Forensic Accounting

Your bookkeeper has informed you of suspicious entries in your company’s records. You suspect that a member of your finance team has misappropriated funds and transferred merchandise to their own company. What should you do?

The first step is to inform your corporate counsel of the events that have taken place. This may result in retaining a forensic accounting specialist to help plan and execute the investigation.

From a communications perspective, it is important to determine who will be informed of the suspected fraud and involved in the investigation. The investigation needs to be properly planned to maximize the recovery of the misappropriated assets. It may be advisable to defer to counsel before confronting the suspect or contacting the police. If the suspect is confronted too early, the recovery of misappropriated assets could be more difficult, and the suspect may flee to another jurisdiction. This risk will need to be balanced against immediately stopping the fraudulent behaviour and placing the suspect on leave pending the outcome of the investigation.

Scope of the forensic accountant’s investigation

The scope of the forensic accountant’s investigation can range from assisting in the investigation to preparing an expert report to be used for civil and/or criminal proceedings.

The forensic accountant can perform a review of the company’s books and records to assess the allegations including: the number of years the fraud has occurred, who may be involved in the fraud, tracing the destination of the funds and the potential amount of the loss. If a fraud has occurred, then the implementation of appropriate internal controls to reduce the risk of further losses can be recommended.

The forensic accountant can also assist with establishing appropriate procedures for the collection, security and preservation of data and evidence.  It may be necessary to also retain a computer forensic specialist to examine computers, images of computer hard drives, etc.

After this review has been performed, the forensic accountant will conduct interviews with various personnel concluding with the suspect(s).  They can produce an expert report which will provide a determination of the amount of the loss and summarize the evidence for court purposes.

Peeling an onion – the investigation process

A forensic accounting investigation is like peeling an onion – layer by layer. The process begins by analyzing the entries identified by the bookkeeper.  Do the entries indicate that funds or product were transferred to an unknown company or individual? To what extent were there similar entries in the general ledgers and for how many years? Who made the entries? What approvals were required for the entries to be made? Were there any internal controls or company policies that were bypassed?

The next step is to gather supporting evidence.  For example, if funds were transferred from the company to an unknown company, the forensic account will obtain the company’s bank statements and other supporting documents such as cancelled cheques, wire transfers, debit slips, cheque stubs, etc., to fully understand the nature and support for each transaction. The endorsements of the cancelled cheques will be examined for signatures and bank account information relating to the payee.  If product was transferred to an unknown company, the shipping documents will be analyzed for the destination of the goods, approvals, etc.

During the interview process, the forensic investigation will determine who was responsible for the fraudulent activities. Forensic accountants consider a suspect’s motivation, opportunity, and rationalization to identify the fraudulent employees. For example, if there was only one perpetrator, the following factors need to be investigated:

Motivation – what financial or emotional factors motivated the individual to commit the fraud?

Opportunity – how was the fraud committed?

Rationalization – did the individual justify their actions? (For example, did they believe they were not being compensated fairly)

Digital forensics can be used to acquire additional evidence. For example, once the individual’s computer is seized, a forensic image of the hard drive is made.  An image is used for analysis so that the original computer is preserved as evidence.

Recovery of assets

One of the most important aspects of the investigation is to determine the extent to which assets can be traced and recovered. Do the assets still exist, and can they be found? Were the assets transferred to a foreign jurisdiction and if so, where? How liquid are the assets found? What is the likelihood of recovery?

Insurance policies should be reviewed to determine if there is any coverage for employee theft.

Safeguarding the future

A forensic accountant can be a valuable resource in the planning and execution of a fraud investigation.  In addition, a forensic accountant can assist in devising a fraud risk assessment and a reaction plan.  The risk assessment plan can assist the company in advancing its internal controls, policies, procedures, and training. The reaction plan is a framework of the agreed-upon steps that should take place if a fraud is detected.

About the author

Bruce Roher, CPA, CA, CBV, CFF, CFE is a partner at Fuller Landau LLP leading the business valuations and forensic accounting practice. He can be reached at broher@fullerllp.com or 416-645-6526.