LEARNING OBJECTIVES

After studying this chapter, you should be able to:

15-1	Understand the circumstances that may necessitate an internal investigation
15-2	Identify who should be part of a fraud examination team
15-3	Define evidence
15-4	Be familiar with several evidence-gathering techniques
15-5	Understand the considerations and concerns related to preserving documentary evidence
15-6	Understand the importance of and methods for organizing documentary evidence
15-7	Identify several sources of evidence and the types of information each can provide
15-8	Be familiar with the standard format and requirements for a professional investigation report

WHEN IS AN INVESTIGATION NECESSARY?

The need for an internal investigation can arise in a number of circumstances. Obviously, such an examination may be necessary to determine the source of losses caused by occupational fraud. A thorough investigation in these circumstances can help a company reduce its losses, identify the perpetrator, gather evidence for a criminal prosecution or civil trial, and recapture some or all of the amount stolen. It can also shed light on weaknesses in the company's control structure, thereby helping to shore up the company's internal defenses against future employee misconduct.

In addition to preventing losses resulting from fraud, an organization or its officers may have legal duties to investigate alleged misconduct. Certain federal statutes, such as the Foreign Corrupt Practices Act, are specifically aimed at detecting wrongful conduct and require that companies report specific instances of misconduct. Obviously, to make an accurate report of misconduct, the company will need to conduct an investigation into alleged wrongdoing. Regulatory agencies such as the Securities and Exchange Commission require accurate financial reporting by the companies they oversee, and they have the power to impose penalties for reports that are inaccurate or that omit facts that could affect the accuracy of the reported information. An investigation can ensure that all relevant facts are known and reported.

Officers and directors of companies are also bound by duties of loyalty and reasonable care in overseeing the operations of their companies. This means they must act in the best interests of the company and take reasonable steps to prevent harm that the company might suffer as a result of employee misconduct. The failure to investigate reliable allegations of misconduct can amount to a violation of these duties, thereby subjecting the director or officer to civil liability for any damages that the company incurs as a result of the failure to investigate.

In many situations, companies must also conduct an internal investigation before they can dismiss an employee who has committed fraud or otherwise violated company rules and policies. A thoroughly documented investigation will help insulate the company from charges that it discriminated against the employee or otherwise wrongfully terminated him.

Additionally, when an organization might be liable for the conduct of one of its employees, an internal investigation can help mitigate the company's liability by cutting off the wrongful conduct before it is allowed to grow and by demonstrating that the company has an effective program to detect and prevent criminal misconduct by its employees—a factor that provides for the diminishment of fines under the Organizational Sentencing Guidelines (discussed in more detail in Chapter 17).

A company's managers may find that the best way to fulfill these legal duties and requirements is to conduct an internal investigation of known or suspected misconduct. Put another way, by failing to adequately investigate an allegation of employee fraud, a company may be failing to comply with the law. However, the decision to investigate is often based on very specific facts, and whether an investigation is compelled by some other legal duty or requirement is best determined by the company's lawyer or lawyers in consultation with senior management and after considering all relevant facts.

PLANNING THE INVESTIGATION

Once the decision has been made to pursue an investigation, the focus shifts. The question is no longer whether the company should investigate the matter, but rather how the company can carry out the investigation in the most efficient, effective manner. The answer to this primary question requires answering two secondary questions:

• Who will be involved in the investigation?
• What will be the investigative strategy?

Selecting the Investigation Team

Internal investigations of fraudulent activity usually require a cooperative effort among different disciplines. Auditors, fraud examiners, line managers, attorneys, security personnel, and others are all frequently associated with fraud examinations. When choosing an investigation team, it is critical to identify those who can legitimately assist in the investigation and who have a genuine interest in the outcome of the examination. These persons should be included on the investigative team, and all other personnel should be segregated. There are a number of reasons for this. First, the more people involved in the investigation, the greater the chance that one of those persons may be somehow implicated in the fraud itself or that one of those persons might leak confidential information about the investigation. Second, the persons involved in the investigation team may have to testify in legal proceedings, or the documents they generate may be subject to discovery, if the investigation leads to civil litigation or criminal prosecution. By limiting the number of investigators, the company can limit its exposure to discovery. In addition, any internal investigation, by its nature, can lead to harsh allegations against one or more suspects. This in turn can lead to charges of defamation and invasion of privacy, among others. These charges will be bolstered if it is found that the company spread information about the suspects to people who did not have a legitimate interest in that information. Therefore, by limiting the size of the investigation team, the company can limit its exposure to certain accusations.

None of this is meant to imply that the company should exclude otherwise necessary individuals from the fraud examination team simply out of fear of potentially harmful legal repercussions. On the contrary: the primary goal should be to resolve the allegations of fraud as thoroughly and efficiently as possible, and that requires that all necessary persons be involved in the effort. However, companies should guard against including extraneous personnel who add no real value to the team.

A typical investigation team might include the following types of professionals:

• Certified fraud examiners
• Legal counsel
• Internal auditors
• Security personnel
• IT and computer forensics experts
• Human resources personnel
• A management representative
• External consultants

Certified Fraud Examiners A CFE is trained to conduct a complex fraud examination from inception to conclusion. Fraud examinations frequently present special problems because they require an understanding of complex financial transactions as well as traditional investigative techniques. Security personnel might be well versed in investigative techniques, such as interviewing witnesses and collecting and preserving evidence for trial, but they may not know how to spot a fraudulent transaction on the company's books. Auditors and accountants, on the other hand, may recognize a fraud scheme but may not have the training to conduct other aspects of an investigation. A CFE has training in all aspects of a fraud examination and therefore can serve as a valuable “hinge” to the investigation team, tying together the financial examination and more traditional investigative techniques.

Legal Counsel It is crucial to have counsel involved in and, in most cases, “directing” the investigation, at least as far as the legal aspects are concerned. An internal investigation can be a veritable hornet's nest of legal questions: Should the company report the results of the investigation, and to whom? How can the company preserve the confidentiality of the investigation? How should the investigation be conducted so as to avoid lawsuits? What areas can the company search, and what information can be gathered without violating an employee's rights? When and how can an employee be fired for wrongful conduct? These are just some of the issues that investigators will face. The investigation team must have legal counsel on hand to sort out these questions, lest the company risk exposing itself to greater danger than the threat it is investigating. In addition, by having an attorney directing the investigation, the company may be able to protect the confidentiality of its investigation under the attorney-client privilege and the work product doctrine.

Internal Auditors Internal auditors are often used to review internal documentary evidence, evaluate tips or complaints, schedule losses, and provide assistance in technical areas of the company's operations. As was pointed out earlier, auditors are frequently the people who detect financial anomalies that lead to fraud investigations. They are expected to be able to identify fraud indicators and notify management if an investigation is required, and they are charged with assessing the probable level of complicity within the organization and with helping design procedural methods to identify the perpetrators as well as the extent of the fraud.

Security Personnel Security department investigators are often assigned the “field work” stage of the investigation, including interviewing outside witnesses and obtaining public records and other documents from third parties. It is crucial that their work be integrated with the financial side of the investigation so that the team does not devolve into two de facto investigations, one for “financials” and one for “field work.” The process works best when all aspects of the investigation are coordinated and focused on the same goal.

IT and Computer Forensics Experts If fraud occurs, it is virtually certain that a computer will have been involved at some point. A computer may have been used to create false documents or alter legitimate documents, and the perpetrators likely used email to communicate. The information technology (IT) department might need to be part of an investigation to safeguard data until it can be analyzed. IT personnel can also help identify what data is available and where it is located.

Computer forensics professionals should be used to capture and analyze digital data. Because electronic data can be easily altered, only trained professionals should be used to secure such data so that it can be analyzed more thoroughly without disturbing the original files.

Human Resources Personnel The human resources department should be consulted to ensure that the laws governing the rights of employees in the workplace are not violated. Such involvement will lessen the possibility of a wrongful discharge suit or other civil action by the employee. Advice from a human resources specialist might also be needed, although normally this person would not directly participate in the investigation.

Management Representative A representative of management or, in significant cases, the audit committee of the board of directors, should be kept informed of the progress of the investigation and should be available to lend necessary assistance. A sensitive internal investigation has virtually no hope of success without strong management support.

External Consultants In some cases, particularly those in which the suspect employee is especially powerful or popular, it might be useful to employ outside specialists who are relatively immune from company politics or threats of reprisals. Such experts might also have greater experience and investigative contacts than insiders. In addition, some investigatory procedures, such as forensic document analysis, require a high level of proficiency and expertise and should therefore only be undertaken by professionals specifically trained in that field.

DEVELOPING EVIDENCE

Once it has been determined that an investigation is warranted, the fraud examiner will need to take steps to prove or disprove the allegation. This involves undertaking procedures designed to collect and develop evidence. Evidence is anything perceivable by the five senses, including any proof, such as testimony of witnesses, records, documents, facts, data, or tangible objects, that is legally presented at trial to prove a contention and to induce a belief in the minds of a jury.

In addition to interviewing witnesses (discussed in Chapter 16) and using public records (discussed later in this chapter), investigating a case and obtaining evidence may involve the following:

• Covert operations
• Surveillance
• Informants
• “Dumpster-diving”
• Subpoenas
• Search warrants
• Voluntary consent

Covert Operations

Covert operations may be used to obtain evidence regarding the allegation. In some cases, they are the only way to prove a fraud, and thus must be carried out with the highest degree of planning and skill. In a covert operation, the investigator assumes the identity of another person—either real or fictitious—to gather evidence. The length of the operation might vary depending on the type of case and what evidence is needed. A written plan detailing specific objectives, time frames, and approvals should be developed prior to undertaking an undercover operation.

The courts have deemed covert operations as an acceptable method of developing information, provided there is sufficient probable cause that a crime has been committed. Entrapment issues, however, are a concern that must be dealt with in covert operations conducted by law enforcement. In private corporations, entrapment is generally not an issue, but consultation with legal counsel is strongly advised prior to conducting an undercover operation.

Pretexting Covert operations may occasionally involve pretexting, which is the practice of obtaining information through some sort of falsehood or deception. The practice is not always illegal, but it should be used with extreme caution. For example, if a fraud examiner is trying to locate a witness or a suspect, she might call the person's relative and pretend to be an old high school friend who is looking for a phone number. Although this type of pretexting generally is not illegal, it is illegal to obtain certain types of information, such as phone records and financial records, through any type of falsehood. Additionally, investigators should never impersonate a member of law enforcement, and they should never impersonate an actual person (particularly the individual being investigated). To do so may lead to charges of identity theft.

The Hewlett-Packard (HP) pretexting scandal provides an excellent example of what can happen when an internal investigation is not properly conducted. The HP scandal began in 2005, when officials at HP initiated a secret internal investigation to discover the source of boardroom leaks. To uncover the source, HP's chairman hired a team of investigators to procure the private phone records of HP's board members through pretexting. Through such efforts, the investigation uncovered the source, and at a board meeting in May of 2006, HP's chairman informed the board of the investigation scheme and identified the source of the leaks. After the board asked the offender to resign, a fellow HP director resigned in protest of the pretexting methods used during the investigation. Although HP's chairman was confident that pretexting was permissible, she could not foresee the disastrous fallout from the investigation. In 2006, the investigators hired by HP were charged with identity theft, conspiracy, and wire fraud, and investigations into the company's practices were undertaken by the California attorney general's office, the U.S. Attorney in San Francisco, the FBI, the FCC, and the Securities and Exchange Commission. Ultimately, HP paid $14.5 million to the state of California, and the chairman was removed from her position. In response to the scandal, the U.S. Congress passed the Telephone Records and Privacy Protection Act of 2006, which makes it an offense to obtain confidential phone records by pretending to be someone else.

Before engaging in any type of pretexting activity, investigators should consult with an attorney to determine whether the information sought is protected by state or federal law as well as whether the planned impersonation method is legally acceptable.

Surveillance

Surveillance, the secretive and continuous observance of a suspect's activities, is another investigative technique frequently used in developing evidence. A surveillance initiative may be undertaken to obtain probable cause for search warrants, develop other investigative leads, identify co-conspirators, gather intelligence, or locate people and things.

Informants

Informants are individuals who have specific knowledge of a criminal activity. They are used extensively by law enforcement and can also be used successfully in private investigations if handled properly. Although informants can be extremely helpful in fraud investigations, the fraud examiner should be cautious in all interactions with informants. Because the reasons informants supply information vary—and can include revenge, financial reward, or clearing their consciences—informants may not be trustworthy. Thus, the examiner should always document all contact with informants to help guard against subsequent problems.

“Dumpster-Diving”

On occasion, an investigator might find it necessary to sift through a suspect's trash to obtain evidence and leads. Important documents and information concerning illegal activity might be found in the perpetrator's own garbage. The courts have upheld that investigators may sift through trash without a search warrant, provided that the trash has left the suspect's possession.

Subpoenas

If evidence is held by other parties or is in uncontrolled locations, specific legal action is required before attempting to obtain it. This usually takes the form of a subpoena or other order from the court to produce the documents and records (including electronic records). A subpoena duces tecum calls for the production of documents and records. Other forms of court orders can be used to obtain witness evidence and statements. Subpoenas are only available as part of an existing legal action, such as a grand jury investigation, pending criminal charges, or a civil suit. Thus, if no legal action has been initiated, obtaining documents by subpoena is not possible.

Search Warrants

There might be occasions when a fraud examiner will be called upon to assist law enforcement or will request the assistance of law enforcement in a particular investigation. If there is probable cause to believe that certain records are being used or have been used in the commission of a crime, the law enforcement officer will prepare an affidavit for a search warrant, which will detail the legal reasoning behind the request for the warrant. Only a judge can issue a search warrant, and only law enforcement can seek and serve a search warrant. Obtaining as much intelligence as possible regarding the location of the potential evidence is very desirable before writing the search warrant affidavit. Therefore, law enforcement personnel will often need guidance from the fraud examiner as they conduct presearch preparation.

Voluntary Consent

Documents can be obtained by voluntary consent. This is often the simplest means to obtain documentation, and therefore, it is the preferred method in many fraud examinations. However, certain circumstances, such as hesitancy to release private information, or resistance by those involved in the scheme, may preclude obtaining voluntary consent for access to documents. While consent can generally be either oral or written, if documents are obtained from possible adverse witnesses or the target of the examination, it is recommended that the consent be acknowledged in writing.

PRESERVING DOCUMENTARY EVIDENCE

Even if the investigator is careful to obtain the evidence legally, the case can be lost if the examination team fails to preserve the evidence so that it is accepted by the court. For the evidence to be admissible, basic procedures in its handling must be followed. Evidence submitted must be properly identified, and it must be established that the proper chain of custody was maintained. In addition, proof must be provided that the evidence is relevant and material to the case.

The following general rules should be observed with regard to the collection and handling of documents:

• Obtain original documents when feasible. Make working copies for review; keep the originals segregated.
• Do not touch originals any more than necessary; they might later have to undergo forensic analysis.
• Maintain a good filing system for the documents. This is especially critical when large numbers of documents are obtained. Losing a key document is an unpardonable sin and may mortally damage the case. Documents can be stamped sequentially for easy reference.

Chain of Custody

From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. This means that a record must be made when the item is received or when it leaves the care, custody, or control of the fraud examiner. This is best handled by a memorandum of interview with the custodian of the records when the evidence is received. The memorandum should state:

• What items were received
• When they were received
• From whom they were received
• Where they are maintained

If the item is later turned over to someone else, a record of this should also be made—preferably in memorandum form. All evidence received should be uniquely marked so that it can be identified later. The preferable way is to initial and date the item; however, this can pose problems in the case of original business records furnished voluntarily. For them, a small tick mark or other nondescript identifier can be used. If it is not practical to mark the original document, it should be placed in a sealed envelope, which should be initialed and dated.

Preserving the Document

When initialing a document for future identification, fraud examiners should only do so in a noncritical area and using a different type of writing instrument than was used for the questioned writings on the document. The examiner should never write or make markings on the original document other than his unobtrusive initials for identification. Likewise, a document should not be folded, stapled, paper clipped, crumpled, or altered in any other way that would affect or change it from its original condition. If the document is stored in an envelope, the examiner should be careful not to write on the envelope and cause indentations on the original document inside. Photocopies and laser-printed documents should always be stored in paper folders or envelopes, not transparent plastic envelopes, which can result in the copies' sticking to the plastic and destroying some features of the document.

If fingerprint examinations are anticipated, the examiner should use gloves to handle the documents. Tweezers can also help the examiner avoid leaving fingerprints, but they should be used with caution, because they can leave indentations that might obscure faint indented writings or the identifiable indentations that are sometimes left by photocopy and fax machines. If any known people have inadvertently handled the documents with bare hands, their names should be provided to the fingerprint specialist. It may also be necessary to provide the expert with sets of inked fingerprints of these people for elimination purposes.

ORGANIZING DOCUMENTARY EVIDENCE

Keeping track of the amount of paper generated is one of the biggest obstacles in fraud investigations. It is essential that any documents obtained be properly organized early on in an investigation and that they be continuously reorganized as the case progresses. Remember—it is usually difficult to ascertain the relevance of the evidence early in the case, so reevaluation throughout the investigation is critical. Good organization in complex cases includes the following:

• Segregating documents by either witness or transaction. Chronological organization is generally the least preferred method.
• Making a “key document” file for easy access to the most relevant documents. The examiner should periodically review the key documents, move the less important documents to backup files, and keep only the most relevant documents in the main file.
• Establishing a database early in the case if there is a large amount of information to process. The database should include, at a minimum, the date of the document, the individual from whom the document was obtained, the date obtained, a brief description, and the subject to whom the document pertains.

Chronologies

A chronology of events should be commenced early in the case in order to establish the chain of events leading to the proof. The chronology might or might not be made a part of the formal investigation report; at a minimum, it can be used for analysis of the case and placed in a working paper binder. Keep the chronology brief and include only information necessary to prove the case. Making the chronology too detailed can defeat its purpose. The chronology should be revised as necessary, adding new information and deleting that which is irrelevant.

To-Do Lists

Another indispensable aid is the “to-do” list. The list, which must be updated frequently, should be kept in a manner that allows it to be easily modified and used as a cumulative record of investigation tasks. In a very complex case, the list can be broken into long- and short-term objectives: that which must be done eventually (e.g., prove elements of a particular count) and that which should be done tomorrow (e.g., conduct an interview or draft a subpoena). No matter how organized an examiner might be, some list of this nature must be kept, lest important points be forgotten during the lengthy investigation.

Using Computer Software to Organize Documents and Other Data

In complex fraud cases, the amount of information to be examined can be enormous. Performed manually, an investigation of a complicated fraud scheme could become overwhelming, requiring so much time and effort that it might cease to be cost-effective. It is imperative that fraud examiners use data analysis and data mining techniques when conducting investigations to maximize efficiency, effectiveness, and accuracy. Data analytics software such as ACL and IDEA can also used to sort, chart, and graph the information in the database, making it easier to analyze relationships and identify anomalies. Additionally, case management software tools allow investigators to easily store and access pertinent information about the case and the documents that have been assembled.

SOURCES OF INFORMATION

A vast variety of information sources is available to the fraud examiner to assist in:

• Locating individuals or verifying their identity
• Researching assets or financial positions
• Documenting lifestyles and background information
• Discovering banking/creditor relationships
• Identifying business affiliations/associates
• Uncovering litigation history

In-House Sources

Some of the most useful information comes from within a subject's employing organization. If an investigator can gain access to a company's records, he can learn a great deal about an individual by examining routine in-house information on file. In-house sources include:

• Personnel files
• Internal phone records and voice mail
• Computer files and records
• Physical files and records
• Time sheets
• Financial records
• Prior audit or investigative files
• Corporate policies and procedures
• Company communications to employees
• Access codes and user identification codes
• Security videos

Public Information

Of all the information available, public records can be one of the most encompassing, challenging, and rewarding sources for an investigator. Public records are those records that a governmental unit is required by law to keep or those that are necessary for a governmental unit to keep in order to discharge its duties imposed by law.

Many types of public records contain similar information about individuals or entities. Yet each agency or governmental unit is responsible for quite different functions that may require them to maintain very unique information. The investigator should be prepared to consult a variety of public records in order to gather the information necessary.

Local or County Records The great majority of an individual's civil records can be found at the county courthouse in the jurisdiction where the subject does business or resides.

Voter Registration Records To be eligible to vote, citizens must register in their respective precincts by filling out a form detailing their name, address, date of birth, Social Security (or other government identifying) number, and signature. Voter registration records are routinely verified by the county, and old addresses are deleted as new ones appear.

Marriage License Records Marriage license information includes the couple's married names, maiden names, the addresses of the individuals, proof of the couple's identities (driver's license numbers or passports), and both parties' dates of birth.

Real Property Records When an individual purchases real estate, he becomes a taxpayer and a registrant in several county records. Each real estate transaction will list a deed verifying the transfer of the property. If the individual either buys or sells a house or piece of property, or if his real property becomes subject to a state or federal lien, the transaction will be reflected in the county real property indexes. Additionally, if improvements are made to the property (e.g., adding a new room or installing a pool), a mechanic's lien or other notice may be on file in the county property records.

A search of these records will reveal:

• Residency and addresses of buyer and seller (referred to respectively as grantor and grantee)
• Price of the property
• Mortgage company and amount originally financed
• Real estate ownership
• Who financed the transaction, if applicable
• Title companies involved
• Improvements to the property and the names and addresses of the contractors

Property Tax Records Most counties charge landowners with property taxes for upkeep of local their schools, courthouses, police forces, and so forth. Property tax records can provide the fraud examiner with an idea of the estimated value, for tax purposes, of the property listed; of the identity of the owner of a vacant piece of land or a piece of property, if ownership is unknown; and of the name of the last person to pay taxes on the property.

When searching real property and tax records, the examiner should always look for other names shown on the documents. Frequently, the name of the attorney or notary public who verified the documents is listed, providing another potential source of further information.

Death Records Death certificates usually can be found at city, county, or state health departments. A death certificate provides the name of the deceased, the address, sex, age, race, birthplace, birth date, death place, date and time of death, Social Security number, medical certificate, and coroner's certificate for the deceased. Additionally, a death certificate generally provides information about the deceased's parents and their occupations.

Health and Fire Departments Most county health or fire departments conduct routine inspections of businesses for health and safety code or fire code violations. These inspectors may have valuable information about the business and its operations, employees, and owners.

Sheriff/County Prosecutor The county sheriff or the county prosecutor may maintain general incident files related to the businesses within the county. These incident files can provide leads on reports or contacts with the managers or owners of the business or on third parties who have made complaints against the subject.

County Fire Marshal The county fire marshal should have a record of any fires that have occurred at specific properties. These records may contain information about a property's insurer, as well as information about any previously conducted investigations.

Utility Company Records Many utility companies are nonprofit corporations or municipalities. Although the recent trend has been to restrict access to utility company records, some companies still make their records available to the public. Utility records may contain the phone number of the customer, even if that number is unlisted.

Permits If a business or individual constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In addition, before most businesses can open their doors, the city or county may require that they possess certain permits. The local fire department may require permits ensuring that the business complies with the fire code. The city health department will require permits for restaurants or other businesses that serve food. Planning and zoning departments enforce regulations regarding the types and locations of businesses.

State Records

Business Filings To open a bank account or to conduct business in a name other than one's own, the law requires certain documents to be filed. These documents can include articles of incorporation, foreign corporation registration, and fictitious name or doing business as (DBA) registration.

Articles of Incorporation Corporations are formed by filing articles of incorporation with the secretary of state (or state corporation bureau or corporate registry office) in the state where the company does business. These corporate records are public records and will include:

• Corporate name
• Ownership information
• Stock value
• Initial shareholders
• Names of the directors and officers
• Registered agent
• Location of the principal office
• Date of incorporation
• Standing/status

This information will permit the investigator to review a corporate structure, identify the registered agent, and trace incorporation dates. The records will often include limited partnership information as well.

Foreign Corporation Registration Some states also require foreign corporations (i.e., corporations that were incorporated in another state) that conduct business transactions in the state to register with the state corporation office. The application is typically filed with the secretary of state and must include the date of incorporation, the principal office, the address of the registered agent, and the names of the officers and directors.

Fictitious Names/Doing Business as Registration A fictitious name or doing business as (DBA) situation occurs when a business owner operates a company under a name that is different from his legal name. DBA information for sole proprietorships or partnerships is typically filed at the county level, though some states require filing at the state level as well. Most states also require limited partnerships, trusts, and joint ventures to file DBA information at the state or county level. DBA filings will provide insight into the true business venture behind the name. Very similar to corporate filings with the Secretary of State, these records will allow an investigator to identify the type of business entity, the date the business was started, and the owners/principals of the business.

Uniform Commercial Code Filings A search of Uniform Commercial Code (UCC) filings can help identify personal property that an individual or business has financed. UCC statements are documents filed by lenders with the secretary of state or with the county level unit to perfect their security interests in financed personal property. Banks, finance companies, and other lenders will generate records or filings of loans granted to individuals and businesses and collateralized by specific assets, such as household furniture, appliances, boats and yachts, automobiles, aircraft, and business equipment.

UCC filings can also disclose when and where a person obtained a personal loan, the type of property that he pledged to the lender to secure the loan, and the current address of the debtor. These documents are great sources for reviewing itemized lists of personal property held by the debtor.

Additionally, UCC filings can help fraud investigators uncover hidden ownership or relationships between parties by providing the names of all listed debtors and their addresses. The examiner may find information linking individuals to the companies they own or discover information about a company's subsidiaries, branch offices, or parent company.

UCC statements can be readily retrieved from the secretary of state's office, through service companies, or through online public records services.

Employee/Labor Records Some states' labor departments require the filing of periodic lists of employees, revealing their names, Social Security numbers, and salaries. These filings can help a fraud examiner track a subject's employment and income. In addition, by examining previous filings, an investigator can identify former employees of the company.

Workers' Compensation Information Because workers' compensation is a state program, these records are held at the state level. Records of workers' compensation claims are available in most states and are normally maintained for seven years, but public access to these records varies from state to state. There are two types of documents relating to workers' compensation cases: (1) injury reports and (2) court-contested claims. The reports commonly show the date of the incident, the amount of time lost, the employer at the time of the incident, the type of injury, the body part affected, and the job-related disability. To obtain workers' compensation information, the requesting party must have the subject's name and Social Security number. Many states also require some type of authorization from the subject before disclosure.

State Tax Filings The revenue departments of some states require certain businesses to obtain tax permits, such as resale licenses or retail sales tax permits. Although tax returns are generally not available to the public, information regarding applications for and issuance of tax permits often is.

Additionally, law enforcement officials may be able to access corporate, business, and personal state tax information, which may unwittingly reveal hidden assets or investments. Tax returns may also disclose the identity of the accountant or attorney preparing the return.

When examining a state tax return, loans to or from officers, stockholders, or related entities should be examined closely. Any mortgages, notes, and bonds shown as liabilities on a corporate return should be investigated. Interest payments and interest income are also very important. Interest income may be shown from a bank that was previously unknown to the investigator.

Professional Associations and Licensing Boards Many state and local agencies or bodies maintain records identifying individuals who hold special licenses or memberships. These can include:

• Medical practitioners, such as doctors, dentists, and nurses
• Attorneys
• Certified public accountants
• Real estate licensees
• Notaries
• Law enforcement personnel
• Firefighters
• Security guards
• Stockbrokers
• Teachers
• Insurance agents
• Private investigators
• Bail bond agents
• Travel agents
• Barbers, cosmetologists, and massage therapists
• Contractors, engineers, electricians, and architects

The licenses and applications granted by the state may be public record. Some applications contain no more than a name and address, but other applications contain lengthy personal information, such as previous residential addresses, previous employers, education and training, and financial statements.

The state regulatory or licensing agency may also have the authority to suspend or revoke the licenses necessary for a business to operate.

The Courts Each year, a great deal of litigation occurs, and many people are subjected to judicial action. Researching civil and criminal suits can provide invaluable information to assist in:

• Locating individuals
• Identifying pending actions
• Uncovering closed cases
• Determining marital status
• Tracing sources of funds (e.g., probate)
• Identifying financial conditions (e.g., bankruptcy)
• Discovering litigation history
• Uncovering outstanding judgments

A wealth of information is available from reviewing court files. Often, civil or criminal actions are not readily known and the researcher must be able to identify the jurisdiction, county, or court involved. Most of the papers filed in civil suits are accessible as public records; however, criminal and juvenile actions may not be open to review. Additionally, different case types are filed at different levels and in different courts. Therefore, to uncover the information desired, the investigator may be required to check several types of courts at several different levels.

Litigation History Court clerks maintain files on all active and closed lawsuits in their jurisdictions. Information regarding these suits is public record and can be searched by scanning the indexes for the subject's name as plaintiff or defendant.

Based on court issues and the financial nature of the claim, different levels of courts may have jurisdiction over a given case. To determine a full picture of the litigation history against a company or individual, the fraud examiner should search each of the following courts:

• State courts
  • State trial courts of general jurisdiction (criminal/civil)
  • State intermediate appellate courts (criminal/civil)
  • Highest state courts (criminal/civil)
  • Probate courts (estate administration)
  • Family courts (matters concerning adoption, annulments, divorce, alimony, custody, child support, etc.)
  • Traffic courts (minor traffic law violations)
  • Juvenile courts (cases involving delinquent children under a certain age)
  • Small claims courts (civil suits of a relatively low dollar amount)
  • Municipal court (offenses against city ordinances)
• Federal courts
  • U.S. district courts (criminal/civil)
  • U.S. circuit courts of appeal (criminal/civil)
  • U.S. Supreme Court (criminal/civil)
  • Bankruptcy courts (federal)
  • U.S. Tax Court (cases arising over alleged tax deficiencies)
  • U.S. Court of International Trade (cases involving tariffs and international trade disputes)

Divorce Records If the subject of the investigation is in the process of becoming, or has been, divorced, the fraud examiner may wish to search for the opposing spouse. Divorce record searches will return marriage partner names and addresses, location of marriage, divorce filing date, and file number. Moreover, court documents from a divorce case frequently contain the subject's financial inventory, which is submitted at the time of the divorce or separation, as well as the partition of assets to each party in the settlement.

Personal Injury Suit Records Documents in a personal injury suit will frequently contain an accident report, injury history, statements of the involved parties, and information about the financial settlement of the case.

Financial Suit Records Reviewing documents filed in a financial suit will disclose the subject's debtors and creditors and will present an outside view of an individual's business history or ability to perform.

Bankruptcy Records Bankruptcy documents are usually located in the federal bankruptcy court for the district where the debtor resided or had his principal place of business. When checking bankruptcy court records, the fraud examiner should check not only the individual or business being investigated, but also any related businesses, principals, employees, or relatives.

The Bankruptcy Code (§107) specifically provides that all documents filed with federal bankruptcy courts are public record and can be examined by anyone without charge. A bankruptcy case file may include the case number; the debtor's name(s), Social Security number, and address; the filing date, the bankruptcy chapter designation; and the case closure date. It may also include transcripts of depositions or interviews. If fraud was suspected, the trustee may have conducted a fraud investigation; thus, investigators may wish to check with the trustee to find out whether any such investigations were undertaken.

Probate Records Probate records are documents filed to show the dispersal of assets after a subject's death. The probate court conducts an investigation to verify any debts owed by the individual's estate and sees to the distribution of assets according to the deceased's will (or, if there is no will, by state law) after all debts are paid. Information about the debts left in an individual's estate will give the investigator the names of persons having an interest in the deceased's estate, as well as the subject's financial position at the time of death. Likewise, the dispersal of assets will reveal the names and addresses of heirs to the deceased and provide some indication of the value of the property willed to them.

The Internet The Internet is often the first place fraud examiners turn for information. It is an amazing research tool, but investigators should remember that much of the information on public websites is questionable. Fraud examiners should not rely on information gleaned from public pages without verifying the authenticity and accuracy of the information.

Search engines like Google and Yahoo provide a convenient way to access the wealth of information available on the Internet. In addition, there are many other ways for fraud examiners to find information online. A list of specific helpful Internet resources is included in Appendix A.

Commercial Online Services A commercial online service may be the best and most efficient way to conduct public records searches, as it provides access to a wide range of data in a single place. There are several companies that provide varying levels of public record information to subscribers. The information is stored on a central database that a subscriber can access from his computer. Some companies provide information that is actually retrieved in hard copy and mailed or faxed to the subscriber, even though the request was made through the online service.

While convenient, the use of commercial public record services comes with an important caveat for investigators to keep in mind: Online records companies have to get their information from somewhere. If the information in the source's records is incorrect, the report received from the database company will also be incorrect. Therefore, it is essential to remember that accessing information online is never a full substitute for actual examination of the public records themselves.

Directories Directories are specialized websites that collect the names of numerous other related websites, allowing users to browse through a listing of possible sites to visit. Directories contain direct links to pages that have a common interest. Some all-inclusive directories cover a plethora of different topics, and others are more focused on particular subjects or disciplines (e.g., accounting and auditing directories that fraud examiners may find very useful).

Blogs A blog is a user-created website consisting of diary-like entries. Although there are many different types of blogs, ranging from community and corporate blogs to blogs focusing on a particular subject, the most relevant type for fraud examiners is the personal blog—an ongoing commentary written by one person.

Reviewing an individual's blog can reveal information that might be relevant to an investigation. For example, with information obtained from a personal blog, the investigator might be able to establish a timeline of the individual's activities or gain insight into the subject's thoughts and mindset, which can be used in the interviewing process.

Blogs, unlike social networks, are generally open to everyone; furthermore, many blogs can easily be searched, often using traditional search engines. Google Blog Search, for example, uses Google search technology to search blogs. In addition to traditional search engines, blogs can be searched via specialized blog-search sites, such as Technorati and IceRocket.

Social-Networking Sites Social-networking sites are specialized websites that help users develop and maintain their relationships more easily. Essentially, social-networking sites take traditional networking activities online. They allow users to create an account, provide specific details about their life—such as schools attended, past and present employers, hobbies, sports, and interests—and become networked to other individuals that share similar backgrounds or interests. Many of these sites are free to use and open to anyone with an Internet connection. Once users become connected linked to other members, they can view the activity on each other's pages.

User pages on social-networking sites contain valuable information. People regularly post many personal details on their social-networking pages, including information about their professional profile, academic history, business connections, personal affiliations, hobbies, favorite sports teams, opinions, work schedule, height, weight, gender, travel schedule, intellectual property, political and charitable causes, updates on family events, drug or alcohol habits, illnesses, and so on. They may also post photos and videos, which can help investigators track changes in physical appearance and location.

Social-networking sites can be searched like traditional websites; much of the information available on social-networking sites can be found using traditional search engines. However, there is an ever growing number of specialized resources that an examiner can also use to search these sites. For example, each social network has a search engine for locating members. Users can use these engines to search for members by name, phone number, or e-mail address. In general, users can search for members without logging in, and searches can usually be done anonymously. Some of these internal search engines are becoming more sophisticated. For example, on LinkedIn, you can perform an advanced search by name, title, company, keyword, location, and school. Using Facebook's Graph Search feature, you can look up anything shared with you on Facebook, and others can find information you shared with them. You can also search for particular interests or locations shared by anyone in the network—regardless of whether you are connected to them.

Privacy settings affect how much of a user's information you are able to see without being formally connected. For instance, if a member's profile is private, the researcher will only see a snapshot of the member's information. Some Facebook users adjust their privacy settings so that people who are not “friends” with the user can only see the user's name and profile picture. However, on some sites, such as LinkedIn, it is common for users to be less private and allow any LinkedIn user to see all of their profile information.

In addition to traditional search engines and search engines within social-networking sites, social network search engines are also available and may provide better results. These search engines use social networks to order, prioritize, or refine search results.

REPORT WRITING

Fraud examinations conclude with reporting the investigation results. In general, this communication takes the form of a formal written report that includes information pertinent to the examination engagement. Such a report is normally used for internal reporting purposes but may also be used for complaints to police services or claims to insurance companies. It is important to note that the topic of writing reports is broad and detailed; many of the finer points of report writing are beyond the scope of this textbook. However, this section is included to provide a general overview of the culmination of the investigation techniques discussed throughout this text.

Purpose of the Report

According to anthropologists, some of the earliest forms of writing were actually drawings recording ceremonial dances. These drawings were made to record specific movements so that others could repeat those that were thought to please the gods. While technology has advanced since those early days, and we no longer write on cave walls or do ceremonial dances to please the gods, we still need to record our specific activities and findings to comply with policies and procedures and, in some cases, to satisfy the courts.

The records or reports stemming from an investigation must be accurate and understandable so that others may know what transpired without having to speak to the report's author. In other words, the report must speak for itself. An important point to remember is that an investigation is often judged not by what was “uncovered,” but by the way in which the information is presented. As such, a good investigation report:

• Conveys evidence: The written report communicates all evidence necessary for thorough and proper evaluation of the case.
• Adds credibility: Because the written report is completed in a timely manner, it adds credibility to the investigation and can be used to corroborate earlier facts.
• Accomplishes objectives of case: Knowing that a written report must be issued after the examination is completed, the report forces the examiner to consider his actions beforehand.

Know the Reader

As with any written document, it is important to identify the reader of the internal report. Internally, this may include the board of directors, corporate executives, internal auditors, and in-house legal counsel.

Each of the readers might have different expectations as to the information he expects to see in a report. For instance, the board of directors might only wish to know that an investigation was conducted and what the outcome was (such as the termination and prosecution of the offending employee). An internal auditor would likely be more interested in whether internal controls were overridden and how. In-house legal counsel might wonder whether proper procedures were followed in the investigation and consequent employee termination. Ultimately, these internal readers will determine what information is included in the report.

Along with the expected internal readers, others who are external to the company might gain access to the internal investigation report. Some of these readers may be given the report voluntarily, and others may gain access to it through other means, including the courts. These external readers could include:

• External auditors
• Outside legal counsel (including those retained by employees who might be the subject of the internal investigation)
• Law enforcement agencies
• Government attorneys or prosecutors
• Other government agencies (e.g., employment or human rights commissions)
• Insurance companies

It is important to remember that while not all investigation reports end up being scrutinized by lawyers and/or used in a civil or criminal trial, they should all be written as if they will be. For this reason, the following points should be followed:

• State only the facts. Do not guess or make assumptions in the report. If information is unknown, that fact should be clearly stated.
• Do not make errors. Minor typographical and other errors might make the report appear unprofessional and could be embarrassing, especially in court. In addition to using a spellchecker, it might be worthwhile to obtain the services of an independent proofreader.
• Do have a follow-up section. In some cases, information or documentation important to the investigation might not be available to the investigator. This should be listed in a separate section.

Format

Using a template or standard report format will reduce the amount of time spent writing a report while ensuring that all pertinent information is included. Nevertheless, some situations might require a customized report format—but even then the basic format outlined below should be followed:

• Author/date
• Summary
• Introduction/purpose
• Body
• Results
• Follow-up/recommendations

These section names are not mandatory and can be changed to suit the report writer's preferences; but as a general rule, all of the information in these sections should be included somewhere in the report.

Summary This section is intended to give very basic information. It should set out the main points of the report in a few sentences and should include the subject, basis, findings, and outcome of the investigation.

EXAMPLE

This report deals with an internal investigation conducted at the Rockside Industries' Wayside Plant based on an anonymous tip that an employee was submitting false expense claims. The investigation determined that $105,375.89 in false invoices had been submitted for reimbursement through the purchasing department. The director of purchasing and a senior buyer were terminated.

Introduction This section provides more detail on what the report is about and prepares the reader for what is to come—that is, the body of the report. Unless there is a separate section, this is where the purpose of the report will be explained, along with any required background information.

EXAMPLE

This report documents the results of an internal investigation into the unauthorized use of purchase cards at the Rockside Industries' Wayside plant. It is intended for use by Rockside Industries in its civil action for recovery of misappropriated funds and for making a complaint to police.

On May 10, 2012, the security department received an anonymous tip on the fraud hotline advising that an invoice for the purchase of a computer backup power supply (UPS) was false and that the actual purchase was for a tablet (mobile computer).

Investigation determined that there was no original invoice for the transaction on file; instead, the file contained a photocopy of the invoice. The purchase was made with a corporate purchase card issued to Randall Trait, a senior buyer at Rockside's Wayside plant. It had been approved by Elizabeth Nelson, the purchasing director. The vendor, ABLE Tech, was contacted, and it confirmed that the invoice number on the file copy matched an invoice it had for the sale of a tablet.

The Wayside plant has a physical asset database in which all nondisposable items having a purchase price of $200 or more are recorded. Each item is assigned a unique ID number and barcode label, which are used to track the item. This database is maintained by the purchasing director. There was no record of the UPS in the physical assets database, and no ID number had been issued for any similar item in the past six months.

An on-site visit was made to ABLE Tech, which has been an approved vendor since June 12, 2007. The manager, Charles Front, advised that in the past six months, the same individual, whom he knew as Randy Trait, had made three other purchases that Charles had considered to be somewhat odd because Randy asked that the items be held for pickup by him rather than be delivered to the plant. Charles provided copies of these invoices, which showed the purchase of a notebook computer, an LCD computer screen, and a digital camcorder.

When these invoices were compared with the plant purchasing records, it was found that the files contained only copies, rather than original invoices, for all three purchases. Each of the file copies reflected the same invoice number, date, and amount as the original invoice, but differed as to what was purchased. All three purchases had been made using the same purchase card as the tablet and had been approved by the director of purchasing, Elizabeth Nelson.

Based on this initial information, a complete review was conducted of all purchases made on the card issued to Randall Trait, the senior buyer, for the past eighteen months, the period of time he had been employed by Rockside.

Body This part of the report identifies the employee(s) and other individuals implicated or involved in the matter. This includes any background information that might have been obtained about the employee or other parties.

EXAMPLE

The body of the report also details the methods used to investigate the matter, including any document reviews, interviews, and other procedures such as video surveillance. If necessary, background information can be provided on the department or process involved in the investigation. For example, in an accounts payable fraud, the document flow might be described or set out in a graphic to assist the reader in understanding how the process works.

EXAMPLE

The Wayside Plant Purchasing Department consists of a senior buyer, two junior buyers, and an administrative assistant. These individuals are responsible for all Wayside plant purchases not related to travel/entertainment expenses.

The director of purchasing also works out of the Wayside plant; he is responsible for supervising the purchasing departments of the eight plants located across North America.

Purchase cards are used for individual items with a value of $1,000 or less and purchases of multiple items with a total value of $5,000 or less (before taxes). All other purchases are invoiced and are paid for using corporate checks.

Procedures

1. A purchase requisition form is prepared by an employee and forwarded to the buyer.
2. The buyer sources goods and makes the purchase.
3. The buyer enters the purchase into the ATAC purchasing system.
4. The goods are shipped to the plant and received in the shipping-receiving department.
5. The shipping-receiving department enters the receipt into the ATAC system.
6. The accounts payable department receives notice of the purchase through the ATAC system and the purchase card online statement. Notice of delivery of the goods is also received through the ATAC system.
7. The purchasing director receives and approves a monthly report from the accounts payable department detailing all purchases made on purchase cards.

Results This section will vary widely depending on the nature of the investigation and the information collected. An investigation that involves only one incident may be explained in a sentence or two. In more complicated or extensive investigations, the narrative may be supplemented by spreadsheets or graphics.

EXAMPLE

A review was conducted of all purchases made with the purchase card issued to Randall Trait, senior buyer, since he commenced employment with Rockside Industries on November 2, 2010.

This review identified 47 transactions, totaling $39,864.36, supported by altered documentation. Each purchase had been made following the proper procedures, except that instead of being shipped to the shipping-receiving department, the purchases were picked up at source by Randall Trait. The purchases were entered into the ATAC system as being received using the employee number of Phil Brothers, a shipping-receiving department employee. Brothers was unable to verify whether he made any of the entries, but attendance records confirmed that on seven of the days on which shipments were entered into the ATAC system, Brothers was listed as being absent from work.

These 47 transactions are contained in the spreadsheet at Tab 1.

The documentation for each of the transactions is located in Tabs 13–59:

1. Invoice from the accounts payable file
2. Invoice from the approved vendor
3. ATAC system printout showing the purchase being made
4. ATAC system printout showing the purchase being received
5. Monthly report from accounts payable signed by Elizabeth Nelson

(Note: No purchase requisition forms were located for any of the 47 transactions.)

In addition, the review uncovered an additional 113 transactions, totaling $63,511.53, that also had altered documentation. These transactions were made using a second purchase card that had originally been issued to Stanley Lampen, the buyer whom Randall Trait had replaced. This card had never been canceled or reissued to another employee when Lampen left Rockside's employment. These 113 transactions are contained in the spreadsheet at Tab 2. The documentation for each of the transactions is located in Tabs 60–172:

1. Invoice from the Accounts Payable file
2. Invoice from the approved vendor
3. ATAC system printout showing the purchase being made
4. ATAC system printout showing the purchase being received
5. Monthly report from Accounts Payable signed by Elizabeth Nelson

(Note: No purchase requisitions forms were located for any of the 113 transactions.)

In interviews conducted by corporate security, Elizabeth Nelson and Randall Trait admitted to making fraudulent purchases using the two purchase cards. Both denied that there were any transactions other than those identified in this report.

Nelson admitted that she came up with the idea when Stanley Lampen left the company and his purchase card was never canceled. When Nelson obtained a new purchase card for Trait, she also kept Lampen's old card.

Both Nelson and Trait admitted that they were childhood friends, and confirmed that it was Nelson who had contacted Trait when the buyer's position had opened up. They both also admitted that they had devised the scheme to help out Nelson when she got divorced and was having financial difficulties.

When presenting information in spreadsheet form, it might be useful to prepare several versions with the data sorted in different ways—for example, by transaction date or amount. If there are several different types of transactions, they may be grouped by type in this manner as well. To supplement the spreadsheet, a written description of a representative sample of the transactions can be given. Generally, it is not necessary to give a written description of each individual transaction, particularly when they are essentially the same except for time, date, and amount.

Follow-Up/Recommendations This section identifies any investigation procedures that remain outstanding, usually because they are outside the mandate of the investigator. These might include the recovery of property that is in the hands of third parties or collection of information held by vendors/suppliers.

It is also the appropriate place to identify and make any recommendations related to procedures and controls.

EXAMPLE

1. Purchase requisition forms: These forms are currently prepared by hand and sent to the buyer making the purchase. After the purchase is made, they are kept by the buyer. Recommendation: A copy of the form should be sent to the accounts payable department, which should keep a copy and send a copy back to the employee requesting the purchase. This would allow for independent confirmation that the employee had actually requested the purchase.
2. Receiving goods: All shipments received by the shipping-receiving department are entered into the ATAC system using the employee number of the shipper-receiver. This number is known to numerous employees outside of this department. This was done to allow temporary employees to enter shipments into ATAC. In addition, these entries can be made from any computer terminal in the Wayside plant, not only the shipping-receiving terminal.

Recommendation: All goods received should be entered into the ATAC using the shipping-receiving department only. Passwords should be required to prevent unauthorized employees from making entries.

Opinions or Conclusions in Report

Other than opinions on technical matters, no opinions of any kind should be included in the written report. If conclusions are not self-evident, then the examiner has usually not completed a good report. In particular, opinions should not be given regarding the guilt or innocence of any person or party.

SUMMARY

The need for an internal investigation can arise in a number of circumstances, including determining the source of and losses from an alleged fraud, complying with federal statutes, fulfilling the professional duties of loyalty and reasonable care, ensuring against allegations of wrongful termination, and mitigating the company's liability related to employee misconduct. When planning a fraud examination, it is important to consider how the company can carry out the investigation in the most efficient, effective manner. The investigation team should be limited to only those persons who are vital to the fraud examination process and may consist of certified fraud examiners, legal counsel, auditors, security personnel, IT and computer forensics experts, human resources personnel, management representatives, and outside consultants.

The purpose of the investigation process is to gather evidence to prove or disprove the allegations of fraud. As part of the engagement, the fraud examiner may utilize a variety of investigative techniques such as undertaking covert and surveillance operations, using informants, “dumpster-diving,” acquiring subpoenas and search warrants, and obtaining voluntary consent.

Once evidence has been gathered, the investigator must take care to properly preserve the evidence to ensure its admissibility in a court of law. This involves making a formal record of the chain of custody and protecting the physical state and attributes of the evidence. Organization of the evidence is also key. Several computer software programs are available to aid fraud examiners in case management and reporting.

A large number of resources exist to assist investigators in gathering evidence. In-house sources, such as personnel files, phone records, computer and physical files, financial records, access codes and user identification codes, and security videos, are especially useful if the fraud examiner can obtain access to them. Additionally, much information about individuals and businesses can be found in public records.

Fraud examinations generally conclude with a formal written report of the investigation results. A good investigation report must be accurate and understandable so that others may know what transpired without having to speak to the report's author. It should also convey evidence, add credibility to the investigation, and accomplish the objectives of the case. To ensure the report appears professional and achieves its purpose, the investigator must identify the expected reader, include all significant information, and avoid stating any opinions in the report.

ESSENTIAL TERMS

Duty of loyalty The requirement that an employee/agent must act solely in the best interest of the employer/principal, free of any self-dealing, conflicts of interest, or other abuse of the principal for personal advantage.

Duty of reasonable care The expectation that a corporate officer, director, or high-level employee, as well as other people in a fiduciary relationship, will conduct business affairs prudently with the skill and attention normally exercised by people in similar positions.

Certified fraud examiner (CFE) A professional who is trained to conduct complex fraud examinations from inception to conclusion. A CFE has training in all aspects of fraud examination, including identifying fraudulent transactions, obtaining evidence, and interviewing witnesses.

Attorney-client privilege The privilege that precludes disclosure of communications between an attorney and client, but only if the client (1) retained the attorney, (2) did so to obtain legal advice, (3) thereafter communicated with the attorney on a confidential basis, and (4) has not waived the privilege.

Evidence Anything perceivable by the five senses, and any proof such as testimony of witnesses, records, documents, facts, data, or tangible objects legally presented at trial to prove a contention and induce a belief in the minds of a jury.

Covert operations An investigatory procedure in which the investigator assumes a fictitious identity in order to gather evidence.

Surveillance An evidence gathering technique involving the secretive and continuous observance of a suspect's activities.

Subpoena duces tecum A legal order requiring the production of documents.

Search warrant A legal order issued by a judge upon presentation of probable cause to believe the items being sought have been used in the commission of a crime.

Chain of custody Refers to who has had possession of an object and what he has done with it. The chain of custody must be preserved or else the item cannot be used at trial.

REVIEW QUESTIONS

15-1 (Learning objective 15-1) What are some of the reasons a fraud examination should be commenced?

15-2 (Learning objective 15-2) Who are some of the professionals who should be included on a typical fraud examination team?

15-3 (Learning objective 15-2) Under what circumstances might the fraud examination team include outside consultants?

15-4 (Learning objective 15-3) What is evidence? What types of things can be considered evidence?

15-5 (Learning objective 15-4) What are some of examples of evidence-gathering techniques that might be utilized in a fraud examination?

15-6 (Learning objective 15-5) When handling documentary evidence, what types of precautions should a fraud examiner take?

15-7 (Learning objective 15-7) What types of information can be obtained by examining internal documentation?

15-8 (Learning objective 15-8) What are three characteristics/objectives of a good investigation report?

15-9 (Learning objective 15-8) What are five sections that should be included in a standard investigation report? What information is found in each of these sections?

DISCUSSION ISSUES

15-1 (Learning objective 15-2) Who should be responsible for directing an internal fraud investigation? Why?

15-2 (Learning objectives 15-2, 15-6, and 15-7) How can computers and technology help in investigating a fraud? What kinds of challenges can the involvement of technology present to a case?

15-3 (Learning objective 15-4) Jim Block, CFE, is investigating Randy Smith for his role in a potential kickback scheme. Gathering evidence about Randy's financial activity has been difficult. While on a stakeout at Randy's home, Jim sees Randy's wife take out the garbage and place it on the curb. Jim steals the trash bag, sorts through its contents, and discovers multiple bank statements that provide details about some of Randy's illicit financial transactions. Is Jim's acquirement of the bank statements legal even though there was no search warrant?

15-4 (Learning objective 15-6) What are some considerations a fraud examiner should keep in mind when organizing documentary evidence? Which method of evidence organization is preferred?

15-5 (Learning objective 15-7) An investigator is looking for information about some vacant land that may be owned by a suspect in a fraud case. What source or sources of public records would be a good place to find this information?

15-6 (Learning objective 15-8) When reporting the results of an investigation, why is it important that fraud examiners not express opinions in their professional report?