ACCT A420 - Exam 2

The observation period used in invigilation should be approximately how long?

14 days

How many observation periods are needed for invigilation?

3

How many divisions or departments is the typical crime lab divided?

4

How does a fraud scheme differ from a fraud theory?

A complete fraud theory includes answers to who what, when, where, how, and why. A fraud scheme includes the same answers but does not include why, because the motive can vary from one individual to the next.

When there is little doubt of a subject's guilt, an interviewer is better off using:

A direct approach

What are some points of identification that could find someone in the office using his or her account to hack into the accounting database?

A few purposes of distinguishing proof may incorporate video reconnaissance or time-clock logs putting suspect in the workplace. PC logs demonstrating the individual's accounting being utilized at moment of the strike, and relating database logs demonstrating the moment of the attack. The forensic science in computing can be asked to trace back the IP address of the convict computer.

Subjects are more likely to respond when they are shown:

Kindness and sympathy

To which of the following is forensic accounting applied?

Legal matters

If a forensic accountant investigates a computer containing a critical file that is known to be highly encrypted but open, what should the forensic accountant do?

Browse the open file

What role should the forensic accountant play in collecting evidence? Should evidence collection and preservation be left only for law enforcement professionals?

A forensic accountant is a person who is well equipped with financial knowledge and investigatory skills. It can play a very important role in investigating the possible financial frauds and helping the agencies or the client in both criminal and civil cases. Preserving of all the evidence during the investigation of a possible fraud and a carefully documented chain of custody should be carried out by a financial accountant. Whenever any evidence of a fraud is uncovered they should leave the decision to the client whether to report it or not. However in some types of crimes reporting is mandatory so he/she should consider a legal advice from his/her attorney.

The primary person responsible for collecting the actual evidence to be introduced in court is:

A fraud investigator

Give an example of an item of evidence that is valid and relevant but not reliable.

A friend of the perpetrator provides a statement that she saw the perpetrator leave the scene of the rime. This testimony can be valid (truthful) and relevant (pertaining to the investigation) but if the friend later changes her story, the evidence is not reliable.

What roles does physical evidence play in financial crimes versus witnesses and confessions?

A physical or material evidence is palpable object that can be presented in a front of a judge in a courtroom. It includes written diary, journals, letter or some files in a computer or in a mail, telephone history history. A physical evidence can be proven as a solid confirmation. Witness corresponds to someone who can use his skill used against the defendant. An expert witness is those who have a specialized knowledge of a specific subject. For example to analyse data from the computer in some cases, it may be hard to prove a felony without a confession so hard material may use to obtain the confession.

Confirmations are:

A process used to determine an understatement of liabilities

A signed confession need not contain:

A reason for his commission of the crime

Give examples of situations in which a search warrant could be used to investigate employee fraud.

A search warrant could be used to investigate employee fraud when the investigator suspects that the employee keeps a separate set of records at home or on property owned by the employee, in the the trunk of the employee's car. Another example involves the situation in which collusion between an employee and a vendor is suspected; in this case, a search warrant could be sought to search the premises and computers of the vendor.

When would a search warrant not be used to investigate an employee fraud?

A search warrant would not be used to investigate employee fraud when the evidence is believed to be entirely on the employer's premises (including evidence that exists on employer-provided computers) since no warrant is necessary in this circumstance.

What is easier to trace, a static or dynamic IP? Explain

A static IP is effortless to follow. In the event that a given client has his possesses individual static IP, at the point a follow will lead straightforwardly to that individual. Then again, a hint of dynamic IP will prompt an association; the forensic accountant at the point needs to discover that at the given time which individual related with that association was utilizing the dynamic IP. If he/she fails to obtain such data by themselves then they must seek the professional help and advice.

Discuss the various ways a subject can avoid answering specific questions.

A subject might assert that he does not want to say anything bad about a person or engage in "gossip"; in this case, the interviewer could state that the subject would be fulfilling a duty to, for example, his employer, and the information he provides will not be repeated as gossip. A subject might say that he doesn't remember; in this interviewer could tell the subject that he will ive him a few minutes to think about it - at the end of the few minutes, the question should be re-asked. A subject could respond to a question by attacking the interviewer by saying, for example, "What do ou mean by that?!" In this case, the interviewer should treat the question as a legitimate one (instead of treating it as an attack) and respond by saying, "I don't know Why would you do that?" A subject might also respond to a question by asking "Why are you bothering me?" The interviewer should explain that he is not trying to bother the subject and that he merely trying to do his job.

Which of these does vertical ratio analysis involve?

A within-statement approach to analytical review

In what type of fraud might it be possible to make a case against a fraudster without catching him in the act?

Almost any type of fraud can be proved by physical and documentary evidence.

Analytical procedures are comparisons of recorded amounts to which of the following?

Amounts to be expected by auditors

Comparing financial data with results the entity itself expected requires:

An attainable budget

What do most document examiners study?

An exemplar of the person suspected of authoring or altering a document

The net worth method can be used as:

An indirect form of evidence

If the subject of an interview is willing to cooperate, the interviewer is better off using:

An induction approach

When would an interviewer want to use confrontational questions?

An interviewer can use confrontational questions when she wants to judge the reaction of the subject (usually suspect or a person who is providing an alilibi for a suspect) to information that contradicts information the subject has provided earlier in the interview. The interview will pay close attention to the body language indicators as well as determine whether the subject's story changes; both of these will provide evidence of whether the subject is lying.

Discuss what a company subject to a debt-to-equity ratio covenant might to do to reduce the ratio so that it does not exceed the bank's stipulated ratio.

Any action that would reduce debt or increase equity would reduce the ratio. There are legitimate ways and illegitimate ways to do this. The illegitimate ways are not ant-GAAP; these involve fraud. Legitimately, the company could offer an incentive, a "sweetner" to convertible debt-holders to induce them to convert the debt they hold to stock. Or the company could simply issue additional stock. The company could also issue stock options having a favorable exercise price; once the options are exercised, the company issues stock and the debt-to-equity ratio decreases. Not so legitimately, the company could debit its liabilities and credit sales to transfer some of its debt to the sales account. (Or, it could record new debt as sales) The company could also record new debt (or transfer old debt) as equity although the paucity of changes to equity accounts would make catching this action fairly easy. If a company is thinking of increasing its equity, any action that would increase revenues (and gains) and decrease expenses (and losses) would cause an increase to equity since net income is a part of retained earnings, which is equity.

Evidence is defined as::

Anything that affects the truth or falsity of an assertion made in an investigation or legal proceeding.

How is the fraud triangle helpful in interviewing?

Armed with the knowledge about the suspect's pressures, perceived opportunities, and rationalization, the forensic accountant can formulate an informed strategy for the initial interview.

Discuss how you might resolve a suspect's allegation that the amount of cash on hand in your net worth method is understated

Ask the suspect questions about the additional amount of cash such as: - How did you acquire this cash? - Did anyone else know of this amount of cash? - Was this cash spent or do you still have it? In addition, those who the suspect names as knowledgeable about the additional cash could be interviewed although the forensic accountant should be aware that the person could be a relative, business associate, friend, or even an associate who has an interest in seeing the suspect prevail in court.

What information or indications could provide predication for asking assessment questions?

Assessment questions could be asked if the subject responds to questions by displaying body language indicators; by providing information (or not directly denying) that he had access to assets taken and/or that he had a motive for committing the fraud, such as the need for assets to pay bills, disdain for the employer or victim, feelings of being unappreciated and/or underpaid; tolerance of the actions of the fraud perpetrator; suggestion of lenient punishment for those who are guilty; and reluctance to implicate anyone.

At what point in the investigation process is it important to develop a fraud theory?

At the very beginning, right after the engagement process is complete and when the evidence gathering process begins.

Discuss the reasons for and against audio recording an interview.

Audio recording an interview can provide the benefit of having a more nearly complete record of what questions were asked and especially the responses that were provided. However, audio recording might inhibit the responses of the subject and thus restrict the quality and quantity of the information that would had been provided had the interview not been recorded.

An objective of the review of physical and document evidence is to:

Become as familiar as possible with the business processes involved

What are some body language indicators that suggest that a subject is lying during an interview?

Body language indicators include sitting in a "flee position" (legs and feet face the door), change such as crossing did not occur in response to nonsensitive questions) significant pauses before answering questions, picking at clothes or fidgeting (playing with pen, pencils, or keys) swallowing, biting lips, covering mouth with hand, and perspiring.

Define calibration and discuss how and why it is used in interviews.

Calibration is the act of fine-tuning an interviewer's perception of person's behavior when the person is asked nonsensitive questions so that the interviewer can contrast that behavior with the subject's behavior when asked sensitive questions. It is used in interviews to provide clues about a person's guilt or, at a minimum, knowledge of illegal behavior. These clues can be used as an indication of the type of questions to ask and the content of those questions.

Give an example of how catching a fraudster in the act can save considerable investigation expenses.

Catching a fraudster in the at more likely to lead to the fraudster confessing and cooperating in the investigation. This can greatly reduce the burden of evidence gathering. For example, with a good confession, the investigator could safely ignore reverse proof.

Points of identification are another name for which of the following?

Characteristics

In many case, evidence from hair on fibers leads to which of the following?

Class ID

Discuss common reasons for committing a fraud against an employer.

Common reasons for committing a fraud against an employer include disliking the employer, belief that the employer wouldn't miss the assets taken, that the perpetrator is underpaid/underappreciated, and that fraud such as embezzlement is a loan and will be repaid.

What are the purposes of concluding questions, and why are they important?

Concluding questions are used to confirm information gathered during the interview, obtain additional information that has not yet been offered by the subject, and solicit the subject's future cooperation should be needed. Asking this type of question is important in order to avoid misinterpreting information provided by the subject and for solidifying a connection with the subject should the interviewer need to approach the subject again for information.

To what does the Locard exchange principle relate?

Connecting suspects to evidence

Which individual focuses on crime scene processing?

Criminalist

Which records are normally not available to the public?

Currency transaction reports

During an interview, confrontational questions are typically asked to:

Determine the pattern of the suspects' speech and body language in response to the question

Making a surprise count is a technique that can be used to:

Determine whether a difference exists between tangible assets and accounting records

What should be done before interviewing a suspect?

Develop a profile of the suspect, with the fraud triangle in mind. Also, observe the suspect before the interview to determine normal body language and general manner.

Strictly speaking, physical evidence includes which of these?

Document evidence

When might document restoration be useful in a forensic investigation?

Document restoration can be helpful when documents have been shredded or damaged by liquids o fire. For example, if a document becomes wet and, as a result, the ink on the paper is difficult to read, the forensic accountant should place the document in a plastic envelope and engage a person qualified a restore documents. Attempting to dry the document by, for example, placing it between paper towels can sometimes create additional damage.

Give examples of documentary evidence that can be helpful in an embezzlement case.

Documentary evidence is a proof sort ordinarily incorporates recorded data, for example, a sound or video recording or a transcript of a phone capture. Dissimilar to physical evidence, it does not justify itself but rather requires to bolster from specialist witness. By and large of composed wrongdoing, the FBI has utilized transcripts of phone captures and transcripts from sound chronicles or irritated discussions.

Which of the following issues with documents would not normally be considered as a possible indicator of fraud?

Duplicate payments

A dial-up internet connection would normally have which type of IP address?

Dynamic

What are some ways that a forensic accountant could catch an unknown internal hacker?

Essential wellsprings of data would originate from physical and PC accessible logs and documents. Physical records can put an individual as suspect at the place of the wrongdoing. PC access records can build up the time the hack happens and the account/PC used to do the assault. For some situation, inner advanced and computerized wiretaps known as packet sniffers might be utilized to record all system correspondences with the PC focused by the programmer. Such chronicles would be accessible regardless of whether the programmer was sufficiently refined to totally erase or specialist basic lo documents.

What should be done in the first 5 minutes of an interview?

Establish rapport and trust, determine body language and eye moments for truthful answers.

Are expert opinions formed during the fraud investigation or only after it is finished? Explain.

Expert opinions are formed during fraud investigations. For Example, the fraud investigator may form an expert opinion that internal controls are inadequate in a given area, or that a bookkeeper has sufficient training to understand a system he is using. This doesn't mean that such expert opinions will be used in court, only that the expert investigator from opinions. Further, such opinions can help shape the investigation.

Which describes the very best science, such as DNA analysis, in forensic identification?

Fallible evidence

A search warrant can be issued if predication does not exist, but only by a court.

False

Crossing his arms is a sure sign of a subject's guilt.

False

Documents are not usually used because of the possibility of alteration or falsification.

False

Which of the following must file currency transaction reports?

Financial institutions when a customer deposits more than $10,000 currency

A reverse IP lookup is useful for which of the following?

Finding out who owns a domain name

Which of the following does tracing involve?

Following the flow of information beginning with the source documents and following the flow of information forward through the system to the financial statements

When might interviewer silence best be used?

In the first 5 minutes of the interview

Construct a compound question. Discuss how a subject might answer one of the questions and divert attention from the other one.

For example, one compound question is " When did you last see Jill and what were you at the time?" I the subject wanted to avoid saying when he last saw Jill, he could say something like, "Hmm I'll to think about that but I do recall what I was doing." The subject could launch into a long description about events that led up to his seeing Jill, inserting an emotional story designed to engage the interviewer and further lead him away from the piece of information the subject wants to avoid divulging; the last time he saw Jill. In these situations, directing the subject back to needed information is the responsibility of the interviewer.

Give a reason why forensic accountants do not usually evaluate physical evidence.

Forensic accountants do not usually evaluate physical evidence because they are not trained to do this type of evaluation (another reason is that they do not have the equipment to do these types of evaluations).

Subjects who are not guilty usually respond to assessment questions:

Gather additional information not provided earlier

The interviewer uses concluding questions to:

Gather additional information not provided earlier

Which of the following is not a basic rule of handling evidence?

Handle original documents whenever possible

During an interview, a subject who consistently looks down and to the left when providing answers that are known to be true is likely:

Hearing dominant

Which of the following systems assists law enforcement officials with fingerprints?

IAFIS

When should an investigation end?

Ideally it should end when no more evidence can be gathered or needs to be gathered, and after the prime suspect has been interviewed. However in some cases, investigations end because of budget or time constraints.

Give an example of a situation in which surveillance could be used to justify seeking a search warrant.

If, for example surveillance is used to watch a governmental employee, a county board member, accept a envelope from a person known to do business with the county, justification exists for seeking a search warrant to uncover additional evidence of the payment of what appears to be a bribe.

If a forensic accountant is called to investigate a computer that has been used by a probable terrorist, what should the accountant do?

Immediately seal off the area and call the police

When, if ever, would is it appropriate for a forensic accountant to investigate handwriting samples?

In an ongoing investigation, a Forensic accountant can inspect the handwriting samples for analysis if it belongs to someone suspicious. Handwriting analysis can help the Forensic accountant to pinpoint an individual who may have some involvement in a fraud. Nonetheless, the Forensic accountant should have some sort of training or some fundamental insight in this area and if needed he shall consider taking an expert advice on it.

A manager is suspected of making top-side journal entries to increase the income of the company because his bonus depends on the company's achieving at least a certain level of income. What would you, a trained forensic accountant, look for when investigating this type of fraud?

Indications to look for would include journal entries at or near the end of the accounting period. The amounts associated with these entries are sometimes round numbers (e.g., $100,000 as opposed to $125,649) Look for indications that these entries were made by upper management but, regardless of who made these entries, identifications of the person who made them should be ascertained and the person interviewed. In addition, new reports or management releases of earnings estimates made prior to the end of the year could be the pressure that led to these top-side journal entries. Interviewing employees as to whether multiple drafts of the financial statements were produced and where these drafts are kept (if not destroyed) could be helpful in determining the process of the financial statement fraud and provide evidence for court.

Discuss the procedures that should be considered when more than one person are to be interviewed.

Interview each person separately, being with the last culpable person and proceed to the most culpable person, consider requesting that the interview be kept quiet.

Discuss the importance of interviewing.

Interviewing is an essential part of the evidence gathering process. Sometimes evidence can't be obtained any other way, and interviewing tends to offer the best chance of obtaining a confession from a guilty suspect.

The difference between interviews and interrogations is that:

Interviews are usually more informal than interrogations

Discuss the importance of each type of question (e.g., informational) to the investigation.

Introductory questions are used to solicit the subject's cooperation and offer a reason for the interview. Informational questions are asked to gather information that is relevant to the investigation; this type of question is usually the most important type used by investigators. Concluding questions are asked of subjects is usually the most important type used by investigators. Concluding questions are asked of subjects who are not suspects and are used to confirm information gathered during the interview, obtain additional information that has not yet been offered by the subject, and solicit the subject's future cooperation should it needed; asking this type of question is important in order to avoid misinterpreting information provided by the subject and for solidifying a connection with the subject should the interviewer believes the subject again for information. Assessment questions are asked if the interviewer believes the subject is a suspect; this type of question is important because it can be used together additional evidence that the suspect is guilty or can eliminate suspicion associated with a subject. Admission seeking questions are important because of the evidence they provide; they can, at times , result in signed confession, which is strong piece of evidence.

The correct order of questions to ask subjects who are not suspects is best represented as:

Introductory, informational, assessment, and concluding

An investigator has identified a fraud in one loan application and wonders whether the same fraud also exists in other loan applications. For budgetary considerations, the investigator is not able to check 100 percent of the loan applications and decides to check every 10th loan application for fraud. This decision is an example of the application of which of the following?

Investigation risk

Describe items of information that the forensic accountant might need, that are in the possession of the confessor, and for which a signed release of information might be appropriate

Items of information that the forensic accountant might need and that are in the possession of the confessor, and for which a signed release of information is necessary, include bank statements, income tax returns, and W-2 forms (statement of wages earned).

Give an example of how link analysis might be used to investigate mortgage fraud.

Link analysis can be used to investigate mortgage fraud by providing the number of times certain individuals being investigated as "homeowners" have called (or have been called) by mortgage bankers and real estate salespersons. In other words, this linking mechanism can provide the evidence of a connection between parties of committing mortgage fraud.

Suggest one technique that an interviewer can use to establish rapport with a subject.

Mention things in common, such as past hardships, and interest in sports, and so on.

Evidence is:

Most useful if it is relevant, reliable, and valid

During an interview, the interviewer should:

Never get angry

Should only suspects be interviewed?

No For example, a non-suspect might report having observed a suspect committing fraud.

Identification occurs only when some characteristic, set of characteristics, or pattern of characteristics can be said to apply uniquely to which of the following?

Object or individual

Eyewitness testimony can best be described as a form of which type of evidence?

Observational

What can the interviewer do to calm a subject's anger?

One approach is do something unexpected to break the "flight or fight" response that usually occurs when a person becomes angry. For example, the interviewer could agree with something the subject said earlier or make a comment that re-establishes a connection between the subject and the interviewer such as "I have a pair of shoes just like the kind you're wearing. Where did you get them? After, the interviewer could request the subject's help by asking something about the situation being investigated that the subject understands well.

How could a forensic accountant accidentally destroy computer data in forensically examining a hard drive?

One can do it without much of a stretch be down essentially by utilizing the PC. At the point when records are erased from a hard drive, even from the recycle bin, their related substances is not physically erased or overwritten. Or maybe the space possessed by the erased records ends by accessible for use by different documents. Perusing the PC make this accessible space be over written with new information. There is much software available in the market to restore the deleted data and if even this doesn't work then the accountant must seek the professional help and advice.

Describe some common approaches that can be used to make confessing easier for a suspect.

One common approach is establish a morally-acceptable reason for the commission of the fraud (note that this is not an excuse from a legal standpoint). Another approach is to appeal to the suspect's desire for peace of mind. Also, the investigator can state that a confession is a form of cooperation and that he will do what he can (without promising anything, of course) to make the prosecutor and judge aware of the information provided by the suspect.

The indirect approach to an interview is relatively more likely to use:

Open-ended questions

The fraud theory approach to fraud investigations does which of these?

Posits a hypothesis, tests the hypothesis against evidence and then accepts, modifies, or discards the hypothesis as warranted.

If data on a hard drive are physically deleted and then overwritten 100 times, which best describes the data?

Possibly recoverable

Which of these is true for data on a hard drive that are deleted and overwritten?

Possibly recoverable from the hard drive with special software

How does hypothesis testing in fraud investigations relate to the principle of predication?

Predication requires that the investigator stop gathering evidence for testing a given fraud theory when it is clear that the fraud theory is not correct. It also suggest that the investigator continue investigating until the fraud theory is either supported or discarded. The idea is that collecting evidence is predicated on their being some reasonable bases for collecting it.

Which of the following best describes how the principle of predication can affect private fraud investigators compared to law enforcement officials?

Provides less constraint.

Which of the following describes fingerprint identification?

Provides likely identification

When might questioned document analysis be used as part of identity theft?

Questioned document analysis could, be used to determine whether signatures are those of suspects, whether alterations were made to documents, and whether the document appears to partly or completely fabricated.

In handwriting comparisons, what is an exemplar?

Sample of handwriting collected from a known subject

The likelihood that a forensic accountant's judgment based on a sample differs from the judgment based on an examination of the complete population is called:

Sampling risk

Of the four ways documentary evidence can be obtained, which can be performed without the suspect being aware of the investigation?

Searching public records can be performed without the suspect being aware of the search.

Which database(s) would help the most in doing a national criminal background check for a suspect?

The FBI's AFIS database would be an assistance the most in completing a national criminal historical verification for suspect. The FBI's AFIS database is the best quality level. It's utilized broadly by U.S. movement administrations, for instance, to run individual verifications for those applying for certain migration benefits.It coordinates the entire or incomplete fingerprints against the connected one. From the information base it makes an inference and after that, the expert inspects themselves certainly. The database has in excess of 40 million individual put away inside it.

If a subject does not want to be interviewed, the interviewer should:

Set up a definite time in the near future with the subject to interview her

An example of a sentence that includes a qualifier is:

She's at the teller window just about all the time

Which item of information from an employees' personnel file might indicate a source of pressure to commit fraud?

Six exemptions on a W-4 form

Sometimes forensic science can lead to information that is useful but not evidence. Explain why this is true.

Some of the forensic science apparatuses or devices may be useful for investigatory purposes yet won't be acceptable as proof into of law. The consequences of a lie finder test is a decent case or suppose something is obtained illegally through wrong means or some illegal drug test. The law enforcer cannot use evidence obtained illegally become litigant are more imperative than a conviction.

The general rule for establishing fraud investigation protocols is that each fraud scheme has which of the following?

Something known as a "smoking gun"

Which one of the following items of evidence must be obtained by voluntary consent?

Tax return

The four types of evidence include which of the following?

Testimonial, Physical, Documentary, and demonstrative

Which test is stricter, the Daubert or the Frye test? Why?

The Daubert test is stricter than the Frye test, as in light of the fact that it not just requires general that the hypothesis or technique be acknowledged in established researchers and scientific community. Yet in addition, the accompanying when every one of its components is practiced to provided circumstance: 1. There is a scientific testing for the given method or hypothesis. 2. The method or hypothesis has been distributed in peer-reviewed in scientific journals, diaries or magazine. 3. The blunder rate of the method or hypothesis is sensibly assessed or known.

Whose responsibility is it to construct the fraud theory to be used in court?

The attorney

Give a reason for the increase in the cost of goods sold percentage that is not the result of fraud.

The cost of goods sold percentage could increase as a result or purchasing inventory that costs more than previously-purchased inventory. In fact, cost of goods sold percentage could increase legitimately if the company increased any of the costs not just inventory that are manufactures a product and acquired new, more expensive, manufacturing equipment, the cost of goods sold would increase.

What is the basis for not accepting copies of original documents in a court?

The court will not allow copies of original documents to be used as evidence if originals are available because of the likelihood that the copies might not be valid copies of the originals and certain characteristics of the originals, e.g., indications of alterations, might not be readily apparent if copies are used.

The fraud theory approach to fraud investigation involves using a fraud theory to structure which of the following?

The evidence collection process

What is the relationship between a fraud theory and the steps in the evidence-gathering process?

The evidence collection process begins with physical and document evidence and proceeds observations and interviews. The particular fraud theory won't change the order of these steps but it will suggest what the types of evidence to be collected, and the exact methods to be used within each step.

In fraud theory, hypothesis testing involves which of these?

The examination of a piece of evidence to decide whether it is consistent with the fraud theory under consideration.

Reliability of evidence refers to:

The extent to which it is consistently credible

A suspect lists former employers on an employment application contained in her personnel file. What might the forensic account do with this information?

The forensic accountant could search the internet to determine whether the former employers existed and are still in business. If still in business, the accountant could contact the former employers and interview them.

Is forensic accounting a forensic science? Explain.

The forensic accounting can be seen as a forensic science as both uses the scientific methods and techniques along with the technologies to investigate the case. The common areas are computer forensics, examine the documents and data analysis. The experts from both the fields can be asked for their expert witness on a trail. The forensic accountants may ask for the assistant of the expertise of a field of forensic science.

What are the relative roles of fraud theory, evidence, expert opinion, and a court case in fraud investigations?

The fraud investigator will collect evidence according to the fraud theory applicable for her investigation. Expert opinion may be needed to interpret such evidence in a court room. Further, the fraud theory (and related evidence) used in the court room may end up being different from the fraud theory (and related evidence) applicable to the fraud investigation.

How does the fraud theory approach structure the evidence-gathering process?

The fraud theory approach posits a hypothesis regrading a fraud scheme, tests the hypothesis with evidence and then accepts, modifies, or discards the hypothesis as the evidence warrants.

Why is a fraud theory an essential part of a fraud investigation?

The fraud theory guides the entire evidence collection process. Without a fraud theory the investigation becomes a fishing expedition.

What should the interviewer be aware of when taking notes during an interview?

The interview should begin the notes for each interview on a separate piece of paper. Also, the interviewer should be careful that does not communicate and judgement of the information provided by the subject; the concern is that later answers provided by the subject could be affected by his perception of the judgement.

Why should the interviewer not write a set of detailed questions to ask the subject?

The interviewer should not write a set of detailed questions to ask the subject because the list can encourage tunnel vision (and this limit the amount of information collected) and if the subject sees the questions, the subject can more easily respond with contrived answers (because the subject has had extra time to formulate a response and can better anticipate what the interviewer is interested in obtaining).

In what order should individuals be interviewed?

The interviews should begin with those farthest away from the primary suspect and then work their way toward the primary suspect, with the primary suspect being interviewed last. "Farthest away" in this context means being least connected to the primary suspect.

How does an investigator test a fraud theory?

The investigator defines hypothesis regarding who, what, when, how, and why. He then collects evidence relevant to testing each hypothesis. The results of the test then either support or don't support the given set of hypotheses.

How does a fraud investigator control investigation risk?

The investigator needs to take into consideration the consequences of errors in testing hypotheses at each step of a investigation. Further, since investigation steps are sequential, ,an error at one step of the investigation can lead errors in subsequent steps. The chapter gives the following example: in investigating an invoice scheme, a failure to detect fraud losses exceeding $500 among a group of invoices could result in a failure to interview the perpetrator, who might be sitting on the edge of her seat ready to confess. There is no easy formula for controlling investigation risk. The experience and judgement of the investigator must come into play. In many cases it's possible to either under-investigate or over-investigate a possible fraud. Good communication with the client can help a lot. For example, an investigator could tell a client that the evidence gathered so far is reasonable and doesn't suggest the presence of any fraud, but the investigator can continue the investigation if the client wants to be absolutely certain of there being no fraud.

When is it acceptable for a fraud investigator to render an opinion that a suspect is guilty?

The investigator should never render such an opinion. Further, it's never necessary. Guilt is determined by judges and juries. The investigator can render opinions as to whether the evidence appears to be consistent or inconsistent with a given fraud theory. Pointing to guilt violates the Certified Fraud Examiner's ethics code, and can also result in the suspect suing the investigator.

What are the investigator's primary roles in fraud investigations?

The investigator's primary roles are to investigate possible fraud suggested by some incident report. The investigation is conducted by forming a fraud the theory and then gathering and testing evidence against that theory. As part process of the process the investigator can consider the theory supported, not supported, or in need of replacement or modification.

Almost all ongoing fraud schemes have one weakness in common:

The perpetrator is subject to being caught in the act

Why are interviews conducted after physical, document, and observation evidence are collected?

The physical, document, and observation evidence provides a helpful basis and background for asking the right interview questions.

What are the primary sources of evidence in a fraud investigation?

The primary sources of evidence are physical, documents, observations, and interviews.

Describe the various items that a signed confession should contain and the reasons they should be included in it.

The signed confession should contain the following: a) A statement that the confession was voluntarily made. If a suspect is coerced into making a confession, the confession is not admissible in court. b) An acknowledgment that the confessor knew the act he committed was wrong. This is important in establishing intent; a person must know his actions are wrong to have formed the intent to commit the act despite its illegally. c) The approximate dates on which the offense were committed. This information is necessary for two reasons; To obtain a better estimate of the losses from the fraud and to establish the credibility of the signed confession (conviction is easier to obtain if the suspect's dates coincide with evidence of missing amounts from other sources) d) An approximate amount of the losses. This, too aids in obtaining a better estimate of the losses and can increase the credibility of the signed confession when the amount provided by the suspect is close to the amount determined from other sources. e) A statement that the confessor has read the statement. When a person signs a statement, his signature is evidence that he knew of the statement's contents. f) A statement that he believes the statement is true to the best of his knowledge. If this statement is not in the signed confession, the suspect might more easily later that the contents were not true.

During an interview, a subject consistently looks up and to the left when providing answers that are known to be true. This likely indicates that:

The subject is accessing visually stored memories

You just received a tip that a substantial amount of inventory is being stolen from the dock area of the company for which you work as an internal auditor. What techniques might be useful in determining whether this allegation is true (i.e., collecting evidence of this fraud)?

The techniques that could be used include surveillance, documentation, surprise counts, and interviews. Cameras or simplify undercover persons posing as employees could provide eyewitness evidence that a fraud is occurring. Doing a "3-way match' (comparing the purchase order, receiving report, and invoice) could uncover inconsistencies (less merchandise inventory received than paid for) but, if collusion that involves an employee in receiving is occurring, in difference might be noticed. Conducting surprise counts of inventory and comparing them to the records would uncover a deficiency in inventory. Interviews could be helpful, particularly or employees who have knowledge of the fraud and who are brave enough to talk.

Describe the organization of a typical crime lab.

There are crime labs at the state level under which many regional labs are established so that the law enforcement agency has the access of the lab conveniently and the process of investigation can be completed as soon as possible. Typically in a crime lac, there are four division or departments. One department is for serology and unknown substances such as drugs, poisons and other unknown substances. The second department is for trace evidence, small evidence or items require to analyze under microscopes such as fibers and hairs. Another department is for ballistic including bullet fire and at the end, a department for fingerprints that includes the study of fingerprints found at the crime scene or any other place related to crime.

Why might the fraud theory used in court differ from the fraud theory developed and used by the fraud investigator?

There are two main reasons. First, lawyer might collect evidence in addition to what has been collected in a fraud investigation. Such additional evidence could suggest a different fraud theory. Second, the evidence could be consistent with more than one fraud theory, and a lawyer might favor a theory different from the main theory investigated by the fraud investigator.

How does an investigator establish protocols for a given fraud investigation?

There is no generally-accepted set of fraud investigation protocols. But the investigator can identify the "smoking gun" that is typically associated with a given fraud scheme.

What would it take to qualify a forensic accountant who plans to give expert testimony in an embezzlement case under the Daubert test?

There is no set of guidelines, however, the accompanying would be useful: significant expert accreditations, for example, the CPA and CFE, applicable scholarly degrees, skill, wisdom, professional publications, experience, and involvement in pertinent expert associations. The more honored and experienced member in the community the more trusted by the law of court and likely to take their opinions.

What happens when data are logically deleted from a hard drive?

They can be undeleted

Questioned documents are documents that are contested for what reason?

They exhibit one of the document-related indicators of fraud

Explain how a forensic accountant would go about finding the originator of an anonymous e-mail message.

This errand would be proficiently by analyzing the interior headers of the email message to discover the IP address of the PC used to deliver the message. A turn around query could then be performed to locate the proprietor to locate the proprietor of the IP address. On the off chance that the proprietor ends up being an association as opposed to a person, as is regularly the case it will be important to contact the association to discover who was utilizing the individual IP address at the time the message was delivered. At times a subpoena might be important to get this data. Now and again the header data might be mock and hard to follow; in different cases, the association owning the IP address may not know who utilizes one of its IP addresses at a given time. Extra data ,for example, the email address used to send the message may be useful in working with the association owning the IP address.

How does application of the predication principle apply to the "what" question?

To "what" question deals with what fraud may have occurred or may be ongoing. If there is no fraud, then there is nothing further to investigate. Therefor the "what" question must be asked before an investigation proceeds. The entire investigation must be predicated on at least a hypothetical answers to the "what" question.

Which of the following is the function of DNS?

To link URLs to IPs

What is required to obtain a search warrant?

To obtain a search warrant, a law officer (including authorized IRS personnel) must prepare an affidavit and present it to a judge. The purpose of the affidavit is to show probable cause. If the judge, after reviewing the affidavit, believes probable cause exists, the law officer must swear that the affidavit was prepared truthfully. After the oath of the officer has been witnessed, the judge will issue the search warrant.

During an interview, a subject who blinks her eyes when providing answers that are known to be true is likely:

Touch dominant

For what types of fraud would the technique of invigilation be used?

Typically, invigilation would be used to investigate frauds that are characterized by cash skimming. These "off-the-books" frauds are difficult to catch because there's not much evidence of them except for the comparison of sales levels provided by invigilation.

What is needed besides the fraud investigation report to resolve issues related to taxes and insurance?

Unpaid payroll taxes must be paid. It might be necessary to fight a Trust Fund Recovery Penalty that results from a dishonest employee embezzling trust fund taxes. Records might need to be recontructed in order to have sufficient information to file tax returns.

An attorney pursuing a court case against a fraudster generally:

Uses the same or different theory as the fraud investigator

Relative to the Frye test, the Daubert Test focuses on which of these?

Verifiability

Give an example of how opposing counsel might seek to discredit a co-worker's testimony.

Ways to opposing counsel could seek to discredit a co-worker's testimony include: - Trying to assert that co-worker is jealous of the defendant. - Introducing any evidence that suggests the co-worker as been less-than-truthful to the employer or in previous court appearances. - Introducing evidence that suggests that the co-worker leads a secret life (evidence of actions that indicate less than full disclosure or, in some cases, a hypocritical stance by acting one way at work and a completely different way the rest of the time) - Taking quotations out of context to make the co-worker appear to contradict what she is saying in court.

The first question asked in a fraud investigation is:

What?

Discuss the differences between verbal responses of suspects and nonsuspects to assessment questions.

When asked assessment questions, suspects will usually stall for time to think of answers, be evasive downplay the seriousness of the crime, and suggest lenient penalties for those found guilty. Nonsuspects, on the other hand, will usually answer promptly and directly.

Analyze yourself to determine whether you primarily speak in terms of the sight, auditory, or touch sense. Without disclosing your determination to anyone else, ask a friend or family member to provide his or her opinion on your primary sensory orientation.

When asked assessment questions, suspects will usually stall for time to think of answers, be evasive, downplay the seriousness of the crime, and suggest lenient penalties for those found guilty. Nonsuspects, on the other hand, will usually answer promptly and directly. Nonsuspects will also usually express disgust over the crime and agree to harsh penalties for those who commit such crimes.

A fraud theory is similar to a fraud scheme except with respect to which of these questions?

Why?

The best approach during interviews is for the investigator to:

Withhold knowledge of evidence for strategic and tactical reasons.

Why is it important that evidence be tied to a fraud theory?

Without a fraud theory, there is no guidance relating to what possible evidence needs to be gathered.

Is a verbal confession by a suspect part of the evidence of a fraud case? Explain.

Yes, it's part of the interview evidence. Of course, it must meet certain standards to be admissible in court.

Which of the following questions should be avoided?

You didn't go to the store after that, did you?

An inappropriate way to accuse a suspect is to ask:

You took the money, didn't you?

Rob Ellis is a forensic accountant who has been engaged to investigate a case of electronic fraud at Weezer, a company that operates a chain of wholesale restaurant supply stores in the Houston area. Sonya Goyos, Weezer's controller, first contacted Rob. She tells him that she's discovered that one of several employees working in the main office has been stealing company blank checks. The main checkbook is normally kept locked in the office desk of the CFO's secretary. Only the CFO, the secretary, two accountants, and the company janitor normally have access to the CFO's office suite. Sonya discovered the problem in a routine reconciliation of the bank statement against the cash disbursements ledger. The reconciliation revealed two paid checks in the amounts of $1,324 and $1,726, both made payable to and cashed by Maximo Gomez. Sonya's follow-up investigation revealed that both checks had been cashed in the drive-thru window of Weezer's bank, and on both occasions the teller had written Maximo's driver's license number and address on the back of the checks. Sonya reported the two checks to the check fraud division of the local district attorney's office. Two weeks later, she received a call from one of the investigators. He had visited Maximo's residence and found that he had been very ill and immobile for several months. It seemed apparent that Maximo was the victim of identity theft and had nothing to do with cashing the stolen checks. "We see this all the time," said the investigator. "We have the videos of the person cashing the checks." He was obviously wearing a wig and sunglasses. He also knew exactly how to position his head to minimize his exposure to the bank's surveillance camera. "What about a license plate number?" Sonya asked. "Did that show up on the video?" "Yes, but it was unreadable. This guy was a real professional. It appears that he put some kind of reflective coating on the license plate to confuse the camera." Sonya was really frustrated. Her preliminary conversations with the bank led her to believe that Weezer would have to eat the losses because a company employee was obviously involved in the scheme. Even worse, she had a strong feeling that the problem would happen again. There was really no way to keep the bank from cashing the checks, and next time the losses could be even worse. Sonya discussed the problem with Harry Winkler, the CEO He strongly insisted that Sonya focus on catching the crook because doing that was more important than taking a chance that the problem might happen again. She replied that she wanted to place a hidden surveillance camera in the CFO's office, but Harry refused because he was afraid of the possible consequences of spying on his CFO whose family connections were important to Weezer's survival. "No, I want you to gather evidence from what you have already," Harry said. "Hire a forensic accountant and let the accountant provide some evidence as to who did it. If that evidence is good, then I'll consider installing a spy camera." Rob was hired to conduct a preliminary investigation that involved a handwriting analysis of the checks. He was not a handwriting expert, but he quickly found that there was no obvious correspondence between any of the handwriting on the bad checks to the handwriting of any of the employee suspects. He concluded that he needed to interview each of the suspects and perhaps obtain a confession. Rob decided to conduct the first interview with Maria Ladronia, the CFO's secretary. Both he and Sonya considered Maria to be the prime suspect. Rob conducted the interview in an empty conference room. She sat directly across from him on the other side of the table. "Hello, I'm Rob Ellis," he said to her. "I'm a certified fraud examiner from the Wilson and Larson Accounting Firm." I need to ask you only a few questions. Maria stiffened. "Please don't worry; you're not being accused of doing anything wrong. I'm just here for a routine investigation." His reassurance did not seem to help, and Maria only looked more nervous. Rob wondered if Maria was acting guilty. "Do you know what I am investigating?" Rob asked. Maria shook her head back and forth, still sitting straight up in her chair like a lamppost. "Someone stole checks from your boss's desk," Rob told her. "Are you a policeman?" she asks. Rob tried to speak in a calm and reassuring voice, "No, just an accountant." Maria began to cry softly, but she still remained upright and stiff. "Why are you crying?" Rob asked. "I don't want to lose my job. I have two kids in private school, and my husband and I can barely make ends meet." Rob decides that Maria was acting very guilty and decided to get right to the heart of the matter. "Ok," he said. "We do have information that points straight to you. You might as well confess. Help me out, and I'll see if I can convince your boss not to press charges." Maria became very quiet, and for a time Rob heard only the hum of the overhead florescent lights. Finally, Maria spoke. "You're accusing me. I want a lawyer, and I'm not going to talk to you. And I'll sue both you and my company if anything happens to me." She got up and walked out of the room. a. How well did Rob handle the interview? b. How well did Rob handle the overall investigation? c. What might Rob have done differently? d. What is Rob's assessment of Maria's responses?

a) - No advance preparation by developing a fraud-triangle profile of the subject. - No separate person to take notes during the interview. - Rob didn't ask the subject if sh knows who committed the crime. - Stiffening to match the subject's body language wasn't a good idea. Matchin a subject's body language works best with normal, more relaxed body language. - Rob began his interview by telling her not to worry, that she's not being accused of anything and that he's just doing a routine investigation. But then he quickly changed and told her that he had evidence that points directly to her. This inconsistency causes her to lose trust in Rob. The first five minutes of the interview is critical, and Rob should have sought to be establish rapport with her. In this case, Rob failed to establish rapport with her and partly as a result of this failure she walked out of the room. - Rob decided she was acting guilty when she told Rob she didn't want to lose her job. This is a premature conclusion. She might just be afraid of being blame for something she didn't do. At this point Rob knew very little about her. - Rob told her that he would try to persuade her boss not to press charges. This promise by Rob represents unprofessional conduct. Rob's job is to investigate and not to get personally involved in the case. Police routinely lie to suspects, and do so legally, but is not good conduct for a forensic accountant. - Rob didn't attempt to learn her sensory type. It's good to being with some questions that she can answer easily. This not only helps establish rapport, but would give Rob a chance to study her eye movements and body language. - Overall, Rob didn't attempt to carry out an organized interview plan. b) Rob did not handle the overall investigation very well. Rob proceeded to interview a person he though was a suspect without whether a greater benefit could be obtained by interviewing other, seemingly less culpable, persons, first. In addition, he might have been better served if he had suggested that Weezer hire a qualified document examiner to provide more credible evidence as to whether the signature matched Maria's. Because he has put Maria on the defensive, he now runs the risk of not learning as much as he could have from Maria and the risk that important evidence might be "lost" or destroyed. c) Rob would have been better off had he not rushed to judgment. Maria might be innocent. Rob should have interviewed others such as Harr Winkler, the CEO (perhaps his reason for not giving permission to place a hidden surveillance camera in the CFO's office was not his real reason) When interviewing Maria, Rob should have established a rapport with her and asked her nonsensitive questions to establish a behavioral baseline so that he could be more likely to determine whether she was telling the truth when he asked sensitive questions. Using assessment questions to determine, for example, how she felt the person who is guilty should be punished would have been helpful. d) Rob believes that the reason Maria began to cry is that she is guilty. But Maria might not be guilty, just worried that she might appear to look bad. For example, she might have become concerned because she'd heard of innocent persons being found guilty and imprisoned. She might even be an accessory who did not play a major role in the embezzlement. If so, her testimony would be helpful in convicting the mastermind behind the embezzlement. Rob will now have more difficulty finding out whether this is true because if it is true, Maria has most likely tipped off the prime suspect.

Which statement is true regarding protocols for investigating fraud schemes?

a) A complete set of protocols is published by the American Institute of Public Accountants b) A complete set of protocols is published by the Association of Certified Fraud Examiners c) A complete set of protocols is published in the accounting literature ANSWER: None of the above

Which of the following does the principle of predication require?

a) A reasonable incident report exists before commencing an investigation b) Interviews are conducted after collecting documentary evidence c) A preponderance of evidence at each step of the investigation ANSWER: None of the above

To which does the Daubert test apply?

a) All federal and state courts b) Federal courts only c) Some federal courts and some state courts ANSWER: None of the above

Which of the following words should be avoided during the introductory and informational phases of the interview?

a) Assignment b) Examination c) Inquiry ANSWER: All of the above words are acceptable

To effectively use collected evidence in court, an attorney will also need which of these?

a) At least one eyewitness b) A signed confession c) A fraud report ANSWER: None of the above

When should interviews normally be conducted?

a) Before documentary evidence is collected b) After a preliminary draft of the fraud investigation report is ready c) Once a suspect can be identified ANSWER: None of the above

Which unit in the FBI crime lab examines paper documents, surface impressions on paper documents, and other types of surface impressions such as shoeprints and tire tread impressions?

a) Computer analysis and response b) Records investigative c) Racketeering records ANSWER: None of the above

As a certified fraud examiner, Laura Wu has been retained by an attorney to investigate an overstatement of revenue fraud at Unlimited Growth Ltd. All sales to the company are on credit (i.e., there are no cash sales). Laura has found an entry in the records debiting accounts receivable and crediting the Sales account on the last day of the fiscal year. a. Would confirmations help her gather evidence in preparing for prosecution of financial statement fraud? Why? b. Laura employed a novice fraud examiner to help her in the investigation. After an employee of Unlimited Growth had prepared the confirmation letters (using the positive "in-blank" type), her novice fraud examiner reviewed the letters and asked another employee (who had worked at Unlimited Growth for 12 years and had a character that was beyond reproach) to mail them for him. The confirmations were all returned, and all recipients had indicated that the information provided in the letter agreed with their records. Should Laura be concerned about the process her fraud examiner used and the results?

a) Confirmations might not be of help in this situation because if the entry was fraudulently made, the person who made the entry could interpret the confirmation of the misstated account and return it with the indication that the account balance is correct. On the other hand, if a "positive" confirmation of the misstated account is returned and the forensic accountant can demonstrate that the account balance was fraudulently misstated, the confirmation of this account becomes evidence of the fraud because i was a part of the cover up. If Laura wishes to use confirmations she should determine whether the address associated with the account in question is a P.O. Box or some other form of "drop" Use of such addresses are often indications of fraud. There are a number of possibilities here: The account which was adjusted by the debit to Accounts Receivable and a credit to Sales could be an existing account owed by a wholly innocent customer. This customer might have no idea that her account is being used to inflate revenues and assets because the entry might be reversed before the next statement is mailed. On the other hand, the account that was adjusted might be a wholly fictitious account that is used when the need for additional revenue arises. b. Laura should be very concerned about the process her fraud examiner used and of the results. Often, the persons who commit fraud are those who are trusted and are in positions that allow them access to records ans assets; these positions are more likely to be attained after working for the company for several years. In the present case, the employee who had worked for the company for 12 years could be colluding with another employee who had worked for the company for 12 years could be colluding with another employee who made the suspected entry. If the entry was fraudulent, the employee who mailed the confirmations could have either (1) changed the confirmation letter for the misstated account so that the overstated balance is correctly stated; as a result, the unsuspecting customer would not be aware that his account is being used temporarily to inflate revenues and assets or (2) change the address so that the confirmation is mailed to himself or confederate. IF confirmations are to be used, the best approach under these circumstances is to not allow employee access to confirmations after they have been prepared and not for the forensic accountant to mail them herself.

At the beginning of any investigation, serious consideration should be given to the possibility of catching the fraudster in the act because:

a) Doing so can result in lowering investigation costs b) Doing so can provide

Andrus Bettenhaus had worked at Ye Old Troubadour for 15 years and had been given increasing levels of responsibility until he reached the position of manager. One evening, Sharon Ellis, an employee at the Troubadour, asked to speak with Carmela Rodriguez, one of the managers in the internal audit division of the company. "I think Andrus has been taking cash from the register," said Sharon. "Thanks for letting me know about this, Sharon. Can you tell me what made you suspect that he was doing this?" Carmela replied. "I came to his office just after Kim, one of the cashiers, dropped off her register tray, and he was trying to hide something in his desk drawer. He looked a little sheepish and seemed flustered. I don't know . . . maybe it's nothing." "Well," Carmela replied, "we don't know that yet, so I'll look into this. In the meantime, please don't say anything about this to anyone. If it does turn about to be nothing, no one is hurt." After Sharon agreed and left, Carmela's thoughts turned to a conversation she had earlier with her supervisor, Karen Turner. She recalled that Karen had said that an analysis of the cash collections had indicated that they hadn't been as high for the last three months as they had been previously. "But Andrus is such a well-liked and trusted employee. I just can't imagine why he would do such a thing," Carmela thought. "There must be a reason." a. List some reasons why an employee might embezzle cash from his employer and the evidence that would determine which reason (or reasons) could provide the pressure to motivate a person to embezzle. Note which evidence, if any, is obtainable only if the employee voluntarily makes it available. b. How would an opposing attorney try to discredit the evidence that Carmela thinks is relevant to the case?

a) Employees might embezzle for various reasons include the following: - Feeling underpaid/underappreciated (work attitude noticed by co-workers and comments heard by co-workers, friends) - Need cash to support family (number of exemptions on W-4 form, information from co-workers on size of family and health issues of family members. - Need cash to support drug habits (behavior at work and after hours, if witnessed by co-workers, friends; medical drug test) - Need cash to support gambling habits (comments made by Andrus about betting that are heard by co-workers, friends;excitement about betting in office pools) - Desire to impress others with asets acquired with embezzled funds (bragging about house, vacations, wearing expensive clothes, and driving expensive cars) - Belief that embezzling is a challenge worthy of effort (bragging about ability to crack passwords, fool systems) The medical drug test is an example of evidence that must be volunteered by Andrus unless it is a condition or remaining employed (drug test every six months) b) An opposing attorney might try to discredit the evidence that Carmela thinks is relevant to the case by introducing other possibilities for Andrus sheepishness. For example, he might raise the possibility that Andrus might have been looking at personal materials that were inappropriate to look at during working hours. Even though Andrus might once again be embarrassed, his embarrassment would pale in consideration to the embarrassment he would suffer if he were convicted of embezzlement. The attorney might also try to discredit Carmela's character by asserting that he is nosy and is a very "rule-oriented" person who is not an easy-going, forgiving person. If the attorney is successful in finding co-workers, friends, or acquaintances who would lend support for one or both of these assertions, the attorney might be successful in introducing doubt in the minds of a jury or judge and thus increase the likelihood of a "not guilty" verdict.

Which of the following is the ultimate item of evidence that is admissible in court?

a) Fraud investigation report pointing to the perpetrator b) Video recording of the suspect appearing to commit the fraud c) Set of solid, forensic, physical evidenced) ANSWER: None of the above

Surveillance is not typically used for which of the following?

a) Gathering evidence to support probable cause for the issuance of a search warrant b) Gathering evidence leading to the identification of activities and individuals involved in crimes and the apprehension of perpetrators c) Gathering evidence of crimes ANSWER: All of the above

The feeling of rapport can be enhanced if the interviewer:

a) Makes small talk with the subject b) Shakes hands with the subject c) Engages in the act of mirroring ANSWER: All of the above

A guilty person is likely to respond to the question "What is the reason a person might take money from the cash register?" by saying:

a) Maybe she needs to feed her children and she's not being paid enough b) I don't know; he probably had a good reason

When may Certified Fraud Examiners include an opinion of guilt or innocence in their fraud reports?

a) Only when there is a clear-cut signed and properly obtained confession b) When physical forensic evidence irrefutably ties the suspect to the crime c) When the suspect is caught in the act ANSWER: None of the above.

Cary and Elle Bronson had been married for 15 years when trouble arose in their marriage. Cary's long hours of working had taken a toll on it; he was rarely around even for family functions. The last straw came when Elle found lipstick on the collar of Cary's shirt and the unmistakable scent of a very expensive woman's perfume; this wasn't the first time she had noticed the telltale signs of what appeared to be a clandestine affair. The next day, Elle visited an attorney to begin divorce proceedings. After some small talk, the attorney, Mark Smithson, asked Elle about the major assets accumulated during the marriage. "Oh, there are the cars—a Jeep Cherokee, a Chevy Suburban, and a Bentley," she answered. "A Bentley?" he queried, somewhat surprised. "Yes," said Elle. "Our restaurant, The Roasted Duck, has done very well over the years. We began the business with almost nothing and both worked there until Karen, our second child, was born. At that point, I became a stay-at-home mom and left everything to Cary." "I've eaten at The Roasted Duck—the food is excellent," Mark said. "Thank you," replied Elle. "Is this the only source of income for you and your husband, Mrs. Bronson?" he asked. "Yes, other than some interest and dividends," she answered. She and the lawyer discussed other matters pertaining to the divorce. He told Elle that he would obtain information from Cary's attorney so that an equitable division of assets could occur and the issue of the custody of their children would be settled. Two weeks later, Elle received a call from Mark. Through the discovery process, Cary's attorney had submitted a valuation of the restaurant that seemed unusually low and had not listed any other assets that could account for the house and vehicles that the Bronsons had acquired and the private education that they had provided for their children. "That can't be right!" Elle exclaimed. "Well, it certainly doesn't look right," Mark said, "I'll look into this some more and let you know what I find." After he hung up the phone, Mark called Cary's attorney. "This value placed on the restaurant doesn't make any sense. What's your take on this?" After a short pause, the attorney replied, "Cary told me that the restaurant business is not doing well and, thus, the value has declined." After Mark hung up the phone, he pondered the situation: There must be an answer to this mystery. One thing's for sure; if Cary isn't telling the truth, he might as well change the name of his restaurant to The Cooked Goose. a. What evidence (i.e., physical, documentary, and observational) could be collected to determine whether the valuation is correct? How could you go about collecting this evidence? b. Assume for a moment that the valuation is correct. What other sources of money could Cary have to maintain his family's lifestyle? How would you test your theories?

a) Question Ellie as to whether she is an officer of the corporation that conducts business as The Roasted Duck. If she is an officer, she should be able to request copies of the tax returns and any financial statements submitted to banks for loans provided to the corporation. If, however, Cary is skimming cash sales and not reporting it to taxing authorities or to banks when applying for bank loans, using indirect methods, the net worth method, might be helpful in determining the amount of money not reported. In addition, surveillance could be used to determine the vehicles used in the business; in particular if newly purchased vehicles are used the 'I'm not doing well" message of the husband might not sound as credible. The husband, Cary should be deposed to ascertain his thoughts on why the business is not doing well. His statements should be checked out. For example, if he assets that the traffic through his restaurants is too low for him to be successful, counting those who enter and exit the restaurant can be noted and an approximate level of gross sales can be calculated. A copy of the menu would be helpful in determine the sales prices of items and, while posting as a customer, a forensic accountant can ask waiters what they consider to be the most popular items could also help. A forensic accountant and her associates could also pose as survey takers outside the restaurant for the purposes of asking patrons about their habits and, in particular, what they just ordered in the restaurant. This would allow them to develop a better estimate of revenues. Because the restaurant is not a chain restaurant, obtaining a profit percentage that can be applied to an estimate of the gross sales is difficult. If the forensic accountant has friends who own restaurants, she could ask them for an average net profit percentage. b) If we assume for a moment that the valuation is correct, Cary might have other sources of money that he could use to maintain his family's lifestyle. These could include the selling of drugs and the laundering of drug money, brokering transactions for purchases in which part of the sales price is under the table and this is not reported b the seller to tax authorities and not claimed by the buyer. In these situations using indirect methods of determining expected increases to net worth can be helpful as well as surveillance, such as watching Cary to determine, for example whether he appears to be engaging in "business" while at the restaurant or visiting places that seem to be connected with illegal activities casino parking lots, and dog tracks.

Which of the following is not an objective of a computer forensic investigation?

a) To identify the perpetrator of a crime or other type of malfeasance b) To locate and recover data relating to a crime or civil matter c) To reconstruct damaged databases and files ANSWER: All of the above could be objectives

A fraud scheme is a predefined set of answers to which of these?

a) Who, why, how, when, where questions b) Who, what, how, why, where questions c) Who, what, how, why, when, and where questions ANSWER: None of the above

Denise Stubbs, the Nancy Drew of forensic accounting, sat in her office pondering yet another financial mystery. Her client, Candace Goodwell, owns Salon Select and the building and land on which the building sits. The retiree, who spends her winters in Florida and her summers in New York, had just left Denise's office after discussing a matter that was particularly troubling. Candace had relied on her office manager, Dick Maxwell, who had been with her for years, to obtain bids to resurface the parking lot at Salon Select while she was in New York. He had told her that he had obtained the bids and had engaged the lowest bidder to do the job. Candace had recounted to Denise the conversation she had just last week with a representative of an asphalt company. She had been pleased with the resurfacing job when she had returned from New York on August 2 until Nick Woods, the representative, had stopped by the salon. Candace had happened to be in, and he had asked her if she needed her lot resurfaced. "Why, I had it resurfaced just three months ago," replied Candace. "That's interesting," said Nick. "I looked at the lot before I came in and, although it has the sheen of a new lot, the edges tell a different story." "What do you mean?" asked Candace. "Well," Nick continued, "the edge can indicate whether the lot is newly surfaced by the thickness and layers that exist. Of course, only drilling down and taking a sample will tell us for sure, but due to the relative thinness, I think you've been had." "Egad!" exclaimed Candace. "I don't understand how this could have happened. Where's Dick? I need to ask him some questions!" Dick was in the back office when Candace found him. "Dick, what happened? The man who was just here said that the lot might not have been resurfaced." "No," replied Dick, "he's mistaken. Here, you can look at the paperwork." "You know I don't like to look at that stuff," retorted Candace. "I just don't know what to do. I can't do anything now; I've got to run to attend a charity event in West Palm." With that, she left. But the information was still bothering her. That's why she mentioned it to Vic Rickenbacker when she was in his office to discuss another matter. He had encouraged her to see Denise and, after some discussion, had solicited Candace's permission to set up an appointment. "Denise can do some preliminary investigation to determine whether you've received the service and product for which you have paid," Vic told Candace. During the call to set up an appointment, Vic set up a fee arrangement whereby Denise, a CPA and CFF, would practice, for purposes of this matter, as his agent. A few days later, Candace was in Denise's office. "Hmmm," said Denise. "I need your permission to interview your employees. Also, please don't mention that you've come to see me. Sometimes it puts people on the defensive and I can't get the information I need to do a good job for you. Just tell your employees that an office consultant—that's me—might need to interview them for a project to improve the business and that they are to cooperate with her. Do you understand?" "Yes," replied Candace. "Then I'll get to work. By the way, when does Dick come in each day?" "Oh, usually not until the afternoon," replied Candace. "Good," thought Denise. "I'll interview a couple of staff members in the morning and catch Dick when he arrives in the afternoon." After Candace left the office, Denise began to think about a plan to collect the information she needed to draw a conclusion. "The lot may have been resurfaced and, then again, it might not have been." She contacted a friend who owns an asphalt paving company and asked him to take some core samples at the salon after it closed at 7:00 p.m. A few days later, the results were in: Five different core samples taken from different areas of the lot indicated that it had not been resurfaced. Denise had evidence. Her next step was to ask Candace to allow her to search the salon's files for the invoice from the asphalt company. Once she had the name of the repaving company, she would do some searching to verify that the company existed. A quick search of the Internet did disclose the company, RJ New Look, along with its address and phone number. Denise slowly dialed the number and, when a voice answered, inquired about whether the company would be interested in repaving her lot. "Could you give me some references—some jobs that you've done in my area so that I can decide whether to use you?" She was hoping that Salon Select would be mentioned but, even if it wasn't, she was prepared. When Salon Select was not mentioned, she brought it up. "There's a business in my area whose parking lot looks great. I believe it's . . . uh . . . Salon Select; yes, I'm sure of that. Do you know who did its lot?" "Yes," said the voice on the other end of the line, "we did that lot." "It must have been recent. Can you tell me when it was done?" asked Denise. "Just a moment and I'll check on that," said the voice. Within a few minutes, the voice returned. "It was done two months ago on July 22." "Thanks," replied Denise, "I may be getting back with you soon about doing my lot. Goodbye." Denise arrived at Select Salon a few days later and interviewed a couple of employees. Both said the same thing: The asphalt job was done quickly on a Sunday. One of the employees said she'd driven by the salon going and coming from a friend's house and aid that the job could not have taken more than two hours. She was surprised that it took so little time. When Dick arrived, Denise introduced herself as an office consultant and asked if she could ask him a few questions. "I guess so," replied Dick, "but make it quick. I have a lot of work to do." "I'll do my best," replied Denise. "By the way, the parking lot looks nice; did you have it repaved recently?" "Oh yes," he replied., "It was done early in June. The New Look Company did it for us. I was very pleased with the job." "Interesting," replied Denise. "I was a consultant on a job recently. The job was to look into some fraud that had occurred. It seems that the company that was to resurface a parking lot simply put on a layer of thin coating so that it looked as though it had been resurfaced." Dick sat back abruptly in his chair. "Well, that certainly didn't happen here!" he exclaimed, visibly shaken. "What was the name of the company you said resurfaced, or . . . er . . . pretended to resurface the lot?" "I can't mention names, Dick, but it was a local company. It works with insiders who receive kickbacks from the company," replied Denise. "Let's get back to what you want to discuss, Denise, and leave the tawdry gossip for others," said Dick. "Actually, Dick, I'm here to talk about the parking lot. I know it wasn't resurfaced. If you tell me what happened, I'll let Candace know that you were cooperative. If you don't, you will face harsher consequences." Dick began to protest. "I did not . . ." but Denise cut him off immediately. "Yes, you did," Denise said firmly. "I have the evidence. Protesting only makes your situation worse. Right now, I'm just trying to understand why you did this. I know we all need additional money. Was it because you needed the money?" a. Did Denise handle the events leading up to the interview correctly? b. Did Denise handle the interview correctly? c. Should Denise have approached the resurfacing company before she interviewed Dick? d. What do you think will happen next in the interview? e. What should Denise bring with her to the interview with Dick?

a) Yes, Denise handle the events leading up to the interview correctly. She proeeded on the basis of predication that came in the form Nick Woods, a representative of an asphalt resurfacing company. She posed as a consultant so that she could increase the likelihood that she would no encounter employee resistance to her investigation. She collected information about the alleged resurfacing by interviewing employees, had core samples taken, and confirmed, with a representative of RJ New Look, that the "resurfacing" had been done. Once she had sufficient evidence, she interviewed the suspect, Dick. b) Yes, Denie handled the interview correctly. She was able to ask, in an innocuous manner, a question about the parking lot and then introduce information that was consistent with a fraud she believed occurred at Salon Select when she said to Dick, "I was a consultant on a job recently, The job was to look into some fraud that had occurred. It seems that the company that was to resurface a parking lot simply put on a layer of thin coating so that it looked as though it had been resurfaced. "This information she divulged was aimed at determining how Dick reacted to it and has a similar objective as that of asking an assessment question. Based on Dick's reaction, she pressed him for an admission of guilt and properly cut him off when he protested. c) No, because Salon Select has less control over the resurfacing company than it does over Dick, who is an employee and is working in an office that can be searched. If Denise can get Dick to confess, she gathered strong evidence that Vic, the attorney, can use to recover the fees paid to RJ New Look. If she had begun with the resurfacing company, it could have immediately begun to alter or destroy evidence and have tipped off Dick as to what he could be facing. d) Dick could either continue to protest and Denise could continue to interrupt his protests until he confesses or Denise reassess whether she feels that he is guilty, or Denise could try a coax a confession from Dick later. Dick could simply refuse to speak to anyone without an attorney being present. e) Denise should bring the report of the core sample taken by the asphalt paving company. She might have to show this to Dick in order to encourage him to confess.

What is another name for the science of fingerprinting?

a)Pteradactlry b) Paleography c) Diplomatic ANSWER: None of the above

Gabriela Pearson is a professionally certified independent forensic accountant. She has more than 20 years of experience investigating fraud and has testified numerous times in both state and federal courts in both civil and criminal cases. She was recently hired by WindSand Hotels, a closely held corporation, to investigate a company purchasing officer who was suspected of taking kickbacks on purchases. Gabriela gave WindSand her standard engagement letter with the scope of the investigation to be limited to investigating the one suspect. It promised no guaranteed findings or results. She deal directly with Sam Markoff, the company's controller, and Joanna Rodriguez, the outside attorney. Gabriela was working under attorney-client privilege. At their first get-to-work meeting, Sam said, "We've had three different tips from our Web site about this. All three were short messages that simply said Tania Perez, our main purchasing agent, was taking kickbacks from our suppliers. One tip even named a particular supplier, the Whole Coast Seafood Supply, a company that supplied fresh and frozen seafood to our restaurants." Gabriela responded, "Any documentation that supports her involvement in this?" "Not yet," said Sam. "That's why we hired you. If she's selling us out under the table, it could be costing us a fortune." Joanna, the outside attorney, jumped into the conversation. "I've already talked to several employees about Tania Perez, and I'm convinced that she's guilty. I heard from one reliable employee that one of your suppliers paid for her vacation on a Caribbean cruise ship. And there are rumors that she had bank accounts in the Cayman Islands and Brazil." Gabriela thought about the situation. She knew that kickback schemes were difficult to break. "Don't worry," said Sam. "I've known her since she was a little kid. She'll confess if we confront her and tell her we have the evidence against her." "What evidence is that?" asked Gabriela. "All we have to do is bluff," said Sam. "I know her. She'll buckle right away. All she needs to do is believe that a forensic accountant has the goods on her." "It's against my ethics to lie to suspects," said Gabriela. "But the police lie all the time to catch suspects, don't they?" asked Sam. "You'll have to let me run the investigation," said Gabriela. a. What steps might Gabriela follow to proceed with her investigation? b. What mistakes, if any, have already been made in the investigation?

a. This case gives a good example of how ethical issues can arise during an investigation. It is correct that police can and do lie to suspects, but in the authors' opinion this is not a good idea or the accounting profession. Further, various laws are in place that protect police from law suits; accountants lying to suspects might find themselves being sued without the protections afforded to police. Gabriela should probably just withdraw from the engagement if Sam decides to proceed with his bluff. Besides, if his bluff works, then Sam probably doesn't need her anyway; Joanna, the outside attorney could record a confession. An obvious problem with this case is that there have been interviews with employees before other forms of evidence were collected. Such interviews can give the suspect an advance notice of questions to come her way, and permit her to concoct a story. Th physical and document evidence should have been quietly reviewed before conducting any interviews.

Alterations of documents are usually classified as:

b) Additions c) Deletions

Which of the following does physical evidence include?

b)Fingerprints and DNA c) Tire tracks and passkey

When multiple persons are to be interviewed:

interview the least culpable person first and then progress to the most culpable

Tunnel vision:

should always be avoided