End of Chapter Questions and Cases For

End of Chapter Questions and Cases
for
by
Mark J. Nigrini, Ph.D.
Version 1.00 dated June 18, 2020.
Copyright © 2020 by Mark J. Nigrini. All rights reserved.

This document is a supplement to Forensic Analytics Second Edition and has been prepared for
purchasers of the book.
Table of Contents
A Note to Students ..................................................................................................................................... 2

Chapter 0: Introduction.............................................................................................................................. 3
Chapter 1: Using Microsoft Excel for Forensic Analytics ........................................................................... 8
Chapter 2: The Initial High-Level Overview Tests .................................................................................... 11
Chapter 3: Benford’s Law: The Basic Tests .............................................................................................. 15
Chapter 4: Benford's Law: Advanced Topics............................................................................................ 20
Chapter 5: Benford's Law: Completing the Cycle..................................................................................... 23
Chapter 6: Identifying Anomalous Outliers: Part 1 ................................................................................. 26
Chapter 7: Identifying Anomalous Outliers: Part 2 ................................................................................. 29
Chapter 8: Identifying Abnormal Duplications ........................................................................................ 32
Chapter 9: Comparing Current Period and Prior Period Data: Part 1 ...................................................... 35
Chapter 10: Comparing Current Period and Prior Period Data: Part 2 .................................................... 39
Chapter 11: Identifying Anomalies in Time-Series Data .......................................................................... 47
Chapter 12: Scoring Forensic Units for Fraud Risk ................................................................................... 51
Chapter 13: Case Study: An Employee’s Fraudulent Tax Refunds ........................................................... 54
Chapter 14: Case Study: A Supplier’s Fraudulent Shipping Claims.......................................................... 58
Chapter 15: Detecting Financial Statement Fraud ................................................................................... 66
Chapter 16: Using Microsoft Access and R for Analytics ......................................................................... 76
Chapter 17: Concluding Notes on Fraud Prevention and Detection ....................................................... 79
IDEA-Based Cases ..................................................................................................................................... 89
Concluding Case (Fraud Numbers) ........................................................................................................... 97
1
A NOTE TO STUDENTS
Forensic accounting is an interesting, challenging, and rewarding profession with very few dull days.
The Department of Labor estimates that computer and mathematical occupations will have above average
job prospects for 2018 to 2028. Their estimates for accountants and auditors in general are less rosy with
a 10-year growth projection of 90,000 jobs. That number is approximately equal to the number of people
sitting for the CPA exam each year. Fortunately, data analytics in general, and specifically forensic
analytics, will help you to align yourself more closely with the outlook for computer and mathematical
occupations. To do this will require some new skills.
A search for “data analytics” in the Journal of Accountancy (at www.journalofaccountancy.com/)
shows that data analytics is becoming increasingly more important. There are over 200 “data analytics“
hits with a recent article titled “How firms are delivering value with audit data analytics” (January 21,
2020). Another article titled “CPA exam topics undergoing change for digital age” (November 1, 2019)
notes that “Advances in technology, data analytics, and process automation have led to changes in the
skills required of newly licensed CPAs.”
Your forensic analytics skills are transferable making it easier for you to transition to the exciting field
of Business Intelligence (BI). Your forensic analytics skills could also serve as a stepping-stone to data
mining, predictive analytics, and machine learning. There is a machine learning-related example in the
book.
These forensic analytics skills are not easy to acquire. Fraud investigation requires special skills
because we are trying to detect activities that the fraudster purposely tried to conceal. Also, we operate in
an adversarial court system and so errors and omissions on the part of an investigator will be used by
defendants and their attorneys. A quick skim through the chapters isn't going to develop a useful skill.
You need to carefully read the chapters and to practice running the tests yourself.
The end-of-chapter materials for each chapter of Forensic Analytics Second Edition includes a set of
short multiple-choice questions and one or more cases. Some of the questions or cases will require you to
think "outside the chapter." You might not find the exact answer to the question in the chapter. The cases
will assume some level of familiarity with data analysis software. Nowadays these skills can be acquired
by reviewing online videos, online support, and a small mountain of books on almost every topic. If you
get stuck, then look at your course syllabus for guidance on getting help.
The end-of-chapter materials include PowerPoint slides that outline the main points in the chapter.
These slides, together with a short lecture on each chapter can be found by searching for Forensic
Analytics Second Edition, Chapter xx, Review on YouTube (there is a Forensic Analytics Second Edition
Chapter Reviews playlist). There are guidance videos for most of the cases and for the IDEA cases at the
end of this supplement. The guidance videos are in two playlists on my (Mark Nigrini) YouTube channel,
Forensic Analytics Second Edition, Guidance for Cases, and Forensic Analytics Second Edition, IDEA
Cases. The data and other files for the cases can be found at https://tinyurl.com/ForensicAnalyticsEOC.
The short videos are not a substitute for reading the chapter. There are, after all, 203,000 words, 230
figures, and 50 tables in the book.
Mark J. Nigrini, Ph.D.
Morgantown, West Virginia, USA
June 18, 2020
2
CHAPTER 0
INTRODUCTION
Multiple Choice Questions

1. A necessary ingredient in an embezzlement case is that the act must have been ____.
a. monetary
b. intentional
c. committed at a for-profit company
d. done without an accomplice
2. Considering the six drivers of occupational fraud, the _____ driver is the one that could be completely
absent in a particular fraud scheme.
a. habit
b. attitude
c. rationalization
d. opportunity
3. Gambling is an expensive vice that is most closely linked to which occupational fraud driver?
a. pressure
b. expected utility
c. opportunity
d. double down
4. The competence occupational fraud driver suggests that occupational fraud _______.
a. needs someone that is undeterred by the potential penalties
b. requires an attitude of superiority
c. depends on a large dose of greed
d. involves multiple acts
5. In Ryan Homa’s case the ability to reprint a check was the flaw in the accounting system that provided
the _______ for the fraud scheme.
a. pressure
b. rationalization
c. opportunity
d. arrogance
6. The use of analytics related to a financial statement audit is called ____ by the AICPA.
a. audit evidence analytics
b. audit data analytics
c. opinion corroboration analytics
d. evidence supported analytics
3
7. Tableau uses the word measures to describe data that is/are _______ .
a. numeric and which can be used for mathematical operations
b. composed of values that we might want to filter on
c. round number estimates
d. related to time (days, weeks, months, and years)
8. Graphs can be easily created in Tableau by dragging data fields to ___________ .

a. a new worksheet
b. a new dashboard
c. a new story
d. the Columns and Rows lines
9. Tableau has shown itself to be a valuable tool when the ____ of the analysis is/are not clear at the
outset.
a. objective
b. biases
c. specified data set
d. results
10. Many of the users of technology to combat fraud and/or economic crimes find that their tests often
result in too many _______ .
a. convictions
b. risk assessments
c. false positives
d. visualizations
The chapter’s case is on the next page.
4
Case 0.1
Read the information document related to the college admissions federal case of William Rick Singer.
Read paragraph 1 to 46 and 125 to 140 of the indictment related to the college admissions federal case of
Lori Loughlin. These documents are 0_LoughlinIndictment_1-46_125-140 and 0_SingerInformation.
Required
Type your name and the date at the top of the answer sheet (on the next page) and answer the questions
below on that answer sheet. Questions 1-14 relate to William Rick Singer and Questions 15-20 relate to
Lori Loughlin.
1. On the first page, the lines immediately below the counts and allegations all have the abbreviation
U.S.C. What does U.S.C. abbreviate?
2. 44 refers to a $350,000 payment and USC. In that paragraph what does USC abbreviate?
3. 5 refers to the ACT exam. In that paragraph what does ACT abbreviate?
4. The case is being prosecuted by the U.S. Attorney’s Office, District of Massachusetts. Is there any
reference to the state of Massachusetts or a town or city in MA in the first 25 paragraphs? Yes No
5. Students with certain learning or other disabilities may quality for ______ (a rebate, a reconciliation,
test accommodations, the use of an iPad) in the ACT and SAT tests.
6. The ACT and the SAT tests are administered under ____ (flexible, generous, typical, strict) time
limits.
7. 23 & 24 refer to Federal Express and United Parcel Service. The reason for such statements in an
indictment is to support a charge of mail fraud. See the first page. Was he charged with mail fraud?
Yes No
8. One of the elements of mail fraud is “use of the mail for the purpose of executing, or attempting to
execute, the scheme (or specified fraudulent acts).” Do you feel that Singer met this requirement? Yes
No, give a one sentence reason for your opinion.
9. For admitting Yale Applicant 1 Singer mailed a check for $_____ to the women’s soccer team coach.
10. For USC Singer directed payments of $_____ to a soccer club controlled by two of USC’s soccer
coaches.
11. Singer paid a Georgetown tennis coach bribes, labeled as "consulting" fees, totaling more than
$____.
12. The father of UCLA Applicant 1 asked Singer to confirm that the KWF contribution of $____ would
be returned to them in the event his daughter did not receive final admission to UCLA.
13. In 2017, the Hillsborough Parents filed personal tax returns that falsely reported total gifts to charity
in 2016 of $_______, an amount that included the ineligible contribution to KWF.
14. How many times does the Singer indictment use the term “to wit.” In this context what does that
mean?
15. Do the Loughlin counts include any references to mail fraud? See page 1. Yes No.
16. Is there any reference in Lori Loughlin’s indictment to Massachusetts? Yes No.
17. The names of Loughlin’s two daughters are redacted. Give the full names of both daughters.
18. Mossimo (the husband) wanted a roadmap to success that avoided the older daughter going to __ __
__ (full name of university).
19. 136 states “your younger daughter receives his [sic] final letter. Why is the word [sic] after the word
his?
20. 140 ends with “Um-hmm.” State in a sentence or two what you think that Loughlin was thinking
right there and then.
5
Name: Date:
Answer the questions in the spaces below. You can add lines or give yourself extra space if needed.
Question Answer
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
6
Case 0.2
Our federal courts hear civil, tax evasion, bankruptcy, and criminal cases which includes cases of
embezzlement when the amounts are large, or where the cases involve the federal government.
Required
Create a Word document with you name and the case number as headings. Submit your Word document
and your three indictments before the due time on the due date.
1. Give the FBI’s definition of embezzlement (this answer is one sentence long). Give the ACFE’s
definition of internal fraud (this answer is two sentences long).
2. Find your three U.S Attorneys Districts on the Excel spreadsheet distributed. You can use one, two or
all of your districts for this case. Go to the News part of the relevant U.S. Attorney’s Office website
using the links from https://www.justice.gov/usao/us-attorneys-listing. Scan the news reports for 2020,
2019, and 2018. Find three embezzlement cases (the unlawful misappropriation of an employer’s
money by an employee) where the CFO of a public company, a private company, or a non-government
not-for-profit carried out the scheme. If you cannot find three cases using the above criteria you may
go back to 2017 and/or 2016. Create a table of the three cases (the person’s name, key words of the
scheme in three to ten words, the victim organization, the amount embezzled (rounded to the nearest
$10,000, if available), the U.S. Attorney’s Office that prosecuted the case, and the link to the case on
the justice.gov website).
3. Locate the indictments, information docs, or criminal complaints related to your three cases in (2)
above by doing a “Party Search” on PACER.gov. These are usually the first documents listed in the
History/Documents section. The abbreviation for defendant is dft. Download the three indictments.
Send the three indictments to me, the instructor, using the shared Google Drive folder that you can
access at [insert link]. The pdf files must be named YourLastName_Indictment1 to
YourLastName_Indictment3. Show a screenshot of your files in the folder. Parts 1, 2, and 3 of this case
should fit on one page.
4. Create a heading on the second page with the fraudster’s name and “-Embezzlement Scheme.”
Summarize what the fraudster did for the fraud case where you have the most detail, or the one that
you find most interesting, in about 400 words. This should take up about 80 percent of the page if you
use Times New Roman 11-point font, and 16-point line spacing. You can always get extra case details
by reading other documents in the court records, such as transcripts, the sentencing memorandum, the
plea agreement, and so on. You can copy sections of the court records verbatim, but the passage must
sound as if you wrote it. Avoid copying sentences with legal jargon and facts that have nothing to do
with what the fraudster “did.”
5. This requirement is based on the Control Activities section on pages 42-45 of Albrecht, Albrecht,
Albrecht, and Zimbelman’s Fraud Examination Fifth Edition. Read the document which lists five
primary control activities. With reference to your embezzlement case in (4) above, decide which
control activity (or activities) was not working, or was not working properly, and which allowed the
embezzlement scheme to take place. List the control(s) that were not working properly, and which
allowed the embezzlement scheme to take place. Give reasons. Your answer for this part should be
about 100 words long and should use up the rest of page 2.
7
CHAPTER 1
USING MICROSOFT EXCEL FOR FORENSIC ANALYTICS

1. The first step in an audit data analytics application is to _____
a. select the tools and graphics to be used
b. obtain the relevant data
c. to set the objectives of the analytics test
d. to consider the EU’s data privacy statutes
2. The data cleansing or data scrubbing phase can be best described as _____
a. labor intensive
b. a task easily completed using Tableau
c. a task that always takes about 10 percent of the total expected hours
d. that part of the work that should usually be outsourced
3. The best way to describe copying Excel results to Word and PowerPoint is _____
a. do so at your own risk
b. easy and seamless
c. difficult, hence the need to use Google Chrome instead
d. time-consuming, and best done by college interns
4. An Excel limitation is that the cells in an Excel spreadsheet cannot contain _____
a. photos
b. calculated numbers
c. column headings
d. neither photos, nor calculated numbers, nor column headings are correct
5. The term ______ describes the risk that faulty decisions are made based on errors in spreadsheets.
a. systematic risk
b. spreadsheet risk
c. logical risk
d. sampling risk
6. When using the IF function, we might need to evaluate whether two conditions are true, for example,
C2=1 and C3=2. To do this we would use the ___ function nested in the IF function.
a. IF2
b. BOTH
c. DOUBLE
d. AND
7. PivotTables allow us to summarize data. The commands to create a PivotTable are _______.
8
a. Formulas→Tables→PivotTable→OK
b. View→Tables→PivotTable→OK
c. Data→Tables→PivotTable→OK
d. Insert→Tables→PivotTable→OK
8. The fourth piece of information that is needed in the VLOOKUP function’s syntax is ______.
a. TRUE if you want an exact match or FALSE if you want an approximate match
b. FALSE if you want an exact match or TRUE if you want an approximate match
c. TRUE if your data is numeric or FALSE if your data is text
d. TRUE if you want a vertical lookup or FALSE if you want a horizontal lookup
9. The components of analytics-based dashboards can best be described as ______.

a. satellite images
b. links to relevant websites
c. R, SQL, and Python code
d. graphs and tables
10. Journal entries can be classified into two groups. These groups are _______.
a. subjective and objective entries
b. operating and investing entries
c. automated and manual entries
d. current and noncurrent entries
9
Case 1.1
Use the 1_CensusData_2010 data file. That Excel file shows the state, the county reference, the county
name, the county area, and the county population according to the 2010 census. There are 3,143 records
and a header row. Use Excel and show your screenshots or text for the requirements.
There is a guidance video Forensic Analytics Second Edition, Guidance Case 1.1, Using Excel’s
VLOOKUP function for a Histogram.
Required
1. Use the VLOOKUP function in Column F to add a Description for each county that describes the
population as an Error if the population is less than 1, as Small if the population is in the 1 to 14,999
range, as Medium if the population is in the 15,000 to 49,999 range, as Large if the population is in the
50,000 to 499,999 range, and as Very Large for populations of 500,000 and higher. Show a screenshot
of your headings and the first 10 rows of your results. A blurred clue is shown below:
2. Create a table showing the counts for the Error, Small, Medium, Large, and Very Large categories and
the five category names. Show the total of the five counts. The count for the Error category should be
zero. Make sure that your five category counts reconcile with the total number of counties (3,143).
Sort the Descriptions as set out in the first sentence, that is, from the smallest category (Error) to the
largest category (Very Large).
3. Read the histogram section in Chapter 2 on pages 56-58. Create a histogram of the 2010 population
numbers using 11 intervals (1-49,999, 50,000-99,999, …, 500,000 and higher). The last interval is for
all populations 500,000 and higher. In Chapter 2 in Figure 2.5 (on page 58) the last interval is for all
dollar amounts $2,800 and higher. The x-axis labels should show the upper bounds of the intervals
(49,999, 99,999, 149,999, 199,999, …, 499,999, 500,000+). Be sure to add a graph title and to label
the x-axis and the y-axis with descriptive words and text that can be easily read on a screen. A blurred
clue is shown below:
4. Read the histogram section in Chapter 2 on pages 56-58. Is the Census 2010 population data positively
or negatively skewed? Does the data show the same general pattern that is expected for the dollar
amounts of purchasing card data and for invoices paid through the accounts payable department?
5. Give an example of a data set that you think would have a negatively skewed skewness measure.
Avoid giving an example that has to do with time. Histograms generally have nothing to do with time.
A negatively skewed data set will have more large numbers and relatively fewer small numbers.
6. Review the Case Submission Checklist and type the statement, “I reviewed the case submission
checklist before submitting this case.”
10
CHAPTER 2
THE INITIAL HIGH-LEVEL OVERVIEW TESTS

1. The word used to describe entities that are most dissimilar to some norm is ____.
a. standard deviation
b. percentile
c. outliers
d. average
2. The data profile is our first chance to assess the _____ of our data.
a. format
b. currency
c. relevance
d. completeness
3. The data profile is also useful for identifying ____ amounts in data that should not have _____
amounts.
a. negative, negative
b. irrational, irrational
c. currency, currency
d. liability, liability
4. A histogram will show if the data is either _____ skewed or _____ skewed.
a. percentile, decile
b. positively, negatively
c. highly, lowly
d. revenue, expense
5. The periodic graph gives insights related to time. On the graph time is shown on the _____.
a. x-axis
b. y-axis
c. both the x-axis and the y-axis
d. Chart title
6. The mean, the median, and the mode are all measures of _________.
a. dispersion about the mean
b. accuracy
c. current data for the current fiscal year
d. central tendency
7. In Access a query is run by _____.
11
a. clicking the Submit button
b. clicking the Run button
c. clicking the Save button
d. clicking the Enter button
8. The height of each bar in a histogram indicates the ________ in/of the interval.
a. relative importance
b. x-axis location
c. central tendency
d. number of records
9. The Excel functions that will return 2009-1 from a date such as 1/2/09 are ______.
a. JOINTOGETHER, YEAR, MONTH
b. CONCATENATE, YEAR, MONTH
c. JOIN, YEAR, DASH, MONTH
d. CONVERT, DATE, YEARDASHMONTH
10. The periodic graph can be easily created in Tableau by dragging the ___ field to the Columns line and
by dragging the _____ field to the Rows line.
a. columns, rows
b. interval, month
c. amount, date
d. date, amount
12
Case 2.1
Use the 2_Somerville_2013-2016 Excel data file that contains payments data for 2013 to 2016 for the City
of Somerville in Massachusetts. Somerville is a city with a population of 80,000 people and it is located
two miles north of Boston and occupies 4 square miles. There are 55,746 records (check payments) and a
header row. Assume that the 15 check amounts equal to $0 were checks that were lost in the mail and that
were later reissued for the correct amount. Do not treat them as missing values. Use Excel and show your
screenshots or text for the requirements. Edited data set source accountingintheheadlines.com/ (thank you
Professor Wendy Tietz, Kent State University). Original source www.somervillema.gov/.
Data Dictionary
• ID: This field identifies each payment uniquely.
• GovCategory: This field indicates whether the transaction relates to Education, General Government,
or Public Works, the three divisions of government for the City of Somerville.
• VendorName: This field contains the name of the check payee.
• Amount: This field is the dollar amount of the check.
• CheckDate: This field is the date that the check was written.
• Department: This field is the department in the Category of Government related to this payment.
• CheckNum: This field is the sequential check number.
• OrgDescription: This field gives additional detail about the specific organization within the general
Department related to this payment.
• AcctDescription: This field provides details about the type of expense.
• ExpenseType: This field classifies the payments into broad expense classes.
There is a guidance video Forensic Analytics Second Edition, Guidance Case 2.1, High-level overview
tests in Excel.
Required:
1. Prepare the data profile for the payments data using the NigriniCycle.xlsx template. Use the default
strata boundaries in the DataProfile tab. This means that you can leave all the formulas in the
DataProfile tab unchanged. Show a screenshot of your data profile. A blurred clue is shown below.
2. Does the number of records in your Data Profile (cell D10) agree with the number of records in the
data file? Note that the data file uses one row for headings.
3. Create a histogram of the check payment amounts using 21 intervals (0.01-4,999.99, 5,000-9,999.99,
…, 100,000 and higher). The last interval is for all payments 100,000 and higher. The x-axis labels
should show the integer values of the upper bounds of the intervals (4,999, 9,999, 14,999, 19,999, …,
99,999, 100,000+). Be sure to add a graph title and to label the x-axis and the y-axis with descriptive
words and text that can be easily read on a screen. A blurred clue is shown below:
13
4. Is the check payments data positively or negatively skewed? Does the data show the same general
pattern that is expected for the dollar amounts of purchasing card data and for invoices paid through
the accounts payable department?
5. Create a periodic graph of the monthly (January to December) totals for the invoices. There should
only be 12 bars, one bar for each month in a year. The total for January should be the total for all four
Januaries in the data (2013, 2014, 2015, and 2016), and so on for February to December. A blurred
clue is shown below:
6. The June total is significantly higher than average. Why do you think that this might be occurring?
7. Prepare a table of descriptive statistics for the payments data using Table 2.1 as a guide. There is no
need to include a Notes field in the table. The table below can be used as a template.
2013-2016
Sum $
Number of Records
Number of missing records
Mean $
Median $
Mode $
Minimum -$
Quartile 1 $
Quartile 3 $
Maximum $
Range $
Interquartile range $
Standard Deviation
Skewness
14
CHAPTER 3
BENFORD’S LAW: THE BASIC TESTS

1. Frank Benford’s data included all the numbers in an issue of _____.
a. Fibonacci Quarterly
b. Physics Weekly
c. PC Magazine
d. Reader’s Digest
2. Frank Benford analyzed the ____ of 20 lists of numbers with 20,229 observations.
a. decimal places
b. first digits
c. logarithms
d. expected frequencies
3. In Table 3.1 the expected frequencies are displayed as proportions. The proportions in each of the four
rightmost columns add up to ______.
a. 1.0
b. 4.0
c. 10.0
d. different values
4. Benford concluded that nature counts e0, ex, e2x, e3x, and so on, and builds and functions accordingly.
The numeric value of the “e” that is being referred to is _______.
a. 0.30103
b. 2.718
c. 3.141
d. √-1
5. A geometric sequence is a sequence of numbers in which each successive number is the previous
number _______.
a. plus a constant
b. plus √-1
c. multiplied by zero
d. multiplied by a common ratio
6. If all the numbers in a dataset that conformed to Benford were multiplied by a (nonzero) constant, then
the new dataset _________.
a. will also conform to Benford
b. will not conform to Benford
c. will sum to 1.0000
15
d. will follow the rules of linear algebra
7. Table 3.2 shows the total revenues of Enron for 1997 to 2000 (both years inclusive). Of these revenue
numbers _____ have a second digit 0.
a. zero
b. one
c. two
d. three
e. four
8. The underlying premise of the Benford literature is that authentic data should follow Benford and that
deviations from Benford could signal _______.
a. incomplete data
b. that the data is a sample and not the population
c. a qualified audit opinion
d. irregularities of some sort
9. Generally speaking, when expecting conformity to Benford, the data should not have a built-in
minimum or maximum value. However, a built-in minimum of _____ is usually acceptable.
a. √-1
b. zero
c. π radians
d. a geometric sequence
10. In the first-two digit graphs in Figure 3.4 the x-axis shows the first-two digits which range from 10 to
99. The number of first-two digit combinations (the number of bars in each of the graphs) equals _____.
a. 89
b. 90
c. 99
d. 100
16
Case 3.1
Background
Elaine Ashby had come to enjoy the family holiday celebrations. While year-end was normally a busy
time with Elaine preparing for her upcoming audits, the holiday events provided a welcome break from
her clients. Being promoted to partner this past year at Powers and Sullivan, LLC meant new audit
responsibilities and several new clients. Elaine needed, and looked forward to, a relaxing evening with her
extended family.
Cole Forester is Elaine’s nephew and a senior majoring in statistics. Both Elaine and Cole shared a
common interest – solving brainteasers. Elaine anticipated that Cole would try to stump her with
challenging problems that he had come across since the family’s last get-together.
Sure enough, Cole had a lot of interesting mind-twisting puzzles. They tested each other for a while.
To introduce the next problem, Cole took an Almanac from the bookshelf.
Cole said, “Aunt Elaine, this is a question about the length of rivers. What do you think is the most
common first digit of a river’s length? Do most river lengths start with a 5 as in 50 miles or 500 miles, or
do river lengths mostly start with some other digit?”
“Wow, this is a good one!” said Elaine. Thinking aloud, she wondered, “It is more likely that the first
digit of a river’s length is a 5, or a 6, or a 2?” “Wait, this is a trick question. Is the river’s length in miles
or kilometers,” asked Elaine?
“The answer is the same whether length is measured in miles or kilometers,” answered Cole. “In fact,
the answer is the same no matter how you measure it. You could measure it in beer can lengths if you
wanted,” Cole stated.
After a few moments, Elaine said, “I’m stumped. I would think that each digit would be equally likely,
especially if the measurement doesn’t matter.”
“The most common first digit for river lengths is 1,” replied Cole. “Look here in the almanac.” Cole
opened the book to show Elaine a list of rivers and their lengths. Indeed, 1 was the most common first
digit, followed by 2, then 3, and so on.
Cole continued, “And it’s not just river lengths, it could be the stream flow numbers, the populations
of cities, the market capitalizations of listed companies, or almost anything in which numbers occur
naturally.”
“Pretty interesting stuff, where did you find this one?” asked Elaine.
“We were talking about Benford’s Law in one of my statistics classes. Frank Benford, back in the
1930’s, saw that the first pages of his logarithm tables were more worn than the last pages. The first pages
show the logs of numbers with low first digits. He did some analysis of real-world numbers and a little
integral calculus and voila – Benford’s Law. Benford found that the probability of digits occurring is
mathematically determinable and that large differences between the expected probabilities of the low and
high digits exist. For example, the likelihood of a 1 being the first digit is more than 30% and the
likelihood of a 9 being the first digit is less than 5%,” said Cole.
“Okay, you got me on that one. Now, I have one for you,” replied Elaine. For the next half-hour,
Elaine and Cole challenged each other.
On her way home Elaine mulled over what Cole had said about Benford’s Law. Maybe she could use
Benford’s Law to help identify which client accounts to audit. Her thought was that authentic numbers
would follow Benford’s Law, while fictitious numbers would not follow Benford’s Law. If a fraud has
been, or is being, perpetrated, the principles of Benford’s Law might help her identify the fraudulent
17
(invented) numbers. She decided to call Cole in the morning to ask for some more information on
Benford's Law.
Cole wrote a report that described the fundamental elements of Benford’s Law. Cole’s professor gave
him some references to recent academic and professional articles. After reading the report, Elaine felt that
forensic analytics was appropriate as part of the analytical procedure process and as a fraud detection tool.
Elaine felt that Benford’s Law provided a valid benchmark against which to test the actual digit
frequencies against the expected digit frequencies. Excesses of any specific digit, digit combination, or
specific number, might point to a fraud (where the scheme causes the same numbers to be used
repeatedly), or a bias in the numbers (where employees duplicate transactions just below internal control
limits). Another possibility was that the abnormal duplications were something innocently inherent in the
way that the client did their business.
Elaine’s believed that a tool that could help detect fictitious numbers might assist in the audit of
management’s existence or occurrence assertion. Detection of processing inefficiencies or biases might be
offered to clients as a consulting service linked to the audit. She considered Benford's Law to be a new
analytical procedure. The auditing standards require auditors to use analytical procedures in planning the
nature, timing, and extent of other auditing procedures. Forensic analytics is a series of high-level data
overview tests together with tests that drill down to look for small sets of data anomalies.
Elaine also knew that auditors were required to specifically assess the risk of material misstatement
due to fraud. Benford's Law, because of its detective abilities, is one useful tool for assessing fraud risk.
By identifying data that does not conform to the expected digit frequencies, the auditor could direct
additional audit effort to these high-risk areas. For example, if an accounts receivable list showed
significant deviations from Benford’s Law, the auditor could increase the level of confirmations, do
additional scanning of transactions, and perform a more thorough examination of supporting documents.
Elaine decided that her newest client, the City of Somerville, would be a good candidate for some
Benford's Law and forensic analytics tests. Under Commonwealth of Massachusetts laws, the city was
required to have an annual audit performed by a firm of independent public accountants. In her
discussions with Edward Bean the director of Finance, he noted a concern about intentional and
unintentional errors bypassing the preventive controls in that payments system. With over 10,000 check
payments annually, and expenditures of over $300 million in total (paid for by check and otherwise) it
was highly likely that some questionable payments bypassed the preventive controls. Edward’s office did
not have the resources to perform complex analytics. Elaine wanted to make a good impression with the
firm’s management. She believed that forensic analytics would be a good starting point and would also
help with audit planning. Edward gave Elaine an Excel file with 2013 to 2016 payments data
Data Sources and Other Information
of Somerville in Massachusetts. This data was introduced in Case 2.1.
There are 55,746 records (check payments) and a header row. The 15 check amounts equal to $0 were
checks that were lost in the mail and that were later reissued for the correct amount. Do not treat them as
missing values. Use Excel and show your screenshots or text for the requirements.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 3.1, Benford's Law in
Excel and Access.
Required
18
1. Copy the data in the Amount field (55,746 records and a header row) from the Somerville file to
column D in the Data tab in the Nigrini Cycle template. Run the Nigrini Cycle tests. Show a
screenshot of your first digit graph.
2. What level of conformity does the data have to Benford’s Law? Use the first digits mean absolute
deviation (MAD) as calculated in cell F12 in the Tables tab. Use Table 4.2 in Chapter 4. You answer
is either close conformity, acceptable conformity, marginally acceptable conformity, or
nonconformity. If you have a very neat graph, then your answer is probably close conformity. If you
have a messy graph, then your answer is probably nonconformity. If you have something in between,
then your answer is probably an in-between category.
3. Show a screenshot of your first-two digits graph.
4. What level of conformity does the data have to Benford’s Law? Use the first-two digits mean absolute
deviation (MAD) as calculated in cell N93 in the Tables tab. Use Table 4.2 in Chapter 4. See the notes
in (2) above. Note that the conclusions drawn from the two graphs can differ.
5. Identify the first-two digits (10, 11, …, 99) that have the three largest spikes on the first-two digits
graph. A spike occurs when the actual proportion exceeds the expected proportion. First, identify the
three largest Z-Statistics (in Column O in Tables) and then see which first-two digits they refer to. The
first-two digits are in Column I in Tables. For example, if your largest Z-statistic is in cell O43 then
the spike is for the first-two digits 50. Note again that a spike occurs when the actual proportion
exceeds the expected proportion.
6. Did you expect the check payments data to conform to Benford's Law? Give reasons.
7. The number of records used to create the first digit, first-two digits, last-two digits, and the second
last-two digits graphs is less than the total number of records. The record counts can be seen in cells
D30:D33 in the Tables tab. Why were some records (correctly) excluded from the graph calculations?
8. Create a new Access database. Import the Somerville data into Access. Import the source data into a
new table in the current database. Use the Import Spreadsheet Wizard. Select the No Primary Key
option when it is offered because we already have an ID field. Show a screenshot of your first ten rows
of data and of only the leftmost four fields ID, GovCategory, VendorName, and Amount.
9. Run the query used to calculate the first-two digits as is shown in Figure 3.7. However, change the
Criteria row (bottom middle of Figure 3.7) to >=10. Show a screenshot of the first 11 rows of the
results of your Figure 3.7 query. There will be two fields, namely Amount and FirstTwo. Scan some of
the entries in FirstTwo to check that the first-two digits have been calculated correctly.
10. Run the query used to count the first-two digits as is shown in Figure 3.8. Show a screenshot of the
results of your first 11 rows of your Figure 3.8 query. An example of such a screenshot (using the
purchasing card data) is shown in Panel A of Figure 3.9.
11. Do your first-two digit counts in your screenshot for (9) above agree with cells J3:J13 in the Nigrini
Cycle’s Tables tab? The answer here should be yes because we are running the same calculations on
the same data.
19
CHAPTER 4
BENFORD’S LAW: ADVANCED TESTS

1. The goal of the external auditor is to avoid giving a(n) _______ when the financial statements are
materially misstated.
a. statement of cash flows
b. form 10-K
c. PCAOB exemption
d. unqualified audit opinion
2. The first digit test has a bluntness issue. An amount such as $200,000 can be increased by ______
percent and it will still have the same first digit.
a. 49.999 percent
b. 99.999 percent
c. 100 percent
d. 200 percent
3. The Z-statistic is used to test whether the actual proportion for a specific first-two digits differs ______
from the Benford expectation.
a. materially
b. significantly
c. null hypothesis
d. functionally
4. We conclude that we have a statistically significant difference at a significance level of 5 percent

between the actual and the Benford proportions when the test statistic exceeds the critical value of ___.
a. 0
b. 1.96
c. 2.57
d. π
5. If a first-two digit test is run, and if the calculated chi-square statistic exceeds 112.02, then we would
conclude that the data _________.
a. contains material errors
b. needs to continuity correction term
c. does conform to Benford
d. does not conform to Benford
6. With respect to the critical values for the MAD in Table 4.2, the smallest MADs in each case (first
digits, second digits, and so on) give us a(n) _________ conclusion.
a. close conformity
20
b. nonconformity
c. equal to that of the chi-square test
d. materiality-based
7. Figure 4.6 shows 13 large spikes depending on your definition of large. Choose the best definition of a
spike.
a. The actual proportion exceeds the expected Benford proportion by a large margin.
b. The expected Benford proportion exceeds the actual proportion by a large margin.
c. The actual proportions for the 10, 20, 30, …, 90 first-two digits.
d. A calculated chi-square above 112.02.
8. With Benford-based sampling the positive and the negative amounts are tested separately because ___.
a. Excel is limited in the number of rows that it can process.
b. Excel’s COUNTIF function can only work on positive numbers.
c. Benford’s Law does not apply to negative numbers.
d. the way that they are manipulated is diametrically opposite.
9. The HealthSouth fraud scheme is discussed in the journal entries section. The company knew that the
external auditors only tested journal entries that were _______.
a. over the 126,000 norm per quarter
b. $2,000 to $4,999
c. $5,000 and higher
d. above a MAD of 0.0022
10. HealthSouth fraudulent journal entries suggests that Benford-based sampling would be effective
where the number of fraudulent journal entries is relatively _____ compared to the population count.
a. low
b. high
c. stable
d. statistical hypothesis
21
Case 4.1
Use the 1_CensusData_2010 data file. That Excel file shows the state, the county reference, the county
name, the county area, and the county population according to the 2010 census. There are 3,143 records
and a header row. Use Excel and show your screenshots or text for the requirements.
There is a guidance video Forensic Analytics Second Edition, Guidance Case 4.1, Benford's Law
advanced tests.
Required
1. Copy the data in the People_2010 field (3,143 records and a header row) from the Census Data file to
column D in the Data tab in the Nigrini Cycle template. Run the Nigrini Cycle tests. Show a
2. Show a screenshot of your first-two digits graph.
3. What level of conformity does the data have to Benford’s Law? Use the first-two digits mean absolute
deviation (MAD) as calculated in cell N93 in the Tables tab. Use Table 4.2 in Chapter 4. You answer
is either close conformity, acceptable conformity, marginally acceptable conformity, or
nonconformity. If you have a very neat graph, then your answer is probably close conformity. If you
have a messy graph, then your answer is probably nonconformity. If you have something in between,
then your answer is probably an in-between category.
4. Divide the data into two random samples of 1,572 and 1,571 records respectively using Excel’s
RAND() function and four “descending” sorts. Run the Nigrini Cycle tests on both samples. Show a
screenshot of your two first-two digit graphs.
5. What level of conformity do the two random samples have to Benford’s Law? Use the first-two digits
MAD as calculated in cell N93 in the Tables tabs. State your two MAD values. Also, use Table 4.2 in
Chapter 4 to classify each of the MADs as either close conformity, acceptable conformity, marginally
acceptable conformity, or nonconformity. See (3) above.
6. State your single first-two digits MAD for the population. State your two first-two digits MADs for
your two samples. Did the population data, or the two samples, conform best to Benford?
7. In line with the HealthSouth fraud’s modus operandi we will add 1,000 fictitious counties to our data.
Select the 1,000 People_2010 numbers in the 4_CensusData_Fraud file. Copy the 1,000 fictitious
population numbers to cells D3145:D4144 in the Data tab in the NigriniCycle template which should
still have your data and results from (1) above. Now run the Nigrini Cycle tests with the extra 1,000
“fraudulent” rows of data. Show a screenshot of your first-two digits graph.
8. What level of conformity does the fraud data have to Benford’s Law? Use the first-two digits MAD as
calculated in cell N93 in the Tables tab. Use Table 4.2 in Chapter 4. You answer is either close
conformity, acceptable conformity, marginally acceptable conformity, or nonconformity.
9. Did the level of conformity, as measured by the MAD, improve or deteriorate with the addition of the
fraudulent population numbers?
22
CHAPTER 5
BENFORD’S LAW: COMPLETING THE CYCLE

1. The number duplication tests indicates which specific amounts were causing the _____ in the first-two
digits graph.
a. chi-square test
b. Benford line
c. spikes
d. upper bound
2. The first-two digits graph of the credits in the electric utility company case in Figure 5.7 had a close
conformity with a MAD of 0.0009. This case suggests that in such cases ______.
a. the close conformity confirms that there is no fraud
b. an audit sample equal to 0.0009 times the record count is optimal
c. a periodic graph is unnecessary
d. the number duplication test should still be run on the numbers associated with selected spikes
3. The listing of the fraud checks in the Michelle Higson fraud scheme in Table 5.1 shows that _____
amount(s) were(was) duplicated over the course of her fraud scheme.
a. one
b. two
c. three
d. four
4. The letter from Michele’s defense attorneys referred to her husband who had a significant online
gambling problem. With reference to the drivers of occupational fraud in the book’s Introduction, this
online gambling problem is most closely related to _____.
a. pressure
b. opportunity
c. rationalization
d. arrogance
5. Figure 5.9 shows the last-two digits of the purchasing card transactions. The last-two digits range from
00 to 99. The number of last-two digit combinations (the number of bars in the graph) equals _____.
a. 90
b. 99
c. 100
d. 0.01
6. Table 5.2 shows the amounts charged against the stolen credit cards by the neighborhood pub operator.
In over one-half of the cases, the last digit (ignoring the cents amounts that are not shown) was _____.
23
a. an 8
b. either an 8 or a 9
c. either an 8 or a 0
d. November
7. The amounts charged against the stolen credit cards by the neighborhood pub operator included _____.
a. statistics, round numbers, and last digit duplications
b. outliers, decimal numbers, and last digit duplications
c. outliers, round numbers, and last digit duplications
d. outliers, round numbers, and last-two digit duplications
8. In the missing cash sales case, Lynn the controller, was responsible for refilling the ATM machines in
the bars and the bowling alley. To do this she used cash from ________.
a. the nightly deposit bags
b. the ATM machines in the casino
c. her personal bank accounts
d. the sales of intangible assets through Craigslist
9. In the missing cash sales case, Lynn was charged with structuring. In basic terms this statute makes it
an offense to ______.
a. deposit cash every day of the week except for bank holidays
b. deposit cash only with bank branches in stand-alone buildings
c. use one joint bank account for widely dissimilar business divisions
d. divide cash deposits into amounts that are under the $10,000 reporting threshold
10. In the missing cash sales case, in addition to structuring Lynn was also charged with _____.
a. mail fraud
b. wire fraud
c. controller fraud
d. money laundering
24
Case 5.1
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 5.1, Number
Duplications Last-2 Digits Excel Access.
Required
1. Use Excel. Run the number duplication test on the dollar amount of the checks. Show the first 15 rows
of your results in a table with Rank, $ Amount, Count, and First-Two as headings as is shown in Figure
5.5.
2. The first 15 positions show high levels of duplications of $500.00 and $50.00. How does this tie in
with your 3 largest Z-statistics in Case 3.1?
3. The first 15 positions show high levels of duplications of $75.00. How does this tie in with your 3
largest Z-statistics in Case 3.1?
4. Use Excel. Use the Nigrini Cycle template. Run the last-two digits test on the dollar amount of the
checks. Use the cents values as the last-two digits and calculate the last-two digits for positive
amounts greater than or equal to $10.00. Show a screenshot of your last-two digits graph.
5. Which last-two digits combination occurred most frequently in the data? Your answer here is one
combination from the range of combinations 00, 01, …, 99.
6. Does your answer in (5) above tie in with your answer in (1) above?
7. Use Access. Import the check payments data in Access. Run the number duplication test query as
shown in Figure 5.12. Change the criteria from >= 0.01 to >= 10.00. Your table should show $
Amount, Count, and First-Two as field names. Do not include the Rank field this would be difficult to
do in Access. Show a screenshot of the first ten rows of your results. Do your results for the first ten
rows using Access agree with your Excel results in (1) above?
8. Construct a query to extract all the transactions with first-two digits 50. Sort the results by dollar
amount descending. The fields required are ID, GovCategory, VendorName, Amount, CheckDate,
Department, ExpenseType, FirstTwo. The FirstTwo field would be a calculated field with the first-two
digits of the amounts in the Amount field. You will need to adapt the query in Figure 5.13. Show the
first ten rows of your results.
9. Review the Case Submission Checklist and type a statement as follows “I reviewed the case
submission checklist before submitting this case.”
25
CHAPTER 6
IDENTIFYING ANOMALOUS OUTLIERS: PART 1

1. In the summation test graph in Figure 6.1 the x-axis shows that the first-two digits range from 10 to 99.
The number of first-two digit combinations (the number of bars in the graph) equals _____.
a. 89
b. 90
c. 99
d. 100
2. With reference to the Kenneth Steen case, assume that a (very anomalous) data set has every single
number with a first-two digits of 30. Assume that this was graphed as is shown in Figure 6.1 The
proportion for the first-two digits 30 (the height of the 30 bar) would equal ______.
a. 0
b. 0.10
c. 1.00
d. 3.00
3. With reference to the Kenneth Steen case, assume that a (very anomalous) data set has every single
number with a first-two digits of 30. Assume that this was graphed as is shown in Figure 6.1 The
proportion for the first-two digits 99 (the height of the 99 bar) would equal ______.
a. 0
b. 0.10
c. 0.99
d. 1.00
4. In the Michael Spada case two red flags surfaced in the summer of 2008. Table 17.2 in Chapter 17 talks
about the ways that occupational frauds are discovered. The Spada red flags were most closely related to
____.
a. internal audit
b. external audit
c. by accident
d. account reconciliation
5. The largest subsets test essentially involves ______ the records and then looking for large values.
a. grouping
b. selecting
c. stratifying
d. sampling
6. The largest subsets test has produced valuable results in part because fraudsters generally ________.
26
a. rely on the summation test
b. make mistakes when using Benford’s Law
c. don’t fit the data profile
d. don’t know when to stop
7. Assume that a supplier has $0 in period 1 and $1,000 in period 2. The percentage increase from period
1 to period 2 _______.
a. is 0 percent
b. is 100 percent
c. is 1000 percent
d. cannot be calculated
8. The Cindy Mills fraud reminds us that income from a fraud scheme (stolen property) needs to be
reported on the person’s federal income tax return. For the 2019 tax year such amounts need to be
reported on ______.
a. line 8 of Schedule 1
b. line 1 of Schedule 3
c. line 15 of Schedule A
d. line 1 of Schedule B
9. The fraud vulnerability study conducted by Summerford Accountancy referred to kickback schemes. In
these schemes a kickback is ___________.
a. a discount allowed by the supplier for prompt payment, usually 2/10
b. a premium charged for work done on a Sunday
c. a payment made by a supplier to an employee of a customer
d. an allowance for doubtful accounts
10. The fraud vulnerability study conducted by Summerford Accountancy referred to a fraudulent auto
repair vendor. An analysis of the invoice amounts showed that ______.
a. 50 invoices were for under $2,500
b. two-thirds of the invoices were for under $2,500
c. the largest fraudulent invoice was for $5 million
d. the fraudulent invoices charged 342 percent of what would be considered a fair price
Note: For questions 2 and 3 you could create a data set that has every number with 30 as its first-two
digits. Your data set could be a sequence of 500 numbers starting at 30,000 and ending at 30,499. Copy
the numbers into cells D2:D501 in the Data tab and run the Nigrini Cycle tests. Then answer the
questions based on the results that you see.
27
Case 6.1
The guidance video is Forensic Analytics Second Edition, Guidance Case 6.1, Largest subsets & largest
subsets growth Excel.
Required
1. Use Excel. Use the Nigrini Cycle template. Run the summation test on the dollar amounts of the
checks. Show a screenshot of your summation graph.
2. Interpret the graph. What is the graph telling you?
3. Sort the check amounts in the Excel file from largest to smallest (that is, descending). Show a
screenshot of the ten largest check amounts.
4. The four largest spikes on the summation graph at for 10, 14, 15, and 60. These spikes are caused
either by a very few very large amounts, or a larger group of medium sized amounts. Refer only to
your 10-row answer for (3) above and complete the table below:
First-Two Digits Amount Magnitude Group Size
10
14
15
60
The entries for the Amount Magnitude column are either very large or medium-sized, and the entries
for the Group Size are either very few or larger group.
5. Run the largest subsets test on the vendors using VendorName as the subset field and Amount as the
field to sum. Format the total sum as currency with 0 digits after the decimal point. Calculate the total
count of the payments to the various vendors. Treat the $0s and the negative amounts as negative
payments (perhaps checks that were lost in the mail and cancelled). Show a screenshot of your 20
largest vendors (based on total dollars) in a table like that in Figure 6.5.
6. The largest subsets test shows that $2.878 million was paid to AM-PM Cleaning Corporation over the
four-year period. That company was purchased by GDI Integrated Facility services
(https://gdi.com/us/). Go to the GDI website and assess whether $2.878 million paid to the company
over a four-year period seems reasonable. Does this company look like a large-scale operation or more
like a mom-and-pop store where $2.878 million seems out of place?
7. Run the largest subsets growth test using VendorName as the subset field and Amount as the field to be
summed. Delete any vendors with only one payment in the period because going from $0 to a positive
amount does not have a percentage increase and going from a positive amount down to $0 is not a
percentage increase. Classify 2013-2014 as Period 1 and 2015-2016 as Period 2. Calculate the
percentage increase for each vendor from Period 1 to Period 2. Do not calculate a percentage increase
for vendors with $0 in the first period. Create a table of growth percentages as is shown in Figure 6.7.
Round the growth percentages to one decimal place. Do not show the payment counts for the two
periods. Show a screenshot of the 20 vendors with the largest growth percentages (that is, a table
showing the vendor name, the Period 1 total, the Period 2 total, and the growth percent).
8. Refer to (7) above. Now delete all vendors with a Period 1 total under $500. Show a screenshot of the
largest 20 vendors sorted by growth percentages.
9. Refer to (8) above. Select one vendor from the 20 largest vendors to audit for fraud. A fraud vendor
would be one that did not deliver any services or that delivered services at highly inflated prices. Give
the vendor’s name and state in two or three sentences why you selected that vendor. You might want
to reread the school district fraud case in Chapter 6 to answer this part.
28
CHAPTER 7
IDENTIFYING ANOMALOUS OUTLIERS: PART 2

1. The RSF formula divides the largest record in a subset by the _______.
a. largest record in the subset
b. second smallest record in the subset
c. second largest record in the population
d. second largest record in the subset
2. When the largest amount and the second largest amount are equal, the RSF equals _____.
a. not meaningful
b. zero
c. 1
d. 100
3. When the decimal point error occurs in an accounts payable system, the vendor is paid ____ times the
correct amount
a. 2
b. 1.01
c. 100
d. 3,200
4. The more ____, the more the largest amount stands out from the crowd.
a. subsets in the population
b. records in the subset
c. digits after the decimal point
d. descriptive statistics in the report
5. The three elements of any fraud scheme are ________.

a. pressure, opportunity, and rationalization
b. the largest, the second largest, and the quotient of the two
c. a model employee, a position of trust, a betrayal of trust
d. the act, the concealment, and the conversion
6. If Melodie Fallin’s fraud scheme had not been discovered in January 2012 and the ledger accounts
corrected, then the effect of her fraud scheme on the December 31, 2011 financial statements would be
that ______.
a. liabilities would be overstated
b. liabilities would be understated
c. assets would be overstated
d. assets would be understated
29
7. The Patricia Smith $10 million plus auto dealership fraud makes no direct or indirect reference to
which driver of occupational fraud.
a. pressure
b. opportunity
c. rationalization
d. habit
8. The Patricia Smith fraud scheme involved adding back sold vehicles to inventory and reducing the
vehicle financing loan account. Those two actions are related to which element of the fraud scheme?
a. conversion
b. concealment
c. the act
d. opportunity
9. The Patricia Smith fraud scheme refers to an e-mail from the CFO on July 28, 2011 asking for
explanations. With reference to the fraud detection methods in Table 17.2 it seems that the most likely
way that this fraud was detected was ______.
a. external audit
b. surveillance
c. notified by law enforcement
d. management review
10. One factor making detection very difficult in the vice chairman/Thomas Coughlin case was that the
fraud act involved _________.
a. a high-ranking executive
b. collusion
c. bribery
d. kickbacks
30
Case 7.1
There guidance video is titled Forensic Analytics Second Edition, Guidance Case 7.1, Relative Size
Factor.
Required
1. Use Excel. Calculate the Relative Size Factor (RSF) for each vendor using equation 7.1 in Chapter 7.
Do not calculate a RSF for vendors (subsets) with only one payment during the four-year period. Also,
do not calculate a RSF for vendors where the second largest amount is zero or less. Submit a
screenshot of your first 20 rows of output (heading plus RSFs for 20 vendors) sorted by RSF
descending. Include all the details that are shown in the chapter example’s results in Figure 7.1.
2. The Findings section in the chapter talks about the decimal point error and a decimal point error
candidate. Which vendor is the first (i.e., the one closest to the top) decimal point error candidate in
your results for (1) above?
3. The Findings section in the chapter notes that “Large RSFs are more indicative of error when the
subset has many records.” Using this criterion which vendor is the most indicative of error in your
results for (1) above?
4. The Findings section in the chapter notes that “The team found interesting and suspicious items, and
possible errors where the RSFs were equal to 10, 5, 4, 3, 2, and 1.” Scroll down to the section of your
results where there are three RSFs equal to 10.00. Note that the RSFs are rounded and so a RSF of
10.00 might be a number that is slightly smaller than or larger than 10.00. Given limited audit
resources which of those three vendors would you audit? The audit need not be an intensive review of
all the supporting documents.
5. The vendor Elsie and Sons Christmas Trees (“Elsie”) had a payment that was just below $10,000.
Extract all three records for this vendor. Do the entries in the AcctDescription field seem reasonable?
Do the payment dates seem reasonable given the type of goods that the vendor supplied?
6. Can you find the vendor Elsie and Sons Christmas Trees on the internet (other than on the
www.somervillema.gov/ website)? The answer to that question is most likely “no.” It seems that the
vendor’s name is misspelled in the vendor master file of the city of Somerville. Can you find a vendor
with a similar name that in the Northeast region (as defined by the US Census Bureau
https://www.census.gov/) of the United States?
31
CHAPTER 8
IDENTIFYING ABNORMAL DUPLICATIONS

1. The same-same-same test requires some creativity in planning to identify anomalous matches. If
careful planning is not done this test could well generate large numbers of ______.
a. exhibits in a forensic report
b. outliers
c. relative size factors
d. false positives
2. The purchasing card results for the same-same-same test in Figure 8.1 are sorted by _______.
a. Count descending, Amount descending
b. Count ascending, Amount descending
c. Count descending, Amount ascending
d. Count ascending, Amount ascending
3. An accountant might pay a supplier’s invoice on December 5th and then raise a liability in the books of
account for the same $2,204.00 on December 31 st (the year-end). If this error is not detected, then in the
annual financial statements ________.
a. expenses or cost of goods sold will be overstated by $4,408.00
b. expenses or cost of goods sold will be overstated by $2,204.00
c. expenses or cost of goods sold will be correctly stated
d. revenues will be overstated by either $2,204.00 or $4,408.00 depending on the historical cost used
4. A duplicate payment fraud scheme would most likely ask the vendor to repay the overpayments using
______.
a. cash in US dollars
b. credits against future purchases
c. bitcoin
d. checks or wire transfers
5. With reference to the fraud detection methods in Table 17.2 it seems that the most likely way that Ryan
King’s duplicate payments scheme was detected was ______.
a. external audit
b. document examination
c. confession
d. account reconciliations
6. There is a higher chance of duplicate payments to the same vendor in cases where ________.
a. the vendor is a sole proprietor
b. payments are made by wire transfer
32
c. the vendor has more than one vendor number
d. each payment is independently reviewed before payment is made
7. On December 28, 2010 Susan Thompson was formerly charged with Theft of Corporate Property under
Section 609.52.2(15) of the __________.
a. United States Code
b. United States Department of Labor Regulations
c. Minnesota Power Code of Conduct
d. Minnesota Statutes
8. On February 14, 2013 at the sentencing hearing, Kevin Cornwall told the judge that he could no longer
represent Susan because of ethical concerns. Kevin Cornwall was _________.
a. Susan’s defense attorney
b. the prosecutor
c. Minnesota Power’s legal counsel
d. Minnesota Power’s head of internal audit
9. In detecting fraud we are trying to find people doing something that seems to be completely out of
character. This is because we, as forensic accountants, can only know the details of which of the
following fraud drivers?
a. Rationalization
b. Pressure
c. Opportunity
d. Arrogance
10. In the subset number duplication example at the bottom of page 231, if the last record (2) was
replaced with 1805, the Number Frequency Factor would _______.
a. increase
b. decrease
c. remain the same
d. the change cannot be determined
33
Case 8.1
There guidance video is titled Forensic Analytics Second Edition, Guidance Case 8.1, Abnormal
Duplications
Required
1. Use Excel. Run the same-same-same test on the payments data. Define a duplicate to be the same
vendor, the same date, and the same amount. Delete amounts under $100 since our audit resources are
scarce. You should expect that such duplicates are rare because we are looking at the payment date
and not the invoice date. Show a screenshot of the first 20 rows of your results sorted by count and
then amount descending.
2. Review your results in (1) above. Given limited audit resources which one duplicate payment would
you audit? You can assume that payments to the state and payments to the bank are not errors, and that
if they are errors that the recipient will give you a credit for the overpayment. The audit need not be an
intensive review of all the supporting documents.
3. The data does not contain the invoice numbers. Assume that if an invoice is paid twice that the second
(erroneous) payment will be made 30 days or less after the first (correct) payment. Define a duplicate
payment to be a payment to the same vendor, for the same amount, more than one day later and less
than 31 days of the first payment. Assume that the payments will be two successive payments to the
vendor. In other words, payments of $1,805.00, $1,983.00, and $1,805.00 should not flag the
$1,805.00 as duplicates even if the payment dates are less than 31 days apart because of the $1,983.00
in the middle. Run the same-same-same test looking for such duplicates. Delete all amounts under
$1,000.00 from the dataset before running the test. Show a screenshot of the first 24 rows of your
results sorted by vendor name ascending.
4. Review your results in (2) and (4) above. Given limited audit resources in is probably not feasible to
audit the “almost” duplicates. Based on the payments and the results would you be inclined to review
the organizations controls to prevent duplicate payments?
5. Use Excel. Run the subset number frequency test. The subsets in this case are the vendors. Delete
amounts under $100 from the dataset before running the test. Show a screenshot of the first 20 rows of
your results sorted by NFF descending and Count descending. Your results need only show the
vendor’s name, the count for the vendor, and the vendor’s NFF if the vendor has an NFF greater than
0.
34
CHAPTER 9
COMPARING CURRENT PERIOD AND PRIOR PERIOD DATA: PART 1

1. A comparison of balances for the current period with those of the prior period is known as a(n) _____.
a. ratio analysis
b. analysis of the elements of a balance
c. horizontal analysis
d. vertical analysis
2. The main concern of an external auditor is an undetected _______ in the financial statements.
a. ratio
b. major misunderstanding
c. inadequate incisiveness
d. material misstatement
3. Table 9.1 shows that the sum increased by 29.5 percent and that the number of records decreased by
5.4 percent. Based on these two facts alone we would expect the average amount to have ______.
a. decreased
b. increased
c. remained the same
d. cannot conclude as to an increase or a decrease
4. Table 9.1 shows that the mode was $4.75 in 2011 and in 2012. If we ran a number duplication test
(shown in Figure 5.3 in Chapter 5) for 2011 and 2012 we would expect to see the amount of $4.75 ____.
a. at Rank #1
b. at the bottom of the list of duplications
c. at the midpoint in the list of duplications
d. not on the list of duplications
5. Table 9.1 shows that the interquartile ranges were $588.00 and $629.67 respectively. Those amounts
can be calculated _______.
a. by multiplying the Quartile 1 amount by 3
b. by multiplying the median amount by the number of records
c. by subtracting the Quartile 1 amount from the Quartile 3 amount
d. by subtracting the minimum amount from the maximum amount
6. The 2012 first-two digits spike at 99 is partly due to 21 amounts in the 99,000 to $99,999.99 range that
were not matched in the 2011 data. The test that is designed to detect such situations is the _______.
a. number duplication test
b. summation test
c. last-two digits test
35
d. largest subsets test
7. When using My Law, we are comparing the first-two digit graph for the current period to the first-two
digit graph for the prior period, instead of comparing the first-two digits for the current period to ______.
a. the first-two digits for the future period
b. the interquartile range
c. a horizontal analysis
d. Benford’s Law
8. The training data is used to develop a classification algorithm that will be used on the test data set.
Choose the application that is most closely related to a classification algorithm application.
a. predicting tomorrow’s rainfall from today’s total
b. an airline segmenting customers into status groups
c. a stock analyst forecasting Amazon’s revenues for the next fiscal year
d. a “books you may like” suggestion on amazon.com
9. The first intervals of the histograms of the early and the late shopping data in Figure 9.7 shows that
there is a _____ proportion of low peso purchases early in the day as compared to later in the day.
a. smaller
b. higher
c. equal
d. cannot tell from the histogram
10. The Rita Crundwell $50 million plus Dixon, Illinois fraud makes no direct or indirect reference to
which driver of occupational fraud.
a. pressure
b. opportunity
c. rationalization
d. competence
36
Case 9.1
There guidance video is titled Forensic Analytics 2nd Edition, Guidance Case 9.1, Descriptive Statistics
Excel.
Required
1. Use Excel. Extract two samples, namely the payments for 2015 and the payments for 2016. Call the
2015 data the prior period and call the 2016 data the current period. Prepare a table of descriptive
statistics as is shown in Table 9.1 that includes the rightmost column, the change percentages. Since
we are using Excel you do not need to run Levene’s test for the difference between the variances, nor
do you need to test the data for normality.
2012 2011 Change

Sum
Number of Records
Mean
Test used
Median
Mode
Minimum
Quartile 1
Quartile 3
Maximum
Range
Interquartile range
Standard Deviation
Coefficient of Variation (CV)
Skewness
2. The descriptive statistics show that the change from period to period has been reasonable. In the real-
world you would have some history to support your conclusion that the changes are normal and that
they don’t signal a major change in circumstances. The only item worthy of some audit attention is the
change in the mode from $100.00 to $150.00. Extract all the 2016 payments for $150.00 and scan
them to see if any items appear to be errors or fraud. What do you conclude?
37
3. Run the first-two digits test on both the 2015 and the 2016 payments and present the results side-by-
side like the graphs shown in Figure 9.2.
Panel A: 2016 Payments Panel B: 2015 Payments
[insert graph here] [insert graph here]
4. Give the MADs for 2015 and 2016 respectively. Are these two MADs similar?
5. The 2016 spike at 15 is visibly larger than the 2015 spike at 15. Which 2016 descriptive statistic
suggests that the 2016 spike at 15 should be larger than the 2015 spike at 15?
38
CHAPTER 10
COMPARING CURRENT PERIOD AND PRIOR PERIOD DATA: PART 2

1. Vectors are matrices with ______.
a. one or more columns containing text
b. accounting data
c. two arrows extending from the origin and ending in Quadrant 1
d. one column and m rows
2. In Figure 10.1 vector a extends from the origin to the point (4, 3). What are the starting coordinates of
vector a? Or, stated differently, what are the coordinates of the origin?
a. (y,x)
b. (0,0)
c. (3,4)
d. (a,a)
3. Vector a has components (5,6) and vector b has components (7,1). Using equations 10.1 and 10.2,
which vector has the largest length?
a. Vector a
b. Vector b
c. The lengths are equal
d. The answer cannot be calculated from the information given
4. Vector a has components (5,6) and vector b has components (7,1). Using equations 10.3 and 10.4,
which vector has the largest slope?
a. Vector a
b. Vector b
c. The lengths are equal
d. The answer cannot be calculated from the information given
5. Vector a has components (5,6) and vector b has components (7,1). Using equation 10.7, the length
(length) of the vector c (as shown graphically in Figure 10.1) is ____.
a. length < 2
b. 2 ≤ length < 4
c. 4 ≤ length < 6
d. length ≥ 6
6. Vector a has components (5,6) and vector b has components (7,1). Using equation 10.5, the angle theta
between the two vectors is calculated to be 0.7342 radians. What is that angle in degrees? See the notes
just below equation 10.5.
a. degrees < 24
39
b. 24 ≤ degrees < 36
c. 36 ≤ degrees < 48
d. degrees ≥ 48
7. Vector a has length 7.81, vector b has length 7.07, and vector c has length 5.39. The Vector Variation
Score (VVS) calculated using equation 10.8 is _______.
a. VVS < 0.25
b. 0.25 ≤ VVS < 0.375
c. 0.375 ≤ VVS < 0.50
d. VVS ≥ 0.50
8. See (7) above. Vector a is renamed as b, and vector b is renamed as a. Vector a has length 7.07, vector
b has length 7.81, and vector c has length 5.39. The Vector Variation Score (VVS) calculated using
equation 10.8 is _______.
a. VVS < 0.25
b. 0.25 ≤ VVS < 0.375
c. 0.375 ≤ VVS < 0.50
d. VVS ≥ 0.50
9. Choose the most correct statement from the alternatives offered. Richard Hatch was found guilty on all
three tax evasion counts, and not guilty on the _________ counts.
a. wire fraud and mail fraud
b. wire fraud, mail fraud, and bank fraud
c. wire fraud, mail fraud, and nonprofit organization fraud
d. S corporation tax evasion
10. In March 2011 Richard Hatch was sentenced to nine months of incarceration for _______.
a. tax evasion
b. not filing amended tax returns for 2000 and 2001
c. nonprofit organization fraud
d. an unauthorized interview with Matt Lauer
The chapter’s cases follow on the next page.
40
Case 10.1
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 10.1, Vector
Variation Score.
Required
1. Use Excel. Extract two samples, namely all the payments for 2015 and all the payments for 2016.
Calculate the 2015 and 2016 sums for each of the Departments (Column F in the worksheet). How
many department totals do you have in 2015? How many departments do you have in 2016? Do the
departments match each other? In other words, does each 2015 department also have a positive total in
2016, and does each 2016 department also have a positive total in 2015?
2. Call the 33 department totals for 2015 vector a and call the 33 department totals for 2016 vector b.
Calculate the length of vector a and the length of vector b.
3. Calculate the length of the vector c using equation 10.7.
4. Calculate the Vector Variation Score (VVS) using equation 10.8.
5. Using Figure 10.2 as a guide would you say that the VVS is small, medium sized, or large?
6. Calculate the angle between the two vectors in degrees.
7. Using equation 10.15 identify the department that made the largest contribution to the VVS and give
the two (2015 and 2016) totals for that department.
8. Assume that Elaine Ashby (from Case 3.1) has just done the calculations in (1) to (7) above and she
would like to assess whether the changes from 2015 to 2016 were below normal, normal, or above
normal. What could she compare these 2015-2016 results to?
41
Case 10.2
This case is based on the Vectors and Measures of Change section in Chapter 10 that starts on page 275
and goes through to page 280.
For the calculations and graphs you should use the 10_VectorVariationScoreCalcs Excel template that is
in the Dropbox folder at https://tinyurl.com/ForensicAnalyticsEOC.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 10.2, Vector
Variation Score.
Required
1. Vector a has components (4,0.25) and vector b has components (4,0.50). Using the Excel template, the
length of the vector c (as shown graphically in Figure 10.2) is ____.
angle in degrees between the two vectors (the angle θ) (as shown graphically in Figure 10.2) is ____.
Vector Variation Score (as shown graphically in Figure 10.2) is ____.
4. Refer to the information in the previous three requirements. See also the Figure 10.1 tab in the Excel
template. The two vectors just described are most like _____ (Panel A, Panel B, or Panel C) in Figure
10.2.
5. Vector a has components (4,0.25) and vector b has components (1,4). Using the Excel template, the
8. Refer to the information in the previous three requirements. See the Figure 10.1 tab in the Excel
template. The two vectors a and b are most like _____ (Panel A, Panel B, Panel C) in Figure 10.2.
9. Refer to the information in the previous four requirements. Complete the Figure 10.1 tab in the Excel
template so that it looks almost like Panel B in Figure 10.2 To do this you need to insert the two
arrows and the dotted line with an arrow tip from (1,4) to (4,0.25). The arrows are inserted using
Insert→Illustrations and then formatting the arrows using Format Object.
10. Vector a has components (4,0.4) and vector b has components (-4,0.50). Using the Excel template, the
13. Refer to the information in the previous three requirements. See the Figure 10.1 tab in the Excel
template. The two vectors a and b are most like _____ (Panel A, Panel B, or Panel C) in Figure 10.2.
14. Refer to the information in the previous four requirements. Refer now to your Figure 10.1 tab in the
Excel template. The two plotted points do not look like Panel C in Figure 10.2. This is because the y-
axis in Panel C ranges from 0 to 4 and the y-axis in the template ranges from 0 to 0.6. Use the Format
Axis routine to change the y-axis range in the template to 0 to 4. Your template should now look much
more like Panel C. Insert the two arrows and the dotted line with the arrow tip from (4,0.4) to (-4,0.50)
and submit a screenshot of your graph which should look like the Panel C graph except for some
minor formatting differences.
42
Case 10.3
Read the court documents related to the Richard Hatch tax evasion case. These documents are
10_HatchIndictment, 10_HatchJuryVerdict, 10_HatchJudgment_May2006, and
10_HatchJudgement_March2011. The documents are numbered 1, 49, 64, and 163 in the court records of
his tax evasion case. Answer the questions below the Required heading.
Required
1. In addition to the monetary prize Richard Hatch also won _____.
a. a place on the For Goodness Sake television program
b. the opportunity to co-host the Today Show with Matt Lauer
c. an automobile
d. a job as a co-host of The Wilde Show
e. a place on the Weakest Link television program
2. The Survivor show that featured Hatch as a contestant was filmed on _______.
a. the Pearl Islands of Panama
b. the Masquesas Islands of French Polynesia
c. Pulau Tiga off the coast of Borneo
d. Palaui Island in the Philippines
e. Macauta in Fiji
3. In November 2001 Hatch met with members of the accounting firm that he had retained in March,
2001. Their prepared tax return showed that Hatch owed taxes for the 2000 calendar year plus $66,670 in
interest and penalties. The penalty amount was, at least in past, most likely due to ____.
a. earning income in a foreign country
b. an issue relating to Rhode Island individual taxes
c. failure to pay proper estimated tax
d. a dishonored check or other form of payment
e. failure to complete the Alternative Minimum Tax worksheet
4. Early in 2001 CBS sent Hatch a _____ that showed that they had paid him $1,010,000 in the 2000 tax
year.
a. Form 1040-MISC
b. Form 1099-MISC
c. Form W-2
d. Schedule C
5. In Spring, 2001 Hatch was a speaker at ________.

a. a meeting of his fans at 21 Annandale Road, Newport.
b. a gathering of Pontiac Aztec owners.
c. a meeting of the producers of For Goodness Sake!
d. the annual general meeting of East Boston Savings Bank.
6. Hatch had a personal bank account and Tri-Whale Enterprises had a bank account.
a. These accounts were exactly the same bank account.
b. They had different accounts, but both were located at Newport Federal Savings Bank.
43
c. They had different accounts, but both were located at East Boston Savings Bank.
d. Tri-Whale Enterprises did not have a bank account and deposited its income into the bank account of
Hatch’s first accountant.
7. In June-July 2001 Hatch sent two faxes to NBC in Los Angeles. The faxes included the forged
signatures of ____.
a. Bobby Magee
b. Ralph Magee
c. Charlie Wilde
d. an Annandale Road tenant
8. In addition to tax evasion, Hatch was charged with _____.

a. mail, fire, and bank fraud
b. mail, liar, and bank fraud
c. mail, wire, and bank fraud
d. mail, charity, and bank fraud
9. Choose the most correct statement below with respect to the jury verdict.
a. Hatch was found guilty on all charges.
b. Hatch was found guilty of tax evasion for the year 2000 only.
c. Hatch was found guilty of tax evasion for 2000 and 2001, and of signing a false tax return for Tri-
Whale Enterprises.
d. Hatch was found guilty of tax evasion for 2000 and 2001, and of signing a false tax return for Tri-
Whale Enterprises, plus wire fraud.
10. Choose the most correct statement below with respect to the jury verdict.
a. Hatch was found innocent of wire, mail, and bank fraud.
b. Hatch was found not guilty of wire, mail, and bank fraud.
c. Hatch was found not guilty on all charges.
d. Hatch was found guilty of all charges related to 2000 and not guilty of all charges related to 2001.
11. Hatch originally pleaded "not guilty" on September 17, 2005 at his _____. (The answer to this
question is not in the four court documents. Use some logic and a law dictionary.)
a. sentencing
b. Survivor finale
c. appeal
d. arraignment
12. Hatch was sentenced on May 16, 2006 by Judge _____.

a. Andrew J. Reich
b. Ernest C. Torres
c. Ruth Bader Ginsburg
d. Antonin Scalia
13. In addition to the prison sentence issued in the 2006 judgement, Hatch was also required to _____.
a. refund the diverted funds to his Horizon Bound charity
44
b. cease having tenants at his house on Annandale Road, Newport, RI.
c. deregister his Tri-Whale Enterprises S-Corporation
d. participate in a program of mental health counseling
e. pay compensation to Ralph Magee for forgoing his signature
14. In addition to the prison sentence issued in the 2006 judgement, Hatch was also required to _____.
a. file amended returns for the 2000 tax year
b. file amended returns for the 2000 and 2001 tax years, both individually and for Tri-Whale Enterprises.
c. file amended returns for the 2000 and 2001 tax years, both individually and for Tri-Whale Enterprises,
and to pay all taxes due and owing for those years.
d. in addition to filing amended returns, write a letter of apology to the IRS
15. Hatch’s judgment on May 16, 2006 called for an imprisonment term of _____.
a. three years
b. 51 months
c. 87 months
d. 102 months
e. 138 months
16. Hatch’s judgment on May 16, 2006 include a criminal monetary penalty of ____ and restitution of
______.
a. $300, $0
b. $300, $500,000
c. $3,000, $500,000
d. $3,000, $1,000,000
17. Hatch’s was again sentenced on March 11, 2011. The violation this time was __________.
a. the unauthorized sale of his Pontiac Aztec
b. unauthorized interview with Matt Lauer of NBC
c. a violation of the special conditions of supervision set out in 2006
d. tax evasion related to his Rhode Island state income tax
18. With respect to Hatch’s judgment on March 11, 2011, the sentence this time included both ____ and
_____.
a. 9 months of prison time, 25 percent of gross income to be paid to the U.S. Marshals
b. 9 months of prison time, 25 percent of gross income to be paid to the IRS
c. another 51 months of prison time, 25 percent of gross income to be paid to the IRS
d. 9 months of prison time, 36 months of supervised release
19. Richard Hatch spent most of his prison time at FCI Morgantown. Look up Richard Hatch’s details on
the Find an Inmate page of the website of the Federal Bureau of Prisons (https://www.bop.gov/). What
was Richard Hatch’s Register #?
a. 05559-070
b. 16735-027
c. 12-12-2011
d. 03-13-2020
45
20. Richard Hatch spent most of his prison time at FCI Morgantown. Look up Richard Hatch’s details on
the Find an Inmate page of the website of the Federal Bureau of Prisons (https://www.bop.gov/). When
was Richard Hatch released from prison?
a. 03-11-2011
b. 05-16-2006
c. 12-12-2011
d. 03-13-2020
46
CHAPTER 11
IDENTIFYING ANOMALIES IN TIME-SERIES DATA

1. An example of a seasonal pattern is _______.
a. the housing boom of the early 2000s.
b. the stock market boom of the late 1990s
c. the release dates of Taylor Swift CDs
d. heating oil sales that are low in summer and high in winter
2. The data points used for the purchasing card example discussed in the chapter were the monthly totals
for 2009 to 2014. This data was used to generate forecasts for ______.
a. 2008-01 to 2008-12
b. 2014-01 to 2014-12
c. 2015-01 to 2015-12
d. 2020-01 to 2020-12
3. The Minitab results include a MAPE accuracy measure. The abbreviation MAPE stands for ______.
a. Mean Accurate Percentage Error
b. Mean Absolute Percentage Error
c. Minimum Absolute Percentage Error
d. Maximum Absolute Precision Error
4. Katherine Harrell’s fraud scheme involved ________.

a. removing coins from the bank vault
b. transferring funds from the payroll account to her personal bank account
c. depositing funds into customer’s accounts
d. withdrawing funds from customer’s accounts
5. Given the large visible differences in Figure 11.5 between the actual values and the fitted values in the
time-series plot of the Katherine Harrell monthly totals we would expect to see _____.
a. a relatively high MAPE in the Accuracy Measures
b. a decreasing trend line
c. the time period is so long
d. a relatively small MAD in the Accuracy Measures
6. In the grocery store sales example the fitted trend equation is 117,825 + 240 x t. In mathematical terms
the 117,825 term is also known as the __________.
a. MAPE
b. average monthly increase
c. slope
d. y-intercept
47
7. The vector representation of a trial balance is a(n) ____________.
a. set of descriptive statistics
b. a column of the monetary amounts
c. three-dimensional graph
d. inverse cosine function
8. The trial balance example stated that the sales account and the cost of goods sold account were
“responsible” for 45.9 and 38.3 percent of the VVS respectively. The formula used to calculate those
numbers was ______.
a. the contribution formula in equation 10.15
b. the slope formula in equation 10.3
c. the angle theta formula in equation 10.5
d. the large VVS formula in equation 10.11
9. In the customer rebates application the auditors wanted to assess the risk of improper allowances. The
effect of improper allowances would affect the financial statements in the form of ________.
a. an increase in net income
b. a decrease in net income
c. an unbalanced trial balance
d. a prior year adjustment
10. The polar plot representation requires the x and y-coordinates of vector b to be calculated using
equations 11.4 and 11.5. In those equations the abbreviations cos and sin stand for ______ respectively.
a. cost of sales and stock inventory number
b. cost of sales and special item number
c. change of score and special inventory number
d. cosine and sine
The chapter’s cases are on the next pages.
48
Case 11.1
missing values. Use Excel and Minitab and show your screenshots or text for the requirements.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 11.1, Time Series
Analysis with Minitab.
Required
1. Use Excel. Calculate the total payments (in dollars) per month from 2013-01 to 2016-12. Show a
screenshot of your 12 monthly totals for 2013.
2. Use Excel. Prepare a graph showing the total amount per month for each of the 48 months from 2013-
01 to 2016-12. Use a bar graph. Include a title at the top of the graph and a title for each of the axes.
3. Review your graph in (2) above. Is there a seasonal pattern to the monthly totals?
4. How do you think that the patterns that you see in 2013 to 2015 will affect the MAPE? Do you expect
a large MAPE, a medium-sized MAPE, or a small MAPE?
5. Use Minitab. If you do not have access to this app then you can use a free trial version. Run a Google
search for Minitab trial for details. Use the Stat→Time Series→Decomposition routine. Set the
season length at 12 and keep the default multiplicative and trend plus seasonal options. Use the 2013-
2015 data to generate forecasts for the twelve months in 2016. Show a screenshot of your Time Series
Decomposition Plot for Amount as is shown in Figure 11.2.
6. Your Minitab output includes a fitted trend equation Yt = 12100314 + 75668xt. What does the 75668
(the slope) represent?
7. Your Time Series Decomposition Plot shows the MAPE. What is the MAPE written out in base ten
numerals and rounded to three places after the decimal point?
8. Would you classify the MAPE as a large MAPE, a medium-sized MAPE, or as a small MAPE?
9. Your Minitab output includes a set of forecasts in the form of a table for periods 37 to 48. Show a
screenshot of your table of 12 forecasts.
10. Prepare a table of the actual and forecast monthly totals as is shown in Table 11.1. Your table will
show the 12 months in 2016, the actual monthly totals for 2016, the forecast monthly totals for 2016,
and the difference between the actual and forecast monthly totals. The difference should be calculated
by subtracting the forecast amounts from the actual amounts. Format the numbers as currency and
round all amounts in the table to whole dollars.
11. Examine your results in (10) above. If Elaine Ashby, the auditor, were to ask Edward Bean the
director of Finance, a question about the variance (difference) for a single month, which month should
she choose and what would that question be?
49
Case 11.2
Use the 11_Employees Excel data file, obtained from the human resources department, that lists the
employee number, their last name, their first name, and their termination date if they have been
terminated. Use the 11_OfficialUsers Excel data file, obtained from the network administrator, that lists
the employee number, their last name, their first name, a “Yes/No” indicator indicating whether the
employee has access to the network, and the date of their last access. The condition that we are looking
for would is the set of cases where the date of the employee’s last network access was after their
termination date. An extract from each of the two files is shown below.
The TermDate field in Employees shows the termination date of the employee if they were terminated. A
blank (null) value in that field means that they are a current (i.e., not terminated) employee. The Empl_ID
field is the employee’s ID. The contents of the other fields are clear from their field names.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 11.2, Terminated
Network Users Accessing Systems.
Required
1. Open Access. Import the Employees Excel data file. Do not add an ID field since the Empl_ID field
functions as an ID field. Show a screenshot of the first ten rows of the data.
2. Open Access. Import the OfficialUsers Excel data file. Do not add an ID field since the Empl_ID field
functions as an ID field. Show a screenshot of the first ten rows of the data.
3. Run a query to identify the employees that were terminated (they have a termination date in the
TermDate field in the Employees file) and that have not been disabled (they have a “No” indicator in
the AccessHalted field in the OfficialUsers file). Sort your results by Empl_ID ascending. Show a
screenshot of the first ten rows of your results which should include the employee’s name, their
Employee ID, and the AccessHalted field showing No.
4. Run a query to identify the five employees that have been terminated (they have a date shown in the
TermDate field in the Employees file) and that accessed the system after their termination date (they
have a LastLoginDate in the OfficialUsers file that is after their termination date in the Employees
file). Sort your results by Empl_ID ascending. Show a screenshot of your results which should include
the employee’s name, their Employee ID, their termination date, and their last login date.
5. How often do you think that these (terminated employees accessing the system) system access
analytics should be run by the managers in the cyber security department? Should it be daily, weekly,
monthly, or some other time interval? Give a reason(s) for your answer.
50
CHAPTER 12
SCORING FORENSIC UNITS FOR FRAUD RISK

1. In the risk scoring applications each predictor is scored with a score that ranges ______.
a. from -1 to 1
b. from 0 to 1
c. from 0 to 100
d. from 1 to 10
2. The audit selection method developed by the IRS started with an audit of 50,000 tax returns. This audit
was called the TCMP which stands for ______.
a. Taxpayer Change Management Process
b. Taxpayer certified Money Penalty
c. Taxpayer Confidential Measurement Program
d. Taxpayer Compliance Measurement Program
3. The audit selection model developed by the IRS is based on a modified version of which statistical
analysis technique?
a. Discriminant analysis
b. Linear regression
c. Data mining
d. Evasion analytics
4. The description of Victor Sturman’s fraudulent “S&S Design” vendor scheme suggests that internal
auditors might identify a fraudulent vendor by extracting a listing of all vendors _________.
a. supplying services as opposed to supplying goods for resale
b. with a total amount billed of $3 million over the past 12 years
c. with P.O. Box mailing address within an easy commute of the administrative offices
d. where the controller approves the invoices for payment
5. Victor retired in 2004. Assume that the fiscal year is the calendar year and that Victor processed no
fraudulent invoices in 2004. If the largest subsets growth test (Chapter 6) was run on December 31, 2004
we would expect S&S Design to be _____ in a listing of the results.
a. at the bottom
b. at the top
c. in the middle
d. nowhere, because a percentage change from a positive number down to $0 cannot be calculated
6. Victor Sturman’s case suggests that people responsible for accounting and for processing expenditures
for payment should not have ________ in the same business activity.
a. an understanding of the business
51
b. a profit-sharing plan
c. operational responsibilities
d. an office anywhere near
7. Wayne James Nelson’s scheme started small (see Table 12.1) and then increased by leaps and bounds.
Starting small and then increasing by leaps and bounds is the underlying motivation for the ____ test.
a. the largest subsets test
b. the largest subsets growth test
c. the summation test
d. the Benford’s Law
8. The chapter refers to other predictors identified as P 6-P15. Which predictor shown below is not on that
list (read the predictors below carefully)?
a. the vendor has purchase orders without invoices
b. there is increased activity just before the year-end holidays
c. the vendor master record has a history of changes
d. the vendor has many invoices that are just below key approval amounts
9. In the sales reporting risk-scoring application, the objective was to identify franchisees that had ______
their monthly sales numbers.
a. overstated
b. understated
c. not reported
d. accurately stated
10. The statistical technique used to identify an irregular sales pattern (P 5) was _____,
a. the angle theta
b. discriminant analysis
c. Benford’s Law
d. correlation
52
Case 12.1
Please note that Somerville payments fraud is not suspected. This case is simply designed for practice.
We will score each vendor according to its “fraud risk” using a very basic risk scoring model.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 12.1, Scoring
Forensic Units for Fraud Risk.
Required
1. Create data set with only the payments for 2015 and 2016 with the date sorted such that the oldest date
is shown first. Sort the data by Date ascending and by Amount descending. For this requirement type
“data set created.”
2. Calculate the percentage increase for each vendor (using total dollars) from 2015 to 2016. Score each
vendor as 1.00 if the increase is from 20 percent to under 100 percent. Score each vendor as 0.50 if the
increase is from 100 percent to under 150 percent. Score each vendor as 0 otherwise (increase under
20 percent, or a decrease, or an increase of 150 percent or more). Vendors with a $0 total in 2015
(where we can’t calculate a percentage increase) should be scored as 0. Your results here must be a
listing of all the 2015 – 2016 vendors and their scores, including vendors with activity in just one of
the years. For this requirement type “P1 created.”
3. Score each vendor with 2016 activity as 1.00 if the 2016 total is from $50,000 to $149,999.99. Score
each vendor with 2016 activity as 0.50 if the 2016 total is from $150,000 to $249,999.99. Score all
other vendors as 0. For this requirement type “P2 created.”
4. Score each vendor with 2016 activity as 1.00 if the 2016 total payments count is from 6 to 24, both
counts inclusive. Score each vendor with 2016 activity as 0.50 if the 2016 total payments count is
from 1 to 5. Score all other vendors as 0. . For this requirement type “P3 created.”
5. The city usually prepared its checks on a Wednesday. Score each vendor with 2016 activity as a 1.00
if 20 percent or more of the invoices are dated on a day other than a Wednesday. Score all other
vendors as 0. For this requirement type “P4 created.”
6. Weight each of the four predictors with a 0.25 weight and calculate the risk scores for each 2016
vendor. Rank the vendors by risk scores descending and then by total payments in 2016 descending.
For this requirement type “final risk scores calculated.”
7. Show the first 20 rows of your results. The results should include the vendor’s name, the total dollars
of payments for 2016, the total dollars of payments for 2015, the total number of payments in 2016,
the four predictor risk scores, and the total risk score.
8. Select one vendor from the list in (7) above. Give the vendor’s name and say why you selected that
vendor for audit attention.
53
CHAPTER 13
AN EMPLOYEE’S FRAUDULENT TAX REFUNDS

1. Harriette’s fraud scheme suggests that someone that is operating an embezzlement (occupational fraud)
scheme should preferably not have a wife or a husband because _____.
a. it is a strain on the relationship if they sit in first class while their spouse and children sit in coach
b. the “innocent” spouse is likely to gossip about the fraud scheme to their family
c. it saves them from having to explain the extra wealth to their spouse
d. the innocent spouse it likely to continually nitpick at the flaws in the scheme
2. Which statement best describes the relationship that Harriette had with her work colleagues?
a. She lent them money at rates that were described as usurious
b. She always put nepotism ahead of her own needs
c. Her annual evaluations were always fair and balanced
d. She gave her colleagues gifts that ranged from small to extravagant
3. In the mid-1980s Harriette saw various forms of corruption at work. This included seeing a colleague
divert, for her own benefit, refund checks that had been returned to the tax office because the taxpayer
had ______.
a. died
b. moved to Florida
c. been found guilty of tax evasion
d. asked for the funds to be applied to next year’s property taxes
4. The refund checks were made out to supposed DC property owners. To get the checks deposited into
accounts that she controlled, Harriette relied on the cooperation of __________.
a. Chris Thorn
b. teamwork consultants
c. a local bank teller
d. an ATM machine manager
5. To escape detection Harriette knew that she had to stay off the radar of the monitoring systems of the _.
a. CIA
b. banks
c. SAT proctors
d. HR department
6. Harriette avoided using _______ as the second digits in her fraudulent amounts.
a. 0s and 1s
b. 6s and 9s
c. 1s and 2s
54
d. MADs
7. Table 13.1 shows that Harriette duplicated 14 large dollar amounts. Based on the way that the
overpayment refunds were calculated, these large number duplications should have been _________.
a. much more plentiful
b. almost infinite
c. standard
d. rare or nonexistent
8. The “End is High” section suggests that with Bank of America’s Walter Jones out of the picture, that
Harriette should have _________.
a. avoided using any duplicate amounts
b. used only round thousands going forward
c. restricted herself to the period right after the annual audit
d. ended her fraudulent tax refund scheme
9. On September 14, 2007 Harriette mailed her forged letter from the OTR offices to Jayrece’s home.
Using the U.S Postal Service on that day opened Harriette up to a felony charge of ______. [Look up the
definitions of these federal offenses. Only two of the offenses listed in the options below are valid. Two
are fictitious.]
a. wire fraud
b. admissions fraud
c. mail fraud
d. signature fraud
10. After her arrest on November 7, 2007 Jayrece Turnbull ________.

a. allowed herself to be interviewed
b. agreed to apologize to Chris Thorn
c. agreed to be a cooperating witness in Harriette’s case
d. told the special agents where Harriette lived
55
Case 13.1
Open the 13_HarrietteWalters_Data file. This Excel file contains the fraudulent refund data shown in
Appendix 13A of Chapter 13 of Forensic Analytics Second Edition.
Use Excel and show your screenshots or text for the requirements below.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 13.1, Harriette
Walters’ fraud data.
Required
1. Calculate the total of the Amount field. Give the numeric answer in the Currency format to two
decimal places.
2. Does the total amount calculated in (1) above agree with the total amount of the fraud as stated in the
third paragraph on Page 391 of Chapter 13? The answer here is simply yes or no.
3. Calculate the average Amount. Give the numeric answer in the Currency format to two decimal places.
4. Calculate the maximum Amount. Give the numeric answer in the Currency format to two decimal
places.
5. Calculate the number of negative Amounts. Give the answer in the number format with zero decimals.
In one sentence state whether you expected to find any negative amounts in the data.
6. How many fraudulent refunds were equal to or greater than $400,000 but less than $500,000? Give the
answer in the number format with zero decimals.
7. Use the NigriniCycle Excel template. Run the first digit test on all the fraud amounts greater than or
equal to 10. Show a screenshot of your Excel graph. Your result should look like Figure 13.5 in
Chapter 13.
8. What is the Mean Absolute Deviation (MAD) for the first digits? See cell F12 in the Tables tab. The
MAD is discussed in Chapter 6. Using the MAD what level of conformity does the data have to
Benford’s Law? Use Table 4.2 in Chapter 4. You answer is either close conformity, acceptable
conformity, marginally acceptable conformity, or nonconformity.
9. Use the NigriniCycle Excel template. Run the second digit test on all the fraud amounts greater than or
equal to 10. Show a screenshot of your Excel graph. Your result should look like Figure 13.6 in
Chapter 13.
10. Use the NigriniCycle Excel template. Run the last-two digits test on all the fraud amounts greater than
or equal to 10. Use the cents amounts as the last-two digits. Show a screenshot of your Excel graph.
Your result should look like Figure 13.7 in Chapter 13.
56
Case 13.2
Open the 13_HarrietteWalters_Data file. This Excel file contains the fraudulent refund data shown in
Appendix 13A of Chapter 13 of Forensic Analytics 2nd Edition.
Use Excel and show your screenshots or text for the requirements.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 13.2, Harriette
Walters’ fraud data.
Required
1. Create a graph of the monthly (January to December) totals for the invoices. Note that Figure 13.4 in
Chapter 13 graphs the voucher date and the amount. This is not what is required here. This
requirement is a periodic graph with 12 monthly totals that represents the total of all the January
amounts, the total of all the February amounts, through to the total of all the December amounts. A
blurred clue is shown below.
2. In one sentence explain whether you expected to see a seasonal pattern in the data. Note that in Figure
11.5 the 2006 and 2007 amounts in the Katherine Harrell fraud scheme were analyzed, and there was
no seasonal pattern.
3. Harriette had 14 number duplications, and they are shown in Table 13.1. Create a table showing the 14
number duplications with headings that show the First Date, the Second Date, and the Amount, with
the Amount field sorted ascending (smallest to largest) and with the first date being the first time that
that amount was used. For example, the first two rows in Table 13.1 would be shown as 10/22/1991,
07/20/1993, and 58,250.41 in the table. The last row in the table would be 06/15/2006, 04/25/2007,
and 468,000.000. A blurred clue of the first five records is shown below.
4. Read the article published in the May 2018 issue of the Journal of Accountancy titled “Round
Numbers: A Fingerprint of Fraud” by Mark Nigrini. The article can be accessed by searching for Mark
Nigrini at https://www.journalofaccountancy.com/. The Harriette Walters fraud is discussed on page
38. For this part simply state, “I read the round numbers article.”
5. Identify the round number refunds in the fraud data. Define a round number to be a number that is a
multiple of $1,000. Page 39 of the article in (4) above shows how to identify the round numbers. Show
a screenshot of the table of 24 round numbers showing the Payee, the Date, and the Amount fields as
headings and 24 rows of data. Sort the results by Amount descending (largest to smallest).
6. Calculate the round number percentage using the count of the round numbers (available from (5)
above) and the total count of the fraudulent numbers (the count of the records in the data set). Give the
numeric answer in the format xx.xx%.
57
CHAPTER 14
A SUPPLIER’S FRAUDULENT SHIPPING CLAIMS

1. C&D submitted 499 invoices for inflated shipping charges. What percentage of these invoices (based
on the count, not the dollar amounts) were paid by the Defense Finance and Accounting Service?
a. 20.20 percent
b. 22.44 percent
c. 100 percent
d. 112 percent
2. The second digit proportions in Figure 14.1 show that two out of three times the second digit was ___.
a. either a 1 or a 9
b. either a 0 or a 9
c. a 00
d. a 0
3. In an attempt to avoid prosecution, Darlene sent the Department of Defense a check for ______ asking
that the matter be settled in a friendly way outside of any legal channels.
a. $3.7 million
b. $4.5 million
c. $7.1 million
d. $20.6 million
4. The assets listed in the forfeiture order (Table 14.2) shows ______ beach houses in Edisto Island, SC.
a. one
b. two
c. three
d. four
5. On October 25, 2006, some three weeks after Darlene’s death, a ______ at the C&D warehouse caused
considerable damage.
a. burglary
b. fire
c. hailstorm
d. water main break
6. In her plea agreement dated August 7, 2007, Charlene pled guilty to ________ to commit wire fraud
and ___________ to launder money.
a. scheme, scheme
b. trickery, treason
c. ignorance, ignorance
58
d. conspiracy, conspiracy
7. The judge in Charlene Corley’s court case was judge ____________.

a. Deborah Barbier
b. Winston Holliday
c. John Roberts
d. Margaret Seymour
8. Charlene’s sentencing memorandum concluded that apart from the accusations, Charlene had led a(n)
_______.
a. exemplary life
b. Vacation Bible School
c. Budget and Control Board department
d. appliance delivery division
9. At the sentencing hearing the prosecutor claimed that, “If the Department of Defense had not caught
them, they would today still be _____.”
a. friends
b. twin sisters
c. stealing
d. delivering appliances for Sears
10. The controls that are designed to detect errors or incidents that have slipped through the preventative
controls are known as ________ controls.
a. effective
b. protective
c. objective
d. detective
59
Case 14.1
Read the excerpt from the Charlene Corley sentencing hearing 14_Corley_SentencingHearing and answer
questions 1-10 below the Required heading. Questions 11-15 are based on the Control Activities section
on pages 42-45 of Albrecht, Albrecht, Albrecht, and Zimbelman’s Fraud Examination Fifth Edition. The
internal control questions are reasonably logical, and it is not critical that you read the pages in the
textbook. Pages 42 and 45 (which includes a summary) of the textbook are available on Google Books at
https://books.google.com/books?id=R6q5BwAAQBAJ&printsec=frontcover#v=onepage&q&f=false.
Required
1. The stolen money was more than what most honest hardworking people in the country would ever __.
a. pay in taxes
b. pay for college
c. accumulate in their 401(k) accounts
d. see in their lifetime.
2. One of the things that Charlene Corley purchased with the stolen funds was a $250,000 box in _____.
a. the Lexington post office
b. St. Paul’s Cathedral
c. the Colosseum of Rome
d. Clemson University’s stadium
3. Corley had the ability to earn a good legitimate income. She had a husband who had his own _____.
a. trust fund
b. software patent
c. accounting firm
d. tv show
4. In the year prior to sentencing Corley had a position as a ______.

a. substitute teacher
b. manager at the South Carolina Budget and Control Board
c. Lexus salesperson
d. realtor specializing in beach houses
5. The prosecutor argued that the payment system was built ________.
a. in modules
b. on trust
c. for ease of use
d. by Microsoft
6. The prosecutor argued that the cost of the fraud was going to be paid for by _____ .
a. other suppliers
b. the accounting system’s developers
c. the external auditors
d. every U.S. taxpayer
7. The prosecutor argued that other people had suffered losses as a result of the fraud. For example, Miss.
Boozer and her husband had stopped receiving _____.
a. mortgage payments
b. royalties
c. meals on wheels
60
d. income from their part-time jobs
8. During the period of the investigation, a warehouse on the property of C&D Distributors _____.
a. was used as sleeping quarters
b. mysteriously burned down
c. was purchased by amazon.com
d. was stolen
9. The fraud investigation included agents from ______.

a. MI6
b. the Internal Revenue Service
c. the Department of Homeland Security
d. the Department of the Treasury
10. The prosecutor asked for a sentence ________.

a. above the guideline range
b. in the guideline range
c. equal to the time of the fraud
d. that excluded any chance of parole
11. Control procedures are used to promote goal congruence and to ___ fraud.
a. repent
b. prevent
c. segment
d. consent
12. Segregation of duties is most often used when _____ is/are involved.
a. budgeting
b. standard costs
c. responsibility accounting
d. cash
13. When people are not authorized to perform an activity, the ____ to commit fraud is reduced.
a. pressure
b. opportunity
c. rationalization
d. time
14. Physical controls are often used to protect ______ by storing it/them in locked cages or warehouses.
a. employees
b. customers
c. the pro-forma financial statements
d. inventory
15. Without ________ no accountability exists.

a. documents
b. Excel spreadsheets
c. a code of ethics
d. an organizational chart
61
Case 14.2
Watch the Investigation Discovery Channel video titled Green-Eyed Monsters, an episode in the Evil
Twins Season 2 series
(https://www.youtube.com/watch?v=9yH4zh9tSRY&list=ELjkFmRJotxso&index=6 or
https://www.amazon.com/Evil-Twins-Season-2/dp/B00E0ZSOI6). Answer the 25 questions that follow
the Required heading.
Required
1. And within those fraternities and sororities you are going to meet people who come from wealthy
backgrounds. And the Schuler twins couldn’t quite _____.
a. compete
b. understand
c. explain
d. challenge
2. After graduation Darlene became a(n) ______ .

a. nurse
b. school teacher
c. pharmacist
d. accountant
3. Charlene felt that she was marrying into status when she married a(n) _____ in Lexington County.
a. forensic accounting professor.
b. mayor
c. army lieutenant
d. Corley
4. C&D Distributors started in _____.

a. 1989
b. 1991
c. 1993
d. 1997
5. She told the twins how easy it was to become an online ____ for the U.S. military.
a. travel agent
b. transcriptionist
c. tutor
d. supplier
6. C&D Delivery delivered ____ for stores throughout the state. At one point in time …..
a. appliances
b. pizza
c. bottled water
d. flowers
7. One of the twins accidently put the _____ in the column that said, “shipping costs.”
62
a. date
b. zip code
c. payment terms
d. invoice number
8. At the speed of a keystroke Charlene and Darlene had discovered a ______.

a. bankroll
b. payroll
c. loophole
d. price control
9. This $5,000 check would tell anybody that there were no ____ and that the shipping charges were paid
automatically.
a. standard costs
b. flexible budgets
c. responsibility centers
d. controls
10. Here is an open invitation to _____.

a. appeal
b. reveal
c. conceal
d. steal
11. What if we make a mistake and this time ___________?

a. not tell the auditors
b. not pay it back
c. not open the mail
d. invest in bitcoins
12. Between 1997 and 2000 Charlene and Darlene billed the government with _________.
a. Western Union
b. Venmo
c. their PayPal accounts
d. reckless abandon
13. They bought vacation homes. They bought ______.

a. luxury hamburgers
b. luxury hotels
c. luxury apartments
d. luxury automobiles
14. And just like they had done in the past with the $5,000 mistake, they paid back the $500,000 in full
very ______.
a. quickly
b. thickly
63
c. much like a loan
d. much like a deposit
15. The department of defense was under a system called ______.

a. Oracle financials
b. payroll
c. double entry bookkeeping
d. fast pay
16. This tells me that they were testing the waters, trying to see how high they could go without being __
a. asked
b. discovered
c. caught
d. afraid of heights
17. And purchasing a box was a very big ______.

a. surprise
b. spender
c. storm
d. status symbol
18. The twins even used their ill-gotten gains to build their ______ in the community.
a. fan club
b. identities
c. customs
d. reputations
19. For her 18th birthday they gave her a brand-new ________.
a. watch
b. convertible car
c. computer
d. iPhone
20. In 2005 they had enough money to live comfortably for the rest of their _____ and ….
a. life
b. summer
c. semester
d. family
21. She lied to the end and past the _______.

a. pretend
b. trend
c. dividend
d. end
22. Charlene threw her sister under the bus and blamed everything on ______.
64
a. her accountant
b. her family
c. Darlene
d. her internet connection
23. A mysterious ____ breaks out in the warehouse where the twins had their offices.
a. drought
b. water pipe
c. disease
d. fire
24. We found files that had Charlene’s _____ on them.

a. fingerprints
b. signature
c. lunch
d. eyelash
25. Charlene was sentenced to about ____ and a half years in federal prison.
a. two
b. six
c. ten
d. twelve
65
CHAPTER 15
DETECTING FINANCIAL STATEMENT FRAUD

1. In the Alali and Wang (2017) study, the authors found that financial statement frauds were most often
accomplished by manipulating __________.
a. expenses
b. revenues
c. inventory
c. investment-related accounts
2. Carslaw hypothesized that numbers just below an a*10k (a,k integer) boundary were valued abnormally
less than a similar difference occurring elsewhere. An example of such a boundary is,
a. 0.5 * π
b. assets equal liabilities plus owner’s equity
c. December 31, 2020
d. 5,000,000
3. Table 15.1 shows that from 1999 to 2000 Enron’s revenues grew from just over $40 billion to an
amount just over $100 billion. This was a percentage increase of approximately ____ percent.
a. 60
b. 100
c. 150
d. 250
4. Andrew S. Fastow was the CFO of Enron from 1998 to 2001. In 1999 he _______________.
a. was awarded the Golden Duke Award
b. was named CFO of the year
c. won the Diagram Prize
d. coauthored a WSJ article with Bethany McLean
5. At the end of 2002 HealthSouth’s assets were overstated by $2.74 billion. The most likely consequence
of that overstatement was that ________.
a. inventories were understated by $2.74 billion
b. total liabilities were overstated by $2.74 billion
c. accumulated other comprehensive income was overstated by $2.74 billion
d. retained earnings were overstated by $2.74 billion
6. The WorldCom financial statement fraud was accomplished using improper journal entries. The
Beresford Report makes several references to a specific type of journal entry called a(n) _______ journal
entry.
a. top-side
66
b. ad hoc
c. unbalanced
d. post-closing
7. With reference to WorldCom’s rounded numbers assume that a company had net income available to
common stockholders of $1,805 and that its weighted-average number of common shares outstanding for
the period was equal to 9,295. The basic EPS would be $0.1942 which would be rounded down and
reported as $0.19 on the income statement. If the company desired a basic EPS amount that would be
rounded up to $0.20, it would need to _______.
a. fraudulently adjust the lowest common denominator
b. fraudulently calculate the EPS using an improper fraction
c. fraudulently decrease the numerator
d. fraudulently increase the numerator
8. The Beneish M-Score uses a “Days sales in receivables index.” This means that his M-Score increases
(signaling a higher risk of fraud) when _______.
a. accounts receivable shows an abnormal decrease
b. accounts receivable shows an abnormal increase
c. accounts payable shows an abnormal decrease
d. accounts payable shows an abnormal increase
9. Insiders such as internal auditors that are investigating the risk of financial statement fraud need to be
aware of _________ which can circumvent internal controls that appear to be operating effectively.
a. segregation of duties
b. management override
c. red flags
d. analytical procedures
10. A financial statement misconduct risk-scoring system is described in the chapter. The system used
predictors to evaluate the reported numbers for errors and for _______.
a. violations of IFRS
b. breaches of contract
c. violations of the AICPA’s Code of Professional Conduct
d. violations of policies and procedures
67
Case 15.1
Scan the Table of Contents of the amended S-1 Registration Statement of Snap, Inc. filed with the SEC at
https://www.sec.gov/ on February 24, 2017 and accepted (Filed/Effective) on February 27, 2017. There
are some inconsistencies between these two dates as to the date filed and date accepted. See the image
below.
Snap’s February 24/27 submission consists of the S-1 document and all the exhibits and graphics. You
will need to switch between the original S-1 filing (February 2, 2017) and the S-1/A to access all the
exhibits. The “/A” means amended. You will also need to refer to some of the quarterly reports (10-Q
filings) of the company as filed with the SEC. Answer the questions that follow the Required heading.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 15.1, Snap
Registration Statement.
Required
1. The Snap submission includes the October 27, 2016 employment letter of CFO Andrew Vollero. What
is his annual salary, excluding the annual supplemental payment?
a. under $210,000
b. $210,000 to under $310,000
c. $310,000 to under $410,000
d. $410,000 to under $510,000
e. $510,000 and higher
2. Based on the filings, did Andrew Vollero hold a university accounting degree?
a. No
b. Yes
c. Do not use this option
d. Do not use this option
3. What is the name of the person who was the CFO of SNAP according to the 10-Q filed on October 23,
2019?
a. Timothy (Tim) Stone
b. Rebecca Morrow
c. Lara Sweet
d. Andrew Vollero
e. Derek Andersen
4. Refer to Exhibit A (the Pricing Exhibit) in Exhibit 10.20 (see original filing). What is the minimum
amount that Snap has agreed to pay Google each Discount Period for the initial term of 5 years? A
Discount Period is a 12-calendar-month period (see page 22).
a. under $210 million
68
b. $210 million to $310 million
c. $310 million to $410 million
d. 410 million to 510 million
e. over $510 million
5. Refer to the bylaws of the company and Article V that deals with officers. Read the section that refers
to the duties of the CFO. Complete the following sentence: The Chief Financial Officer, subject to the
order of the Board of Directors, will have the custody of ____________.
a. all of the funds and securities of the corporation
b. developing measures of performance
c. items in the lost and found office
d. the children in the company's day care facility during working hours
e. the CEO's security detail
6. Refer to the bylaws of the company and Article V that deals with officers. Read the section that refers
to the duties of the CFO. Complete the following sentence: The CFO shall render statements of the
__________ of the corporation in such form and as often as required by the Board of Directors.
a. tax returns
b. location
c. political leaning
d. financial affairs
e. employee morale
7. A. G. Lafley is a non-executive director of the company. When did A.G. Lafley join the board of
directors? (month and year)
a. July 2016
b. January 2016
c. July 2015
d. January 2015
e. February 2017
8. A. G. Lafley is a non-executive director of the company. Mr. Lafley is paid $200,000 cash per year to
cover what costs?
a. personal security detail
b. unexpected hospital visits
c. travel to meetings
d. director's liability insurance
e. a private office near Snap's headquarters
9. A. G. Lafley is a non-executive director of the company. Mr. Lafley was formerly the CEO of what
large public company?
a. Twitter
b. General Electric
c. Microsoft
d. General Motors
e. Procter and Gamble
69
10. What statement does the company make regarding the payment of cash dividends in the future?
a. Snap does not expect to declare or to pay any cash dividends in the near future
b. Snap expects to start paying dividends in 2020
c. Snap expects to start paying dividends in 2021
d. Snap expects to start paying dividends in 2020 on Evan Spiegel's stock only
e. Snap expects to declare a cash dividend in 2020, only payable in 2022
11. The MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND

RESULTS OF OPERATIONS section states that the company has a five-year senior unsecured revolving
credit facility that allows it to borrow up to _____ to fund working capital and general corporate-purpose
expenditures?
a. $11 million
b. $110 million
c. $510 million
d. $1.1 billion
e. $1.75 billion
12. Refer to the previous question on the five-year senior unsecured revolving credit facility. What is the
annual commitment fee in dollars in a year in which the zero dollars are actually borrowed against the
credit facility?
a. under $1 million
b. $1 million to under $2 million
c. $2 million to under $5 million
d. $5 million to under $10 million
e. $10 million or higher
13. What was Snap's street address on the date that the S-1 Registration Statement was filed?
a. 63 Market Street
b. 2772 Donald Douglas Loop North
c. 4080 Lafayette Center Drive
d. 523 Ocean Front Walk
e. 229 W 43rd Street
14. Snap’s first quarterly report as a public company was for the quarter ended on what date?
a. September 30, 2016
b. June 30, 2017
c. February 28, 2017
d. December 31, 2017
e. March 31, 2017
15. Snap’s revenue comes from three geographic segments (see page 69). Name the three geographic
segments.
a. North America, Europe, and rest of the world
b. USA, Canada, Mexico
c. North America, Japan, and rest of the world
70
d. USA, China, and India
e. China, USA, and Europe.
16. Which accounting firm was dismissed as Snap’s auditors (independent registered accounting firm) on
March 3, 2016?
a. PricewaterhouseCoopers LLC
b. Ernst & Young
c. Deloitte
d. KPMG
e. Goldman Sachs
17. Which accounting firm was appointed as Snap’s auditors in April 2016?
a. PricewaterhouseCoopers LLC
b. Ernst & Young
c. Deloitte
d. KPMG
e. Goldman Sachs
18. For the year ended December 31, 2014 the auditors identified material weaknesses that were the result
of a lack of sufficient qualified ___.
a. marketing vice presidents
b. supply chain professionals
c. accounting personnel
d. software engineers
e. employee benefits
19. Is there any direct or indirect reference in the S-1 filing to the risk of employee embezzlement? Note
that they might not use the exact words employee embezzlement in the filing.
a. No
b. Yes
c. Do not use this option
d. Do not use this option
20. The net cash used in operating activities for the year ended December 31, 2016 was $_____ million.
a. under 1
b. 1 to 200
c. 200 to 400
d. 400 to 600
e. over 600
71
Case 15.2
Access the 10-K of Snap, Inc. filed with the SEC (https://www.sec.gov/) on February 5, 2020.
All questions relate to the annual numbers. Answer the questions that follow the Required heading.
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 15.2, Snap Annual
Report 2019.
Required
1. The audit report is best described as ______.
a. an unqualified opinion
b. a qualified opinion
c. an adverse opinion
d. a disclaimer of opinion
2. The audit report refers to _____ critical audit matters

a. 1
b. 2
c. 3
d. 4
e. 5
f. 6
3. The change in accounts receivable is shown in parentheses in the cash flows from operating activities.
This relates to their accounts receivable balance that (a) increased, or (b) decreased over the year.
a. increased
b. decreased
c. do not use this option
d. do not use this option
4. The net loss shown on the statement of operations is a ___ percent decrease over the previous period.
a. less than 15
b. between 15 and 17.5
c. between 17.5 and 20
d. between 20 and 22.5
e. greater than 22.5
5. The net interest received amount was _____?

a. under $10 million
72
d. $14 million to $20 million
e. over $20 million
6. The total cash and cash equivalents and marketable securities amounted to ________.
a. under $0.5 billion
b. $.5 billion to $1 billion
c. $1 billion to $1.5 billion
d. $1.5 billion to $2 billion
e. over $2 billion
7. Use the annual numbers and a 360-day year. The days sales outstanding amounted to _______.
a. under 60 days
b. 60 to 80 days
c. 80 to 100 days
d. 100 to 120 days
e. over 120 days
8. The book value of the company as a whole is ______.

a. under $2 billion
b. $2 billion to $2.5 billion
c. $2.5 billion to $3 billion
d. over $3 billion
9. The book value per share of common stock is ________. Use the sum of the Class A, Class B, and
Class C shares outstanding as is shown on the last line of the cover page of the 10-K filing.
a. under $1.25
b. $1.25 to $1.45
c. $1.45 to $1.65
d. $1.65 to $1.85
e. $1.85 to $2.05
f. over $2.05
10. The accumulated loss on the balance sheet date is _____?

a. under $4.5 billion
b. $4.5 billion to $5 billion
c. $5 billion to $5.5 billion
d. $5.5 billion to $6 billion
e. over $6 billion
11. Refer to the Summary Compensation Table. The total compensation of the CFO was _______.
a. under $8 million
d. over $10 million
73
12. Refer to the Summary Compensation Table. The total compensation of the Chief Accounting Officer
was _______.
a. under $2 million
d. over $6 million
13. Refer to the Director Compensation Table. The total compensation of A.G. Lafley was _______.
a. under $250,000
b. $250,000 to $350,000
c. $350,000 to $450,000
d. over $450,000
14. Refer to Item 14. The total audit fees for the year amounted to ______.
a. under 5 million
b. $5 million to $6.5 million
c. $6.5 million to $8.0 million
d. over $8 million
15. Refer to Exhibit 10.21 (Rebecca Morrow). Her stated annual salary is $________ per year.
a. under $80,000
b. $80,000 to $180,000
c. $180,000 to $280,000
d. $280,000 to $380,000
e. over $380,000
16. Find the average Daily Active Users for the quarter ended December 31, 2019. Find the total revenue
for the year 2019. Assume a 360-day year. The average revenue per day per daily active user is $____.
a. under $0.010
b. $0.010 to $0.015
c. $0.015 to $0.020
d. $0.020 to $0.025
e. $0.025 to $0.030
f. over $0.030
74
Case 15.3
This case raises some issues with respect to executive pay and corporate governance. The questions
should be answered with reference to the corporate filings of Oracle (ORCL) on the SEC’s website
(https://www.sec.gov/).
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 15.3, Executive
Compensation.
Required
1. Access the Schedule 14A filing for fiscal 2018 of ORCL on the SEC’s website. The filing is called a
DEF 14A filing and it is dated September 26, 2018. Ignore the DEFA 14A (the first “A” here stands
for amended) filing on that same date. Locate the Director Compensation section that starts on page 14
and then the Fiscal 2018 Director Compensation Table in that section. Show a screenshot of this table
with its headings and ten rows of data, one row for each director.
2. Calculate the average of the ten Total ($) amounts shown in the far-right column. Round your answer
to the nearest dollar and for this part simply give the average amount in the format $xxx,xxx.
3. Use the Fiscal 2018 Summary Compensation Table on page 42 in the same filing. Prepare a neat table
showing the names of the five NEOs, their titles, and their 2018 total compensation. This table should
have a header row, five rows of data, and three columns (name, titles, and total 2018 compensation).
4. What does the abbreviation NEO stand for?
5. In 2018 Lawrence (“Larry”) Ellison was named to the Board of Directors of which well-known public
company in the business of manufacturing cars?
6. NEO Mark Hurd previously served as chairman, chief executive officer, and president of which well-
known public company?
7. Locate the CEO Pay Ratio section on page 49. What was the fiscal 2018 total compensation of the
company’s median employee? Give the amount in the format $xx,xxx.
8. The same CEO Pay Ratio section discloses the ratio of Mark V. Hurd’s total fiscal 2018 compensation
to the median employee’s annual total compensation. What was that ratio? Give the ratio in the format
x,xxx to 1.
9. Locate the fiscal 2015 Schedule 14A filing of ORCL on the SEC’s website. The filing is also called a
DEF 14A filing and it is dated September 25, 2015. Locate the Director Compensation for Fiscal 2015
section on page 17. Give the following two values: (a) The maximum total amount paid to a director,
and (b) the average total amount paid to a director.
10. Read the Wall Street Journal article at
https://www.wsj.com/articles/SB10001424052748703724104575379680484726298. The WSJ is a
subscription site and so you probably can only read the first paragraph, which is enough. Type the
statement “I accessed the article.”
11. Answer this requirement without any reference to the specifics of ORCL. Assume a situation where a
company’s executives are well-paid, and the board of directors are also well-paid. Each of those two
groups presumably approves each other’s total compensation. Does each group being well-paid open
them both up to questions of them being too cozy with each other?
75
CHAPTER 16
USING MICROSOFT ACCESS AND R FOR ANALYTICS

1. An Access database is a software program used for _______.
a. importing and analyzing data, and reporting information
b. collecting, storing, and importing data, and reporting errors
c. collecting, storing, analyzing, and exporting data
d. collecting, storing, and analyzing data, and reporting information
2. In Access data is stored in _________.

a. one or more tables
b. one or more modules
c. one or more macros
d. one or more worksheets
3. One goal in database design is to avoid storing duplicate information, also known as _________ data.
a. duplicate
b. secondary
c. redundant
d. dualistic
4. The first step in running a Benford’s Law test is to extract the first-two digits of the Amount using
Val(Left([Amount]*10000,2)). This type of query is called ______.
a. grouping records
b. creating a calculated field
c. filtering data
d. a parameter query
5. The second step in running a Benford’s Law test is to count how many times each possible first-two
digits combination occurred. This type of query is called ______.
a. grouping records
b. creating a calculated field
c. identifying duplicates
d. appending data
6. Chapter 1 discussed the valuable “IF” function in Excel. Access has an IIF function for a single IF
evaluation and a _____ function which allows for multiple IF evaluations.
a. MANYIF
b. IFAND
c. IIIF
d. SWITCH
76
7. Access allows users to neatly view and format the results of a query. This is done by using the Access
database object called a(n) _______.
a. form
b. module
c. report
d. switchboard
8. R is an open-source data analytics program with many advantages over other data analytics programs.
offerings. R _______.
a. runs on all the major platforms such as Windows, Linux, and macOS
b. runs on all the major platforms such as MS-DOS, Linux, and macOS
c. is programmed to run fastest on a Windows 8 computer
d. is limited to macOS which has the benefit of it running on all iPhone 11 models
9. An R _________ document can include descriptive text, R code, the data sources, and the results of the
tests.
a. ReportPlus
b. Documenter
c. Information
d. Markdown
10. Table 16.1 shows the R command “length(First)”. This command ______.
a. returns the number of decimals that each number in the vector First is formatted to display
b. returns the value of the first record of the vector currently being analyzed
c. calculates the number of elements in the vector First.
d. gives the number of characters in the word First including spaces
77
Case 16.1
There is a guidance video titled Forensic Analytics Second Edition, Guidance Case 16.1, Number
Duplications & Largest Subsets using R.
Required
1. This requirement is identical to a requirement in Case 5.1 except that you need to use R for the
analysis. The Rank and the First-Two fields are not required since the values for these fields can be
quite easily done in Excel, Use the latest versions of R and R Studio. Run the number duplication test
on the dollar amount of the checks. Some example code is shown on page 152. For this requirement
show your R code until the part where the number duplications are calculated.
2. For this requirement show the code where you write the results to a .csv file.
3. For this requirement show the first 15 rows of your results in the .csv file with $ Amount, and Count as
headings as is shown in Figure 5.5.
4. Use the latest versions of R and R Studio. Sort the check amounts in the Excel file from largest to
smallest (that is, descending). Show a screenshot of the ten largest check amounts. Display the top 10
amounts in R as opposed to writing them out to a .csv file. The command to display the Top 3 results
is shown in row 25 of Table 16.1.
5. This requirement is identical to a requirement in Case 6.1 except that you are required to use the latest
versions of R and R Studio for the analysis. Run the largest subsets test on the vendors using
VendorName as the subset field and Amount as the field to sum. To keep matters simple treat the
negative amounts as “negative” payments. In other words, they are to be subtracted from the sum of
the positive amounts for those vendors. So, a vendor with 18, 18, -5 will have a total of 31. Some
example code is shown on page 179. You should be able to add this part on at the bottom of your
existing R code for requirements (1) to (4). Show a screenshot of the R code used to calculate the
totals per vendor.
6. Show a screenshot of your first ten rows of data as shown in the R studio console.
7. Show a screenshot of the first 10 rows of your results in the .csv file with VendorName and
TotalAmount as headings.
8. Do the Top 10 results in (6) and (7) above agree with the vendor totals calculated in Case 6.1?
78
CHAPTER 17
CONCLUDING NOTES ON FRAUD PREVENTION AND DETECTION

1. In court the prosecutor and the defense attorney pit their wits against each other in a(n) ______ process.
a. constitutional
b. rulemaking
c. plaintiff
d. adversarial
2. The courtroom oath to "tell the truth, the whole truth and nothing but the truth" only applies to ______.
a. jurors
b. witnesses
c. the grand jury
d. trustees
3. Timothy Provost’s fraud scheme can best be described as __________.

a. corruption
b. financial statement fraud
c. asset misappropriation
d. grand larceny
4. Proof _____ is the legal standard that the prosecutor must satisfy to obtain a guilty verdict against a
criminal defendant.
a. by a preponderance of the evidence
b. by clear and convincing evidence
c. within a reasonable doubt
d. beyond a reasonable doubt
5. After conviction and sentencing, the defendant has the right to _________.
a. an open and public trial
b. the assistance of counsel
c. subpoena a witness that had been granted immunity
d. appeal their sentence
6. The _______ defense is linked to the fact that after a certain time period has passed the courts lack the
authority to try or to punish a defendant.
a. statute of lastingness
b. statute of limitations
c. date of conclusions
d. discontinuation of litigation
79
7. The economics of crime model is set out in terms of the satisfaction received from consuming a good
or service, this satisfaction is referred to as the expected _____ of the individual.
a. treasure
b. reward
c. resources
d. utility
8. A system of independent checks means that if people know that their work or activities will be
monitored by others, their ability to successfully _______ a fraud will be limited.
a. conceal
b. convert
c. monitor
d. report
9. The result of a company-wide fraud risk assessment is ______.

a. the arrest of several employees
b. given to the grand jury in secrecy
c. evaluated by the external auditors before being submitted to the SEC
d. a report that identifies fraud threats
10. Management’s commitment to openness, honesty, integrity, and ethical behavior is an important part
of the ________ environment.
a. political and legal
b. social and cultural
c. control
d. extraordinary
80
Case 17.1
Read the article published in the August 2014 issue of the Journal of Accountancy titled "Lessons from an
$8 million fraud" by Mark Nigrini and Nathan Mueller. The article can be accessed by searching for Mark
Nigrini at https://www.journalofaccountancy.com/. Answer the questions that follow the Required
heading.
Required
1. A high school friend of Nathan Mueller remembers that Mueller’s family was/were ______.
a. very supportive during his court trial
b. all members of the ACFE
c. always on a tight budget
d. originally from Las Vegas
2. Mueller found himself employed at a multinational company as a result of _______.

a. his fluency in Dutch
b. a takeover
c. his being on the external auditor’s audit team
d. an internship there during his undergraduate degree
3. Mueller discovered, quite by accident, that he had the ability to _____ checks up to $250,000.
a. print
b. remove
c. improve
d. approve
4. Extensive personal debts and a new child provided the _____ for the first phase of the fraud.
a. opportunity
b. rationalization
c. internal control weakness
d. pressure
5. One of the steps that Mueller used to conceal his fraud was to _____ the U.S. dollar value of the
income from their Canadian investments.
a. misclassify
b. omit
c. understate
d. overstate
6. An effective anti-fraud program would include ______ detection activities.

a. proactive
b. conservative
c. attractive
d. interpretive
7. ______ controls restrict the access of authenticated users to certain classes of information and
capabilities.
81
a. correction
b. authorization
c. validation
d. cancellation
8. The article suggests that the largest subsets ____ test should have been run on the Ace vendor.
a. decline
b. both
c. growth
d. improvement
9. A co-worker living beyond what his or her salary should allow is a classic _____ for fraud.
a. red fire
b. red flash
c. red tag
d. red flag
10. Companies need to carefully control who has permission to add new ____ to the payments system.
a. passwords
b. employees
c. projects
d. vendors
11. An organization's hiring policy should include past employment verification, a background check, a
credit check, and _____
a. education verification
b. a lunch-time social event
c. a salary comparison
d. a religious affiliation questionnaire
12. During Mueller's time in prison he paid off his restitution at the rate of ____ a month through a
repayment program.
a. $100
b. $300
c. $75
d. $250,000
13. Look up Nathan Mueller’s details on the Find an Inmate page of the website of the Federal Bureau of
Prisons (https://www.bop.gov/). Nathan was released from prison in ______.
a. 2013
b. 2014
c. 2015
d. 2016
14. Nathan Mueller’s fraud scheme can best be described as __________.

a. corruption
82
b. insurance fraud
c. asset misappropriation
d. forgery
15. Nathan states that, “In our small accounting department, we knew everyone else’s system passwords.
This was a practical workaround for when we needed to get something done when someone was out of the
office. We often logged on as someone else to get the job done.” What analytics tests could you run on
network data to test whether employees are logging on as someone else to “get the job done.” Assume
that the system logs include, amongst other things, logon (or login) times and dates and the IP address of
the logon.
83
Case 17.2
Read the criminal complaint related to the Vance Pearson fraud case. The document is
17_VancePearson_CriminalComplaint. The document is numbered #1 in the court records of his fraud
case. Answer the questions the follow the Required heading.
Required
1. On the last page the document is signed by Special Agent ____.
a. Andrew Donohue
b. David R. Grand
c. Vance Pearson
d. J. Edgar Hoover
2. The defendant is alleged to have violated _____ code sections.

a. 1
b. 2
c. 3
d. 4
e. 5
f. 6
3. There are ____ tables are in the criminal complaint. For the definition of a table see Wikipedia’s Table
(Information) page.
a. 1
b. 2
c. 3
d. 4
e. 5
f. 6
4. The UAW's headquarters are in _____.

a. Detroit, Michigan
b. Palm Springs, California
c. Dallas, Texas
d. New York, New York
e. Hazelwood, Missouri
5. The UAW holds elections every _____ years to elect its officers
a. 1
b. 2
c. 3
d. 4
e. 5
f. 6
6. The New Year's Eve dinner mentioned in paragraph 30 (a) included four bottles of _____.
a. Louis Roederer Cristal
84
b. Macallan 18-year old
c. Perrier water
d. Sutter Home White Zinfandel
e. Bud Lite
7. The ethical practices code of the union states that no officer or representative shall accept "kickbacks",
under-the-table payments, valuable gifts, _____, or any personal payment of any kind.
a. lavish entertainment
b. Italian sports cars
c. free tuition
e. hotel room upgrades
f. rounds of golf
8. The abbreviation CW used in the criminal complaint refers to _____.

a. consistent with
b. chicken wings
c. conventional wisdom
d. country & western
e. cooperating witness
9. The document that prescribes the financial procedures and approval procedures for the union is called
the ____.
a. Code of Ethics
b. Financial Officers Manual
c. CFO Guidance Document
d. Union Governance Document
e. Audit Committee Charter
10. The Region 5 Conference typically lasted for 3 to 5 days. Union officials would spend weeks and/or
months in _____ enjoying an extravagant lifestyle.
a. Miami
b. Phoenix, Arizona
c. Palm Springs
d. Hawaii
e. Las Vegas
11. The UAW had a(n) _____ arrangement with the Renaissance Palm Springs Hotel. This allowed the
UAW to deposit funds up front and then to use those funds for various expenses.
a. line of credit
b. overdraft
c. titanium elite
d. master account
12. The Region 5 conference typically lasted for ______.

a. a Saturday morning
b. four days
85
c. two weeks
d. two months
13. An LG Prime Steakhouse receipt from January 5, 2017 included details of the purchases of eight
bottles of Duckhorn 3 Palms merlot at ____ per bottle.
a. $12
b. $18
c. $22
d. $180
14. The criminal complaint refers to 16 boxes of Diamond Crown Churchills at $243 per box totaling
$3,888. The content of the boxes was _____.
a. laser pointers for presentations
b. cigars
c. refreshments for the mid-morning breaks
d. name tags for the attendees
15. The criminal complaint refers to a similar arrangement with a Four Seasons hotel in the Lake Ozarks
region. Their examples of expenses included a Titleist 917 driver purchased on October 26, 2016 for
$529.86. That item was ______,
a. a shuttle service for trips to the airport
b. a noticeboard placed outside a concurrent session
c. a public speaking trainer
d. a speech teleprompter
e. a golf club
86
Case 17.3
On October 9, 2018 Michael Sorrentino was sentenced to 8 months in prison, fined, and subjected to two
years of supervised release for income tax evasion at the federal level. Read the superseding indictment
17_MikeSorrentino_Indictment dated April 7, 2017. Answer the questions that follow the Required
heading.
Required
1 Michael Sorrentino (“Sorrentino”) was a reality TV star whose television show aired on the ___
network.
a. TLC
b. C-SPAN
c. MTV
d. Comedy Central
2. For tax years 2010, 2011, and 2012 the two defendants earned approximately _______ million in gross
income.
a. 1.0
b. 2.0
c. 8.9
d. 9.8
3. The U.S. Return of Partnership Income form is Form _____.

a. 1040
b. 1065
c. 2020
d. C
4. Financial institutions are required to file (a) ______ for monetary transactions involving cash
exceeding $10,000.
a. financial statements
b. Form 8-K
c. deposit slips
d. currency transaction reports
5. Michael Sorrentino did not file a ______ for tax year 2011.
a. Form 1040
b. Form 10-K
c. Social security declaration
d. Change of Address form with the USPS when he went to the Jersey Shore
6. In the table shown on pages 11 and 12, the deposit of $_____ is the closest to the amount that will
trigger a currency transaction report (“CTR”).
a. 9,900.00
b. 9,987.00
c. 9,500.00
d. 9,448.10
87
7. Michael Sorrentino filed a false and fraudulent Form 1040 for the tax year 2012 on what date?
a. April 15, 2013
b. July 15, 2013
c. September 13, 2013
d. November 6, 2013
e. December 31, 2013
8. Counts 4-12 state that Michael Sorrentino filed false and fraudulent tax returns that ______ deductions.
a. overstated and mischaracterized
b. understated
c. itemized
d. ignored
9. Counts 4-12 state that Michael Sorrentino filed false and fraudulent tax returns that ______ gross
receipts.
a. overstated
b. itemized
c. ignored
d. understated
10. Count 14 can be summarized as _________.

a. used the mail to carry out their embezzlement scheme
b. used a fax machine to send a signed document
c. added himself as a payee on a check
d. fictitious journal entries were made in the QuickBooks records
An optional addition essay question is to contrast this case with the Richard Hatch tax evasion case.
Topics that are relevant is the amount of income tax evaded, plea agreements, the prison terms, the level
of appeals, and the cash deposits to the bank accounts.
88
IDEA-BASED CASES
IDEA Educational Version

Register as a professor and register your class at, https://academicportal.casewareanalytics.com/
After your class is approved (usually in a matter of hours) the educational version is available for
download by the professor and the students by clicking, View Course.
There is a welcome e-mail that gives students the required codes to access the portal.
The four IDEA cases start on the next page.
89
IDEA Case 1
Use the 2_Somerville_Sample Excel data file that contains payments data for 2013 to 2016 for the City of
Somerville in Massachusetts. Somerville is a city with a population of 80,000 people and it is located two
miles north of Boston and occupies 4 square miles. This data file contains a sample and it has 4,999
records (check payments) and a header row because the IDEA Educational version can only process 5,000
records. Assume that the check amounts equal to $0 (if any) were checks that were lost in the mail and
that were later reissued for the correct amount. Do not treat them as missing values. Use the latest
educational version of IDEA. This is available from the IDEA Academic Portal at
https://academicportal.casewareanalytics.com/. Show your screenshots or text for the requirements.
Edited data set source accountingintheheadlines.com/ (thank you Professor Wendy Tietz, Kent State
University). Original source www.somervillema.gov/.
Data Dictionary
There is a guidance video Forensic Analytics Second Edition, IDEA 1, Calculations, Summarization,
Field Stats, & Benford’s Law.
Required
1. Read Section 1 of the IDEA Data Analysis workbook which ends on page 23. The workbook is
available from the IDEA Academic Portal at https://academicportal.casewareanalytics.com/. The
document has also been posted in our IDEA-related items folder. For this requirement type “I read
Section 1 of the IDEA Data Analysis workbook.”
2. Import the Somerville Sample into IDEA. For the Output file name option change the default from
2_Somerville_Sample to Somerville. Show a screenshot of your first ten rows of data and only the
leftmost four fields ID, GovCategory, VendorName, and Amount.
3. Create a table of the monthly (January to December) totals for the invoices. There should only be 12
totals, one total for each month in a year. The total for January should be the total for all four Januaries
in the data (2013, 2014, 2015, and 2016), and so on for February to December.
4. Which month of the year (January, February, …, December) has the highest total over the four-month
period? Simply type the name of the month for this answer.
5. Prepare an abbreviated table of descriptive statistics for the payments data using Table 2.1 as a guide.
90
There is no need to include a Notes field in the table. The abbreviated table is shown below.
2013-2016
Sum $
Number of Records
Mean $
Median $
Mode $
Minimum -$
Maximum $
Skewness
(Insert answers to the right of the $ signs. Copy the completed table to your submission document)
6. The mean (average) of the complete data set (all 55,746 payments) is $12,144.64. Would you expect
the average of the sample to equal this amount? If not, would you expect it to be higher or lower?
7. The mode of the complete data set (all 55,746 payments) is $135.00. What is the mode of the
Somerville sample?
8. Would you expect the mode of the sample to equal this amount? If not, would you expect it to be
higher or lower?
9. Run the first digit test on the data. Show a screenshot of your first digit graph.
10. What level of conformity does the data have to Benford’s Law? Use the first digits mean absolute
deviation (MAD). You answer is either close conformity, acceptable conformity, marginally
acceptable conformity, or nonconformity.
11. Run the first-two digits test on the data. Show a screenshot of your first-two digits graph.
12. What level of conformity does the data have to Benford’s Law? Use the first-two digits mean
absolute deviation (MAD). You answer is either close conformity, acceptable conformity, marginally
acceptable conformity, or nonconformity. Note that the conclusions drawn from the two graphs can
differ.
13. Identify the first-two digits (10, 11, …, 99) that have the three largest spikes on the first-two digits
graph. A spike occurs when the actual proportion exceeds the expected proportion. Note again that a
spike occurs when the actual proportion exceeds the expected proportion.
14. Did you expect the check payments data to conform to Benford's Law? Give reasons.
15. Review the Case Submission Checklist document and type a statement as follows “I reviewed the
case submission checklist before submitting this assignment.”
91
IDEA Case 2
Use the 1_CensusData_2010 data file that contains a state abbreviation, the FIPS code that uniquely
identifies each county, the county name, the area of the county in square miles, and the county population
numbers from the 2010 census (People_2010). The file contains a header row and data for the 3,143
counties and county equivalents in the US .

Create a Word document and then create a heading with your name and “Quiz 2” and for each of the
requirements show one or more screenshots or type the answer that shows that you have done the task
correctly. Use IDEA for all the requirements.
The title of the guidance video is Forensic Analytics Second Edition, IDEA 2, Import, Sample, Top
Records, Benford, & Calculated Field.
Required
1. Import the census data into IDEA. For the Output file name option change the default from
1_CensusData_2010 to Census. Show a screenshot of the name of the table (which should be Census-
People2010), the first eight rows of data and all five fields. The name of the table should be the Output
file name entered when using the import wizard, followed by a hyphen (-), and then followed by the
name of the worksheet in the Excel file that was imported.
2. Use the Field Statistics option. Give the following amounts, (a) the number of records, (b) the total
number of people in all the counties, (c) the minimum county population number, and (d) the
maximum county population number.
3. Use the Analysis→Extract→Top Records routine to identify the eight counties with the largest
populations. Show a screenshot of the five fields for the largest eight counties.
4. Use the Analysis→Sample→Random routine to extract a random sample of eight counties. Use the
random number seed “582” without the quotes. Leave the Allow duplicate records option unchecked.
Show a screenshot of the five fields for your sample of eight counties.
5. Use the Analysis→Explore→Benford’s Law routine to run the first digit test on the data. Show a
6. What level of conformity does the data have to Benford’s Law? Use the mean absolute deviation
(MAD) of the first digits. You answer is either close conformity, acceptable conformity, marginally
acceptable conformity, or nonconformity.
7. Use the Data→Fields→Append routine to create a calculated field SQMILE which calculates the
number of people per square mile in the county. The field will be a virtual numeric field. Set the
accuracy at 2 decimals. The formula to use is PEOPLE_2010 / AREA. Show a screenshot of the first
eight rows of your Census-People2010 table which should now have six fields. The SQMILE field
should have the amounts displayed to two decimal places.
8. Review the Case Submission Checklist document and type a statement as follows “I reviewed the case
submission checklist before submitting this assignment.”
92
IDEA Case 3
Use the 1_CensusData_2010 data file that contains a state abbreviation, the FIPS code that uniquely
identifies each county, the county name, the area of the county in square miles, and the county population
numbers from the 2010 census (People_2010). The file contains a header row and data for the 3,143
counties and county equivalents in the US .

Use the 1_CensusData_2000 data file that contains the county population numbers from the 2000 census
in the field People_2000 where needed.
Import the 2 census data files into IDEA. For the Output file name options change the defaults from
1_CensusData_2010 to Census and from 1_Census_2000 to Census.
Use the CensusDataReceived data file that contains the same fields as the 1_CensusData_2010 data file
but that has fewer records where needed. That is, some of the records in the source data file have been
lost. Or stated differently, CensusDataReceived is a subset of 1_CensusData_2010. Import the
CensusDataReceived data file into IDEA. For the Output file name options change the default from
CensusDataReceived to Received.
Create a Word document and then create a heading with your name and “Quiz 3” and for each of the
requirements show one or more screenshots or type the answer that shows that you have done the task
correctly. Use IDEA for all the requirements. Import the data files into IDEA when needed.
The title of the guidance video is Forensic Analytics Second Edition, IDEA 3, Duplicates, Calculated
Fields, and Joins.
Required
1. Use the Analysis→Explore→Duplicate Key→Detection routine to identify the seven states that have
two counties with the same 2010 population numbers. For example, Iowa has two counties each with
16,667 people (Linn County and Dickinson County). Each duplicate will be shown on two lines and
your results will therefore be shown on 14 lines (2 lines for each of seven duplicates). Your results
should show the State abbreviation (such as IA), the county names, and the population numbers that
were duplicated. Your results should be sorted by state abbreviation (such as IA) ascending (A to Z).
The Iowa results are shown as a clue below:
2. Go back to your results in (1) above. Change the format of the numbers in the PEOPLE_2010 field to
include the thousands separator. This would change the IA numbers to 16,667.
3. Calculate the population change for each county from 2000 to 2010. If a population number was 1,983
in 2000 and 2,083 in 2010 then the change would be 100. There are 3,143 counties and so there will be
3,143 changes. The changes could be positive numbers (most of the counties), zero, or negative
numbers if the population decreased. Show the State, the Name, People_2000, People_2010, and the
93
Change in your results. Sort your results by Change descending. Show a screenshot of the eight largest
changes. As a check, the largest change was for Maricopa with an increase of 744,968 people.
4. Calculate the population totals for each state and the District of Columbia for both 2000 and 2010.
Name these fields TOTAL2000 and TOTAL2010 respectively. Your two new data sets will each have
51 total population numbers, one for each of the 50 states, and one for DC. Calculate the population
change for each state from 2000 to 2010. So, if a population number was 198,300 in 2000 and 208,300
in 2010 then the change would be 10,000. There are 51 states and so there will be 51 changes. The
changes could be positive numbers (most of the states), zero, or negative numbers if the population
decreased. Show the State, TOTAL_2000, TOTAL_2010, and the Change in your results. Sort your
results by Change descending (Largest to Smallest). Show a screenshot of the eight largest changes.
As a check figure, the largest change was for Texas with an increase of 4,293,741 people.
5. Use the table with the 2010 county populations (3,143 records). Use the Analysis→Extract→Direct
routine to extract all the records where the county populations are greater than or equal to 2,000,000
people. Show a screenshot of your results. Sort your results by the population numbers descending.
Your results should show the State, Name, and People_2010 fields for those 12 counties.
6. Assume a hypothetical situation where a university researcher asks the Census Bureau for the data file
with the 2010 county populations. A Census Bureau employee sends the 1_CensusData_2010 file.
The file that the researcher receives is the CensusDataReceived file. That file is incomplete because 14
records have been lost. Use IDEA to ascertain which records were lost in the transmission. Show a
screenshot of the “sent but not received” records. Show all the fields in your screenshot, namely State,
FIPS, Name, Area, and People_2010.
94
IDEA Case 4
Use the 2_Somerville_Sample Excel data file that contains payments data for 2013 to 2016 for the City of
Somerville in Massachusetts. Somerville is a city with a population of 80,000 people and it is located two
miles north of Boston and occupies 4 square miles. This data is a sample and it has 4,999 records (check
payments) and a header row because the IDEA Educational version can only process 5,000 records.
Assume that the check amounts equal to $0 (if any) were checks that were lost in the mail and that were
later reissued for the correct amount. Do not treat them as missing values. Use the latest educational
version of IDEA available from the IDEA Academic Portal at
https://academicportal.casewareanalytics.com/. Show your screenshots or text for the requirements.
Edited data set source accountingintheheadlines.com/ (thank you Professor Wendy Tietz, Kent State
University). Original source www.somervillema.gov/.
Data Dictionary
There is a guidance video Forensic Analytics Second Edition, IDEA Case 4, Summarization, Date
Calculations, and Joins.
Required
1. If you have previously imported the Somerville Sample data, go to the File Explorer section on the
left and delete the Somerville Sample table and all its related tables. You can do this by highlighting
the table and then using a right click and Delete, or you can use the Delete icon just under the words
File Explorer. Note that IDEA calls a table a database and related tables are called “child databases.”
For this requirement type “I deleted any Somerville tables that were in the File Explorer section.”
2. Import the Somerville Sample into IDEA. For the Output file name option change the default from
2_Somerville_Sample to Somerville. Show a screenshot of the name of the table (which should be
Somerville-CheckBook), the first eight rows of data and only the leftmost four fields ID, GovCategory,
VendorName, and Amount.
3. Use the Analysis→Visualization→Discover routine. Show a screenshot of the graph titled
Somerville-CheckBook: Count of records by CHECKDATE (STRATIFIED).
4. Refer to your answer in (3) above. In a single sentence, using easy to understand language, explain
what was graphed.
95
5. Scan the visualization results from (3) above. The results at the top of the page include the number of
negative records for the Amount field. How many negative amounts are in the data?
6. Review the Somerville-CheckBook: Sum of AMOUNT and Count of records by GOVCATEGORY
graph. Which GOVCATEGORY has the largest record count – General Government, Education, or
Public works?
7. See the Comments section (bottom right-side of the IDEA screen). There is a message “Database has
been truncated. Maximum number of records has been reached.” Is the first sentence in the message
correct? Have we lost some records because the table exceeded the educational version’s capacity?
8. Delete the comment in (7) above in IDEA. Show a screenshot of the Comments area (bottom right-side
of the screen) which should now be blank.
9. Use the Data→Search→Search routine to find all the payments to a vendor whose name includes
“Kevin Klein” (without the quotes). Create a table of these four transactions. Show a screenshot of
these four transactions.
10. Use the Analysis→Extract→Direct routine to find all the payments made on July 1, 2013. Create a
table of these eight transactions. Do not include the OrgDescription and AcctDescription fields in your
table. Show a screenshot of these eight transactions.
11. The data dictionary states that the ID field exists to identify each field uniquely. Use the
Analysis→Explore→Duplicate Key routine to identify any duplicate IDs. Do not include the
OrgDescription and AcctDescription fields in your results table. Does the data contain duplicate ID
values? If yes, then show a screenshot of the first 8 rows of your results.
12. Use the Dow (which abbreviates day of the week) function to create a Virtual Numeric field
(DayWeek) where Dow is based on the CheckDate field. The first CheckDate in the table is 1/2/2013
(which was a Wednesday) and for that date your DayWeek result should be 4. Hide the
OrgDescription and AcctDescription fields. Show a screenshot of the first 8 rows of your results
which should include the new DayWeek field.
13. Use the Analysis→Categorize→Summarization routine to count the number of checks paid on each
day of the week (your DayWeek field created in (12)). Were any checks dated on a Saturday or a
Sunday? Show a table of your results.
14. If a vendor was paid (say) $5,000 by check number 1805 of which $3,000 was for one category of
expense and $2,000 was for another category of expense then the table would show check number
1805 twice, once for $3,000 and once for $2,000. Use the Analysis→Categorize→Summarization to
identify the four check numbers were used to pay five categories of expenses. In other words, the table
shows that these check numbers were used five times each. Show a screenshot of your results.
15. Use the Analysis→Relate→Join routine to identify the five payments made with each of the four
check numbers. Sort your results by check number ascending. Show a screenshot of the first ten rows
of your results. Show all the fields that are visible without scrolling to the right.
96
Concluding Case (Fraud Numbers)
“Nigrini, M. 2019. The patterns of the numbers used in occupational fraud schemes. Managerial Auditing
Journal 34 (5): 602-622” reviews and summarizes the patterns of the numbers used in embezzlement,
corruption, and financial statement fraud schemes. Read the article and answer the questions below the
Required heading. For eight or nine of the questions the answer cannot be found in the published article.
Those questions require an understanding of what was written. Your strategy should be to do a little extra
reading (perhaps using Google) on the topic that is the subject of the question.
Required
1. An employee that diverts an organization’s assets for their personal gain is an example of _____.
a. mail fraud
b. asset misappropriation
c. corruption
d. financial statement fraud
2. Paragraph 2.1 notes that AOL padded its advertising revenue by paying inflated prices to vendors with
a side agreement that the vendor would purchase online advertising for the amount overpaid. The net
effect on AOL’s net income was that their net income was _____.
a. correctly stated
b. inflated
c. understated
d. converted from a small loss to a large gain
3. Paragraph 2.1 notes that in one fraud scheme the controller capitalized labor of $104,000 and overhead
of $265,000 to Work in Process. The Work in Process account is reported in the financial statements
as a ______.
a. Cash flow from investing activities
b. Cost of sales
c. Current liability
d. Current asset
4. Paragraph 2.1.1 shows a formula that can be used to calculate notable round numbers. If the largest
value in a data set was $87,559,264 then the notable round numbers would be those amounts that were
evenly divisible by ______.
a. $1,000,000 or $500,000
b. $10,000,000 or $5,000,000
c. $8,755,926
d. $1,000,000 or $2,000,000
97
e. $100,000 or $200,000
5. The round numbers test can generate many false positives. In this context a false positive means ____.
a. an error in which a test result improperly indicates no presence of a condition when it really is present.
b. an authentic but flexible test result
c. a result that shows that something is present when it really is not
d. an imprecise measurement using the metric system
6. In the context of fraud numbers the reason for rapidly rising numbers (or totals) is because, loosely
speaking, fraudsters don’t know when to stop. This could give rise to payments to fictitious vendors
showing a(n) _____ growth pattern over time.
a. arithmetic
b. logistic
c. symmetric
d. geometric
7. The rising numbers test could generate an audit sample that is impractical to manually review for an
organization with many vendors, employees, or loyalty program members. This is because ____.
a. the number of records in the audit sample is too large for the personnel hours available
b. the source documents are usually housed in a remote location
c. the supporting information is encrypted
d. the audit team needs a HIPAA release for every employee on the list
8. Paragraph 2.3 states that threshold numbers are numbers that are a level, point, or numeric value at
which something is true. Choose the best example of a threshold number from the options below.
a. The number of employees with company purchasing cards
b. The number of loan applications denied by a regional bank
c. A company’s car insurance deductible is $500
d. The number of Form 10-K forms filed by a specified company (e.g., SNAP or ORCL)
9. Carslaw showed that corporate earnings tend to be rounded-up above cognitive reference points. Using
his mathematical formula in paragraph 2.3 an example of such a cognitive reference point is ____.
a. 3.14159 (π)
b. 5,000,000
c. 2020
d. 5:00 p.m.
10. In the graph in Figure 1 (A) the x-axis shows that the first-two digits range from 10 to 99. How many
possible first-two digit combinations are there? In other words, how many bars are in the graph?
a. 90
b. 99
c. 100
d. 109
98
11. In paragraph 2.3 the discussion of the fraud scheme related to Figure 1 talks about the perceived
threshold of 106. That amount, when written out in base-ten numerals is _____.
a. 60
b. 106
c. 100,000
d. 1,000,000
12. The discussion of threshold numbers in paragraph 2.3.1 includes a note on qualitative aspects of
materiality. The PCAOB oversees the external audits of _____.
a. private companies
b. public companies
c. both private and public companies
d. both public companies and professional corporations
13. The HealthSouth fraud was made possible, in part, because their external auditors only tested journal
entries that were ____.
a. posted on dates that were before the Excel-to-PeopleSoft interface
b. equal to or greater than $5,000
c. related to the major categories on the income statement
d. posted to the general ledgers of the 1,500 facilities
14. The HealthSouth fraud was the topic of an Oversight and Investigations subcommittee hearing. A
congresswoman questioned the company’s external auditors about the number of confirmation letters
that were sent out. In this context conformation letters refer to _____.
a. a letter from the auditor to the audit client accepting the audit engagement
b. a letter from a prospective supplier validating an oral agreement
c. a letter from the controller to the facility controller asking if they accept the PeopleSoft journal entries
d. a letter from a bank to the external auditors confirming a bank account’s balance
15. Paragraph 2.4.1 states that occupational fraud involves deception and that running tests based on
intuition-based heuristics is unlikely to identify fraudulent transactions. In this context heuristics
means _____.
a. based on the use of representative random samples
b. based on the use of stratified random samples
c. based on trial-and-error methods
d. based on fraud risk assessments
16. The situation envisioned with the use of repeated numbers in an occupational fraud scheme is one
where someone with accounting authority _____.
a. sends a customer two checks, each for exactly one-half of the amount purchased
b. deposits a customer’s check twice into the company’s bank account
c. sends a supplier two checks, each in full payment of a single invoice
99
d. sends a customer two checks, each for exactly double of the amount purchased
17. Michael Hoffner bought credit card numbers online and then he processed sales transactions at his
neighborhood bar as if the real owner of the credit card had walked in and bought drinks and perhaps
food or snacks. A review of the fraud numbers showed that for a little over half of the fraudulent
charges _______.
a. the amounts were round multiples of $100
b. the amounts were just below the reporting requirements for cash deposits
c. the last digit was either an 8 or a 9
d. he used the same Navy Federal credit card
18. In a petty cash imprest system, the bi-weekly replenishment checks should equal _____.
a. the total amount spent during the two-week period
b. the total amount spent during the two-week period, plus the estimated amount for the next period
c. the total amount spent during the two-week period, minus the beginning balance
d. the total amount spent during the two-week period, plus the desired ending balance
19. With reference to paragraph 2.7 assume that a company had net income available to common
stockholders of $1,805 and that its weighted-average number of common shares outstanding for the
period was equal to 19,060. The basic EPS would be $0.0947 which would be rounded down and
reported as $0.09 on the income statement. If the company desired a basic EPS amount that would be
rounded-up to $0.10, it would need to ______.
a. fraudulently increase the numerator
b. fraudulently decrease the numerator
c. omit reporting the basic EPS amount and only report the diluted EPS amount
d. calculate the basic EPS amount using the median-average number of common shares outstanding
20. The concluding comments in paragraph 3 includes a brief note on the Harriette Walters fraud scheme
and two references to revenue variances. In this context the word variance refers to _____.
a. the revenue trends
b. the difference between the budgeted and actual amounts
c. the revenue approval limits
d. official dispensations from building regulations
Use the Answer Sheet on the next page. Complete and send only the answer sheet to the instructor by the
due date.
100
Name: Date:
Question Answer* Question Answer*

1 11
2 12
3 13
4 14
5 15
6 16
7 17
8 18
9 19
10 20
* Answer in Capital letters (A, B, C, D, or E)
101

End of Chapter Questions and Cases For

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

End of Chapter Questions and Cases For

Uploaded by

Copyright:

Available Formats

End of Chapter Questions and Cases

Mark J. Nigrini, Ph.D.

Version 1.00 dated June 18, 2020.

Copyright © 2020 by Mark J. Nigrini. All rights reserved.

A Note to Students ..................................................................................................................................... 2

Multiple Choice Questions

8. Graphs can be easily created in Tableau by dragging data fields to ___________ .

The chapter’s case is on the next page.

USING MICROSOFT EXCEL FOR FORENSIC ANALYTICS

Multiple Choice Questions

9. The components of analytics-based dashboards can best be described as ______.

The chapter’s case is on the next page.

THE INITIAL HIGH-LEVEL OVERVIEW TESTS

Multiple Choice Questions

7. In Access a query is run by _____.

The chapter’s case is on the next page.

BENFORD’S LAW: THE BASIC TESTS

Multiple Choice Questions

The chapter’s case is on the next page.

BENFORD’S LAW: ADVANCED TESTS

Multiple Choice Questions

4. We conclude that we have a statistically significant difference at a significance level of 5 percent

The chapter’s case is on the next page.

BENFORD’S LAW: COMPLETING THE CYCLE

Multiple Choice Questions

The chapter’s case is on the next page.

IDENTIFYING ANOMALOUS OUTLIERS: PART 1

Multiple Choice Questions

The chapter’s case is on the next page.

IDENTIFYING ANOMALOUS OUTLIERS: PART 2

Multiple Choice Questions

5. The three elements of any fraud scheme are ________.

The chapter’s case is on the next page.

IDENTIFYING ABNORMAL DUPLICATIONS

Multiple Choice Questions

The chapter’s case is on the next page.

COMPARING CURRENT PERIOD AND PRIOR PERIOD DATA: PART 1

Multiple Choice Questions

The chapter’s case is on the next page.

2012 2011 Change

COMPARING CURRENT PERIOD AND PRIOR PERIOD DATA: PART 2

Multiple Choice Questions

The chapter’s cases follow on the next page.

5. In Spring, 2001 Hatch was a speaker at ________.

8. In addition to tax evasion, Hatch was charged with _____.

12. Hatch was sentenced on May 16, 2006 by Judge _____.

IDENTIFYING ANOMALIES IN TIME-SERIES DATA

Multiple Choice Questions

4. Katherine Harrell’s fraud scheme involved ________.

The chapter’s cases are on the next pages.

SCORING FORENSIC UNITS FOR FRAUD RISK

Multiple Choice Questions

The chapter’s case is on the next page.

AN EMPLOYEE’S FRAUDULENT TAX REFUNDS

Multiple Choice Questions

10. After her arrest on November 7, 2007 Jayrece Turnbull ________.

The chapter’s cases are on the next pages.

A SUPPLIER’S FRAUDULENT SHIPPING CLAIMS

Multiple Choice Questions

7. The judge in Charlene Corley’s court case was judge ____________.

The chapter’s cases are on the next pages.

4. In the year prior to sentencing Corley had a position as a ______.

9. The fraud investigation included agents from ______.