BKAB3013 FORENSIC ACCOUNTING

SEMESTER A181

TOPIC 4 – FRAUD INVESTIGATION

(PART 1: INVESTIGATING THEFT ACTS)

NOR ZALINA MOHAMAD YUSOF

21 NOVEMBER 2018
LEARNING OBJECTIVES
After studying this topic, you should be able to:
• Understand the various ways frauds are investigated and when to use each
investigation method.
• Discuss theft investigation methods and how they are used to investigate
suspected fraud.
• Understand how to coordinate an investigation using a vulnerability chart.
• Describe the nature of surveillance and covert operations.
• Understand the effectiveness of invigilation to investigate fraud.
• Explain how to obtain physical evidence and how it can be used in a fraud
investigation.
• Understand how to seize and analyze electronic information from cell phones,
hard drives, e-mail, social networking sites, and other sources.

2
Deciding When to Investigate
• Some of the factors that are considered in deciding whether or not to
investigate are the following:
• Perceived strength of the predication
• Perceived cost of the investigation
• Exposure or amount that could have been taken
• The signal that investigation or non-investigation will send to others inside
and outside the organization
• Risks of investigating and not investigating
• Public exposure or loss of reputation from investigating and not investigating
• Nature of the possible fraud

6
Fraud Triangle Plus Inquiry Approach to
Investigations

7
Beginning an Investigation
• Investigations should usually begin by using techniques that will not arouse
suspicion and will not wrongly incriminate innocent people.
• When starting an investigation:
• Involve as few people as possible
• Avoid words such as “investigation”
• Use techniques that will not likely be recognized
• As the inquiry proceeds, investigative methods will work inward toward the
prime suspect.
• Waiting to interview the primary suspect allows you to gather sufficient evidence to
conduct a powerful, directed interview without giving your case away prematurely.
• Figure 7.2 provides an illustration of this pattern.

8
Figure 7.2 Example Theft Act Investigative
Pattern

9
Developing a Vulnerability Chart
• When beginning a fraud investigation, it is often useful to develop
hypotheses about:
• What kind of fraud could have occurred
• Who the possible perpetrators could have been
• What their motivations might have been
• How much might have been taken
• One way to develop such hypotheses is to use a vulnerability chart, a
tool that explicitly considers all aspects of the fraud.

10
Purpose of a Vulnerability Chart
• A vulnerability chart coordinates the various elements of the possible
fraud, including:
• Assets that were taken or are missing
• Individuals who had theft opportunities
• Theft investigative methods
• Concealment possibilities
• Conversion possibilities
• Symptoms observed
• Pressures of possible perpetrators
• Rationalization of perpetrators
• Key internal controls that had to be compromised for the theft to occur
• The following table provides an example of a vulnerability chart.

11
Example Vulnerability Chart

CHAPTER 11 12
Theft Act Investigation Methods
• Theft act investigation methods are those activities that directly
investigate the fraud act, such as:
• Surveillance and covert operations
• Invigilation
• Obtaining physical evidence
• Gathering electronic (computer) information

13
Surveillance and Covert Operations
• Surveillance or observation means watching and recording (on paper,
film, or other electronic device) the physical facts, acts, and
movements, which are part of the theft act of a fraud.
• The three types of surveillance are:
• Stationary or fixed point
• Moving or tailing
• Electronic surveillance
• Some form of surveillance is often used in investigating most frauds,
including even financial statement frauds.

14
Invigilation
• Invigilation (in-vij-uh-ley-shun) is an investigative technique that
involves close supervision of suspects during an examination period.
• Such strict temporary controls are imposed on an activity that, during the
period of invigilation, makes fraud virtually impossible to commit.
• When controls are made so strict that opportunities to commit fraud are
eliminated, a fraud-free profile can be established.
• Changes seen between the control periods and the non-control
periods highlight where fraud may be occurring.
• The use of detailed record keeping before, during, and after invigilation is key
to this method.

15
Physical Evidence
• Physical evidence can be useful in some cases, especially those
involving inventory where physical stock can be counted and a search
for missing inventory can be conducted.
• Physical evidence is more commonly associated with non-fraud types of
crimes, such as property crimes, murder, and armed robbery.
• Because fraud is rarely seen and has few physical symptoms, physical
evidence can often be difficult to find.

16
Gathering Physical Evidence
• Gathering physical evidence involves analyzing objects such as:
• Inventory, assets, and broken locks
• Substances such as grease and fluids
• Traces such as paints and stains
• Impressions such as cutting marks, tire tracks, and fingerprints
• Gathering physical evidence also involves searching computers.

17
Electronic Evidence
• The gathering of electronic evidence is usually termed computer
forensics.
• Confiscating and searching of computers are often associated with a
fraud investigation.
• Because of the wide variety of electronic media available today, the
process for gathering electronic evidence varies from device to
device.

18
Electronic Communications
• Today, many different communication methods are being analyzed
during investigations.
• Texts
• E-mail
• Social media
• Be sure to work with IT support and legal counsel to collect data from
these sources correctly; some are likely unavailable without a search
warrant.

19