Forensic Accounting and Fraud

Examination 2nd Edition Hopwood

Solutions Manual
Visit to Download in Full: https://testbankdeal.com/download/forensic-accounting-and-
fraud-examination-2nd-edition-hopwood-solutions-manual/
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

Chapter 9
Fraud Examination Evidence I: Physical, Documentary, and Observational
Evidence
Teaching Notes

This chapter focuses on physical, documentary evidence, and interview evidence.

• General

Physical evidence is evidence that is tangible. A major consideration for the investigator
is not to preserve physical evidence for a possible trial.

Documents (including records in electronic format) are the most often used type of
evidence in forensic accounting investigations. This type of evidence includes not only
documents collected as part of the investigation but also those created by the forensic
accountant such as charts, graphs, and other exhibits admitted into evidence as part of
expert testimony. Documents may be in paper or electronic format.

Various sources of documents include personnel files, resumes, co-workers, friends and
acquaintances, background checks, other states, social networking sites, and public
records and restricted records from government and private files.

• Learning Objectives
• LO1: Define evidence from relative to investigations versus relative to a
court of law.
• LO2: Explain the importance of the care, protection, and
organization of documents.
• LO3: Describe various sources of evidence that can be used to
build a profile of a suspect.
• LO4: Identify sources of information available to the public.
• LO5: Identify sources of information not generally available to the
public.
• LO6: Discuss analytical procedures that can be used to locate areas of
fraud.

9-1
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

• LO7: Describe audit techniques that can be useful in gathering evidence.

• LO8: Discuss the objectives and limitations of using indirect methods.
• LO9: Discuss the reasons for document analysis and identify
various analyses that can be used in examining documents.
• LO10: Describe the methods of obtaining observational
evidence and the benefits and disadvantages of such methods.
• LO11: Identify factors that should be considered when
choosing the appropriate evidence-gathering technique.

Review Questions

1. Evidence is:
a. Useful in court only if the plaintiff and defendant can agree on its admissibility.
b. Allowed in court only if it is truthful.
c. Most useful if it is relevant, reliable, and valid.
Correct: Evidence that pertains to the matter at hand (relevance), is from a credible
source (reliable), and is valid (truthful) is the most useful.
d. Allowed if it passes the Vorhees test of veracity.

2. Reliability of evidence refers to:

a. Its truthfulness.
b. Its accuracy.
c. The extent to which it is consistently credible.
Correct: Reliability of evidence is the extent to which the evidence is consistently
credible.
d. All of the above.

3. Which of the following does physical evidence include?

a. Observation and surveillance.
b. Fingerprints and DNA.
c. Tire tracks and passkey.
d. b and c.
Correct: Fingerprints, DNA, tire tracks, and a passkey are all forms of physical evidence.

4. Documents are not usually used because of the possibility of alteration or

falsification.
a. True.
b. False.
Correct: Although a possibility exists that documents have been altered or falsified,
they are used because many frauds employ documents as a means of committing fraud.
If the fraud examiner is concerned that they have been altered or falsified, he or she can
engage a qualified document examiner to provide evidence as to their legitimacy; this
evidence becomes a part of the case.

9-2
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

5. Which of the following is not a basic rule of handling evidence?

a. Keep documents in a secure location.
b. Maintain appropriate chain of custody information.
c. Handle original documents whenever possible.
Correct: When conducting the examination, a forensic accountant will use copies
of the originals to reduce the possibility that the originals will be lost or destroyed
and to lessen the likelihood of an allegation of evidence-tampering.
d. All of the above are basic rules of handling evidence.

6. Which one of the following items of evidence must be obtained by voluntary

consent?
a. Trash outside a suspect’s residence placed on the curb.
b. Tax return.
Correct: There are usually three entities that have a copy (or original) of a person’s tax
return: the taxpayer, a tax preparer (if one exists), and the government taxing agency
(e.g., the IRS). The government will not release a copy of a tax return to a third party
(e.g., a fraud examiner) and a tax preparer will not release a copy to a third party except
when consent is given by the taxpayer. Therefore, voluntary consent by the taxpayer is
required to obtain a copy of a tax return from the taxpayer himself or from the preparer
of the tax return.
c. Videotape (no audio) of suspect shopping.
d. None of the above items requires voluntary consent.

7. Which item of information from an employees’ personnel file might indicate a

source of pressure to commit fraud?
a. Signature indicating agreement to abide by a code of ethics.
b. Six exemptions on a W-4 form.
Correct: Six exemptions is often an indication of a higher level of expenditures than is,
for example, two exemptions. Therefore, higher levels of expenditures produce a
greater need for assets to pay for those expenditures.
c. Award for commendable service to the company.
d. None of the above indicates a source of pressure to commit fraud.

8. Which records are normally not available to the public?

e. Assumed name indexes.
f. Uniform Commercial Code filings.
g. Currency transactions reports.
Correct: Currency transaction reports are filed by financial institutions with the
Federal government and thus are normally not available to the public.
h. Real estate records.

9. A search warrant can be issued if predication does not exist, but only by a court.
a. True.
b. False.
Correct: A court will issue a search warrant only upon showing of probable cause (i.e.,
predication).

9-3
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence
10. Comparing financial data with results the entity itself expected requires:
c. Consistency of data among periods.
d. An attainable budget.
Correct: An attainable budget presents amounts that the entity realistically expects to
achieve; if the budget is unattainable, any deviation of actual performance from the
budgeted amount is less meaningful. This means that if the entity realistically expects an
ending cash balance of $2 million and the actual data is $1.2 million, the difference of $.8
million is a surprise to the entity. If, instead of $2 million being the budgeted amount, an
unrealistic budgeted amount of $3 million is used, the difference of $1.8 million is
confounded by $1 million of inflated, unrealistic dollars and thus the amount by which the
entity has been defrauded is more difficult to determine.
e. Estimate the amount of inventory lost due to fire.
f. Data from similar entities to use as a comparison.

11. Which of these does vertical ratio analysis involve?

a. A columnar approach to analytical review.
b. A within-statement approach to analytical review.
Correct: A vertical ratio analysis presents the numbers within a financial statement in
terms of a percentage of a base number (e.g., all components of the income statement can
be expressed as a percentage of sales).
c. A year-to-year approach to analytical review.
d. None of the above.

12. Analytical procedures are comparisons of recorded amounts to which of the

following?
a. Standard amounts as determined by generally accepted accounting principles.
b. Similar amounts known not to contain errors.
c. Amounts expected by auditors.
Correct: Recorded amounts are compared to expectations formulated by auditors.
d. None of the above.

13. Which of the following does tracing involve?

a. Following the flow of information beginning with the financial statements and going
back through the system to the source documents.
b. Following the flow of information beginning with the source documents and fol-
lowing the flow of information forward through the system to the financial
statements.
Correct: This direction is usually called “tracing” where as the process of beginning
with the financial statements and proceeding backwards to the source documents is often
called “vouching”.
c. Applying analytical procedures to the financial statements.
d. Using surveillance to observe the steps of a suspect as he commits the crime.

9-4
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

14. Making a surprise count is a technique that can be used to:

a. Account for understated liabilities.
b. Determine why inventory is missing.
(Counts only indicate how much of an asset is under- or overstated, not why the
asset is under- or overstated.)
c. Determine whether a difference exists between tangible assets and accounting
records.
Correct: The surprise count is compared to the accounting records and any difference can
then be investigated.
d. Locate overstated inventory.
(Although a true answer, it is not as good as (c) above since it pertains only to one
type of asset, inventory. Surprise counts can be made of other types of assets such
as property, plant, and equipment. )

15. The likelihood that a forensic accountant’s judgment based on a sample differs from
the judgment based on an examination of the complete population is called:
a. Difference estimation.
b. Discovery sampling.
c. Sampling risk.
Correct: The sample might not be representative of the population; therefore, the
forensic accountant’s judgment based on the sample would not be the same as the
judgment she would make if she examined the entire population.
d. Judgmental risk.

16. Confirmations are:

a. Always a reliable source of evidence.
(No, e.g., look at the fraud associated with the Parmalat company.)
b. A process used to determine an understatement of liabilities.
Correct: Confirmation of liabilities is usually a good method of determining whether
liabilities are understated; since the recipient of the confirmation request is owed money, he
has a vested interest in reporting the correct amount that is owed to him.
c. A good indicator of fraud if the recipient does not respond.
(No, there are many reasons why a recipient might not respond and, if the negative type
of confirmation is used (see the chapter on auditing), a non-response is interpreted as an
indication that the recipient agrees with the balance printed in the confirmation, i.e.,
nothing is incorrect.)
d. All of the above.

17. The net worth method can be used as:

a. A direct form of evidence.
b. An indirect form of evidence.
Correct: The net worth method does not provide evidence of the source of the
increase in net worth, only information about the level of net worth (i.e., whether
there was an increase or decrease). Any increase must then be explained as either
from a legitimate source, e.g., inheritances or loans, or an illegitimate source, e.g.,
embezzlement.
c. Conclusive evidence that embezzlement has taken place.
d. An indication that collusion between employees has occurred.

9-5
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

18 Alterations of documents are usually classified as:

a. Changes.
b. Additions.
c. Deletions.
d. Both b and c.
Correct: Alterations are typically classified as additions or deletions.

19. Which of the following issues with documents would not normally be considered as a
possible indicator of fraud?
a. Duplicate payments.
Correct: Duplicate payments sometimes happen by accident.
b. Photocopied documents.
(Photocopied documents exist for one of several reasons, including the fact that
alterations of an original are not as likely to be noticed if the original is photocopied
and photocopies are sometimes used to cover up a theft of assets.)
c. Unrecognized handwriting.
(This suggests forgery.)
d. All of the above could normally be taken as a possible indicator of fraud.
(This is also correct, although answer (a) is a more nearly direct answer.)

20. Questioned documents are documents that are contested for what reason?
a. They exhibit one of the document-related indicators of fraud.
Correct: For example, a document might be questioned because the handwriting is
unrecognized or the document contains apparent additions or deletions.
b. They are declared fraudulent by a document examiner.
c. They are questioned by an auditor.
d. None of the above.

21. What do most document examiners study?

a. The author’s choice of words, syntax, spelling, and phrasing.
(This is the work of a forensic stylist.)
b. An exemplar of the person suspected of authoring or altering a document.
Correct: Document examiners use exemplars to determine whether a suspect authored a
document.
c. Both a and b.
d. None of the above.

9-6
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

22. Which of the following must file currency transaction reports?

a. Any person who physically transports, mails, or ships currency or monetary instru-
ments of more than $10,000 into or out of the United States or any person who
receives payments from a source outside the United States.
(This requires the filing of FinCen Form 105, Report of International Transportation
of Currency or Monetary Instruments.)
b. Financial institutions when a customer deposits more than $10,000 currency.
Correct: This requires the filing of FinCen Form 104, Currency Transaction Report.
c. Businesses that receive more than $10,000 in one transaction or in a series of related
transactions.
(This requires the filing of Form 8300, Report of Cash Payment of Over $10,000
Received in a Trade or Business.)
d. Answers a and b only.

23. How many observation periods are needed for invigilation?

a. 1
b. 2
c. 3
Correct: Invigilation is an observational technique that involves three periods: pre-
observation, observation, and post-observation. Data from the observational period is
compared to data from the pre- and post-observational periods to determine whether
frauds, such as skimming, are occurring. For example, assume that management suspects
that one of its employees is stealing inventory. The presence and often purpose (to
determine why inventory levels are declining) of the forensic accountant is announced to
employees. After a period of time, these employees are told that the forensic accountant
is no longer investigating the decline in inventory methods. The forensic accountant then
compares data from three periods to determine whether any change in behavior as
measured by inventory levels occurred as a result of the announcement.
d. 4

24. The observation period used in invigilation should be approximately how long?
a. 10 days.
b. 7 days.
c. 30 days.
d. 14 days.
Correct: the observation period should be approximately 14 days; fewer days might not
produce reliable evidence.

25. Surveillance is not typically used for which of the following?

a. Gathering evidence to support probable cause for the issuance of a search warrant.
b. Gathering evidence leading to the identification of activities and individuals
involved in crimes and the apprehension of perpetrators.
c. Gathering evidence of crimes.
d. All of the above.
Correct: All of the above are typical uses of surveillance.

9-7
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

Discussion Questions

26. Give an example of an item of evidence that is valid and relevant but not reliable.

A friend of the perpetrator provides a statement that she saw the perpetrator leave
the scene of the crime. This testimony can be valid (i.e., truthful) and relevant (i.e.,
pertaining to the investigation) but if the friend later changes her story, the
evidence is not reliable.

27. Give a reason why forensic accountants do not usually evaluate physical evidence.

Forensic accountants do not usually evaluate physical evidence because they are
not trained to do this type of evaluation (another reason is that they do not have the
equipment to do these types of evaluations).

28. What is the basis for not accepting copies of original documents in a court?

The court will not allow copies of original documents to be used as evidence if
originals are available because of the likelihood that the copies might not be valid
copies of the originals and certain characteristics of the originals, e.g., indications
of alterations, might not be readily apparent if copies are used.

29. Of the four ways documentary evidence can be obtained, which can be performed
without the suspect being aware of the investigation?

Searching public records can be performed without the suspect being aware of
the search.

30. A suspect lists former employers on an employment application contained in her per-
sonnel file. What might the forensic accountant do with this information?

The forensic accountant could search the Internet to determine whether the
former employers existed and are still in business. If still in business, the
accountant could contact the former employers and interview them.

31. Google your name (or the name of a friend) and location (e.g., state). What informa-
tion can you find on yourself (or this person)? Is this information correct?

Answers to this question will vary.

32. A manager is suspected of making top-side journal entries to increase the income of
the company because his bonus depends on the company’s achieving at least a certain
level of income. What would you, a trained forensic accountant, look for when investigating
this type of fraud?

9-8
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

Indications to look for would include journal entries at or near the end of the
accounting period. The amounts associated with these entries are sometimes round
numbers (e.g., $100,000 as opposed to $125,649). Look for indications that these
entries were made by upper management but, regardless of who made these
entries, identifications of the person who made them should be ascertained and the
person interviewed. In addition, news reports or management releases of earnings
estimates made prior to the end of the year could be the pressure that led to these
top-side journal entries. Interviewing employees as to whether multiple drafts of
the financial statements were produced and where these drafts are kept (if not
destroyed) could be helpful in determining the process of the financial statement
fraud and provide evidence for court.

33. You just received a tip that a substantial amount of inventory is being stolen from the
dock area of the company for which you work as an internal auditor. What techniques
might be useful in determining whether this allegation is true (i.e., collecting evidence of
this fraud)?

The techniques that could be used include surveillance, documentation, surprise

counts, and interviews. Cameras or simply undercover persons posing as
employees could provide eye-witness evidence that a fraud is occurring. Doing a
“3-way match” (i.e., comparing the purchase order, receiving report, and invoice)
could uncover inconsistencies (e.g., less merchandise inventory received than
paid for) but, if collusion that involves an employee in receiving is occurring, no
difference might be noticed. Conducting surprise counts of inventory and
comparing them to the records could uncover a deficiency in inventory.
Interviews could be helpful, particularly of employees who have knowledge of
the fraud and who are brave enough (or upset enough) to talk.

34. Discuss how you might resolve a suspect’s allegation that the amount of cash on hand
in your net worth method is understated.

Ask the suspect questions about the additional amount of cash such as
▪ How did you acquire this cash?
▪ Did anyone else know of this amount of cash?
▪ Where was this cash kept?
▪ Was this cash spent or do you still have it?
In addition, those who the suspect names as knowledgeable about the additional cash
could be interviewed although the forensic accountant should be aware that the
person could be a relative, business associate, friend, or even an associate who has an
interest in seeing the suspect prevail in court.

35. When might questioned document analysis be used as part of identity theft?

Questioned document analysis could, for example, be used to determine whether

signatures are those of suspects, whether alterations were made to documents, and
whether the document appears to be partly or completely fabricated.

9-9
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

36. When might document restoration be useful in a forensic investigation?

Document restoration can be helpful when documents have been shredded or

damaged by liquids or fire. For example, if a document becomes wet and, as a
result, the ink on the paper is difficult to read, the forensic accountant should place
the document in a plastic envelope and engage a person qualified to restore
documents. Attempting to dry the document by, for example, placing it between
paper towels can sometimes create additional damage.

37. Give an example of how link analysis might be used to investigate mortgage fraud.

Link analysis can be used to investigate mortgage fraud by providing the number
of times certain individuals being investigated as “homeowners” have called (or
been called) by mortgage bankers and real estate salespersons. In other words, this
linking mechanism can provide the evidence of a connection between parties
suspected of committing mortgage fraud.

38. What is required to obtain a search warrant?

To obtain a search warrant, a law officer (including authorized IRS personnel)

must prepare an affidavit and present it to a judge. The purpose of the affidavit is
to show probable cause. If the judge, after reviewing the affidavit, believes
probable cause exists, the law officer must swear that the affidavit was prepared
truthfully. After the oath of the officer has been witnessed, the judge will issue the
search warrant.

39. When would a search warrant not be used to investigate an employee fraud?

A search warrant would not be used to investigate employee fraud when the
evidence is believed to be entirely on the employer’s premises (including evidence
that exists on employer-provided computers) since no warrant is necessary in this
circumstance.

40. Give examples of situations in which a search warrant could be used to investigate
employee fraud.

A search warrant could be used to investigate employee fraud when the

investigator suspects that the employee keeps a separate set of records at home or
on property owned by the employee, e.g., in the trunk of the employee’s car.
Another example involves the situation in which collusion between an employee
and a vendor is suspected; in this case, a search warrant could be sought to search
the premises and computers of the vendor.

9-10
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

41. Give an example of a situation in which surveillance could be used to justify seeking a
search warrant.

If, for example, surveillance is used to watch a governmental employee, e.g., a

county board member, accept an envelope from a person known to do business
with the county, justification exists for seeking a search warrant to uncover
additional evidence of the payment of what appears to be a bribe.

42. For what types of fraud would the technique of invigilation be used?

Typically, invigilation would be used to investigate frauds that are characterized by

cash skimming. These “off-the-books” frauds are difficult to catch because there’s
not much evidence of them except for the comparison of sales levels provided by
invigilation.

43. Give an example of how opposing counsel might seek to discredit a co-worker’s
testimony.

Ways that opposing counsel could seek to discredit a co-worker’s testimony include
▪ Trying to assert that the co-worker is jealous of the defendant.
▪ Introducing any evidence that suggests the co-worker has been less-than-
truthful to the employer or in previous court appearances (e.g., perjury).
▪ Introducing evidence that suggests that the co-worker leads a secret life
(evidence of actions that indicate less than full disclosure or, in some cases, a
hypocritical stance by acting one way at work and a completely different way
the rest of the time).
▪ Taking quotations out of context to make the co-worker appear to contradict
what she is saying in court.

44. Give a reason for the increase in the cost of goods sold percentage that is not the result
of fraud.

The cost of goods sold percentage could increase as a result of purchasing

inventory that costs more than previously-purchased inventory. In fact, the cost
of goods sold percentage could increase legitimately if the company increased
any of the costs—not just inventory—that are included in the cost of the product
manufactured or sold. For example, if the company manufactures a product and
acquired new, more expensive, manufacturing equipment, the cost of goods sold
would increase.

45. Discuss what a company subject to a debt-to-equity ratio covenant might to do to

reduce the ratio so that it does not exceed the bank’s stipulated ratio. (Hint: Abandon
conformance to GAAP when thinking of answers.)

Any action that would reduce debt or increase equity would reduce the ratio.
There are legitimate ways and illegitimate ways to do this. The illegitimate ways
are not just anti-GAAP; these involve fraud.

9-11
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence
Legitimately, the company could offer an incentive, e.g., a “sweetner”, to
convertible debt-holders to induce them to convert the debt they hold to stock.
Or, the company could simply issue additional stock. The company could also
issue stock options having a favorable exercise price; once the options are
exercised, the company issues stock and the debt-to-equity ratio decreases.

Not so legitimately, the company could debit its liabilities and credit sales to
transfer some of its debt to the sales account. (Or, it could record new debt as
sales.) The company could also record new debt (or transfer old debt) as equity
although the paucity of changes to equity accounts would make catching this
action fairly easy. If a company is thinking of increasing its equity, any action that
would increase revenues (and gains) and decrease expenses (and losses) would
cause an increase to equity since net income is a part of retained earnings, which is
equity.

Cases

46. Cary and Elle Bronson had been married for 15 years when trouble arose in their
marriage. Cary’s long hours of working had taken a toll on it; he was rarely around
even for family functions. The last straw came when Elle found lipstick on the collar
of Cary’s shirt and the unmistakable scent of a very expensive woman’s perfume; this
wasn’t the first time she had noticed the telltale signs of what appeared to be a clandestine
affair. The next day, Elle visited an attorney to begin divorce proceedings. After some
small talk, the attorney, Mark Smithson, asked Elle about the major assets accumulated
during the marriage.

“Oh, there are the cars—a Jeep Cherokee, a Chevy Suburban, and a Bentley,” she
answered.

“A Bentley?” he queried, somewhat surprised.

“Yes,” said Elle. “Our restaurant, The Roasted Duck, has done very well over the years.

We began the business with almost nothing and both worked there until Karen, our
second child, was born. At that point, I became a stay-at-home mom and left everything
to Cary.”

“I’ve eaten at The Roasted Duck—the food is excellent,” Mark said.

“Thank you,” replied Elle.

“Is this the only source of income for you and your husband, Mrs. Bronson?” he asked.

“Yes, other than some interest and dividends,” she answered.

9-12
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence
She and the lawyer discussed other matters pertaining to the divorce. He told Elle that
he would obtain information from Cary’s attorney so that an equitable division of
assets could occur and the issue of the custody of their children would be settled.
Two weeks later, Elle received a call from Mark. Through the discovery process, Cary’s
attorney had submitted a valuation of the restaurant that seemed unusually low and had
not listed any other assets that could account for the house and vehicles that the Bronsons
had acquired and the private education that they had provided for their children.

“That can’t be right!” Elle exclaimed.

“Well, it certainly doesn’t look right,” Mark said, “I’ll look into this some more and let
you know what I find.”

After he hung up the phone, Mark called Cary’s attorney. “This value placed on the
restaurant doesn’t make any sense. What’s your take on this?”

After a short pause, the attorney replied, “Cary told me that the restaurant business is not
doing well and, thus, the value has declined.”

After Mark hung up the phone, he pondered the situation: There must be an answer to
this mystery. One thing’s for sure; if Cary isn’t telling the truth, he might as well
change the name of his restaurant to The Cooked Goose.

What evidence (i.e., physical, documentary, and observational) could be collected to

determine whether the valuation is correct? How could you go about collecting this
evidence?

Assume for a moment that the valuation is correct. What other sources of money could
Cary have to maintain his family’s lifestyle? How would you test your theories?

Answers:

Question Ellie as to whether she is an officer of the corporation that conducts

business as The Roasted Duck (often spouses are listed as officers even though they
don’t work actively in the company; if she doesn’t know, look for evidence in filings
with state regulatory agencies). If she is an officer, she should be able to request
copies of the tax returns (income, sales, and payroll) and any financial statements
submitted to banks for loans provided to the corporation. If, however, Cary is
skimming cash sales and not reporting it to taxing authorities or to banks when
applying for bank loans, using indirect methods, e.g., the net worth method, might be
helpful in determining the amount of money not reported. In addition, surveillance
could be used to determine the vehicles used in the business; in particular, if newly-
purchased (be careful, they could be leased) vehicles are used the “I’m not doing
well” message of the husband might not sound as credible.

9-13
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

The husband, Cary, should be deposed to ascertain his thoughts on why the business
is not doing well. His statements should be checked out. For example, if he asserts
that the traffic through his restaurant is too low for him to be successful, counting
those who enter and exit the restaurant can be noted and an approximate level of
gross sales can be calculated. A copy of the menu would be helpful in determine the
sales prices of items and, while posing as a customer, a forensic accountant can ask
waiters what they consider to be the most popular items could also help. A forensic
accountant and her associates could also pose as survey takers outside the restaurant
for the purposes of asking patrons about their habits and, in particular, what they just
ordered in the restaurant. This would allow them to develop a better estimate of
revenues. Because the restaurant is not a chain restaurant, obtaining a profit
percentage that can be applied to an estimate of the gross sales is difficult. If the
forensic accountant has friends who own restaurants in the area or who are
accountants for restaurants, she could ask them for an average net profit percentage.

If we assume for a moment that the valuation is correct, Cary might have other
sources of money that he could use to maintain his family’s lifestyle. These
could include the selling of drugs and the laundering of drug money (easier to
do if a large portion of the revenues of his restaurant are in cash, and even
more so if the restaurant has a bar), brokering transactions for purchases in
which part of the sales price is under the table and thus is not reported by the
seller to tax authorities and not claimed by the buyer (often a person who has
accumulated money from drug sales or other illicit activities such as
prostitution). In these situations, using indirect methods of determining
expected increases to net worth can be helpful as well as can surveillance, such
as watching Cary to determine, for example, whether he appears to be
engaging in “business” while at the restaurant or visiting places that seem to be
connected with illegal activities, e.g., casino parking lots, horse and dog tracks
.

47. Andrus Bettenhaus had worked at Ye Old Troubadour for 15 years and had been given
increasing levels of responsibility until he reached the position of manager. One evening,
Sharon Ellis, an employee at the Troubadour, asked to speak with Carmela Rodriguez,
one of the managers in the internal audit division of the company.

“I think Andrus has been taking cash from the register,” said Sharon.

“Thanks for letting me know about this, Sharon. Can you tell me what made you suspect
that he was doing this?” Carmela replied.

9-14
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence
“I came to his office just after Kim, one of the cashiers, dropped off her register tray, and
he was trying to hide something in his desk drawer. He looked a little sheepish and seemed
flustered. I don’t know ... maybe it’s nothing.”

“Well,” Carmela replied, “we don’t know that yet, so I’ll look into this. In the meantime,
please don’t say anything about this to anyone. If it does turn about to be nothing, no one
is hurt.”

After Sharon agreed and left, Carmela’s thoughts turned to a conversation she had
earlier with her supervisor, Karen Turner. She recalled that Karen had said that an
analysis of the cash collections had indicated that they hadn’t been as high for the last
three months as they had been previously. “But Andrus is such a well-liked and trusted
employee. I just can’t imagine why he would do such a thing,” Carmela thought. “There
must be a reason.”

List some reasons why an employee might embezzle cash from his employer and the
evidence that would determine which reason (or reasons) could provide the pressure to
motivate a person to embezzle. Note which evidence, if any, is obtainable only if the
employee voluntarily makes it available.

How would an opposing attorney try to discredit the evidence that Carmela thinks is
relevant to the case?

Answers:

Employees might embezzle for various reasons (and the evidence that would
indicate that the reason is the motivation) including the following:
▪ Feeling underpaid/underappreciated (work attitude noticed by co-workers
and comments heard by co-workers, friends);
▪ Need cash to support family (number of exemptions on W-4 form,
information from co-workers on size of family and health issues of family
members)
▪ Need cash to support drug habits (behavior at work and after hours, if
witnessed by co-workers, friends; medical drug test)
▪ Need cash to support gambling habits (comments made by Andrus about
betting that are heard by co-workers, friends; excitement about betting in
office pools)
▪ Desire to impress others with assets acquired with embezzled funds
(bragging about house, vacations, wearing expensive clothes, and driving
expensive cars)
▪ Belief that embezzling is a challenge worthy of effort (bragging about
ability to crack passwords, fool systems)
The medical drug test is an example of evidence that must be volunteered by
Andrus unless it is a condition of remaining employed (e.g., drug test every six
months).

9-15
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

An opposing attorney might try to discredit the evidence that Carmela thinks is
relevant to the case by introducing other possibilities for Andrus’ sheepishness.
For example, he might raise the possibility that Andrus might have been looking at
personal materials that were inappropriate to look at during working hours. Even
though Andrus might once again be embarrassed, his embarrassment would pale in
consideration to the embarrassment he would suffer if he were convicted of
embezzlement. The attorney might also try to discredit Carmela’s character by
asserting that she is nosy and is a very “rule-oriented” person who is not an easy-
going, forgiving person. If the attorney is successful in finding co-workers, friends,
or acquaintances who would lend support for one or both of these assertions, the
attorney might be successful in introducing doubt in the minds of a jury or judge and
thus increase the likelihood of a “not guilty” verdict.

48. Talia Finn is working as an analyst for the Drug Enforcement Agency (DEA) and has
been assigned to a case in which the suspect is believed to be engaged in a rather large
drug-dealing operation behind the sham business Nutritional Supplements. Her first
assignment is to perform a net worth method on Clyde Barrow Jr., the sole proprietor of
the unincorporated business.

a. Talia prepared a net worth method using the information she had collected that
follows.

9-16
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

Financial Information for Clyde Barrow Jr.

Year 1 Year 2 Year 3

Assets
Cash on hand $ 500 $ 750 $ 900
Cash in bank 3,000 12,500 15,000
Vehicles 30,000 90,000 120,000
Real property: Store 250,000 250,000
Real property: Homes 350,000 575,000
Total assets $33,500 $703,250 $960,900
Liabilities
Vehicle loans $20,000 $ 70,000 $ 85,000
Mortgages 290,000 450,000
Total liabilities $20,000 $360,000 $535,000
Income
Income from business $ 85,000 $ 97,000
Total income $ 85,000 $ 97,000

Expenditures
Vehicle payments $15,000 $ 15,000
Mortgage payments 55,000 190,000
Additional living 100,000 135,000
eexpensesexpenses
Total expenditures $170,000 $340,000

9-17
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

b. After Talia completed her analysis, Clyde’s attorney raised an objection. Talia
asked to meet with Clyde again, and at that meeting Clyde told her that he
believes that the cash on hand amounts that were used in the projection were
too low. Although he had provided the amount to her earlier, he now believes
that it was much higher than the amounts used and seems to recall that he had
about $200,000 “stashed away” in case the economy crashed. When Talia asked
him about the source of the $200,000, Clyde shrugged and said, “Part of it was
an inheritance from my dear old Aunt Hattie, and the balance was just some
money I had saved.”

c. How should Talia respond to this new information (i.e., would she want additional
information from Clyde), and what are the sources of evidence that she needs to
follow up on his assertion?

Answers:
a. The net worth method calculation for Clyde Barrow,
Jr. is shown below.

Net Worth Calculation for Clyde Barrow, Jr.

Year 1 Year 2 Year 3
Total assets $33,500 $703,250 $960,900
Less: Total liabilities 20,000 360,000 535,000
Net worth 13,500 343,250 425,900
Prior year net worth 13,500 343,250
Increase (decrease) in net worth 329,750 82,650
Add: Additional living expenses 170,000 340,000
Total income 499,750 422,650
Less: Known sources of income 85,000 97,000
Income from unknown sources $414,750 $325,650

b. No answer required; this item simply provided additional information.

Note to instructor: You could use this information to ask the class if
they had heard of persons who had asserted that they had inherited
money and were later convicted (or at least suspected) of obtaining the
money by fraudulent means. A good example of the use of this type of
reason for unexplained sums of money can be found in the
http://www.GainsvilleTimes.com in which an employee was found
guilty of embezzlement by means of cashing forged checks. According
to the article,

9-18
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

At least one witness testified Baghose was shown on a Wachovia

bank video cashing a forged check at the main Gainesville branch
on Jesse Jewell Parkway. Baghose, a ZF Industries employee for
20 years, kept the key to the company’s check-printing machine
and reconciled the books at the end of the month; according to
court testimony…She claimed frequent deposits to her personal
bank account were from an inheritance. (Stephen Gurr, “Former
ZF Industries employee found guilty of embezzlement”
http://www.GainsvilleTimes.com, August 21, 2009,
http://www.gainesvilletimes.com/archives/22622/.)

c. Talia should ask Clyde for information such as

▪ Does anyone else know that your Aunt Hattie
bequeathed this amount to you? If so, what
are the names of these persons and where do
they live? (Talia should contact these persons
and ask then about the inheritance and their
relationship (e.g., relative, friend,
acquaintance) to Clyde.
▪ Who was the attorney that took care of your
Aunt Hattie’s estate? (Talia should determine
whether this attorney exists; she can do this by
looking up his or her license and then
contacting the attorney for any information the
attorney might divulge, such as whether Aunt
Hattie had been a client of his or whether he
had been involved in the administration of the
will.)
▪ Did Aunt Hattie have any children? If so, who
are they and where do they live? (This
question is asked because children are usually
well aware of the contents of a will and, thus,
whether or not Clyde inherited any money
from their mother. She should interview these
children.)
▪ What did you do with this money you
inherited? Did you spend it and, if so, for
what? (Follow up on answers received, e.g., if
spent for a house, ask “Do you still own the
house?” If he says, “No,” then inquire as to the
disposition of the house.)
▪ Why did you accumulate the money you
saved? (If he responds that it was saved for a
particular purpose, ask whether he achieved
that purpose.)

9-19
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

▪ What was the source of the money you saved?

(If from a side business, ask about persons
who knew about the business, former
customers, etc.)
▪ Where did you keep the money that you
saved? In an account? If so, what bank? (If in
a bank account, ask to see banking records, if
still available. If he has transferred this money,
ask where and, if into another account, request
those records.)
▪ Do you still have this money (and the
inheritance from Aunt Hattie)? If so, where
do you keep it?
▪ Does anyone else know about this money you
saved? If so, who are these persons and where
do they live? (Follow up by contacting these
persons.)

49. As a certified fraud examiner, Laura Wu has been retained by an attorney to investi-
gate an overstatement of revenue fraud at Unlimited Growth Ltd. All sales to the company
are on credit (i.e., there are no cash sales). Laura has found an entry in the records debiting
accounts receivable and crediting the Sales account on the last day of the fiscal year.

a. Would confirmations help her gather evidence in preparing for prosecution of

financial statement fraud? Why?

b. Laura employed a novice fraud examiner to help her in the investigation. After an
employee of Unlimited Growth had prepared the confirmation letters (using the
positive “in-blank” type), her novice fraud examiner reviewed the letters and asked
another employee (who had worked at Unlimited Growth for 12 years and had a
character that was beyond reproach) to mail them for him. The confirmations
were all returned, and all recipients had indicated that the information provided
in the letter agreed with their records. Should Laura be concerned about the
process her fraud examiner used and the results?

Answers:

a. Confirmations might not be of help in this situation because if the entry was
fraudulently made, the person who made the entry could intercept the
confirmation of the misstated account and return it (if the “positive” type of
confirmation is used) with the indication that the account balance is correct
(recall the types of confirmations discussion from the auditing chapter: The
“positive” confirmation is the one that the auditor expects will be returned
whether the balance is correct or incorrect; if the confirmation type selected is
the “negative” confirmation, any unreturned confirmations are considered
evidence of correct balances).

9-20
Chapter 09 - Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence

On the other hand, if a “positive” confirmation of the misstated account is

returned and the forensic accountant can demonstrate (by other means) that
the account balance was fraudulently misstated, the confirmation of this
account becomes evidence of the fraud because it was a part of the cover-up.

If Laura wishes to use confirmations she should determine whether the

address associated with the account in question is a P.O. Box or some other
form of “drop”. Use of such addresses are often indications of fraud.

There are a number of possibilities here: The account which was adjusted by
the debit to Accounts Receivable and a credit to Sales could be an existing
account owed by a wholly innocent customer. This customer might have no
idea that her account is being used to inflate revenues and assets because the
entry might be reversed before the next statement is mailed. On the other
hand, the account that was adjusted might be a wholly fictitious account that
is used when the need for additional revenue arises.

b. Laura should be very concerned about the process her fraud examiner used
and of the results. Often, the persons who commit fraud are those who are
trusted and are in positions that allow them access to records and assets; these
positions are more likely to be attained after working for the company for
several years. In the present case, the employee who had worked for the
company for 12 years could be colluding with another employee who made
the suspected entry (or he could have made the entry himself). If the entry
was fraudulent, the employee who mailed the confirmations could have either
(1) changed the confirmation letter for the misstated account so that the
overstated balance is correctly stated; as a result, the unsuspecting customer
would not be aware that his account is being used temporarily to inflate
revenues and assets or (2) change the address so that the confirmation is
mailed to himself or a confederate. If confirmations are to be used, the best
approach under these circumstances is to not allow employee access to
confirmations after they have been prepared and for the forensic accountant
to mail them herself.

9-21