Ch12

I drove to Tim’s office with the reports, hoping he would be there to provide me with an update regarding the police report. Luck was on my side, and he was in his office. I provided him with the report copies, and asked him if he had heard anything from the police. He said he had received a voice message from a detective late in the afternoon yesterday, but due to his schedule with meetings and other obligations, he had not returned the call. I asked Tim if he wanted to reach the detective while I was in his office, to ensure a meeting would accommodate both our schedules. Tim provided me with the detective’s name, and dialed the number left on his voice mail.

The detective was in, and we set a meeting for later in the day. Tim and I would go over to the police station to discuss the case, and bring a copy of my report. While I was in Tim’s office I asked him about the insurance claim. Tim indicated he had already completed the claim affidavit, and planned to simply attach a copy of my report to the claim. Tim said he was going to have

LEARNING POINT Simple steps can help ensure the integrity of your report is consistent with the integrity of your investigation. Once your report has been finalized, assembled, bound, and signed for delivery to your client, who is likely counsel, a quick flipping of pages within each copy of your report can identify issues in assembly that could undermine your credibility and hard work on the engagement. Obvious things can be easily corrected if identified prior to delivery of your report, things like pages bound upside down or out of order, duplicate or missing pages, and exhibits out of sequence. A rule of thumb at our firm is to sit and flip through each and every copy of every report prior to delivery, page by page, to ensure none of these things or anything else has occurred that could prove embarrassing at the least, damaging at the worst, to our reputation and our standing as an expert in our field.

Even worse could be opposing counsel using one of these easily detected issues within your report against you. If the defense’s position contends the activity was a series of undetected mistakes, opposing counsel could use you and your report to illustrate how mistakes could go un detected, and now you and your report could be being used to support the suspect’s position.

Documenting the Investigation (Your Written Report) 165

counsel review the claim affidavit prior to filing, with the goal of having the claim filed within a day or so. I asked Tim to send me a copy of the final claim affidavit filed for my files, and Tim said he would send me a copy of what was filed.

Tim and I drove over to the police station together, bringing a copy of my report. I had my audit bag with my notebooks and other information collected during the procedures, and I knew the originals for the case were still secured in the storage room within Tim’s building. I hadn’t recently checked the evidence tape to ensure no one had accessed the room, but I was fairly confident the tape would still be intact as it had been every time I did access the room. A middle-aged detective emerged from a closed door on the side of the lobby, and he introduced himself to Tim and me. The detective escorted us back through the door he emerged from and down the hall to a small interview room. We sat at a table, and the detective read the initial report documented by the patrol officer. Once finished, he asked Tim to explain what happened.

Tim ran through a high-level summary of the events from the initial tip through my final report while the detective took notes in his notebook.

166 Anatomy of a Fraud Investigation

12C H A P T E R DOCUMENTING THE INVESTIGATION

(YOUR WRITTEN REPORT)

Now I had work to do on this matter. Before we could go to the police, we needed to document the case in a fashion that the police could follow, supported by the evidence we collected to date. I knew based on my experience that we would receive the best reception from law enforcement if I created a written report referencing all the procedures that had been performed along with exhibits containing copies of the supporting evidence. Pre- sented with a report or binder, the assigned person would then be able to build his criminal case off the work we had already performed, as well as rely on an independent, objective expert (myself) working on behalf of the victim.

Knowing we were still waiting for the vendors to provide copies of their invoices for the payments that were paid through the un- disclosed account, I asked Tim if he wanted me to start documenting my report in the hope that the vendor invoices would arrive before long. Tim said he thought that was a good approach to take, and asked me to let him know when I would be prepared to meet with him and the local police department. I asked Tim to tell the senior accountant to contact me as soon as any of the vendors provided their invoices. I also asked Tim to review the organization’s insurance coverage again, to ensure the potential claim was not dependent on meeting certain requirements, such as having the suspect arrested, to get the claim paid. With that I left for my office.

Driving to my office I reviewed different approaches I could use to document my report. I knew my report would have to be

159

identified as ‘‘preliminary report’’ or ‘‘initial findings’’ until the vendor invoices were received. Once the last pieces of information arrived from the vendors I would be able to finalize my report. I reviewed my report’s audience as well. In this case I knew my report would be used by counsel in a civil matter, should the organization choose to sue the controller and possibly other involved individuals to recover its funds. I knew my report would be used by law enforcement, a prosecutor, a judge, and/or a jury in the criminal matter soon to be initiated. I also knew my report would likely be used by Tim to support an employee-dishonesty claim with the organization’s insurance carrier. Although this range of audiences relying upon my report was typical, I deliberated how best to approach documenting this case.

I spent the rest of the day organizing my thoughts and notes, and spreading out the copies of the evidence collected. I printed the various spreadsheets I had prepared or had received and revised from the senior accountant, and determined which items would need to be added as exhibits to my report to support my findings. Then I started writing.

LEARNING POINT Writing, reading, editing, and rewriting the report is a very time consuming period in every engagement. I know when I write my reports, I want to be sure to include all the pertinent details and findings, but at the same time I want the report to be easily read and followed by someone with much less financial experience. As I started to write my narratives, I created references to numbered exhibits that I knew I would need to include to illustrate detailed information and findings.

The approach I use in documenting my report allows my report to stand on its own, meaning that everything needed to support my proce dures and findings is contained within my report as an exhibit. In most cases, my report and exhibits need to be presented within three ring binders. The goal of this approach is that anyone who reads my report can easily go to the detailed exhibits to review the supporting information as well, minimizing the need to ask me for additional information or details. If something were to happen to me once a report was issued, everything needed to substantiate the report contents would still be available directly within my report as attached exhibits.

160 Anatomy of a Fraud Investigation

I continued writing the next day as well. By that afternoon I had drafted my preliminary report based on the procedures performed to date, and had included all the exhibits needed to support my preliminary findings. The next morning I printed the report and sat in my conference room where I read the entire report without any interruptions. I marked up the report with a red marker as I customarily do, and went back to my desk to make all the changes to the actual report file. I saved the updated report with changes to the same file name as the initial report file.

Once satisfied with my ‘‘preliminary report,’’ I printed a copy and prepared a fax cover letter to counsel. Since we were waiting for vendor invoices anyway, I figured I would have counsel review and approve the report up to this point, and simply update my report once the vendor information was received. I also knew with Tim there would be no way I could finish and issue my report without his prior review and approval of a draft. In my fax cover I asked counsel if I should fax a copy to Tim for his review at the same time. I

LEARNING POINT Saving drafts: My experience has shown me that drafts or versions of reports can be problematic to the case if they are retained. While drafts are common as your report is being drafted and ultimately finalized, each draft identifies the changes made since the last draft or version.

A common practice is to never retain drafts, as drafts do not exist. Each time a report is revised toward issuance, the file is saved over the prior file, leaving the sole file on the hard drive. All pages printed for review and revision are shredded and not saved, if printed at all. Drafts are not shared with outside parties, and if a draft is prepared and discussed with an outside party, such as with counsel, then and only then is a hard copy of the draft retained for the engagement files. The electronic file is still overwritten as the report is finalized.

It is important to remain consistent and compliant with your firm’s draft policies. In many cases, I find myself reminding counsel who retained me that if I were to produce a draft of my report for their review, then I would have to retain the draft as part of my files subject to discovery by opposing counsel. In most cases, a draft is no longer desired.

Documenting the Investigation (Your Written Report) 161

faxed my report to counsel, and put Tim’s copy aside pending approval from counsel.

Later in the day I received approval via e-mail from counsel to send my draft preliminary report to Tim for his review. I faxed it over, and asked him in my fax cover to check with the senior accountant regarding following up with the vendors for copies of their invoices.

! ! !

At the end of the day I called Tim to ask him how he made out reviewing my preliminary report. Tim said he had reviewed the report, and was sending back ‘‘suggestions’’ to clarify things or add more details. Tim knew it was my report and I didn’t need to make any changes to address a client’s suggestions, but typically the changes suggested are minor and don’t change the context or facts in any way. Further, the client typically wants to feel they contributed to the overall investigation, and by suggesting changes to the written report, they have made an impact, albeit a minor one, to my report. I also knew in the end that I, the expert, objective, unbiased, inde- pendent forensic accountant, am responsible for the report I issued, and that it must reflect my procedures, findings, and conclusions unfettered by the client or anyone else.

FRAUD FACTS Although the following references to North Carolina and laws vary from state to state, this

ruling is the general standard in federal and most state court systems.

‘‘Plaintiff’s assertion of the attorney-client privilege to shield discovery of any

communications with counsel involving his expert opinions is misplaced. Expert witnesses

are subject to specific rules of discovery under the North Carolina Rules of Civil Procedure.

Generally, the facts known to and the opinions held by an expert are discoverable as well as

the materials the expert relied upon in coming to his or her opinion. If [the expert’s]

opinions are based upon any information supplied to him by counsel, that information is

discoverable and Plaintiff is required to make disclosures of that information.’’1

The drafts, e-mails, approvals, and such in this case all constitute discoverable

communications, which is why you want to minimize all communications including what

you document in your notes and in your files regarding the engagement.

162 Anatomy of a Fraud Investigation

I received and reviewed the suggestions identified by Tim—all minor changes, mainly cosmetic in nature. Nothing was recom- mended changing or influencing the nature of my procedures, the results, or my findings. I made the changes and saved the file over the original file, leaving only the latest file on my computer drive. Then I called Tim to discuss setting up the meeting with the police. I reached Tim in his office, and indicated that we should start the process using my preliminary report. Tim agreed, and asked if we should provide a quick update to counsel before proceeding. I agreed, and Tim was able to connect with counsel to join us on our phone conversation.

After a brief discussion regarding my preliminary report, coun- sel said we should proceed. Tim said he would contact the local department to initiate a case. I told Tim that the typical response was for a patrol officer to meet with Tim to take an initial com- plaint, and once filed, the department would assign someone inside, a detective or someone similar, to handle the case from that point forward. I told Tim that he should provide minimal information to the patrol officer, enough to document a complaint worthy of follow-up by the department, and not provide a copy of my preliminary report. I said once the next person was assigned and contacted Tim, we should meet and review a copy of my preliminary report at that time. Tim agreed with my approach and said he would call today to start the process. I told Tim I didn’t need to be at the initial reporting, but that once he was contacted by the individual assigned the case, I wanted to be at that meeting. Tim agreed.

A few hours later I received a call from Tim. He said he met with a patrolman who came to his building and took the initial complaint. Tim said the police officer indicated he would submit his report at the end of his shift, and that the case would then be turned over to the detective division for follow-up. Tim said the officer told him he would be contacted by a detective within a few days. I asked Tim if the senior accountant had received any of the vendor information. Tim said he would check and get back to me. I asked Tim if we could proceed with the insurance claim filing, or if he wanted to wait until the vendor information was received. Tim said he would make that determination once he spoke with the senior accountant.

I received an e-mail from the senior accountant with images of vendor invoices attached. The invoices were from the window

Documenting the Investigation (Your Written Report) 163

replacement vendor. In the e-mail the senior accountant stated each vendor was contacted again today to provide their in- voices, and as any were received they would be forwarded to me for review.

I reviewed the scanned invoices and recognized instantly that the work performed was not at the address of the division, but rather at the personal residence of the controller. I updated my spreadsheet of the bank account activity, and allocated the invoice amounts to the controller’s column of diverted funds.

By the end of the day two additional similar e-mails were received from the senior accountant. In both cases the invoices reflected repairs or maintenance-type work performed, but the address of service was not identified on the invoices. I called Tim and asked him how we should treat the remaining disbursements from the bank account. Tim said we should check with counsel but prepare to move forward as if no additional invoices were received from the vendors. Tim suggested all the checks be in- cluded in the claim, unless counsel felt differently, and let the controller identify and support why each payment should not be included. I agreed with Tim’s treatment, but said I would discuss it with counsel before finalizing my report. I called and spoke with counsel, and we decided to adopt Tim’s approach for the un- supported payments, allowing me to finalize my report and move the matter along.

! ! !

The next morning I updated my report, exhibits, and analyses for the vendor invoices that were received, as well as the treatment of the remaining unsupported payments. I read my report one last time, recalculated all the amounts and totals within each analysis or exhibit, and saved the report file over the prior file, leaving only one file on my computer drive (no drafts). I generated final pages of my report along with copies of all the analyses and exhibits. I bound and signed each copy of my report, and reviewed each report one last time for assembly accu- racy. I marked each report in a manner consistently used to ensure the authenticity of each report, and prepared the reports for delivery to Tim.

164 Anatomy of a Fraud Investigation