to the small parking lot next to the building, while the senior accountant and human resource director parked in front of the building. Tim and I walked around the side and met up with the others and we walked to the front door as a group. Tim took the lead and opened the front door to their building, and was greeted immediately by the office manager. Tim identified himself as the chief financial officer of the organization, and stated to the office manager that we were there to perform an audit of the financial records. With that, Tim pushed on through the door toward the office areas, followed closely by the office manager. I watched the office manager to ensure he didn’t take or touch anything, and as we entered the offices I noticed a woman working at a desk, with a ‘‘deer in headlights’’ look on her face.

I instructed the office manager to head directly into the confer- ence room without going to his work area or touching anything, and the human resource director asked the woman working at her desk to get up and follow us into the conference room. Both followed without touching anything and I stayed with them in the conference room with the human resource director while Tim and the senior accountant walked through the division looking for other employ- ees. They returned a moment later and indicated there was no one else in the building.

LEARNING POINT Keeping control over the scene and situation is key to maintaining safety issues as well as preserving evidence. I have heard many stories from victims and colleagues who have investigated financial issues where the target was allowed to return to his work area, or worse, asked to come to a meeting at

(Continued )

26 Anatomy of a Fraud Investigation

The senior accountant took the woman into a small office while I remained inthe conferenceroomwith the office manager and human resource director. I identified myself to the office manager, and indicated to him that we needed to ask him some questions regarding his role and responsibilities within the division. The office manager agreed to talk with us, although still quite shocked by our abrupt appearance at his location. Before I asked my first question, he asked us where the controller was and why we were doing an audit while the controller was out of the office. I stated that the controller was not informed of the audit until this morning, and that the information we sought would not necessarily need his involvement. Just then, the office manager’s cell phone rang. As he looked down to see who was calling, I looked at the human resource director and nodded. The office manager answered the call and indicated to the caller that we had just arrived and were starting to ask him questions about his job and the finances. I could hear the caller across the table, and he ended the call by stating he would be at the division shortly. The human resource director also heard the caller, and left the room to let Tim know that the controller would be coming to the division shortly.

As soon as he ended the call, I asked him basic background questions (What is your name, How long have you worked here, What is your position, Do you have a title, etc.). He provided responses to all of my questions. I asked him where the accounting system was located and on which computers the files resided. He stated the accounting system and all the files for the division resided on his hard drive, and that through a peer-to-peer network he had configured in the office, the controller and the woman with the ‘‘deer in headlights’’ expression could access the files from his hard drive using their separate computers.

his convenience, only to use that opportunity to delete files, change pass words, destroy evidence, and eliminate any and all information within his control so it could not be used against him. If a decision has been made that evidence could exist and the target does not know his potential scheme has been illuminated, the best possible scenario is to immediately separate the target from the areas where evidence may exist. If his computer is on, leave it where it is and in the condition it was found. If it is off, leave it off. Secure it.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 27

I asked him where all the computers were located. He identified four desktop computers, as well as a new laptop used by the con- troller. I asked him where the controller kept his laptop. He indi- cated it should be on the center of his desk. I asked him where the financial files and records were stored within the division. He stated the files were stored in multiple locations throughout the building, with the most recent files maintained in drawers in and behind his desk. He also stated the most current bills and deposits were in a bin on top of his desk. I asked him if he would be willing to show me where the financial files and computers were located, and he agreed to show us the locations.

I asked him to identify all of the banks and bank accounts utilized by the division. He named various banks and accounts, and I listed the accounts in my notebook. I asked him if there were any other bank accounts and he stated there were none. I asked him if the division used any credit cards and he stated there were none. I asked him who generated all the checks and signed the checks, and he stated that he generated all the checks, but that the controller signed all the checks. He also said the controller maintained his own set of records over certain accounts and therefore had little to do with those accounts. When I asked him to identify what accounts he was referring to, he said we should ask the controller himself about those accounts. He provided no further details about the accounts.

We left the conference room and the three of us walked throughout the building. As he identified the various locations, I asked him what information was stored in each area. I carried my steno pad and made notes of each location along with the de- scribed contents provided by the office manager. He identified files maintained in multiple locations throughout the building and showed us the five computers (four desktops plus one laptop). He stated that two of the computers were old and no longer used. He showed us the newer laptop that was actually sitting on the controller’s desk (another sign that they had no idea this was about to happen).

Once he identified the last location and indicated there were no further records or computers in the building, we returned to the conference room. I asked him if he had any files, records, or other information pertaining to the division at his house or any other location outside of the building, and he indicated

28 Anatomy of a Fraud Investigation

he had no other records pertaining to the division. I asked him for any passwords that we would need to access the systems and programs. He provided me with the network system administrator password, and said that if I logged into the network using the Admin user ID and password, I could change any of the users’ passwords. Therefore he would not provide his personal pass- word. I asked him if QuickBooks had any passwords, and he provided me with the password to access QuickBooks. I made sure I documented all the user IDs and passwords he provided in my notebook for future use. With that I thanked him for his time and cooperation and left him in the conference room with the human resource director.

After I left the conference room, the human resource director indicated to the office manager that he was being placed on paid administrative leave and that he would be escorted back to his desk to retrieve his jacket and would be escorted out of the building. He was provided with some forms, escorted to his desk by the human resource director and Tim, and then walked out the front door. I watched as he was walked out. He was not happy, but got into his car and drove away. I watched out the window to ensure that he actually drove away and did not return to the building.

LEARNING POINT As discussed earlier, safety should always be a concern when doing fraud investigations. Placing an individual on administrative leave, or worse, terminating an individual’s employment, could present a potential risk to those involved, due to the unknown of how the individual will react. Being prepared, having a plan, and identifying potential risks regarding the individual will help the situation. Until the individual leaves the property, there may be a safety risk to those involved, as well as to others like co workers, supervisors, and management. Observing individuals until they leave the property will identify if they potentially retrieve a weapon from their vehicle and return toward the building. It is unfortunate that such measures need to be contemplated, but in today’s society, such events are not uncommon, and preventing yourself from being ‘‘surprised’’ should always be a concern.

Collecting the Evidence (A.K.A. ‘‘The Raid’’) 29

I went to the office with the senior accountant and the woman who had been working at her desk across from the office manager’s desk when we first arrived. I asked her similar basic background questions, and shared with her the information regarding the computer and financial records locations identified by the office manager. I asked her if there were any other computers or locations for storing financial records that were not identified by the office manager. She reviewed my notes and stated that she did not know of any other computers or locations. She also stated her job did not involve accessing or maintaining financial records, and that she would not know all the areas that the records were stored. I left the woman in the office with the human resource director, and I returned to the office area along with the senior accountant.

! ! !

Tim was busy on his cell phone talking with the executive director about his interaction with the controller. When Tim completed his call, he indicated that the controller had become very angry and stormed out of the office. Tim stated that based on the timing, the con- troller would be arriving at the division any minute, and that he should be solely responsible for dealing with the controller when he arrived.

I walked the building with the senior accountant and made more notes describing each office and room along with a brief description of the contents in each area. I made notes of every computer identified in the building along with the specific location and the current state of each computer (turned on or off, screen locked or opened, application on the screen if still running . . .). Once completed, I called the computer forensic specialists from my cell phone to let them know we had taken control of the division and that they needed to come and collect the computers for examination. I provided them a brief description of each computer to ensure they

FRAUD FACTS Violence in the workplace is a serious safety and health issue. Its most extreme form,

homicide, is the fourth-leading cause of fatal occupational injury in the United States.

According to the Bureau of Labor Statistics Census of Fatal Occupational Injuries (CFOI),

there were 564 workplace homicides in 2005 in the United States.1

30 Anatomy of a Fraud Investigation