Professional Documents
Culture Documents
INVESTIGATING CONCEALMENT
Discussion Questions
3. From the time documentary evidence is received, its chain of custody must be
maintained in order for it to be accepted by the courts. Contesting attorneys will make
every attempt to introduce the possibility that the document has been altered or
tampered with.
Chapter 8 1
Albrecht: Fraud Examination, 4e
9. The three most common ways that investigators can obtain hard-to-get documentary
evidence are subpoena, search warrant, and voluntary consent.
True/False
1. True
5. False. Graphologists limit their analysis to the study of handwriting, while forensic
examiners focus on many more aspects of documents, including date, machine
prepared on, etc.
6. True
7. True
8. False. Discovery sampling is one of the easiest of all statistical sampling methods to
understand.
Chapter 8 2
Albrecht: Fraud Examination, 4e
9. False. When samples are taken, they are always subject to sampling error, meaning
that the sample is not representative of the population.
10. True
11. True
13. True
14. True
15. True
16. False. The best way to obtain documentary evidence in a computer database is to
analyze full populations with queries (data mining).
Multiple Choice
1. a
2. b
3. c
4. d
5. d
6. d
7. a
8. d
9. c
10. b
11. c
12. c
13. a
Chapter 8 3
Albrecht: Fraud Examination, 4e
14. c
Short Cases
Case 1
The 15 checks selected would have the following numbers: 664, 789, 650, 136, 365, 538,
800, 657, 110, 136, 398, 645, 214, 544, 777.
Case 2
1. You have found an actual example of fraud. Because fraud is present in the sample,
you can conclude that fraud exists in the population from which the sample was
taken. Your only question now is how many fraud instances there are in the entire
population. At this point, you should terminate sampling and examine the entire
population to discover the extent of the fraud.
2. If fraud is not present in the sample, you cannot know for sure whether fraud exists in
the population. You would need to examine all checks to be 100 percent sure that
fraud does not exist. Based on your sample size, you can state that, at a certain
confidence level, the probability of fraud is not more than a certain percent. If you
want to be more confident or reduce the probability of fraud, you must take a larger
sample.
Case 3
1. Fraud examiners and auditors should never underestimate the value of documents in
an investigation, as they can be more valuable to an investigation than eyewitnesses.
If the fraud was suspected or known to have occurred, the auditors should have taken
the following steps with respect to the documents: collect, protect, identify, and
preserve relevant documents in as good a condition as possible; and make copies of
the original documents for use during the investigation so the originals will be
available for court.
Case 4
2. Clearly, there appears to be something wrong. First of all, they could only produce
photocopies of the invoices, which is not acceptable. The fact that it took them
several hours to produce these documents also causes suspicion. Your first step in
studying the invoices might be to examine a sample of the invoices given to you. You
should stratify the invoices by purchasing agent, then use a random number table or
another method of drawing a random sample and select invoices to study. For
example, you might start from the top left of the chart, working from left to right and
Chapter 8 4
Albrecht: Fraud Examination, 4e
from top to bottom. You could use the last four digits of each five-digit number,
skipping the numbers that fall outside of the range. You could verify fifty invoices for
each agent. (Obviously, other sampling approaches are also acceptable answers.)
Case Studies
Case Study 1
Most fraud examiners prefer documents as evidence instead of witnesses because unlike
witnesses, documents do not forget, they cannot be cross-examined or confused by attorneys,
they cannot commit perjury, and they never tell inconsistent stories. Of course, where
possible, documents should be used in conjunction with witnesses.
Once a document is in the custody of John Doe (through a subpoena or other method), he
needs to document and maintain its chain of custody. This means that he must keep a record
of when he receives a document and what has happened to the document since it came into
his possession. Opposing attorneys will attempt to discredit the document’s credibility and
authenticity by asking questions about the document’s history.
When John Doe receives a document, he should uniquely mark it so that it can be identified
later. He should then put the document in a transparent envelope marked with the date
received. A copy of the document should be made for investigative purposes to preserve the
original document for trial. It is necessary to protect the original document because
photocopies are only admissible in court:
When the original document has been lost or destroyed without the intent or fault of
the party seeking to introduce the secondary evidence.
When the original document is in the possession of an adverse party who fails to
produce it after a written notice to do so, or when the party in possession is outside
the jurisdiction of the subpoena power of the court.
When the document or record is in the custody of a public office.
When the original documents are too voluminous to permit careful examination, and
a summary of their contents is acceptable.
John Doe also needs a consistent organizational scheme for his documents, whether it is by
witness, date, or transaction. Such an organized scheme is necessary to accommodate the
large amount of documents that can accumulate throughout an investigation process.
Case Study 2
Note that while this case calls for full-population analysis using ACL, Picalo, IDEA,
ActiveData, or another software package, it could be easily modified to use discovery
sampling as well.
Chapter 8 5
Albrecht: Fraud Examination, 4e
1. The following records use a form of post office box in their address (note the
different notation in the addresses):
2. There are at least two ways to solve this problem. If your students are using a package
that supports stratification via text fields, first stratify the claims file by dentist_id and
then check for sequential numbering. If your software does not support advanced
operations (such as sequential checking) on stratified/classified groups (ACL is in this
group), your students can simply sort the file first by dentist id and then by claim id.
Being sorted in this way, the records for each dentist group together. Now check for
sequential numbering to locate the problem records. Dentist with id 748218 is
sending sequential claim numbers that start at 1000 and continue through about 20
claims sent.
3. Dentist with id 476227 has worked on patient 20372, for a total of 58 times during the
three-month period; all of these claims are for cavity fillings.
4. Dentist with id 438439 has a total of five claims for patients that live outside of
Maine.
Internet Assignment
In the Resources menu, choose Fraud Mall, and then High-Tech Tools. Many different kinds
of services and products are offered. The listed packages change often, but the listing should
provide a set of examples for the type of software available.
Debates
Pro: The obtaining of a search warrant allows the FBI to search the suspect’s residence
without violating Fourth Amendment rights. Searching files on a computer is also
permissible, according to common law. Thus, it seems that the FBI was fully “warranted” in
its search and seizure of incriminating evidence.
Con: Possible Fourth Amendment violations could have occurred because of the use of the
Key Logger System (KLS). Had KLS been used solely for the purpose of seizing
incriminating evidence, the FBI would be justified. However, KLS also monitored activities
of the suspect in normal activities, such as the visitation of non-incriminating Web sites on
the Internet. It is possible that the FBI overstepped its rights and infringed Mr. Dayley’s
Fourth Amendment rights.
Chapter 8 6
Albrecht: Fraud Examination, 4e
2. What types of cases should use link analysis software? Is the cost justified in
these cases?
a. Generally, very large cases employ link analysis software. When tens or even
hundreds of investigators are involved, combining of evidence becomes an
issue. In these cases, link analysis software is considered extremely useful.
Chapter 8 7