Conducting investigations - … · 2018 Global economic crime survey results. Investigation...

Conducting investigationsI Heart Audit Conference

February 2018

www.pwc.com

PwC | Conducting investigations

Agenda

2018 Global economic crime survey results

Investigation lifecycle

When to consider an independent investigation

Please feel free to ask questions during the presentation.

2


Global economic crime survey

3


Survey results

4


Survey results

5


Assessment of business ethics and compliance programs

6


Factors contributing to economic crime committed by internal actors

7


Impact of economic crime

8


Most likely characteristics of internal fraudster

9


People measures implemented to address increased regulatory expectations

10



11


Identifying the issue

Common detection methods include:

• Corporate Control

- Internal Audit, fraud risk management, suspicious transaction monitoring

• Corporate Culture

- Internal/external tip-off, whistle-blowing system

• Beyond Management Influence

- Accidental discovery, law enforcement

How was the crime initially detected?

Suspicious transaction

testing

14%Internal Audit

11%Tip-Off

(internal)

11%By

Accident

11%

12



Scope & Background

Evidence Collection

Analysis of Financial

Transactions

Interviews of Knowledgeable

Persons

Follow-up

Reporting

13


Scope & background

Goals and objectives

Documentation

Legal considerations

Work program

14


Evidence collection

Identify, protect and preserve relevant documents• Work with Legal to send a document preservation notice

• Consider collecting hard copy documents (office & cube sweeps), Email servers, Network drives, hard drives (e.g., laptops, smart phones, external drives), etc.

• Work with IT to stop back-up tape deletion rotation

Capture complete data• Search available backups/old and archived data

• Consider walking the facilities for old tapes

• Recover deleted emails/files

• Run specialized software to crack password-protected files (or just ask for the passwords)

15


Evidence collection

Factors to consider:• Ownership, chain of custody (physical documents, electronic data)

• Documents received log (who, what, when, where)

• Original documents should be copied/scanned

• Never make notes on original documents

Data security is first priority. Rigorous encryption and safety protocols must be exercised.

The e-discovery process would involve:

• Identification

• Preservation

• Collection

• Processing

• Review

• Analysis

• Production

16


Evidence collection

• Thoroughly process & analyze data

- “Dedupe” population methodically

- Test search term syntax & apply terms methodically across custodians

• Limiting analysis to common file extensions and not requesting file signatures may inadvertently eliminate potential key documents

• Consider use of analytic options to more efficiently search data (e.g., BrainSpace)

• Train readers in investigation background and review tool

• Consider foreign language files:

- May be difficult to process due to unusual character sets

- May be ignored if readers are unfamiliar with the language in which the document is written

• Identify responsive, relevant, key documents

• Document procedures performed (there will likely be questions later)

17


Evidence collection

DirectReal

Circumstantial

• Internal Records• Financial records• Legal records• HR• Electronic media• Interviews

18


Analysis of financial transactions

• Identify data, files, and fields• Design tests based on past experience, company policies, data and fields, transactions, etc.Planning

• Master files, transaction files, employee data• PO fields, VAT fields, vendor listingAcquisition

• Reconcile data to source files• Tie data to the financial statementsValidation

• Identify red flags, false positives, and procedural breaches• Consider purchase patterns, sequential invoicing, retrospective POs, and master-file duplicatesAnalysis

• Trace paperwork, review files, conduct interviews• Implement controls and monitor complianceResults

19


• Objective is to gain a confession or admission• Highly structured• No notes• The investigator should do the talking• Tone should be accusatory

• Objective is to gain information• Open ended• Notes should be taken• The witness should do the talking• Tone should be supportive

Interview of knowledgeable personsPurpose of the interview

The purpose of interviewing is to gather information and evidence as well as differentiate/eliminate suspects and witnesses.

Interview

Interrogation

20


• Use a standard introduction for each interview you conduct providing the interviewee with:- Name- Company affiliation- Purpose of the interview- Any legal implications

• Build rapport with the interviewee• Use a combination of direct, leading, and open-ended

questions• Paraphrase key responses to ensure mutual

understanding• Consider verbal and non-verbal cues

Interview of knowledgeable personsInterview process

• Decide who will take notes and through what method

• Notes will be less accurate than a recording, but should be “words to that effect”

• Place key quotes in quotation marks• Prepare memorandum of notes soon

after the interview is conducted

• Review relevant documents to identify materials that will assist in conducting the interview or for which an explanation is needed

• Know subject matter• Understand the interviewee’s

background• Prepare an outline, detailing the

topics to be addressed and the documents to be used in connection with each topic

• Cover necessary topics to complete the interview

• If additional time is needed, advise the witness and attempt to gain his/her commitment of continued cooperation

• Express appreciation for the time and effort expended to complete the interview

• If appropriate, permit the witness to ask any questions express concerns he/she may have regarding the investigative process or the subject matter of the investigation

• Select a location that will facilitate the interview

• Don’t conduct the interview alone – select attendees in order to facilitate the interview

21


Interview of knowledgeable personsPreparing for the interview















22

• Relevant documents• Documents requiring further explanation• Subject matter knowledge• Interviewee’s background• Understand the allegations• Outline questions


Interview of knowledgeable personsInterview setting

















23

• Facilitating environment• Multiple participants


Interview of knowledgeable personsDuring the interview















24

•Standard introduction•Purpose of interview•Build rapport with interviewee•Use direct, leading, and open-ended questions

•Paraphrase key responses to confirm understanding

•Consider verbal/non-verbal cues


Interview of knowledgeable personsConcluding the interview















25

• Cover necessary topics• Gain cooperation for additional

interview• Express appreciation• Permit witness to ask questions, if

appropriate


Interview of knowledgeable personsMeeting notes

26















• Decide who will take notes• Determine note methodology• Key quotes in quotation marks• Prepare memorandum soon

after interview


Follow up

Once the initial document review and interviews have been completed:

Consider the evidence gathered

Re-evaluate the scope

Perform additional procedures as needed

Consider remediation procedures if needed

27


Reporting

Do

• Consider the stakeholders• Summary of process and results• Independent and objective language• Spell and grammar check

Don’t

• Write opinions• Use qualitative words (all, large, etc.) • Legal determinations – where

appropriate

28


Common investigation pitfalls

• Not bringing questions to someone’s attention

• Directly confronting the suspect

• Failure to secure data

• Electronic media process if flawed

• Failure to assess the ramifications

• Expectation that an investigation is quick

• Tendency to do a superficial investigation

• Concluding on suspect culpability based on conjecture

• Dismissing the allegations based on materiality/value

• Dismissing the allegations based on personal knowledge of the suspect

• Not communicating early and openly with external auditors

• Not anticipating stakeholder requirements

29


When to consider an independent investigation

30


Investigation life cyclePhase I – Preliminary investigation

31

Multiple Source Origination

Phase II

Incident ClaimCapture

Document Protection

IndependentInvestigation Conducted

PreliminaryInvestigation

No

Yes

End

No

No

Yes

Yes

Do concerns relate to potential:a. Illegal acts,b. Restatement, orc. Misbehavior by

senior mgmt.

Evaluate?

Incident appears to be an isolated

issue

Consider concluding

investigation internally.

No

Seniormanagementimplication

Consider coordinating with internal resources.

Yes


Investigation life cyclePhase II – Independent investigation

32

Re-scoping andadditional procedures

Investigation team

Independent Investigation Conducted

Sizing and datingof problems

Phase III

Information Gathering• Interviews• Document Gathering• E-media

Communication Strategy:• Audit Committee• Auditors • Regulators


Investigation life cyclePhase III – Reporting and remediation

33

Remediation Recommendations

Investigative Report (oral or written)

Preservation of Investigation Documentation

Respond to Inquiries

Findings Follow-up with Management, Audit Committee,

and/or Ind. Accountants


Common asset misappropriation schemes

Asset Misappropriation involves theft, embezzlement or wrongful use of an organization’s assets.

• Check Fraud• Billing & Fictitious

Vendors• Ghost Employees• Overpayment to

Employees• Expense

Reimbursements

Disbursement Related

• Skimming• Check Kiting• Lapping

Receipt Related Corruption Related

• Bid rigging• Kickbacks

Other

• Bustout• Ponzi or pyramid

scheme

34


Common financial statement fraud schemes

• Channel Stuffing• Conditional Sales

(including consignment sales)

• Bill and Hold• Cut-off• Backdating• Sham Sales• Round-tipping• Unauthorized

shipment

Revenue-Related Schemes

• Reclassification of COGS to Operating Expenses

• Channel Incentives and Rebates

• Cookie Jar Reserves

• Capitalization of Expenses

• Gross Versus Net Recognition

Expenses-Related Schemes

Balance Sheet Schemes

• Concealed Liabilities

• Fraudulently stating valuation of assets and liabilities

• Inventory valuation schemes

• Fictitious assets• Misappropriation of

assets

Significant Management Estimates• Biases can result

in overly optimistic or overly conservative assumptions

• Failure to record or disclose known expenses

• Manipulation of fair value estimates

• Manipulation of period depreciation or amortization

Other Financial Statement Schemes• Improper

disclosures• Improper

classification of account balances (e.g. current vs. non-current)

• Failure to properly disclose stock compensation and executive compensation

35


Examples of email

• “Make the entry in January so as not to highlight the issue to auditors”• “I have instructed XXXX to have YYYY come in tomorrow and erase

critical data off the servers and computers in use”• “I have increased the percentage stated in the estimated cost report to

get the earned revenue up to the value actually reported”• “We can produce (dummy) documentation that will satisfy XXX’s

appetite and ostensibly be seen to be compliant”• “Never thought I’d ever admit this, but under your caption - “Attorney-

Client Privilege” - I feel like I’m in a confessional”• “To close this year end, we had to do a lot of very desperate things, more

than you can possibly imagine”• “This shipment will be leaving the building with Elvis this afternoon.

XXX (not the customer) will be holding this order for 30-days”

36


Questions?

37

© 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.

Conducting investigations - … · 2018 Global economic crime survey results. Investigation...

Documents

Transcript of Conducting investigations - … · 2018 Global economic crime survey results. Investigation...