My life in crime: Chronicles of a forensic accountant
By William C. Barrett III, CPA/ABV, CVA, CTP, CCFM
The profession of forensic accounting is like any other industry niche: You evolve to a plateau where track record and honed skills permit you to hold yourself out as a professional. Then, like any other business, you starve a lot before you become an overnight sensation - in demand and truly at the top of your practice in providing value - both on scene and in the courtroom.
Here are a few of the cases I have directed to give you an idea of how well-developed professional skepticism prevails to reveal the fraudster - usually a well-educated, respected member of the community, quite adept at concealing and perpetuating fraud by bending others to his or her will.
Things are never what they seem
Honest, affectionate, easygoing single white male, a young-looking 50, 6', 190 lbs., sandy blonde/blue, attractive, seeks a woman, 37–40, loyal, independent and honest, for long-term relationship (possibly marriage).
After this case's prior divorce expert mysteriously disappeared from Virginia, I was engaged to assist the wife in understanding why the family business, a design and print house for invitations and announcements, could not provide her with living expenses during the divorce proceedings. The business, I was told by her attorney, was bankrupt. It certainly was.
After reviewing the financial statements, detailed general ledger, and tax returns, I discovered a December 31 general journal entry crediting "Officers Salary" and debiting "Staff Salaries" for a neat $30,000. This magical transfer, with no corresponding payroll tax liability, was accepted by the CPA doing the company's SSARS No. 8 (Statements on Standards for Accounting and Review Services) compilation and 1120S tax returns.
It turned out that - after reviewing five years of financial and tax data - the husband took money from the company throughout each year, properly booking it to the "Officers Loan" account. However, on December 31 of each year analyzed, there were journal entries crediting the loan account, debiting "Officers Salary" and then the transfer from "Officers Salary" to "Staff Salaries." The prior four years analyzed left the loan account with a respectable balance at the end of each year, but had annually transferred out, in nice round figures, from $50,000 to $80,000.
Reviewing the general ledger and journal entries for unusual, unexplained or unsupported amounts, entries, transactions or patterns can indicate the possibility of fraud and where it might be occurring and concealed.
Unusual journal entries may include inappropriate charges to expenses or write-offs of assets such as inventory or receivables, and the entries may be made near a month- or year-end to conceal the effects of a theft.
An example is an unexplained credit to inventory with the offsetting debit to cost of sales but with no related sales transaction recorded.
In addition to accounts receivable, inventory and accounts payable, accounts susceptible to fraudulent entries include the following:
- Expense accounts over which no one department or individual has control, such as general maintenance accounts, general transportation accounts (cabs, freight, etc.), stationery and general office supplies accounts or scrap disposal accounts
- Suspense and cash sweep accounts
- Deferred asset or liability accounts
- Contra-accounts, such as the bad debt reserve account or the accumulated depreciation account
- Intercompany accounts
- Accounts over which a sole, domineering, incompetent or frequently absent individual has control
The chart of accounts should be scanned to identify accounts of these types that may be vulnerable to fraudulent entries and which should be scrutinized. The investigator also should investigate and reconcile differences between control accounts and supporting ledgers. Any differences may be due to fraud concealed in one or the other account or ledger.
Adapted from "Forensic Accounting for Business Entities," a CPE course written by William C. Barrett III, CPA/ABV, CVA, CTP, CCFM, for Thomson Tax & Accounting.
The wife, president of the company and the head designer, knew nothing about the transactions or the money taken by her husband, the company's financial and operations officer.
By the time the forensic analysis finished, we found the husband had been traveling the country as a well-to-do single man seducing and proposing marriage to women he met in online dating sites. He was an avid supporter of his college's sports teams and had full season tickets to all home and away games. Needless to say, he liked those away games a lot.
Almost a million dollars had been misappropriated in the tax and financial fraud. This was a long case, but the upshot was we were able to trace and persuade two of four women the husband preyed upon to testify in divorce court.
And the mysterious disappearance of the original divorce expert? He was found to be a bigamist (one wife and kids at the beach and one wife and kids in the city) and left the state after cashing some large retainer and advanced billing checks from clients.
One of the most exciting and adventuresome novels an accountant will ever read is "The Detailed General Ledger." Even if you are not a great fan of fiction, you will not be disappointed in spending some time and a little due diligence with this book.
To read the general ledger, first separate and put aside all the cash and payroll accounts. Review the transaction accounts until you have an understanding of the nature and flow of the particular company. Then review the cash accounts for "the rest of the story."
He who dies with the most toys wins
It was captioned as a shareholder dispute. The 73-year-old father came back to the company, a construction/building materials manufacturer, and threw out his 42-year-old son, the then president, after his hand-picked board of directors voted the father back in.
This transpired after the father had already received about $11 million of the $14 million front-loaded installment sale of his 55 percent share of stock back to the company. This was in addition to a subsidiary company doing about $6 million a year (to give him some pin money in his retirement), a couple of million dollars of choice undeveloped land, a $6,500 monthly annuity to the father's ex-wife, and a various assortment of trucks (for the subsidiary), cars, two helicopters and the company jet. Okay, so the jet was purchased used. The father had now been back in charge for little more than two years.
We were asked to do a forensic investigation for the deposed son, the object of which was twofold: to substantiate the claims of misfeasance by the father before he left and after his return, and to show that the son, during his reign, had not misappropriated anywhere near the amount of company funds the father had alleged in his countersuit. You see, while the father liked owning his own air travel and the quiet, country plantation with his new wife, the son liked owning luxury cars and the new lakefront mansion he and his new wife shared. We were also to do a business valuation to show that the son had not "run the business into the ground" during his tenure.
So far so good, right? After all, we adhered, so we thought, to rule No. 1 in forensic accounting: "Always get an adequate retainer when dealing with shareholder disputes." Well, things got a little complicated over the six-month engagement.
First was the forensic part. After the son's attorney announced to the father's attorney that we were going to make mirror image copies of the company's server and other strategic computers to review accounting and other data entries, several things happened to the tune of "The Dog Ate My Hard Drive." Turns out the server was an off-site timeshare owned by a computer sales and maintenance store that did all the company's work. And strange as it may seem, several months before our request, a thunderstorm had struck the server and fried the hard drive, and all the backup tapes were either discarded or overwritten. Of the company's two financial computers, one was given to charity and the other, which we did get, had a new hard drive in it because the "old one crashed."
The judge in this case felt it was too onerous and costly to conduct an on-site forensic audit of the original financial documents making up this company, which made just under $30 million a year.
Being effectively barred from conducting a forensic investigation, we were able to find tax fraud and violation of tax rules. The father was reporting the installment sale properly, as long-term capital gain, but improperly in not realizing the front-loading, the more than $8 million in transferred property and equipment, and the $78,000 annuity (spousal support) to the ex-wife.
Within the last ten years, the world of electronic or digital evidence has evolved to become a vital part of practically every case a forensic account handles. Most cases require an inquiry into all forms of communications and records of every nature - especially those that are in digital form or were created electronically.
Businesses typically generate hundreds or thousands of documents related to various areas of operations, for instance, thousands of sales invoices, thousands of purchase orders and thousands of checks. Thus, there could be thousands of documents related to an area being investigated for fraud.
The computer can be used to perform investigative procedures on accounts payable and payroll fraud, such as printing out all unauthorized check numbers or checks over a specified amount, printing out a list of all employees not electing insurance or other employee benefits (this might signal a fictitious employee scheme), or identifying vendors that always submit the latest bid or that obtain a disproportionate share of contracts.
For example, an investigator investigating for accounts payable fraud might examine payments to vendors for certain attributes, such as by checking vendor names on checks written to an approved vendor list and searching for checks with different addresses for the same vendor names.
Other examples of investigative procedures that can be performed using computers include the following:
- Recomputing items on documents for mathematical accuracy.
- Searching for fictitious names or addresses by comparing data on documents to known fictitious names or addresses, for multiple names to the same address, or for multiple addresses for the same name.
- Searching for payments made or inventory shipped to a vendor or customer with the same address as an employee.
- Searching vendor payments for duplicate payments. (The suspect intercepts and retains the duplicate payment.)
- Searching for unusual patterns on purchase orders or contracts, such as unusually large numbers or amounts.
- Searching for unusual accounting entries, for example, debit entries to accounts that normally receive credit entries (such as accounts payable or long-term debt) or credit entries to accounts that normally receive debit entries (such as loans receivable or inventory).
- Also, analyzing entries to suspense, clearing and inter-unit accounts.
The company's general ledger software package generally will include transaction reports that can be used to identify all transactions affecting an account during a specified period. These reports can be scanned to help identify unusual items. Also, much of the publicly available information exists in databases that can be accessed by computer. This can make the data gathering process more efficient.
Adapted from "Forensic Accounting for Business Entities," a CPE course written by William C. Barrett III, CPA/ABV, CVA, CTP, CCFM, for Thomson Tax & Accounting.
The violations were in IRS Family Attribution Rules that bar selling your stock back to the family-owned company, while still having contracts with the company and the subsidiary. Not to mention, you can't realize millions of dollars for selling your stock back to the company, then return two and half years later and buy back the same shares at par value of $1 per share. Well, the judge wasn't interested in "tax problems" as a basis to substantiate the need for lifting the bar on the forensic investigation.
Did I mention that the case got a little more complicated? The controller, an ex-CPA, was a convicted tax felon hired after his release from federal prison by the father and had been a dedicated and totally rehabilitated accountant ever since.
This dedicated controller, who had worked for more than eight years for the company, had not made quarterly estimated payments on the son's withdrawals or taxable share of income for the two and a half years the son was president. He said it was because the son had never asked him to do so, even though he had done them for father and son every year since he became controller and for the two years after the father came back as president.
Also, the son's individual income tax returns had not been filed for more than three years. Liability, penalties, and interest totaled more than $5 million for IRS and Virginia income taxes due. The controller's response: He had put the returns on the son's desk to sign, and thought the son had taken care of the returns.
We were able to get the total liability down to less than $1 million, and it would be paid off because the son was selling his 45 percent interest to a rival company who had offered him employment and would seek seats on the father's board once they owned the stock. They would pay the son, $2 million upfront with another $1 million over two years, provided certain conditions were met.
I could go on, but here is how it ended. The son, poor thing, suffering terribly from stress … and some pretty heavy prescription and non-prescription drug abuse, went into a mental institution for a little R&R. The attorneys were paid in full. The son, recently released, now can't afford for his attorneys to move forward. And us? We wrote off billings-in-arrears in the low five figures.
The first that comes to mind is: "Know your client." Or: "Know your client's family," if you are getting into a family business dispute. Then comes: "Know that in litigation, you are either working like the Maytag repairman or a one-armed short order cook," and the amount of work you do when busy is going to be much more than the established retainer - and you will probably be doing this crunch-time work when the client has already used up his or her capital.
The Smoking Gun
It was an internal coup.
The company was positioned to make an initial public offering (IPO). The product offering, a patient appointment concierge service that worked with groups of doctor practices throughout several southeastern states, had been tested and refined over several years and was now ready, with deep-pocket backing, to make its debut in an IPO.
However, two of the corporate offices, both doctors and both board members, as well as the deepest of the deep-pocket investors, had initiated action to remove the operating and finance officers and their staffs just prior to the offering. The deep pocket investor was withholding funds unless they were terminated and replaced by his and the other officer/board members' choices.
The attorney for the CEO and CFO had no proof that the three were conspiring and needed to find evidence they were. We were asked to analyze the hard drives of the company's server and the two laptops the company provided the two doctor board members for data that might show to a court that an illegal coup was being staged. The two doctors had been barred from entering the company's premises. The order had been issued after they had left work one day, and both had left their laptops on their desks. The laptops were kept in the company safe - now with a new combination code.
We conducted a forensic examination of their offices and then the company's server, to no avail. After investigating files on the laptops' hard drives, we found nothing we could use. Now, we were at an impasse.
But as breaks sometime come, we uncovered that the conspirators did communicate through e-mail - not the company's Outlook e-mail running through the server, but on outside sites where they had accounts with Yahoo! and Hotmail. Now we had something.
We performed a mirror image of the second laptop's hard drive. The CEO had narrowed down to a three-day period when the two doctors started to voice, in unison, how and why the CEO, CFO, and their staffs were to be terminated because the investor "had lost confidence in them" and was withdrawing his critical financial support until they were replaced before the IPO.
The investor lived in a rural paradise more than 100 miles away from the company headquarters. We checked the company's telephone records and the doctors' company cell phone records for this time period. There were no calls with the investor on the company phones, but there were increased conversations among the three during this time period on the doctors' cell phones, with a few calls directly prior and afterward.
Now we had something to go on. We began to look for "ghosts" (a "ghost" is a writing to the hard drive that remains cached in Random Access Memory - known as RAM).
When you think about it, it seems quite logical. When you write an e-mail on your computer from an Internet e-mail account, what is really happening? That message isn't held in virtual space; it is written to your hard drive. But because it is not saved to your hard drive, the metadata - the tags (also written to the hard drive) that tell your computer what you are doing and where on your computer it is being done - are deleted from the tracking file when you turn the computer off. However, a "ghost" of the tags remain, even when they may be overwritten by new data.
Forensic software is pretty comprehensive these days. We knew that during this three-day time period, there was no reason for any correspondence to take place on the doctor's laptop with the investor's name attached to it. So we queried the software to find if the investor's name had been written to the hard drive during this time period, and if so, to track the metadata attached to the investor's name to the whole writing.
Bingo! You guessed it - we got the smoking gun - correspondence between the investor and the doctors that laid out the whole process and the doctors' roles in staging the coup. We even got admittance that care was needed because what they were attempting was illegal. Who could ask for anything more?
Coup blocked. Doctors and an investor thrown off board. New investors waiting in the wings. The IPO went forward.
Nothing really disappears. It may be destroyed, but if it isn't destroyed, it is still there and can be found.
I have also learned that there will always be enough fraud and corporate corruption to keep me busy and happy. Sometimes I don't even get under the covers when I go to sleep, because I don't want anything getting in the way when I jump out of bed, raring to go in this wonderful brand new day that is pulling me into some exciting and challenging adventure.
Also, there will always be enough need for fraud detection to go around - so get out there! Incorporate forensic accounting into your career. You will make the profession of public accounting once again a shining beacon of respect and trust.
William C. Barrett III, CPA/ABV, CVA, CTP, CCFM, a sole practitioner in Richmond, VA, has investigated fraud and misfeasance in corporations, boards of directors and medical practices, and has directed teams investigating multi-defendant money laundering, illegal income, tax evasion and white-collar fraud. Bill sits on the NACVA Ethics Oversight Board and is a member of the VSCPA Editorial Task Force. Contact him at firstname.lastname@example.org.
Reprinted with permission from the Virginia Society of CPAs.