Forensic accounting: The thin red line

Forensic accountants don’t come for tea, biscuits and a nice chat

What happens when a forensic accountant walks through your door?

By Anne Lampe


The arrival of auditors is treated at any time with apprehension. When a forensic accountant walks through the front door, you know some significant trouble looms.

Forensic accountants don’t come for tea, biscuits and a nice chat. Their arrival usually means something serious is afoot, perhaps that fraud or embezzlement is suspected or has been identified and the end result is likely to involve police and court proceedings.

It is the role in legal proceedings that defines the special nature of this type of accounting and differentiates it from other forms.

Forensic accounting becomes a new discipline

Forensic accounting became formally identified as a distinct discipline in the early 1990s. A key objective was to provide expert witness testimony in commercial disputes.

“The main focus in the early days was on quantifying economic loss in commercial disputes, assisting with the preparation of our client’s case and giving expert testimony,” says Dean Newlan, partner in McGrathNicol Forensic.

“It also involved quantification of fraud losses, but has evolved into carrying out an investigation from start to finish, searching for and analysing evidence and presenting that evidence in a compelling way.”

That means collecting, analysing and presenting data that is accurate, uncontaminated and complete so that it can sail through tough questioning by lawyers and judges on the processes used to obtain it. If this can be achieved, often cases are so strong they are settled before they get to court.

“In the past 15 years there has been an increasing focus on technology in traditional forensic engagements,” says Shane Bell, director, McGrathNicol Forensic.

“In addition, there has been a growing number of investigations that are purely technology-based. Much of the evidence we need to support our client’s case is held electronically, or was created only in electronic form – electronically stored information or ESI – and there is no hard copy to find.”

Forensic accountants follow the money trail

Newlan estimates there are about 300 forensic accountants practising privately in Australia. The number doubles when government and Australian Taxation Office forensics are included, and it is continuing to rise.

Newlan, who now teaches forensic accounting at Melbourne University, arrived in the field via an accounting degree, 10 years with the Victoria Police, five of which involved investigating fraud cases, then a step into KPMG’s forensic unit and in 2006 McGrathNicol.

“If you had to describe what we do for a client who has suffered a significant fraud loss, I would say we’re about identifying where the money has gone and assisting our client to recover those monies,” he says.

"Ordinary employees can commit workplace fraud when three factors are present – motivation, opportunity and the ability to rationalise their behaviour in their own mind." – Dean Newlan

“But other objectives can and do arise. For example, our client may engage us to assist in preparing a case to hand to the police, they may wish to tighten their internal control system, or they may wish to send a zero tolerance message to their workforce.”

Often the client has fidelity guarantee insurance, in which case forensics quantify the loss to support the client’s claims under the fidelity guarantee insurance policy.

As Newlan mentions, a key feature of the process is finding where the money went. That can involve a lot of sifting through piles of hard copy documents and transactions. It will definitely mean assessing countless electronic transactions.

Fortunately, technology has sped up the process through the use of keyword and number searches where the computer can speedily scan a database and throw up entries of interest – but the trick is knowing the right keywords and numbers.

Accountants on the fraud trail

McGrathNicol employs about 35 forensics around Australia, of which 12 are technology specialists who recover complex data from computer systems, analyse it and present it to investigators, who then shape it for lawyers. Throwing a hard drive into the river does not deter them, it simply shifts the focus to backup tapes or servers.

Victor Borg, manager, forensic accountants with Victoria Police, uses forensic accounting methodologies to identify the proceeds of crime, disrupt organised crime and assist the courts. All of this points to the positive contribution forensic accounting makes to society.

In turn, he points out, society has high expectations about the quality of forensic accounting services and notes that forensic accountants must abide by professional codes of conduct, professional standards and court rules when providing their services.

Borg manages a group of accountants in the fraud unit at Victoria Police who use forensic accounting and analytical techniques to connect documents and an alleged offender to fraudulent or criminal acts. Borg also assists police in the execution of search warrants to obtain accounting and financial documents.

The usual suspects

“Much of what we see is just ordinary people doing things that are deemed criminal, but they do things that everyone is capable of,” Newlan says.

“Research done almost 60 years ago shows that ordinary employees can commit workplace fraud when three factors are present – motivation, opportunity and the ability to rationalise their behaviour in their own mind. I have seen that theory proven in many cases where ordinary employees have stolen from their ordinary employer.

“After working in this area for over 20 years, I have come to the conclusion humans are inherently greedy – well, many of them are – and some can be very devious,” Newlan says.

“The way people go about concealing what they have done is also a very interesting aspect of my work.

“I like to look at the question of workplace theft from an accounting perspective – the accounting equation, if you like.

“Any credit transaction in ‘cash at bank’ will need a corresponding debit on the other side, and it is the ‘debit’ that causes all the trouble for the would-be fraudster. The debit is their only chance of concealing what they have done and it needs to be hidden.”

Tracking that debit post, either through an expense item or the balance sheet, is where the forensic work begins. It might be a long track, because quite often fraudsters will move the debit from account to account in an effort to conceal what has been done.

“If you have a very large debit sitting there you have to decide what to do with it,” Newlan says.

“Typically someone who commits fraud will need access to cash in some way, but they will also need access to systems within the business by which they can conceal their fraudulent transactions.”

What he also looks for are employees who don’t take leave, employees who do take leave but come into the office anyway and employees who have a known gambling problem. It might be an expensive lifestyle or girlfriend that is the giveaway. It usually isn’t drugs, because people with a drug habit are generally not in full-time employment or have jobs dealing with money.

Having identified the suspect, the forensic accountant talks to them.

“A big part of the role is interviewing people,” Newlan says. “Going back 20 years, we would get a pile of papers from our client and analyse the loss and quantify it.

“Now clients are saying they want us to do the whole thing and that includes interviewing people, as well as getting the inside story that can corroborate other evidence that has been gathered to that point or that will be gathered in the future.

“So interviewing skills are a big part of what is now forensic accounting. That is why we value people from a law enforcement background. They are skilled in interviewing and when we talk about interviewing we talk about interviewing witnesses as well as people suspected of wrongdoing.”

Bell adds that a typical engagement might involve investigating a workplace fraud, typically instigated by a mid-level manager or perhaps a more senior manager, involving manipulation of online banking systems and where the fraudster has direct access to systems and by which they can conceal their conduct for two or three years or more.

Newlan says in the past a workplace theft of A$200,000 was regarded as a major fraud. Now losses of A$5 million to A$20 million are becoming increasingly common.

“So if you are aware someone is creating false invoices in the name of a bogus supplier and they are getting payments for those through bank accounts, once we have captured the ESI we can forensically analyse that data and find the evidence we are looking for that may support our client’s case. But this must be done forensically to make sure that the evidence is admissible in court.”

Access to accounts that receive the stolen money is critical. If the suspect refuses to provide authority for his or her accounts to be accessed, the forensics have to obtain a court order and to do that they must make a case before a judge. Newlan says recently he traced money through 60 bank accounts “but we got it in the end”.

Bell says he is now finding that ESI is being stored in ways that were not even thought of 10 years ago. A good example is data stored in the cloud and the ever-increasing popularity and capability of mobile technology.

“We need to be able to keep on top of these changes as they happen to ensure we can gather all relevant or potentially relevant ESI.”

Newlan has been running a program for CPA Australia on forensic accounting and financial investigation for four years. It involves working with investigators to determine the nature of the evidence being sought and which computers would contain evidence of the transactions being investigated.

"Interviewing skills are a big part of what is now forensic accounting. That is why we value people from a law enforcement background." – Dean Newlan
The IT people will capture what is called an image of computer hard drives, an exact copy of the whole disk.

They will also take an image of the file server that contains emails. These are excellent sources of evidence. Written documents are scanned so keyword searches can be made.

“If the fraudster expenses the transaction in the current period he or she runs the risk of someone in control of that particular profit centre asking ‘what is this about?’,” Newlan says.

“So typically you will charge it to a profit centre that you have control of yourself.”

He says when looking for indicators of fraudulent transactions, poorly presented documentation is right up there. Another signal is false invoices with errors.

Another one is incorrect GST calculations on a false invoice, as this can trigger a query with a supplier who is then found to be non-existent.

Newlan says the most typical case would involve a bogus supplier and false invoice documentation, combined with the setting up of a bogus bank account and the funds being transferred electronically.

That money is usually siphoned off elsewhere so it can be applied to pay for gambling, property purchases and lifestyle expenses.

Read next: The accountant's role in combating cyber crooks


July 2020
July 2020

Read the July 2020 issue of INTHEBLACK magazine.

Each month we select the must-reads from the current issue of INTHEBLACK. Read more now.

CONTENT