Conducting investigations I Heart Audit Conference February 2018 www.pwc.com
PwC | Conducting investigations
Agenda
2018 Global economic crime survey results
Investigation lifecycle
When to consider an independent investigation
Please feel free to ask questions during the presentation.
2
PwC | Conducting investigations
Factors contributing to economic crime committed by internal actors
7
PwC | Conducting investigations
People measures implemented to address increased regulatory expectations
10
PwC | Conducting investigations
Identifying the issue
Common detection methods include:
• Corporate Control
- Internal Audit, fraud risk management, suspicious transaction monitoring
• Corporate Culture
- Internal/external tip-off, whistle-blowing system
• Beyond Management Influence
- Accidental discovery, law enforcement
How was the crime initially detected?
Suspicious transaction
testing
14%Internal Audit
11%Tip-Off
(internal)
11%By
Accident
11%
12
PwC | Conducting investigations
Investigation lifecycle
Scope & Background
Evidence Collection
Analysis of Financial
Transactions
Interviews of Knowledgeable
Persons
Follow-up
Reporting
13
PwC | Conducting investigations
Scope & background
Goals and objectives
Documentation
Legal considerations
Work program
14
PwC | Conducting investigations
Evidence collection
Identify, protect and preserve relevant documents• Work with Legal to send a document preservation notice
• Consider collecting hard copy documents (office & cube sweeps), Email servers, Network drives, hard drives (e.g., laptops, smart phones, external drives), etc.
• Work with IT to stop back-up tape deletion rotation
Capture complete data• Search available backups/old and archived data
• Consider walking the facilities for old tapes
• Recover deleted emails/files
• Run specialized software to crack password-protected files (or just ask for the passwords)
15
PwC | Conducting investigations
Evidence collection
Factors to consider:• Ownership, chain of custody (physical documents, electronic data)
• Documents received log (who, what, when, where)
• Original documents should be copied/scanned
• Never make notes on original documents
Data security is first priority. Rigorous encryption and safety protocols must be exercised.
The e-discovery process would involve:
• Identification
• Preservation
• Collection
• Processing
• Review
• Analysis
• Production
16
PwC | Conducting investigations
Evidence collection
• Thoroughly process & analyze data
- “Dedupe” population methodically
- Test search term syntax & apply terms methodically across custodians
• Limiting analysis to common file extensions and not requesting file signatures may inadvertently eliminate potential key documents
• Consider use of analytic options to more efficiently search data (e.g., BrainSpace)
• Train readers in investigation background and review tool
• Consider foreign language files:
- May be difficult to process due to unusual character sets
- May be ignored if readers are unfamiliar with the language in which the document is written
• Identify responsive, relevant, key documents
• Document procedures performed (there will likely be questions later)
17
PwC | Conducting investigations
Evidence collection
DirectReal
Circumstantial
• Internal Records• Financial records• Legal records• HR• Electronic media• Interviews
18
PwC | Conducting investigations
Analysis of financial transactions
• Identify data, files, and fields• Design tests based on past experience, company policies, data and fields, transactions, etc.Planning
• Master files, transaction files, employee data• PO fields, VAT fields, vendor listingAcquisition
• Reconcile data to source files• Tie data to the financial statementsValidation
• Identify red flags, false positives, and procedural breaches• Consider purchase patterns, sequential invoicing, retrospective POs, and master-file duplicatesAnalysis
• Trace paperwork, review files, conduct interviews• Implement controls and monitor complianceResults
19
PwC | Conducting investigations
• Objective is to gain a confession or admission• Highly structured• No notes• The investigator should do the talking• Tone should be accusatory
• Objective is to gain information• Open ended• Notes should be taken• The witness should do the talking• Tone should be supportive
Interview of knowledgeable personsPurpose of the interview
The purpose of interviewing is to gather information and evidence as well as differentiate/eliminate suspects and witnesses.
Interview
Interrogation
20
PwC | Conducting investigations
• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications
• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended
questions• Paraphrase key responses to ensure mutual
understanding• Consider verbal and non-verbal cues
Interview of knowledgeable personsInterview process
• Decide who will take notes and through what method
• Notes will be less accurate than a recording, but should be “words to that effect”
• Place key quotes in quotation marks• Prepare memorandum of notes soon
after the interview is conducted
• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed
• Know subject matter• Understand the interviewee’s
background• Prepare an outline, detailing the
topics to be addressed and the documents to be used in connection with each topic
• Cover necessary topics to complete the interview
• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation
• Express appreciation for the time and effort expended to complete the interview
• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation
• Select a location that will facilitate the interview
• Don’t conduct the interview alone – select attendees in order to facilitate the interview
21
PwC | Conducting investigations
Interview of knowledgeable personsPreparing for the interview
• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications
• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended
questions• Paraphrase key responses to ensure mutual
understanding• Consider verbal and non-verbal cues
• Decide who will take notes and through what method
• Notes will be less accurate than a recording, but should be “words to that effect”
• Place key quotes in quotation marks• Prepare memorandum of notes soon
after the interview is conducted
• Cover necessary topics to complete the interview
• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation
• Express appreciation for the time and effort expended to complete the interview
• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation
• Select a location that will facilitate the interview
• Don’t conduct the interview alone – select attendees in order to facilitate the interview
22
• Relevant documents• Documents requiring further explanation• Subject matter knowledge• Interviewee’s background• Understand the allegations• Outline questions
PwC | Conducting investigations
Interview of knowledgeable personsInterview setting
• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications
• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended
questions• Paraphrase key responses to ensure mutual
understanding• Consider verbal and non-verbal cues
• Decide who will take notes and through what method
• Notes will be less accurate than a recording, but should be “words to that effect”
• Place key quotes in quotation marks• Prepare memorandum of notes soon
after the interview is conducted
• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed
• Know subject matter• Understand the interviewee’s
background• Prepare an outline, detailing the
topics to be addressed and the documents to be used in connection with each topic
• Cover necessary topics to complete the interview
• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation
• Express appreciation for the time and effort expended to complete the interview
• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation
23
• Facilitating environment• Multiple participants
PwC | Conducting investigations
Interview of knowledgeable personsDuring the interview
• Decide who will take notes and through what method
• Notes will be less accurate than a recording, but should be “words to that effect”
• Place key quotes in quotation marks• Prepare memorandum of notes soon
after the interview is conducted
• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed
• Know subject matter• Understand the interviewee’s
background• Prepare an outline, detailing the
topics to be addressed and the documents to be used in connection with each topic
• Cover necessary topics to complete the interview
• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation
• Express appreciation for the time and effort expended to complete the interview
• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation
• Select a location that will facilitate the interview
• Don’t conduct the interview alone – select attendees in order to facilitate the interview
24
•Standard introduction•Purpose of interview•Build rapport with interviewee•Use direct, leading, and open-ended questions
•Paraphrase key responses to confirm understanding
•Consider verbal/non-verbal cues
PwC | Conducting investigations
Interview of knowledgeable personsConcluding the interview
• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications
• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended
questions• Paraphrase key responses to ensure mutual
understanding• Consider verbal and non-verbal cues
• Decide who will take notes and through what method
• Notes will be less accurate than a recording, but should be “words to that effect”
• Place key quotes in quotation marks• Prepare memorandum of notes soon
after the interview is conducted
• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed
• Know subject matter• Understand the interviewee’s
background• Prepare an outline, detailing the
topics to be addressed and the documents to be used in connection with each topic
• Select a location that will facilitate the interview
• Don’t conduct the interview alone – select attendees in order to facilitate the interview
25
• Cover necessary topics• Gain cooperation for additional
interview• Express appreciation• Permit witness to ask questions, if
appropriate
PwC | Conducting investigations
Interview of knowledgeable personsMeeting notes
26
• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications
• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended
questions• Paraphrase key responses to ensure mutual
understanding• Consider verbal and non-verbal cues
• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed
• Know subject matter• Understand the interviewee’s
background• Prepare an outline, detailing the
topics to be addressed and the documents to be used in connection with each topic
• Cover necessary topics to complete the interview
• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation
• Express appreciation for the time and effort expended to complete the interview
• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation
• Select a location that will facilitate the interview
• Don’t conduct the interview alone – select attendees in order to facilitate the interview
• Decide who will take notes• Determine note methodology• Key quotes in quotation marks• Prepare memorandum soon
after interview
PwC | Conducting investigations
Follow up
Once the initial document review and interviews have been completed:
Consider the evidence gathered
Re-evaluate the scope
Perform additional procedures as needed
Consider remediation procedures if needed
27
PwC | Conducting investigations
Reporting
Do
• Consider the stakeholders• Summary of process and results• Independent and objective language• Spell and grammar check
Don’t
• Write opinions• Use qualitative words (all, large, etc.) • Legal determinations – where
appropriate
28
PwC | Conducting investigations
Common investigation pitfalls
• Not bringing questions to someone’s attention
• Directly confronting the suspect
• Failure to secure data
• Electronic media process if flawed
• Failure to assess the ramifications
• Expectation that an investigation is quick
• Tendency to do a superficial investigation
• Concluding on suspect culpability based on conjecture
• Dismissing the allegations based on materiality/value
• Dismissing the allegations based on personal knowledge of the suspect
• Not communicating early and openly with external auditors
• Not anticipating stakeholder requirements
29
PwC | Conducting investigations
Investigation life cyclePhase I – Preliminary investigation
31
Multiple Source Origination
Phase II
Incident ClaimCapture
Document Protection
IndependentInvestigation Conducted
PreliminaryInvestigation
No
Yes
End
No
No
Yes
Yes
Do concerns relate to potential:a. Illegal acts,b. Restatement, orc. Misbehavior by
senior mgmt.
Evaluate?
Incident appears to be an isolated
issue
Consider concluding
investigation internally.
No
Seniormanagementimplication
Consider coordinating with internal resources.
Yes
PwC | Conducting investigations
Investigation life cyclePhase II – Independent investigation
32
Re-scoping andadditional procedures
Investigation team
Independent Investigation Conducted
Sizing and datingof problems
Phase III
Information Gathering• Interviews• Document Gathering• E-media
Communication Strategy:• Audit Committee• Auditors • Regulators
PwC | Conducting investigations
Investigation life cyclePhase III – Reporting and remediation
33
Remediation Recommendations
Investigative Report (oral or written)
Preservation of Investigation Documentation
Respond to Inquiries
Findings Follow-up with Management, Audit Committee,
and/or Ind. Accountants
PwC | Conducting investigations
Common asset misappropriation schemes
Asset Misappropriation involves theft, embezzlement or wrongful use of an organization’s assets.
• Check Fraud• Billing & Fictitious
Vendors• Ghost Employees• Overpayment to
Employees• Expense
Reimbursements
Disbursement Related
• Skimming• Check Kiting• Lapping
Receipt Related Corruption Related
• Bid rigging• Kickbacks
Other
• Bustout• Ponzi or pyramid
scheme
34
PwC | Conducting investigations
Common financial statement fraud schemes
• Channel Stuffing• Conditional Sales
(including consignment sales)
• Bill and Hold• Cut-off• Backdating• Sham Sales• Round-tipping• Unauthorized
shipment
Revenue-Related Schemes
• Reclassification of COGS to Operating Expenses
• Channel Incentives and Rebates
• Cookie Jar Reserves
• Capitalization of Expenses
• Gross Versus Net Recognition
Expenses-Related Schemes
Balance Sheet Schemes
• Concealed Liabilities
• Fraudulently stating valuation of assets and liabilities
• Inventory valuation schemes
• Fictitious assets• Misappropriation of
assets
Significant Management Estimates• Biases can result
in overly optimistic or overly conservative assumptions
• Failure to record or disclose known expenses
• Manipulation of fair value estimates
• Manipulation of period depreciation or amortization
Other Financial Statement Schemes• Improper
disclosures• Improper
classification of account balances (e.g. current vs. non-current)
• Failure to properly disclose stock compensation and executive compensation
35
PwC | Conducting investigations
Examples of email
• “Make the entry in January so as not to highlight the issue to auditors”• “I have instructed XXXX to have YYYY come in tomorrow and erase
critical data off the servers and computers in use”• “I have increased the percentage stated in the estimated cost report to
get the earned revenue up to the value actually reported”• “We can produce (dummy) documentation that will satisfy XXX’s
appetite and ostensibly be seen to be compliant”• “Never thought I’d ever admit this, but under your caption - “Attorney-
Client Privilege” - I feel like I’m in a confessional”• “To close this year end, we had to do a lot of very desperate things, more
than you can possibly imagine”• “This shipment will be leaving the building with Elvis this afternoon.
XXX (not the customer) will be holding this order for 30-days”
36