Ch11

card activity, and I provided them an overview of the $235,000 activity, along with the nature of the activity. Once I finished, counsel asked what measures were still in process or outstanding. I identified that the senior accountant’s requests for the invoices were outstand- ing, and that once we received the invoices, we would have everything likely to be discovered relative to the accounts and activity. Counsel asked me what I thought the next step should be to bring the investigation to a conclusion. I said I thought a meeting should be set up with the controller, to enable him to be interviewed and to determine if explanations existed for any of the activity and accounts identified. I indicated the controller was on paid administrative leave, and as such, he would be required to come to the meeting to discuss his employment. I said if we didn’t provide a means to allow the controller to explain the activity, then if a legitimate explanation existed but was never solicited and the matter moved forward, the ultimate discovery of the legitimate explanation could have a devastating impact on the organization (i.e., the controller could likely sue the organization). By providing a meeting and asking the controller questions, if he chooses not to answer any questions or provide any explanations, then later, even if he provides legiti- mate explanations, it is clear that he had the opportunity to mini- mize things but chose not to do so at the meeting (i.e., less luck successfully pursuing the organization).

After a brief discussion regarding the pros and cons of the meet- ing, who should be present, where it should be held, and what questions should be asked, it was decided that the controller would be requested to come to the main building to meet with me and Tim. It was also decided that Tim would reach out to the controller to set up the meeting and that he would call the controller as soon as our conference call ended. We discussed some potential dates in the next week or so to have the meeting, and we ended the call.

Tim called a very short time later to let me know he had spoken with the controller, who indicated to him that he had counsel representing him. Tim said that the meeting would be held in three days at his building in the conference room at 10:00 A.M., and that because the controller indicated he had an attorney representing him, counsel working with us on this matter would also be present at the meeting. Tim asked me to identify the questions I would like to have asked at the meeting, and to send them along to him and counsel to review in advance of the meeting. We ended our call, and I

Confronting the Suspect (''I Didn't Do Anything Wrong'') 153

spent the next hour writing out my questions. I sent them along via e-mail as requested.

! ! !

Three days later I arrived at Tim’s building early, just after 9:00 A.M. Tim and counsel were getting coffee, and had already put their notebooks and files in the conference room for the meet- ing. I picked a place to sit across from them, and put my files on the table as well. I met up with Tim and counsel, and we talked about the upcoming meeting. I asked them if they thought he would show up. Counsel thought for sure that the controller would show up, and with counsel. I wagered against counsel, and said I thought he would call, or have his counsel call, just prior to the meeting’s start, to indicate there had been a change and that the controller would not be coming to the meeting. I asked counsel and Tim if they wanted to wager against me and my prediction. Neither dismissed my predic- tion, but neither wagered. I said the options were that he would not show up, he would show up, he would show up with counsel, or he would show up with someone else (for moral support). I again asked if either wanted to wager based on which option they thought was going to happen. Still, no takers.

We sat at the table and spent the next hour going through what we knew to date. At precisely 10:00 A.M., the receptionist indicated that the controller was in the lobby, with his attorney. He showed— counsel was right. Too bad counsel didn’t wager—it could have been $3 or $4 if we each bet my standard $1 wager.

We put our serious faces on, while Tim went to retrieve the controller and his attorney. As they entered the room, I realized it was the first time I had really seen the controller, except for the brief glimpses of him on that initial day at the division. His attorney was a well-known criminal defense attorney, someone I had heard much about, but we had never crossed paths. We went around the table exchanging business cards. The controller’s attorney began the meeting by preaching about how wrong it was for the organi- zation to come out to the division in the manner that it was conducted, only to ruin the controller’s livelihood and his reputa- tion permanently. He continued making his statement, obviously uninformed about what really had happened and the information we had subsequently uncovered justifying the investigative

154 Anatomy of a Fraud Investigation

measures taken. Once he finished, Tim indicated that the investi- gation was not finalized and was still in process, and that the purpose of today’s meeting was to solicit information from the controller to provide explanations for the activity discovered. With that, the controller’s attorney countered Tim’s remarks by stating that he and his client were glad to see the investigation was still ongoing and that no conclusions had been reached in the matter regarding the activity. He continued, stating that he and his client were not prepared today to answer any questions or provide any information.

We all looked at him as if to ask what was the purpose of today’s meeting if no information or explanations were going to be pro- vided. Tim stated what we were all thinking and asked the control- ler’s attorney why we set up the meeting if the controller was not going to answer any questions. The attorney responded that the controller was willing to help clear things up, and that if we were to write out all the questions we would likely ask the controller and send the questions to him, he would then provide them to the controller to obtain the answers. A fishing expedition—they were here to find out what we knew to date and also to find out what they could learn about the case against the client, the controller. With that, counsel thanked them for coming in and Tim walked the controller and his attorney out of the meeting and out of the building.

Tim returned a few moments later and we discussed the meeting. Counsel asked me to review the questions that I had previously provided, and asked me to add any further questions. Counsel asked that I review my questions one last time, as should Tim with his own questions, and said that once received, the questions would be compiled into a letter to the controller’s attorney soliciting responses.

Counsel then suggested that the investigation move forward without their responses, as no responses would likely be provided. Counsel said the questions would be forwarded as indicated to the controller’s attorney during the meeting to show good faith on our part, but that there was no way a criminal defense attorney would allow his client to provide evidence that would only incriminate him. Counsel asked Tim what the organization intended to do with the information known to date regarding each individual.

Tim said there had been discussions within management, and that the controller and office manager should be pursued criminally, as well as civilly, for their involvement in the schemes. I asked Tim

Confronting the Suspect (''I Didn't Do Anything Wrong'') 155

measures taken. Once he finished, Tim indicated that the investi- gation was not finalized and was still in process, and that the purpose of today’s meeting was to solicit information from the controller to provide explanations for the activity discovered. With that, the controller’s attorney countered Tim’s remarks by stating that he and his client were glad to see the investigation was still ongoing and that no conclusions had been reached in the matter regarding the activity. He continued, stating that he and his client were not prepared today to answer any questions or provide any information.

We all looked at him as if to ask what was the purpose of today’s meeting if no information or explanations were going to be pro- vided. Tim stated what we were all thinking and asked the control- ler’s attorney why we set up the meeting if the controller was not going to answer any questions. The attorney responded that the controller was willing to help clear things up, and that if we were to write out all the questions we would likely ask the controller and send the questions to him, he would then provide them to the controller to obtain the answers. A fishing expedition—they were here to find out what we knew to date and also to find out what they could learn about the case against the client, the controller. With that, counsel thanked them for coming in and Tim walked the controller and his attorney out of the meeting and out of the building.

Tim returned a few moments later and we discussed the meeting. Counsel asked me to review the questions that I had previously provided, and asked me to add any further questions. Counsel asked that I review my questions one last time, as should Tim with his own questions, and said that once received, the questions would be compiled into a letter to the controller’s attorney soliciting responses.

Counsel then suggested that the investigation move forward without their responses, as no responses would likely be provided. Counsel said the questions would be forwarded as indicated to the controller’s attorney during the meeting to show good faith on our part, but that there was no way a criminal defense attorney would allow his client to provide evidence that would only incriminate him. Counsel asked Tim what the organization intended to do with the information known to date regarding each individual.

Tim said there had been discussions within management, and that the controller and office manager should be pursued criminally, as well as civilly, for their involvement in the schemes. I asked Tim

Confronting the Suspect (''I Didn't Do Anything Wrong'') 155

about the woman who had the United Alliance card. Tim said we would wait to decide what to do with her, but for now we should start the process with the other two individuals. We discussed the control- ler’s role and how to proceed with his involvement. It seemed pretty clear the controller had been using the organization’s funds through his personal use of the United Alliance card, and funding the activity with diverted cash payments and checks. Counsel felt the case against the controller was strong, and that it should proceed as the organi- zation desired. Then, we discussed the office manager’s role in the activity. We all agreed that the office manager had knowledge and facilitated the controller’s scheme. The question that remained was whether the office manager benefited in any way from the activity by aiding and abetting the controller and by conspiring to commit larceny for the controller’s benefit. I was confident that the office manager had benefited from this scheme, as well as through other schemes he likely had that we had not uncovered. The question was whether the information we did have to date was enough to have him charged criminally. Counsel suggested that Tim set up a meeting with the appropriate law enforcement agency to initiate a criminal complaint, and let them help determine the roles and crimes of each individual. I asked if I could be part of that meeting, and they agreed I should be at the meeting.

LEARNING POINT In many jurisdictions, police involvement begins with an initial complaint being made, often at the patrol officer level. This may differ depending on your jurisdiction as well as each agency’s approach to these types of crimes. At the initial meeting, my approach is to provide the minimum level of information required of the agency to initiate a case.

Generally, once the case is initiated or opened, it is often forwarded to a detective or someone more appropriate for these matters. Once assigned and contact has been established, a meeting is set up to discuss the case, as well as provide much more detailed information. Included in the discussions should be the victim’s desired outcome of police involvement.

In certain instances, police involvement was not initially wanted by the victim, but during the course of the investigation the target refused to cooperate, leaving few options to getting the matter resolved. If the sole goal of getting the police involved is to get the target’s attention to come to

(Continued )

156 Anatomy of a Fraud Investigation

terms with what he or she did and to discuss how his or her actions will be resolved, that too should be discussed up front with the police agency. Some agencies and officers will be willing to initiate a case to get things moving along, knowing the criminal case will likely be discontinued if the target comes to terms in dealing with his or her actions. Other agencies and officers will not want to become involved and expend resources unless arrest and prosecution are the goals. In my experience, law enforcement agencies have limited resources and don’t want to invest time and energy acting as pawns to accomplish the victim’s goals and objectives outside of an arrest.

Confronting the Suspect (''I Didn't Do Anything Wrong'') 157

11C H A P T E R CONFRONTING THE SUSPECT

(''I DIDN'T DO ANYTHING WRONG'')

Not happy about being blindsided with information that was known and should have been provided to me during the planning stages of this investigation, I decided I had had enough of this matter for one day. I ensured my notes were complete and updated, and I left the division. All the way back, all I could wonder about was what else I didn’t know that could have an impact or consequence to the whole matter. Albeit the information was sensitive in nature, treated professionally it would have been better to provide it in a controlled fashion with all the appropriate cautions due such information, as opposed to how I actually found it out. I couldn’t figure out how they thought it wouldn’t come up at some point during the case. I needed to work on something else for a while.

The next day, I received an e-mail from the senior accountant with a spreadsheet file attached. I opened the file and reviewed the United Alliance transactions detailed and summarized by card- holder. As I scanned the activity, I noted there were two charges in the entire period attributable to the office manager’s card. Both charges appeared to be business appropriate. I scanned the card activity of the woman, totaling approximately $9,000, and presuming most prescriptions are filled monthly, I identified that there were too many purchases made at pharmacies within each month to be limited to prescriptions only. I figured she had remained less than forthcoming and honest with me, and that many of the purchases at the pharmacies were likely for nonprescription items. I knew she said

147

she didn’t retain the charge slips, and that the pharmacies would never provide them upon request due to HIPAA privacy laws and requirements. Either way, all the charge activity of the woman was personal in nature, regardless of her rationalization.

In regard to the charge activity of the controller, the senior accountant had established columns to categorize each transaction by type or purpose. Columns included meals, airfare, hotels, pur- chases, and other, including a column for business-related pur- chases. I noted there were not many transactions allocated to the last column. It appeared to me that all the activity was personal in nature, and that the reason a separate and undisclosed bank account

FRAUD FACTS

Your Health Information Is Protected by Federal Law

Most of us believe that our medical and other health information are private and should be

protected, and we want to know who has this information. The Privacy Rule, a federal law,

gives you rights over your health information and sets rules and limits on who can look at

and receive your health information.

What Information Is Protected

! Information your doctors, nurses, and other health care providers put in your medical record.

! Conversations your doctor has about your care or treatment with nurses and others. ! Information about you in your health insurer’s computer system. ! Billing information about you at a clinic. ! Most other health information about you held by those who must follow this law.

How This Information Is Protected

! Covered entities must put in place safeguards to protect your health information. ! Covered entities must reasonably limit uses and disclosures to the minimum

necessary to accomplish their intended purpose. ! Covered entities must have contracts in place with their contractors and others

ensuring that they use and disclose your health information properly and safeguard it

appropriately. ! Covered entities must have procedures in place to limit who can view and access your

health information as well as implement training programs for employees about how

to protect your health information.1

148 Anatomy of a Fraud Investigation

was likely used to pay the card balance was to conceal this very fact. Still disappointed with yesterday’s revelation, I put the information away and returned to working on another matter.

! ! !

Within a few days, I received a call from Tim. Tim stated he just received the bank information. I asked him what information the bank provided. He said they produced images of the deposit slips, images of any non-cash deposit items, and images of the checks that cleared the account. I told Tim that I would be over shortly.

It didn’t take me long before I was standing in Tim’s office doorway waiting for him to wave me in. He pointed to an envelope on his desk, and signaled for me to come in and sit down. I emptied the contents of the envelope onto my side of Tim’s desk, and flipped through the pages. Deposit tickets, deposit items, and canceled check images. As I flipped through the stack, I noted that most of the deposit tickets consisted of ‘‘cash’’ deposits, just as we had suspected. The few deposit tickets that contained deposit items other than ‘‘cash’’ were the larger, less frequent deposits. Each deposit, except for one, was supported with an image of the check accompanying the deposit. Each check was written as payable to Crestview and was identified as a donation to Crestview, most of which were paid from estates of prior members and the like for continued support of the organization and their programs. These donations were simply diverted into this pri- vate, undisclosed account maintained by the controller and/or the office manager. One deposit contained a notation from the bank indicating the image was no longer available. So I knew we had cash payments diverted along with checks payable to Crestview. With the diverted donations, even fewer members were needed to create the float necessary to fund the unknown bank account.

LEARNING POINT In conducting a thorough investigation involving the potential theft of funds, it is important not only to quantify the amount of diverted funds, but also to identify and quantify the source of the funds. If, for example, $100,000 of funds were identified as being diverted, then determining where the

(Continued )

Confronting the Suspect (''I Didn't Do Anything Wrong'') 149

The check images were equally interesting. Each check was payable to a vendor for some type of maintenance done at the division. The vendor names were familiar to me, as I had seen many payments to these vendors in the boxes of records. However, for these checks to have been written out of this account, as opposed to the division’s primary operating account, there had to be something different about these payments. One vendor in particular was paid for window replacements per the memo notation on each check. I remembered seeing similar payments to the same vendor for window replacement work.

I asked Tim if anyone had copied the bank-provided images, and he said no copies had been made. I volunteered to copy the records, and I made three sets. The first set was for Tim, the second for the senior accountant, and the last for my use. I returned the originals to Tim along with his copy, and suggested that he maintain the bank- provided originals in an envelope marked as evidence similar to the other evidence maintained in the storage room. Tim said he would take care of that. I also handed Tim the senior accountant’s copy, as he would likely see him before I did.

I asked Tim if he would have time to review and discuss the bank records, and Tim said his schedule was pretty full with meetings for the day. Seeing no reason to stay, I headed back to my office with my copy of the bank images. Using the senior accountant’s spreadsheet of the bank activity, I added a new sheet and began to summarize the deposit information, segregating ‘‘cash’’ deposits from the check deposits. A total of approximately $235,000 in deposits was identi- fied, consistent with the summary of the bank statements prepared

(Continued ) $100,000 came from to enable the $100,000 to be diverted will help close the loop in the investigation.

In this case, knowing that credit card charges were paid by the organiza tion, it was equally important to determine where the funds came from to fund the payments made on the credit cards. The diverted cash and check payments appeared to be the source of the funds, and the payments to the credit card company appeared to be the use of those funds. As long as the source of the funds approximates the illegitimate use of the funds, the investigation results will make sense and seem reasonable.

150 Anatomy of a Fraud Investigation

earlier. Of the deposits, nearly $35,000 were check payments to Crestview, with the smallest being $500 and the largest nearly $10,000. The donor of the largest payment included the notation ‘‘for window replacement’’ on her check. I figured the check deposited into this account, with checks paid from this account for what appeared to be window replacement work, made sense for now. Of course, I couldn’t help but wonder why the deposits and checks weren’t processed through the regular operating account, as had been the other payments to the same vendor.

That left approximately $200,000 in ‘‘cash’’ deposits into this bank account. I finished summarizing the deposits and checks, and then I sent Tim an e-mail with a list of the vendors along with the payment amounts. I asked Tim to contact each vendor and have them provide copies of their invoices to support the payments from this account. One vendor in particular, the window replacement vendor, had several payments. I asked Tim to be sure to have each vendor provide the address of where the work was provided for each invoice, to ensure the work was in fact provided to the building at the division and not to the controller’s or office manager’s personal residence. I was still trying to give both the benefit of the doubt, but I figured the reason these vendors were paid from this account versus the regular operating account was to conceal these payments altogether, as they were funded through cash deposits and diverted checks payable to the organization. Lastly, I asked Tim to have each vendor fax and also mail the copies, mainly so we could get to the information quicker but also have a hard copy for the investigation file.

Tim replied via e-mail pretty quickly, indicating he would have the senior accountant contact each vendor today to obtain the informa- tion. Throughout the day, I received copies of e-mails sent out to each vendor by the senior accountant summarizing conversations he had with them requesting their invoices. It was smart thinking, asking for their e-mails to send along a summary, to help ensure they actually sent them over to us.

I started thinking about our next steps in this matter. We had the bank account, the deposits, the checks, and the United Alliance statements and activity. It all seemed to be very straightforward— steal cash payments and checks payable to Crestview to fund an unknown, undisclosed bank account, and use the proceeds to pay for non-business-related personal purchases and activity through an

Confronting the Suspect (''I Didn't Do Anything Wrong'') 151

unknown, undisclosed United Alliance account. The vendor pay- ments will likely show the work was not done at the division, but rather at some other location, again for personal gain: $235,000 into the account, and $235,000 out. The one thing we still needed was the controller’s explanation for all of these things.

I ended my day by sending Tim another e-mail asking him if he thought it would be a good idea to have another strategy meeting or conference call to move the case forward. I didn’t expect to receive a response so quickly, but Tim responded to my e-mail and indicated we should call counsel in the morning to discuss the next steps. I e-mailed him back suggesting 9:00 A.M., and that I would wait for a call from him or from counsel.

! ! !

The next morning I retrieved my notes and prepared for the conference call. At precisely 9:00 A.M., Tim called and indicated he had the attorney on the call as well. Tim asked me to summarize what we had revealed to date regarding the account and the credit

LEARNING POINT Although it may look like a duck, walk like a duck, talk like a duck, and act like a duck, it still may not be a duck. In order to be thorough and remain objective in an investigation, you need to consider all sources of informa tion even when the findings may be obvious. One source of information would be from the target himself. If you never ask for an explanation of the findings from the target, subsequent information provided by the target explaining the activity may cast doubt over the entire investigation, and put you, the objective investigator, at risk of being labeled biased by not pursuing information from the target. If in the worst case scenario you issue your report and the target’s reputation is negatively impacted pub licly, only to learn there was an explanation and you never sought it, you may be defending legal action in the form of defamation, malicious prosecution, or something similar.

I insist that in my engagements we seek out every source of information to explain the activity and findings, even through meetings with the target. If the individual or his counsel refuse to meet to discuss the matter, then you can at least document that you attempted to obtain their side of things.

152 Anatomy of a Fraud Investigation