Forensic Audit Case studies ICAI Vadodara 2013 Chetan Dalal

1. Forensic Audit Case studies ICAI Vadodara 2013 ChetanDalal

2. A warm welcome to all Thank you to Vadodara Branch and members of ICAI From ChetanDalal

3. Very Important to remember: • All case studies / exhibits / example are adaptations of real life situations, and any resemblance or use of any name, logo or symbol of any entity is purely for academic purposes and to facilitate better understanding. Case studies discussed in the seminar are imaginery and at no point is there any direct or indirect implication of fraud in or by any entity referred to anywhere.

4. Agenda • Forensic Audit: introduction and traits of a forensic accountant and forensic accounting and examples of some unusual frauds in business world • Fraud and manipulations in excel reports • Simple forensic tests which can be conveniently used to detect fraud • Red flags and early warning bells of possible fraud • Unusual methods of investigating

5. 1. Forensic Audit: what it means and What are the traits of a good forensic accountant or auditor?

6. Forensic Audit- Technical definition-Wikipedia, the free encyclopedia

7. Forensic Audit is all about examination and collection of evidence admissible in a court of law. It utilizes the following skills of CAs- Accounting Auditing Investigating

8. What distinguishes a forensic audit from a normal audit? • Forensic audit is issue based or related to a specific problem • It has several components and could include any or all of the following: • Financial and accounting review • Digital forensic analysis • Field investigations • Data mining at an advanced level • Application of Interviewing skills • Technical assistance such as handwriting, specimen signatires, QC evaluation etc Audit relies on documentary evidence, whereas a forensic audit actually examines the reliability of documentary evidence itself Forensic accounting emphasizes the need to look for other evidence available as well.

9. For example a bank manager committing suicide on desk with a suicide note under his hand

10. The most important traits of an investigator • Distrust the Obvious • Think differently and Develop an open mind • Look from different angles and all sides. You will get a different revelation

11. Common reasons why fraud goes unnoticed and forensic audits are needed • Fraudsters/ deceivers are Intelligent • Technology • Stale procedures syndrome • Lack of perseverance

12. Two facets which are applicable to all investigations • Use of desktop internet investigation (useful in audit too) • Use of the theory of impossibility and absurdity to detect fraud. If an investigator habitually applies these his success rate will increase phenomenally.

13. Concept of desktop audit and investigation • This is a technique you must use to conduct verifications, research and information regarding vendors, products, third parties, and almost anything you are auditing or investigating • Do this as frequently as possible to spot forgeries or establish the authenticity of third parties, entities, documents such as invoices, letters, agreements, wills, old records, title deeds, letters of guarantee, LCs, and on rare occasions forgeries in passports, treasury bonds, fixed deposit receipts from banks etc

14. Apply the theory of absurdity and impossibility • When you identify what is not possible or very unlikely, the fallacy or deceit in given submissions will be exposed. • Also, in investigations evidence is often destroyed or changed or altered or hidden. To find the supporting evidence is therefore practically difficult. • Make it a habit to think of what is not possible or impossible or unreasonable

15. 2. Manipulations and fraud in spreadsheets Example using Excel Sheets

16. An illustration of presentation fraud in a spreadsheet • Consider a spreadsheet containing some data of two years’ comparisons • The CEO wanted to show a good performance….Excel-Book1_cd.xlsx • Excel Forensic.xls • Star-Contest-Result.xlsx

17. 3. Some simple forensic tests - Juxtaposition test for testing authenticity of documents format and content • Test of reasonableness or absurdity • Test of replication of content • Test of impossibility • Scrutiny of suspicious documents particularly those having alterations

18. Test of IMPOSSIBILITY: identify events which are not possible and check them out For example: Can be applied on volume of stocks in a warehouse or production with actual machine capacity

19. Scrutiny of Alterations and suspicious documents or large value cash payments Forensic study of alterations – try and discern consistency of cancellations, smudges, spaces and overwritings

20. Juxtaposition test • In simple words it means placing side by side for comparison and spotting differences, where there should be none. This can be very effective in spotting manipulations

21. Where would one apply the juxtaposition test? • Document comparisons: Contracts agreements – copies lying with different departments • Vendor letterheads, bills and letter formats- all bidders’s documents and search for common addresses, telephone numbers, fax numbers, fax/tel numbers, email addresses? • HR frauds- Juxtapose degree certificates, signatures on certificates, multiple reference letters, etc • Fictitious Expense or purchase bills. Juxtapose bills from large volume vendors • Documents lying in multiple departments- eg copies of minutes of meetings or letters or memoes issued to different departments • Signatures on important documents –

22. Test of absurdity or reasonableness Think of events which may be possible but not probable. Can a person arrive and depart at exactly the same time every day ? If smart/swipe card analysis shows such a pattern it is likely to be a phantom employee

23. 4. Early warning bells and red flags • Close nexus with suppliers, customers and third parties • Missing records, details, etc • Discrepancies in inventories, cash, and assets • Behavioural indicators- chronic late sitting, arrogance and known bad habits like gambling, alcoholic traits etc • Too much of power and authority in one or few individuals • Mismatch between standard of living and known sources of income • Arrears and sloppiness in bookkeeping, reconciliations etc

24. Common accounting manipulations likely in • Cash Contras • Stock in transit • Accounting favours to debtors • Non reversal of stale cheques to create secret reserves • Not redepositing unpaid cash expenses such as wages, reimbursements etc • Recycling of petty cash advances or IOUs

26. 5. Unusual Methods of investigating

28. Thirteen point programme to detect symptoms of fraud during audit of financial statements • Secret reserve search • Mirror image evaluation approach to find inconsistent results • Relative Size Factor in stocks, debtors, creditors to detect error or manipulation • Illogical events- loans taken when huge liquid assets are available such as fixed deposits • Impossibility of certain results based on events known • Duplicate Numbers- could stem from error or fraud • Cash /stock shortages indicated by illogical withdrawing/purchasing • Negative asset / expense balances could be errors or fraud • Ghost workers search • Use Test Packs to check software bugs where audit train is invisible • Benford’s theorem test results • Spreadsheet forensics and Ratio Analysis for trends • Physical verifications of assets, processes, and walk through tests, including tiger team tests

29. Forensic Testing of spreadsheet data eg even MIS reports can be falsified • The excel UFSRD method U- unhide F- font coloration S-Show Formula R- rectify and replace D-duplication check..\collections\financialsA.xls

30. SPACE TIME DIMENSION BOTH SPACE AND TIME OFFER TESTING YARDSTICKS FOR AUDIT PURPOSES. • e.g. How much quantity can be stored in a warehouse, container, truck, box can be very useful for corroborative tests of inventory, sales, purchases. • Time can be used in several ways, time of transaction, time taken for the transaction, time difference between two events etc. Case Study

31. A robbery took place in a mall in January 2006 Thieves broke in through the door They stole case worth more than Rs. 40 lacs Police complaint lodged Police made inquiries with staff, neighbourhood

32. Findings of the Police They concluded that this was the work of a local gang of thieves operating in the area and this mall was the latest victim They suspected that some employee may have helped but could not get specific clues against anyone They recommended better locks and greater security. Case virtually closed

33. Management appointed auditors who were specialised investigators more for studying controls and recommending preventive measures

34. Auditors spot red flags The time element indicated that the thieves had only 20 minutes to complete the robbery while the patrolling guards were circling the mall. How could they throw about all contents of all drawers? Where did they have time to steal a few cell phone handsets which were on a different floor? The alarm had been switch off. Therefore it was certain that someone had helped them The door that was broken was done with crude tools- not the work of a professional gang Out of two safes only one was broken into and robbed. The second was left untouched?

35. Findings good but inadequate to point out any means of recovery

36. Auditors try a new approach The use the space time dimension approach IDEA_DATA.xls Amazing findings- Late night sales

37. The log in id was traced – the store manager. On being questioned he confessed There was no robbery- it was a stage managed robbery to cover up stock shortages The shortages were built up over a period of time. The store manager panicked when he was told that a stock taking was to take place He converted the stock shortages into ‘artificial’ sales by entering sales at midnight along with his accomplice the head cashier during the previous two nights. This resulted into stock shortages being converted into cash shortages. This shortage was then palmed off as robbery by breaking open the door and throwing papers and documents in the cash room to make it look like a robbery

38. Relative Size Factor (RSF) Use of mathematical tools

39. Relevance • Scrutiny of individual parties account is humanly ineffective. • It highlights all unusual fluctuations which may be stemming from frauds or errors

40. What is RSF ? • RSF is the ratio of Largest Number to the Second Largest Number of a relevant set. RSF = Largest Number Second Largest Number

43. RSF- Relative Size Factor RSF= highest value divided by the second highest value in a ledger account of debtors, or creditors Even a comparison of prices, quantities or values in an inventory If the RSF > 10, chances of error or fraud are great

44. How does RSF Work ? • Any set of transactions take place in certain range. E.g. A vendor XYZ may have normal pattern of bill value range of Rs. 13k to 50k. • If there is any stray instance of single transaction which is way beyond the normal range than that ought to be looked into. E.g. in above case, if there is bill of Rs. 5 lacs. • RSF is above case will give a ratio of 10 (I.e. ratio of Rs. 5lac to Rs. 0.50 lacs) • These single instances could be cases where there is some foul play.

45. Types of frauds that RSF can unearth • Data entry mistakes • Alterations in decimals • Wrong coding with masters (vendors, customers, employees, etc.) • Revenue items charged to capital accounts and vice versa • Excess payments in payroll

46. Useful algorithm Luhn’s algorithm For verifying correctness of credit cards and other cards which have been generated using the check sum digit

47. Tiger Team Tests Tests used to assess the robustness of a system by actually carrying out penetration tests or walk through tests of processes as in ethical hacking for IT process testing

48. Surprise Repetitive Tests • Surprise tests lose their sting when an auditee can predict an auditor’s plan • Timing is very effective: one way to throw a suspected auditee completely off guard is to repeat a test in quick succession. Complacency, cover-ups and even frauds are likely to be exposed in the repeat test.

49. Mirror Imaging tests • Tests of processes, operations and controls across similar units • Anomalies should be explained, else something is amiss: • Case of discounts in chocolate shops • Case of repairs to moulds in two identical processing units

50. Open Session…. Thank you www.chetandalal.com cd1@chetandalal.com