Financial Forensic Investigations

The Layered Approach

There is a maxim in forensic accounting that investigations take twice as long as anticipated, yet the final report appears to have taken half the time. This article provides an overview of the forensic methodology to balance client expectations with the appropriate level of service. Each progressive layer allows for the milestones reached to be evaluated before expanding the scope. This article will also assist the forensic practitioner in communicating the costs of continuing the analysis against the anticipated benefits.

There is a maxim in forensic accounting that investigations take twice as long as anticipated, yet the final report appears to have taken half the time. This article provides an overview of the forensic methodology to balance client expectations with the appropriate level of service. Each progressive layer allows for the milestones reached to be evaluated before expanding the scope. This article will also assist the forensic practitioner in communicating the costs of continuing the analysis against the anticipated benefits.

Forensic accountants are duty bound to follow the standards of their professional credentialling organizations. To illustrate, the American Institute of Certified Public Accountants (AICPA), the Association of Certified Fraud Examiners (ACFE), and the National Association of Certified Valuators and Analysts (NACVA) have similar requirements for:

• Gathering sufficient relevant data
• Planning and supervising staff
• Exercising due professional care
• Demonstrating competence

These and other factors, such as applying reliable principles and methods, are necessary for expert reports to be admissible. The extent of the actions performed determines the defendability of expert opinions. As described below, the layers of procedures become increasingly granular, with Level 3 being the most defendable.

Analysts are frequently asked to “find the needle” in the proverbial haystack, with limited time, funds, or documents. The unique facts and circumstances of the case determine the relevant forensic procedure(s). Consider how a fraud investigation would be approached differently than a lifestyle spending analysis in a divorce. Experts often create a custom roadmap early in the operation to maximize the effectiveness of the engagement. Adequate discussions with the client, understanding their concerns, and formalizing the scope are best practices. The procedures described below are therefore not appropriate for every case—they are part of an experienced expert’s toolbox.

Level 1: Surveying the Landscape

The Level 1 forensic procedures incorporate summary-type documents. These may include those prepared internally (e.g., profit and loss statements, balance sheets, etc.) and others shared externally (e.g., tax returns, W-2s, 1099s, etc.). The available documents may be confined to the initial production or obtained through progressive requests, subpoenas, or independent research. The landscape is revealed piecemeal through the broad financials and the detailed analyses of supporting documents.

For Level 1 activities, the expert may:

• Analyze the financial statements and tax returns. This includes inputting the information into Excel or other software and checking the mathematical accuracy of the data. Each line item (assets, liabilities, income, and expenses) will be reviewed, and any notes to the financial statements/return schedules will be read and understood. For Schedule C businesses and Schedule E real estate activities, no balance sheets are reported, which limits the usefulness of this technique.
• Prepare a statement of cash flows. The old adage “cash is king” becomes apparent when studying the cash flow statement. Classifying the changes in cash into operating activities, investment activities, and financing activities helps identify trends and irregularities. For example, the Enron scandal was eventually revealed when the cash deficiency from their day-to-day business was covered up through new debt and stock issuance.
• Prepare a statement of changes in equity. The beginning balance of equity should match the ending balance from the previous fiscal year. As simple as it sounds, that is an often-overlooked diagnostic where unreconciled differences can hide. QuickBooks posts unreconciled discrepancies to opening balance equity, which would not necessarily be noticeable without analyzing the changes in equity between periods.
• Convert the financial information to percentage of total assets or total revenue. This “common sized” analysis provides perspective not available with the raw numbers as the expert can follow historic trends or isolate abnormalities. Reviewing the gross profit during inflationary periods may help understand how the price increases were passed on to customers or spot potential unreported revenue.
• Perform reasonableness testing. The expert may calculate ratios and forensic indices to evaluate the company’s profitability, efficiency, turnover, and earning management. This performance may be compared to available benchmark industry data to see how the subject company performed relative to its peers. Further, the IRS’s Formal Indirect Methods (IRM 4.10.4.6.3–4.10.4.6.7) and numerous audit technique guides may be incorporated, as appropriate. In fact, an indirect method was used to help prosecute Al Capone.
• Reconcile related party activity. On the balance sheet, the due to/from accounts will need to be aggregated and matched to the offset on related party financial statements. Any irregularities may be investigated for income manipulation. Any related party income and expenses (such as product sales, management fees, overhead allocations, etc.) will need to be eliminated if consolidating the cash flows. This includes an analysis of transfer pricing where the parties may have shifted profitability from one entity to another.
• Search public records. States maintain databases where business licenses, entities, and individuals can be researched. This can extend to professional licenses, real estate filings, mortgages, PPP loans, and other information, which can be used to corroborate the known disclosures. Expanding the scope to surrounding states or obtaining a current credit report may reveal additional insights.

Other nonfinancial aspects to consider include loan applications, genograms, travel logs, and other qualitative metrics. For example, a simple change in accountants may help to understand unexplained variances in the financials from year to year. Of course, if an individual or a business frequently changes accountants, this would be a red flag for potential misrepresentations.

Level 2: Beneath the Surface

Level 2 procedures involve account statements and other documents prepared internally (general ledger, cash disbursements journal, accounts receivable aging, etc.) or provided by third parties (bank and credit card statements, Amazon purchases, etc.). Documents received from third parties are referred to as “control” and considered more reliable than those prepared internally as they are less likely to be manipulated. Level 2 documents contain the individual transactions, which are helpful to unpack the Level 1 information. The business AMEX card will show the monthly activity for each card member, albeit not the underlying purpose.

For Level 2 activities, the analyst may:

• Obtain and reconcile control documents. Control-type documents include traditional bank and credit card statements for the business, as well as investment accounts, Venmo, cryptocurrencies, IOLTA, escrow, etc., as applicable. These statements can be reconciled to the Level 1 documents to identify discrepancies or areas of concern. The expert may compare the bank deposits with the reported revenue to identify potential over/under reported revenue. Note any loan proceeds; shareholder contributions and other non-revenue cash receipts should be excluded before forming an opinion.
• Reconcile the transfers between financial accounts. Any transfers between accounts should be analyzed to ensure the cash outflows from one account appear as cash inflows on the other. This step is an essential diagnostic procedure and often leads to the identification of hidden accounts. Any unaccounted transfers in/out may be considered unreported income or dissipation, respectively, with the burden of proof on the account holder to dispute.
• Obtain and analyze the general ledger. The company transactions tell a story which reveals the “financial footprints” when aggregated over time. These business activities should align with the overall industry and any inconsistencies may be investigated. For example, a law practice with inventory or a retailer with accounts receivable would be considered atypical. The general ledger data is often exported/converted to spreadsheets for easier data analysis.

  The general ledger should also be evaluated for common sense activities. If there are 13 utility payments recorded in a calendar year, the expert may need to analyze whether the extra payment relates to a prepayment, a personal charge, misclassification, etc. The expert may also review the journal entries for unusual activity (such as adjustments to cash accounts) and other information from the accounting software’s audit trail to test the functionality of internal controls.

• Verify cash receipts and disbursements. Entire data sets can be considered to test the accuracy of the general ledger postings. This exceeds the level of diligence of financial auditors who test only a sample of the transactions. Items such as payees, transaction dates, check memos, and other clues from the documents may provide insight into the existence and reliability of the revenues, expenses, assets, liabilities, and equity accounts. One of the author’s favorite financial manipulations involved a business that recorded capital gains to a shareholder loan account which was systematically “repaid” via personal transactions. The net effect was significant unreported revenue while confining personal transactions to the balance sheet.

  The verification process involves a deep understanding of accounting theory with particular attention paid to transactions near fiscal year ends or other “cut-off” periods. A common fraudulent technique involves minimizing revenue in December followed by a large cash deposit in the first week of January.

• Evaluate consecutive transactions. Certain business activities have unique reference codes so they can be easily tracked. Invoices, purchase orders, work orders, bills of lading, etc., generally have a consecutive numbering system so the gaps can be reconciled with the Level 1 reporting. Any voids or deviations from company policies may warrant further investigation.
• Merge and analyze databases. Experts search for duplicate information appearing in multiple databases, which may be used to direct the procedures. The employee database can be merged with the vendor database whereby addresses, phone numbers, names, etc., can be compared for any unusual activity. Techniques such as Benford’s Law, stylometry, regression, and other analyses may identify aberrant patterns in the data.
• Research payees and source of funds. Additional diligence may be required to understand the origin or recipient of funds as well as the intended purpose. This may involve an internet search or Level 3 documents (see below) to determine whether the transaction was business or personal. If the expert establishes that the business paid for personal items, the next step would be to understand how the transaction was posted to the company’s general ledger. To illustrate, say the business paid $100,000 for personal credit card transactions during the year. Before concluding the items were expensed, the expert must establish the payments were not taken as distributions, used to reduce shareholder loans, or included in officer compensation. This becomes more complicated if the credit card payments were batch posted or entered as journal entries.
• Analyze personal accounts if available. Depending on the type of case and availability of records, analyzing the personal financial accounts may help to understand the consistency of the reported business cash flows with the parties’ lifestyle spending. For example, the author had a case involving a long-standing scrap metal business that barely broke even, yet the parking lot was full of luxury vehicles. Having access to the personal accounts may have influenced the outcome of the case. The expert may also estimate personal living expenses using the Bureau of Labor Statistics and other data.

The above financial information may require additional processing time if the data is hardcopy format. While some analysts still prefer to perform the data entry themselves, there is software available that can import the data straight into Excel. Normal “cleaning” of the data is necessary to format the information correctly and is more efficient than manual entry. If paper-based documents are provided, additional funds may need to be budgeted to scan/convert the data to electronic format.

Level 3: Under the Microscope

For Level 3 forensic procedures, the expert utilizes source documents to independently verify the Level 2 trail of records and potentially adjust. Whereas financial statement audits focus on consistency and completeness, forensic accounting investigations look to identify irregularities/exceptions such as fictious vendors and transactions circumventing internal controls.

For Level 3 activities, the analyst may:

• Obtain original receipts and other supporting documents. The expert may evaluate the business or discretionary spending based on the information contained in the source documents. Items such as description, timestamp, authorized signature/approval, and other information may be on the receipts. Other data may come from e-mails, correspondence, estimates, engineering plans, etc., as available. These records can be compared to the general ledger and potentially recategorized. Often, this data requires the suppliers or customers to be subpoenaed, so this decision should be carefully evaluated for any deleterious effects to the business.

  The expert should critically evaluate the records for manipulation. Altered records may be misaligned, use different font, spacing, etc. The author recently had a case where the bank statement balance was altered to match the lower cash balance in the general ledger.

• Tour the facility. The documents will not tell the whole story. While not always practical or possible, the expert should seek to tour the facility and observe the business operations. The intangible aspects of the business such as cleanliness, customer/staff interactions, and physical layout are important considerations. For example, the number of patient rooms and scheduling calendars may be used to evaluate the revenue quality. Pictures, if allowed, may become part of the expert’s report (think real estate appraisals).
• Conduct interviews. Interviews allow the expert to compare the stated internal controls with the actual operations. The Level 1 and Level 2 data can be corroborated by the staff or other third parties. There are many aspects of interviewing beyond the scope of this article.
• Image the hard drives. Despite the popular belief that electronic data can be deleted, imaging the hard drives is a way for experts to capture information in their native environment and recover sensitive non-financial information. Note, the evidence should be carefully monitored and authenticated for it to be used at trial. Preserving the “chain of custody” is essential to ensure that no damage or alteration occurs during the investigation.
• Create a timeline of events. Overlaying the access rights and various activities of the key individuals may reveal aberrant patterns over time. The classic scenario is when the fraudster gets caught when they finally take a vacation.

The list of available forensic procedures is long and beyond the scope of this article. Forensic accountants cannot communicate findings for work they have not performed, or form opinions beyond their area of expertise or education. Reasonable certainty comes at a price even when cheaper staff rates are utilized. The analysis may be limited to one bank account for one year or expanded to all financial accounts since inception. The more information analyzed, the greater the reliability of the results. The three layers can be integrated to form a defendable opinion through effective analysis of the data.

What Does it All Mean?

According to the AICPA’s Statement on Standard for Forensic Services No. 1, forensic accounting services generally involve the application of specialized knowledge and investigative skills by a member to collect, analyze, and evaluate certain evidential matter, and to interpret and communicate findings. In other words, the output depends on the input. The process also extends to non-financial metrics to bolster the opinions reached. This is illustrated more concisely as “the art and science of investigating people and money”.[1] If the expert understands the people, following the money becomes easier. It is important to note that spending additional time and energy does not magically make needles appear in haystacks. Clients should understand that heuristics are an ordinary and necessary part of the due diligence process, and dead ends are not a failure of the expert.

Understudying and communicating the anticipated scope and related fees before starting the analysis benefits both the client and the expert. This is even more important for rush jobs as hours rack up quickly. While it is difficult to quote jobs by a metric (e.g., $0.25 per transaction), best practices involve an agreed upon budget and a target date to evaluate the initial review. The scope can be reassessed once the expert reviews the documents and modified, if necessary, as the landscape becomes more clear.

Effective communication also extends to the results/deliverables as the certainty of any expert opinion depends on the depth of the analysis. More than 80% of attorneys in an AICPA survey identified the inability to simplify the information and ineffective oral communication skills as the top-two reasons why forensic accountants are ineffective.[2] At each milestone, the client should clearly understand the costs and benefits of continuing the investigation. Finding a balance where the client objectives match the above levels of services makes for a more efficient engagement and increases the odds of a successful outcome for all parties.

This article was previously published by J.S. Held Insights and is republished here by permission.

[1] Dorrell, Darrell and Gadawski, Gregory, Financial Forensics Body of Knowledge, Wiley, 2012, page 6.

[2] Davis, Charles; Farrell, Ramona; and Ogilby, Suzanne, Characteristics and Skills of the Forensic Accountant, AICPA FVS Section, 2010.

---

Jason Pierce, CPA, CMA, CFM, CVA, MAFF, is a Senior Vice President in the Economic Damages and Valuations section of J.S. Held’s Forensic Accounting / Economics / Corporate Finance practice. He specializes in forensic accounting, business valuation, and consulting engagements. He brings more than 25 years of experience in various accounting and finance-related disciplines. Mr. Pierce works with clients on disputes, transactions, fraud, damages, family law, criminal, and estate planning engagements. He has testified as an expert witness in State courts, Federal courts, and in arbitration proceedings. A regular speaker at legal and professional organizations, He also serves as a lead instructor for NACVA’s Master Analyst in Financial Forensics (MAFF) certification program and other courses.

Mr. Pierce can be contacted at (857) 216-9775 or by e-mail to JPierce@jsheld.com.