Reality is simply based in fact, whether it be an event or transaction. A fraudster’s movement is a documented reality. Reality, or the truth, is simply confirmed by documentation, digital footprints and verifiable eyewitnesses, which can be pieced together to reveal the factual timeline.
By: Marlon Balogh, CFE, MS-FA
Reality is simply based in fact, whether it be an event or transaction. A fraudster’s movement is a documented reality. Reality, or the truth, is simply confirmed by documentation, digital footprints and verifiable eyewitnesses, which can be pieced together to reveal the factual timeline. This has now become a natural law in a technologically driven society where a person’s movements, swipes, likes, interests and all other relevant personal metadata is collected to identify an individual. Similarly, transactions are digitally documented, as is an entity’s statements, claims and societal influence. Fraudsters are aware of such circumstances and, therefore, attempt to augment the perception of reality and fact surrounding the perpetration of fraud. Simply put, a fraudster will always be actively in the process of concealment. Fortunately for forensic accountants, such a task is prone to errors and holes, leaving behind trails of evidence to piece together.
The duty of a Certified Fraud Examiner (CFE) and those engaged to determine indicia of fraud is to seek out facts that illustrate the reality supported by evidence. This evidence, though, must be enough to bring the fraudster’s augmented reality back to a fact-based timeline of events. What is meant by “fact based timeline” in forensic accounting and fraud examination and how does a CFE determine an appropriate level of evidence to determine the facts?
The CFE or engaged professional should consider a timeline, a visual demonstration, as a base for developing the full story for effective understanding of financial events as it is supported by documentation. This approach offers guidance, eliminating false narrative, and instead replacing it with a fact-based, evidence-supported, comparative timeline of events.
Concealment is a full-time job for a fraud perpetrator. First-time fraudsters are often worried and anxious whether their scheme will be identified, unless one has sociopathic characteristics. Quite often, the fraudster becomes tired of concealment and, once relaxed, the fraud is discovered by a fellow co-worker, manager or even client. In the matter of kiting schemes, once a perpetrator sets off for a vacation after years of concealing a fraud, suddenly an overlooked and outstanding bill is no longer considered “paid,” toppling the house of cards built over the period of concealment.
It is not likely that a fraud can last forever; it’s quite an undertaking to manage on a regular basis. This leaves the fraudster prone to errors and mistakes. Fraudsters are often tech savvy and intelligent people who can augment receipts, documentation, bank statements and checks using simple editing tools that are readily available on office computers, such as Adobe, free open-source software, and Microsoft Paint and Word. This is considerably important when determining what is a reliable source of documentation and evidence. Documents received from the accused should always be compared to a third-party source such as banks, financial institutions, vendors or other related third parties.
Determining the appropriate evidence is affected by the type of scheme, size and breadth of the fraud perpetrated. These factors determine the level of detail, work and scope the CFE is required to complete to obtain enough evidentiary details and information. So, what is sufficient to support a fact-based timeline? Sufficient evidence for a CFE is either evidence that thoroughly determines and states fact, or a large enough volume of evidence to ensure that fact can be relied upon, illustrated and explained.
A single piece of evidence that is sufficient to determine fact is evidence from an unbiased, uncoerced and reliable third party, which details facts that may confirm a tested detail. To elaborate further, a tested detail is a partial story line or claim tested against provided documentation. For instance, a fraudster may claim that $500 on a specific date was used for a utility expense. When tested, the $500 was not supported by a receipt but was confirmed to be transferred to a personal bank account. Further testing of the personal account also confirmed that no such utility expense was paid for or identified.
The CFE must, of course, have a starting point to test claims and, therefore, the CFE determines the nature and environment in which the perpetrator acts. A trained CFE can determine the general documentation required to begin their investigation based on the industry and known procedures, practices and processes. Preliminary knowledge of the industry, during a discovery phase, allows the CFE to request documentation and prompts the attorney to file subpoenas.
As documentation arrives, the CFE promptly begins analysis that narrows the facts, taking from the documentation all relevant information with a level of detail that properly supports the analysis and whether there is indicia of fraud or not. For instance, data such as receipts, email chains with vendors, bank statements and cashed checks should all support a narrative that is completed. Simply put, a story must have a beginning, middle and end. Without this natural progression, the story is incomplete.
An important detail for a CFE is to visually complete a timeline of events of the fraud perpetrated, supported by the evidence attached directly to the timeline. Such demonstrations allow its users to adequately understand the timeframe in conjunction with evidence, portraying the scheme as it unfolded. This type of demonstration has proven quite effective within the courtroom as it guides the attorneys and displays complex accounting in a palpable, easily understood manner.
In a similar light, a CFE may not be able to state that all evidence supports a conclusion of indicia of fraud if there are missing pieces, such as the transactions identified in bank statements, receipts or checks. What could be said is that there is potential of concealment and that additional work is required to complete an analysis to reach a conclusion of indicia of fraud.
CFEs face a challenge of limited information, but with enough documentation may conclude on the indicia of fraud and support a complete narrative.
CFEs as individuals are not perfect and often face their own internalized challenge of confirmation bias. For instance, once an engagement is presented and base details of the suspected fraud are provided, an inexperienced or compromised CFE may generate a preconception of unsupportable details or draw preliminary conclusions regarding type of fraud, process and concealment methods prior to any review of reliable documentation. This behavior, either based on instinct or a compromising relationship with clients, often leads the CFE to test the evidence in a particularly biased manner (i.e., they may only want to review documentation that supports their opinion of fraud and avoid looking at documentation that may contradict or disprove their notion). CFEs must learn early in their careers to maintain an unbiased approach and in spite of professional relationships with clients. By ignoring documentation that could potentially alter the conclusions of any analysis performed, such work burdens attorneys and especially those accused of wrongdoing.
A deeper version of confirmation bias that is not often spoken of, but exists within the industry, is the misapplication of the forensic approach, steps and procedures. For instance, a knowledgeable and seasoned, but biased, CFE may choose to apply a damages-based approach to a fraud matter if it could narrate a different story and prove indicia of fraud (or not) in a case that would require procedures for embezzlement and theft. This application would offset the total amount of monies embezzled or stolen in the favor of the perpetrator. While this is an oversimplification, confirmation bias can not only be evidence based but could also be completed at the engagement level following inappropriate design and procedures on an engagement. An unbiased CFE may also fall victim to improperly applying procedures and considering themselves as creative in technique and approach, not realizing the misapplication of procedures.
Such knowledge allows the CFE or expert witness to instead argue the difference of approach in court as it may differ from the opposing forensic expert.
CFEs that are opposing biased application of technique and standards should be aware of strategies to also augment the nature of the fraud scheme. The biased CFE is likely to narrate an expert report that lessens or heightens the severity of a scheme depending on which side their bias resides.
Returning to the demonstrative timeline, on which we base our understanding of the events that occurred during the suspected perpetration of fraud, allows each CFE to ground themselves in an unbiased reality. Each moment on the timeline should be well documented, supported and completed with attached exhibits and supportable documentation for each event illustrated. Documentation should be tested, corroborated with appropriate parties and only then reported and evidenced within the working analysis. Such thorough processes eliminate the possibility of falsified documentation entering the relied upon support and, instead, ensures that the CFE’s demonstrative accurately records and displays for its users only fact.
While the topic evidence is not detailed in its complexity, its gravity on matters regarding fraud examination and forensic accounting ensures that CFEs only report fact and not opinion. The industry only serves to benefit from reliable documentation and therefore so does the judicial system with its use of CFEs.
