Great Zimbabwe University

Munhumutapa School of Commerce

Department of Accounting and Information Systems

Course APPLIED forensic auditing

Course CODE MPAC521

Willard chivinda m216030

Due date 05 NOVEMBER 2022
Question 28 (40 marks) individual assignment.

a) Investigators have developed a variety of interrogation styles and techniques

over the years. The decision to choose one style over the other may depend on
many factors, including the personality of the suspect, the personality of the
interrogator, and the nature of the case.

Explain the most common styles of interrogation. (10 marks)

The Reid Technique of Interviewing and Interrogation for Investigators:

The Reid interrogation technique was developed in the 1950s by former Chicago police
officer and psychologist John E. Reid. It is the most popular interrogation technique in law
enforcement. The technique uses alternative themes justifying the crime or verbal aggression
to make a suspect uncomfortable and intensify the line of questioning.
Former Chicago police officer and psychologist John E. Reid created the Reid Technique in
the 1950s. It is mostly used in law enforcement in the United States. The Reid Technique
involves three major components factual analysis, behavior analysis interview, and
interrogation (nine-step process).

Factual Analysis
Law enforcement conducts a factual analysis of each suspect. The suspect's bio-social status,
opportunity to commit the crime, access to the crime, and behavior before and after the crime
are reviewed to develop motive and get a sense of the person's personality. A factual analysis
can provide insight into the probability of the suspect's innocence, guilt, and involvement,
which can be useful during the interrogation.
Behavior Analysis Interview
The behavior analysis interview (BAI) is a non-accusatory question and answer session with
the suspect. The questions asked include both background and investigative questions. The
purpose of the interview is to establish the suspect's normal verbal and non-verbal cues. The
interview includes behavior-provoking questions so law enforcement can observe the
suspect's reaction to help determine innocence or deception. The BAI builds a rapport with
the suspect and gives law enforcement information that aids in the formal interrogation
process.
Deception
An example of deception during an interrogation is law enforcement falsely claiming they
have DNA evidence when they do not. The use of deception is a generally accepted
technique, but it has a few limitations .Various studies concerning the ability to discern truth
from lying. For example, one frequent critic of the Reid Technique, law professor Richard
Leo, argues that extensive social science research has demonstrated that people are poor at
making accurate judgments of truth and deception in general, that the behavior cues police
rely on in particular are not diagnostic of deception, and that investigators cannot distinguish
truthful from false denials of guilt at rates significantly greater than chance, but instead
routinely make confidently held yet erroneous judgments.

PEACE METHOD

The method is called Preparation and Planning, Engage and Explain, Account, Closure and
Evaluate (PEACE). Under the PEACE method, investigators allow a suspect to tell his or her
story without interruption, before presenting the suspect with any inconsistencies or
contradictions between the story and other evidence. Investigators are prohibited from
deceiving suspects during an interview (Meissner et al., 11).

1. Preparation and Planning. Interviewers should create a written interview plan, focusing on

issues such as the objectives of the interview and the order of interviews.

2. Engage and Explain. The interviewers should engage the individual, including using active
listening to establish a rapport with him or her. The interviewers should explain the reasons
for the interview and its objectives.

3. Account. The interviewers should use appropriate questions and active listening to obtain
the interviewee's account of events.

4.Closure. This stage should be planned to avoid an abrupt end to the interview. Among other
things, the interviewers should summarize the person's account of events, allowing the person
to make clarifications and ask questions.
5. Evaluate. The interviewers should evaluate the interview to assess how the interviewee's
account fits with the investigation as a whole, determine if further action is needed, and
reflect on their performance.

KINESIC INTERVIEW

The Kinesic Interview method involves analyzing a person's behavior to assess deception.
The method has some similarities to the Reid Technique.

Kinesics is the study of nonverbal communication. During the analysis phase, the interviewer
uses several techniques to observe and analyze the subject's behavior to determine the
subject's truthful and deceptive behaviors or at least to determine those areas most sensitive
to the subject and, therefore, in need of further attention through verbal inquiry.
b)The Association of Certified Fraud Examiners has developed a model for categorizing
known frauds that it calls the fraud tree. Discuss the fraud tree giving examples in each
category (10 marks)

The fraud tree is a super helpful model for helping us make sure that our fraud brainstorming,
which is a required activity when you’re doing your due diligence for fraud, that you get
together with your team and brainstorm all the possible fraud risks. Some genuine of the
Fraud Tree has been conducted by M. Mosquera and A. Scifo (2004. Fraud cases tend to take
a great variety of forms. They depend on a number of factors, such as corporate governance
structure, internal control schemes, activities performed (production, commercial, financial,
investment, etc.), the expedience of persons committing fraud and others according audit
(Mackevičius, Bartaška, 2003, p. 39.
Key Branches Sub branches and Examples

Asset misappropriation 1. Cash thefts

Examples

Of cash on hand.

Fraudulent disbursements – Fictitious expenses.

Concealment of income related to receipt of cash

2.Inventory and all other assets

Examples

Theft of tangible and intangible property

Deliberately inappropriate use of tangible and

intangible property

2. Corruption 1. Bribery – Bid rigging

2. Extortion

3. Conflicts of interests – Purchases schemes

4. Illegal gratuities

3 Fraudulent financial statements 1.Financial

Examples

Falsification of documents and accounting records and

the illegal use thereof

Failure to enter the actually performed transactions

into accounting records

Entrance of actually unperformed transactions into

 accounting records

Illegal overstatement or understatement of assets

and/or revenues

Illegal overstatement or understatement of expenses

and/or liabilities.

2 Non Financial

Example – Internal documents

c)A computer forensics professional does more than turn on a computer, make a
directory listing, and search through files. Forensics professionals should be able to
successfully perform complex evidence recovery procedures with the skill and expertise
that lends credibility to a case.
Explain any 5 services which can be performed by a computer forensic professional (10
marks)
Data Seizure

Federal Rules of Civil Procedure let a party or their representative inspect and copy
designated documents or data compilations that may contain evidence. Your computer
forensics experts, following federal guidelines, should act as this representative, using their
knowledge of data storage technologies to track down evidence. Your experts should also be
able to assist officials during the equipment seizure process.

Data Duplication/Preservation

When one party must seize data from another, two concerns must be addressed: The data
must not be altered in any way, and the seizure must not put an undue burden on the
responding party. Your computer forensics experts should acknowledge both of these
concerns by making an exact duplicate of the needed data. Because duplication is fast, the
responding party can quickly resume its normal business functions. And, because your
experts work on the duplicated data, the integrity of the original data is maintained.
Data Recovery

Using proprietary tools, your computer forensics experts should be able to safely recover and
analyze otherwise inaccessible evidence. The ability to recover lost evidence is made possible
by the expert’s advanced understanding of storage technologies. For example, when a user
deletes an e-mail, traces of that message may still exist on the storage device or media.
Although the message is inaccessible to the user, your experts should be able to recover it and
locate relevant evidence.

Document Searches

Your computer forensics experts should also be able to search over 100,000 electronic
documents in minutes rather than days. The speed and efficiency of these searches make the
discovery process less complicated and less intrusive to all parties involved.

Media Conversion

Some clients need to obtain and interrogate computer data stored on old and unreadable
devices. Your computer forensics experts should extract the relevant data from these devices,
convert it into readable formats, and place it onto new storage media for analysis.

Expert Witness Services

Computer forensics experts should be able to explain complex technical processes in an easy-
to-understand fashion. This should help judges and juries comprehend how computer
evidence is found, what it consists of, and how it is relevant to a specific situation.

d)Explain the five rules of collecting electronic evidence which relate to properties that
evidence must have to be useful? (10 marks)

Admissible
This is the most basic rule and a measure of evidence validity and importance. The evidence
must be preserved and gathered in such a way that it can be used in court or elsewhere. Many
errors can be made that could cause a judge to rule a piece of evidence as inadmissible. For
example, evidence that is gathered using illegal methods is commonly ruled inadmissible.

Authentic

The evidence must be tied to the incident in a relevant way to prove something. The forensic
examiner must be accountable for the origin of the evidence.

Complete

When evidence is presented, it must be clear and complete and should reflect the whole story.
It is not enough to collect evidence that just shows one perspective of the incident. Presenting
incomplete evidence is more dangerous than not providing any evidence at all as it could lead
to a different judgment.

Reliable

Evidence collected from the device must be reliable. This depends on the tools and
methodology used. The techniques used and evidence collected must not cast doubt on the
authenticity of the evidence. If the examiner used some techniques that cannot be reproduced,
the evidence is not considered unless they were directed to do so. This would include possible
destructive methods such as chip-off extraction.

Believable

A forensic examiner must be able to explain, with clarity and conciseness, what processes
they used and the way the integrity of the evidence was preserved. The evidence presented by
the examiner must be clear, easy to understand, and believable by jury.
BIBLIOGRAPHY

Gudjonsson, Gisli H. False Confessions and Correcting Injustices. 46 New Eng. L. Rev. 689
(Summer 2012).

Gudjonsson, Gisli H. The Psychology of Interrogations and Confessions: A Handbook

(Wiley 2003).

Leo, Richard A. Why Interrogation Contamination Occurs. 11 Ohio St. J. Crim. L. 193 (Fall
2013).

Mosquera, M. Scifo, A. Resource Guide on Fraud (facts, Lessons Learned& Best Practices).
State of New York, 2004

Leo, Richard A. and Steven A. Drizin. The Three Errors: Pathways to False Confession and
Wrongful Conviction, in Police Interrogations and False Confessions: Current Research,
Practice and Policy Recommendations (G. Daniel Lassiter & Christian A. Meissner eds.,
2010).