Investigation Flashcards
Definition of “Fraud Examination”
a process of resolving allegations of fraud from inception to disposition
Forensic Accounting
the use of professional accounting skills in matters involving litigation
Predication
the totality of circumstances that would lead a professional to believe fraud has/is/will occur
The Fraud Theory Approach
1- Analyze Data
2- Create Hypothesis
3-Test Hypothesis
4- Refine Hypothesis
An Indemnity Clause
clauses in contracts that set out to protect one party from liability if a third-party or third entity is harmed in any way
It’s a clause that contractually obligates one party to compensate another party for losses or damages that have occurred or could occur in the future.
A Case Plan
Outlines the course of action the investigation team will take (scope/goals/timing/assignments/documents needed/ etc)
Trash Marks
uniquely identifiable markings on copies that allow one to identify the particular machine used
Anachronisms
items located at a time when they could not have existed or occurred
Indented writing
the impression a writing instrument leaves on sheets of paper below the sheet that had the original writing
Latent fingerprints
Invisible fingerprints left on surfaces by the persons skin
Patent finerprints
Visible fingerprints that are either left by the skin or through the transfer of materials (blood, soil, etc)
Kinesic Interviews
Rather than looking for a confession, attempt to allow the interviewer to assess whether the subject is telling the truth via body language
Once the accused makes the benchmark admission, the interviewer should….
positively affirm confessor’s decision by returning to the theme for their rationalization
(eg, I’m glad you had a good reason. That reinforces what I thought all along—that you were caught up in extraordinary circumstances. When was the first time you did it?”)
A Link-network diagram
shows the relationships between people, organizations, and events.
What are the two preferred means of organizing/presenting information in a fraud examination report?
Chronologically
By transaction
Characteristics of an admission seeking interview
- sufficient privacy
- time is not a factor
- maximizing sympathy
- minimizing the perception of moral wrongdoing
Internet archives
archived versions of web pages that have since been updated or are no longer available online
The US Privacy Act of 1974
regulates the collection, maintenance, consumption, and distribution of personally identifiable information that is maintained by federal agencies.
The US Right to Privacy act
prohibits financial institutions from disclosing financial information about individual customers to governmental agencies without the customer’s consent, a court order, etc.
Deleted files are recoverable until….
they are overwritten
-data are not erased from a computer’s hard drive until the operating system overwrites all or some of the files
Why shouldn’t management implement a blanket policy prohibiting employees from discussing employee investigations?
doing so could violate certain employee rights, especially if the jurisdiction guarantee private-sector employees the right to organize
Under what circumstances does a covert examination make sense?
when there is reliable information about criminal activity or asset losses, but insufficient detail for prevention or apprehension.
Structured Data
the type of data found in a spreadsheet or database
-includes sales records, payment/expense details, financial reports
Unstructured Data
data that would not be found in a traditional spreadsheet or database
-writing
If you’re seizing a computer for forensic analysis, why should you also seize printers attached to it?
Because they have a hard drive that stores images of documents the machines have copied, scanned, or emailed
Why shouldn’t anyone other than the suspect and fraud examiners be in an admission seeking interview?
- The presence of third parties could have liability consequences
- it is very difficult to obtain a confession with witnesses present
When drafting a fraud examination report, fraud examiners should write with the expectation that opposing legal counsel will…..
have access to the information it contains.
When accused of wrongdoing, the typical guilty person reacts with….
silence
If the accused does deny culpability, those denials are usually weak.
The Freedom of Information act
the primary legislation that governs the availability of U.S. governmental records to the general public
The FOIA sets very specific guidelines regarding which governmental records are and are not open to the public.
For a fraud examiner in the private/government sector, any promises made to an informant or source should..
be qualified with the caveat that no absolute assurances of confidentiality can be given.
A signed statement should include a moral excuse that….
is worded in a way that doesn’t diminish legal responsibility
(eg, “I didn’t mean to hurt anybody” is better than “ I didn’t mean to do it”
A net worth analysis
used to prove illicit income circumstantially by showing that a person’s assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income
A letter rogatory
A formal request by the courts of one country seeking judicial assistance from the courts of another country
What is the most critical aspect to defend against allegations of entrapment in covert operations?
That adequate predication based on more than mere suspicion exists before the operation is commenced.
e.g, if the officer received a reliable tip that a suspect committed fraud,
illustrators
hand motions made when talking to demonstrate a point
Inspector General Offices
+relevance to a fraud investigation
The law enforcement function set up within a government admin agency to combat government fraud, waste, and abuse in federal departments and agencies
will have centralized and case file info on businesses that have been investigated and audited
Calibrating
The process of observing behavior to nonthreatening questions before critical questions are asked
Double-negative questions
questions that often suggest an answer opposite to the correct one
shouldn’t be used in an interview
The four phases in the data analysis process
1- planning (understand data available, build fraud profile, determine if predication exists)
2- preparation (identify relevant data, obtain it, verify it, cleanse it)
3- testing and interpretation (analyze it)
4- post analysis (respond to findings, monitor data)
The four goals of introductory questions in an interview
provide intro
establish rapport
establish interview theme [purpose of interview]
observe respondent reactions
An alternative question
forces the accused to make one of two choices, both of which imply guilt. One alternative provides the accused with a morally acceptable reason for the misdeed; the other portrays the accused negatively. Regardless of which answer the accused chooses, they are acknowledging guilt.
eg, “did you deliberately plan this or did it just happen?”
A signature card
evidence of a contract between the bank and a customer that opens a personal account
includes name, address, id#, etc.
The Join Function
Combines two sorted input files so you can find differing records between them
eg, comparing payroll records to the employee master file to look for a ghost employee
Under what circumstances can an employed suspects credit report be pulled without their consent?
The investigation involves suspected misconduct, violation of laws or regulations, or violation of any preexisting policy of the employer.
The employer uses a third party to conduct a workplace investigation
AND the report from the third party is not communicated to anyone other than the employer, an agent of the employer, or the government.
The two categories of inferential confusion
induction - asking respondent to convert actual experiences into higher level of generalization
deduction - asking respondent to give concrete examples of certain categories of experience
What should be the first step in trying to locate a subject using online records?
obtaining a post address of the subject
Textual analytics
a method of using software to extract usable information from unstructured data
eg, searching for fraud keywords in emails
If a suspect is still lying about an aspect of the fraud during a verbal confession, the interviewer should….
Proceed as if the falsehood has been accepted as truth and return to it later.
If a company incorporated in one state decides to expand to doing business in another state then…
depending on the state, they may need to register as a foreign corporation to do business there.
When taking a signed confession, if the suspect admits to more the crime and additional unrelated crimes, then…
The examiner should take separate statements for each of the unrelated crimes, since the suspect may be tried for each offense
Benford’s Law
A technique to identify fictitious numbers
States that for natural numbers (those not ordered in some way or human generated, such as payments), there is a non-random chance that a certain number will appear first
eg, the chance of #1 appearing first in a three digit number is 30%, not 12.5%
Steganography
The process of hiding one piece of information within an apparently innocent file
What does “establishing the interview theme” mean?
Stating the interview’s purpose in a general way that will ensure that the respondent isn’t confused, threatened, or overly cautious
Gap testing
a data analysis function used to identify missing items in a sequence or series
e.g, missing checks or invoice numbers; hidden journal entries
To properly inventory documents, if it is not practical to mark the document, or if marking it would damage the document, then…
it should be placed in an acid-free envelope that has been marked and sealed
In an admission-seeking interview, the interviewer should transition to the verbal confession when …
the accused provides the first detailed information about the offense
The Asset Method
+when to use
- used to prove a suspect’s illicit income circumstantially
- shows that the subject’s assets for a given period exceed those that can be accounted for from known or admitted sources of income
- should be used when it is suspected that the subject has accumulated wealth and acquired assets with illicit proceeds
The Expenditures Method
+when to use
AKA- the sources and application of funds method
- used to prove a suspect’s illicit income circumstantially
- quantifies the cost of the subject’s lifestyle and determine whether the subject’s reported income is sufficient to support their lifestyle
- should be used used when the subject spends illicit income on consumables (e.g., travel and entertainment) that would not cause an increase in net worth
The bank deposits method
+when to use
- used to prove a suspect’s illicit income circumstantially
- computes income by showing what happened to a suspects funds once deposited at a bank
- should be used when most of the subject’s income is deposited in a financial institution and the subject’s books and records are unavailable, withheld, incomplete, or maintained on a cash basis.
Once the accused utters a denial in an admission-seeking interview, the interviewer should….
Interrupt them prevent an outright denial, thereby making it easier for the subject to confess at a later time
it becomes extremely difficult for them to change their response because doing so would be an admission that they lied
A credit header
the information in a credit report that gives basic information about the person
includes identifying information such as name, name variations, current and former addresses, telephone number, date of birth, and Social Security number.
the Deep Web
refers to Web content that is not indexed by standard search engines because a web crawler (search engine) can’t enter, there’s no link there, its in a password protected website, etc
Internet Archive
refers to archived versions of Web pages that have since been updated or are no longer available online
Assessment Questions
seek to establish the respondent’s credibility
Used only when the interviewer considers previous statements by the respondent to be inconsistent because of possible deception.
The three objectives of closing questions in an interview
- reconfirm facts
- gather additional facts
- conclude interview in a way that maintains goodwill
What is “imaging” in examinations involving digital evidence?
Why is it done?
A process that creates an exact duplicate of the hard drive/digital media on original storage media
Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence
An audit clause
allows parties to a contract the right to access another party’s books
Generally allows an organization to demand that a supplier, vendor, or agent turn over relevant documents as a condition of continued business.
The five general types of questions an interviewer can ask
- introductory
- informational
- assessment
- admission seeking
- closing
Complex questions
consist of a series of interrelated questions
Five ways to use data analysis software on asset accounts to help detect fraud
Depreciation to cost reports.
Compare book and tax depreciation and indicate variances.
Sort asset values by asset type or monetary amount.
Select samples for asset existence verification.
Recalculate expense and reserve/provision amounts using replacement costs.
Leading questions
Framed in a way that evokes a specific reply from the respondent
Open questions
Those worded in a way that makes it difficult for the respondent to answer “yes” or “no.”
calls for a monologue response
The Altruism technique
Used in an admission seeking interview
Reducing the moral seriousness of a fraud by claiming that the action was for the benefit of others
eg “A lot of people depend on you for their jobs. I just know you did this because you thought you were doing the right thing for the company, didn’t you?”
Under what circumstances is it ok for a digital forensic examiner to perform live evidence collection from a seized running computer?
if the evidence needed exists only in the form of volatile data
Where are birth certificates generally filed?
At the state bureau of vital statistics
Controlled Answer Questions
Questions used to stimulate a desired answer or direct the interview toward a specific point
A fictitious business name
AKA - DBA (doing business as)
when a business owner operates a company under a name that is different from their legal name, which is not illegal
The purpose of a fraud examination report vs an expert opinion
Fraud exam report - to document results of the exam and provide all evidence necessary to evaluate the case
Expert Report - to provide the fraud examiner’s opinions of a case, as well as the fraud examiner’s qualifications and bases for providing those opinions.
What are the six basic fraud examination reporting documents?
Transmittal letter [confirms sending/ provides context]
Indexes [alphabetized listing with page references]
Memorandum [documents interviews/ discoveries]
Exhibits/documents [supporting source info]
Cover page of letter [summary of key points]
Forms [documentation of info gathering process steps]
Three basic methods for preventing outright denials in admission seeking interviews
Repeated interruptions
Delays
Reasoning
Mutual legal assistance
A process by which countries request and provide assistance in law enforcement matters
