ITS 4450 - Fraud Risk Assessment Tools and Investigation

Chapter 7, Investigating Theft Acts; Chapter 8, Investigating Concealment

This lesson presents material from chapters 7 and 8. Objectives important to this lesson:

1. When to investigate
2. Investigative methods
3. Surveillance
4. Physical evidence
   
   
5. Investigating concealment
6. Documents and records
7. Obtaining evidence
   

Concepts:

Chapter 7

The chapter opens with a story about a fraud committed against McDonalds. No, they didn't steal burgers. The fraud was committed by the person who ran a contest for the company. The contest runner gave away prize tokens to confederates who gave part of the prize money to the contest runner. The flaw in the plan was that someone told the FBI about the fraud. It reminds me of Benjamin Franklin's observation that three people can keep a secret, if two of them are dead. (I am not recommending that anyone should kill their partners in crime, and neither was Dr. Franklin. That turns a white collar crime into something completely different.) The more people who know about a crime, the greater the chance that someone will talk about it. Which can lead to unpleasant behavior.

When you think there has been a crime, oddly you don't have to investigate, but you to have to decide whether you are going to do so. The bulleted list on page 215 gives us a set of criteria to help us decide:

• is there a strong suspicion that fraud took place?
• what will the investigation cost? will it be more than we lost?
• how much do we think was lost, and how much more could it actually be?
• what message will each of our possible decisions send to the rest of the company?
• what is the risk of investigating/not investigating? we should investigate if the risk of loss is high, or if the risk of demoralization is high
• which decision will lead to a loss of confidence in our company?
• what kind of fraud is it? is it likely to happen again?
  

The graphic on page 215 suggests different investigation methods for different aspects of a fraud.

The text presents a discussion of several of the methods in the table above. There is a good deal of detail about surveillance and covert operations. The method that is probably newest to most of you should be invigilation. An example of its use appears on page 222. In the example, the company owner tracked receipts for a month, then did so again after making sure the staff knew there would be a daily audit. In the example, the value of cash payments to the business doubled during the invigilation. This showed the owner in which area his money was disappearing.

It is a good idea for students to review the methods discussed in the chapter to get an idea of how each is used.

Chapter 8

This chapter opens with a story about the lengths to which the owners of an investment firm went to conceal the facts about the fraud that the firm's partners were committing. A person committing a good fraud, or a long term one, will have to cover the facts with believable lies while the crime is still being committed. It is the paper or electronic trail of lies that an investigator must find and understand to prove that a fraud exists. In the example in the text, particularly strict controls were used that found irregularities that ordinary controls might have missed.

So, how do you find that which is, by definition, being hidden? As the text explains, you look for things that don't make sense in a paper or electronic trail of activity, typically involving the movement of money. As with any other evidence gathered in an investigation, you must follow several standard procedures:

• chain of custody, chain of evidence - Whatever it is called in your environment, you must historically document when evidence is received, from whom, and how. You must also prove that it has not been altered since you received it.
• marking evidence - Evidence should be properly handled, preserved, and labeled. A number is typically assigned to each each item as it is received. You must be able to trace evidence back to where and how it was found.
  
  
  
  
• organization of evidence - The text explains that if documents are not stored electronically, they are more easily analyzed if you do that first, which can be a huge job. The bulleted list at the top of page 243 lists information that should be stored along with an image of each document. Why an image? It is less likely to be changed than a live version of an electronic document.
  
• coordination of evidence - In a case in which multiple investigators are examining the same body of evidence, it is important to log evidence into and out of a repository. You should record who has it, when and where they took it, and when it will be returned.
  
• originals or copies - The text explains that photocopies of original paper documents are generally not allowed unless the original was destroyed, the original cannot be subpoenaed, the original is in an office where it must remain, or the original is too large to examine.

There are times when it is not practical to examine all objects that you might wish to examine. When this is true, it is common practice to examine a sample of the population in question. The text mentions that you must calculate the necessary sample size, but it does not explain how to do so. At the risk of making you crazy, I will refer you to a short lesson on determining a proper sample size. It requires you to determine the approximate population size, the confidence level you need, and the margin of error you will accept. Before deciding to take a sample, remember that a sample may not contain the data you need if it is rare in the population, which makes the calculation of an appropriate sample size very important.

The text also discusses obtaining evidence when it is likely that those who have it will not wish to provide it. The two legal methods are by subpoena and by search warrant. An attorney will know the difference between the kind of subpoena the book describes (subpoena duces tecum), and the one that compels a person to testify (subpoena ad testificandum). Some evidence may require both. The text does explain that a search warrant must by obtained from a court, and it will be served by and acted upon by police. This is typically done when searching for evidence in a criminal case. The text suggests that voluntary consent belongs in this group as well, but only in the sense that you can't just take records from someone: you need a court order or their permission.

The text discusses the many things about a document that can be altered to make it say what a person committing a fraud wants it to say. I recommend looking at the sixty questions on page 252 and 253 that introduce you to the subject. For a more personal discussion of the subject matter, I offer you the opportunity to spend an hour with Frank Abagnale, Jr.