Forensic Analytics

The Wiley Corporate F&A series provides information, tools, and insights to corporate professionals responsible for issues affecting the profitability of their company, from accounting and finance to internal controls and performance management.

Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offices in North America, Europe, Asia, and Aus-tralia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers’ professional and personal knowledge and understanding.

Forensic AnalyticsMethods and Techniques for Forensic

Accounting Investigations

SECOND EDITION

MARK J. NIGRINI, B.Com. (Hons), MBA, PhD

Copyright © 2020 John Wiley & Sons, Inc. All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762–2974, outside the United States at (317) 572–3993 or fax (317) 572–4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Cataloging-in-Publication Data

Names: Nigrini, Mark J. (Mark John) Title: Forensic analytics : methods and techniques for forensic accounting investigations / Mark J. Nigrini, B.Com. (Hons), MBA, Ph.D. Description: Second Edition. | Hoboken : Wiley, 2020. | Series: Wiley corporate f&a | Revised edition of the author's Forensic analytics, c2011. | Includes bibliographical references and index. Identifiers: LCCN 2019056749 (print) | LCCN 2019056750 (ebook) | ISBN 9781119585763 (hardback) | ISBN 9781119585879 (adobe pdf) | ISBN 9781119585909 (epub) Subjects: LCSH: Forensic accounting. | Fraud. | Misleading financial statements. Classification: LCC HV6768 .N54 2020 (print) | LCC HV6768 (ebook) | DDC 363.25/963—dc22 LC record available at https://lccn.loc.gov/2019056749LC ebook record available at https://lccn.loc.gov/2019056750

Cover Design: WileyCover Image: © HAKINMHAN/Getty Images

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

To my friends and colleagues in the Department of Accounting, West Virginia University, Morgantown, West Virginia.

Thanks especially to my late-night and weekend-working friends in the west wing of the building, Nick Apostolou, Ednilson Bernardes, and Virginia

Kleist, for their support and encouragement over the past seven years.

vii

Contents

List of Cases xiii

About the Author xv

Preface xvii

Abbreviations xxi

Analytics Software Used xxv

Introduction 1

Temptation in an Occupation 2Fraudulent Checks Written by the CFO 4Fraudulent Purchases Made by a Purchasing Manager 7Donna was a Gamblin’ Wreck at Georgia Tech 9Forensic Analytics 11An Overview of Tableau 13The Risk Assessment Standards 19Discussion 21

Chapter 1: Using Microsoft Excel for Forensic Analytics 23

The Fraud Types Relevant to Forensic Analytics 23The Main Steps in a Forensic Analytics Application 25The Final Report 27An Overview of Excel 28Importing Data into Excel 29Some Useful Excel Formatting Features 30Protecting Excel Spreadsheets 32The Valuable "IF" Function 33The PIVOTTABLE Routine 36The Valuable VLOOKUP Function 38Using Excel Results in Word Files 40Excel Warnings and Indicators 42Excel Dashboards 43Dashboards in Practice 46Summary 47

Chapter 2: The Initial High-Level Overview Tests 50

The Data Profile 51The Histogram 56The Periodic Graph 58Descriptive Statistics 60Preparing the Data Profile Using Excel 62Preparing the Data Profile Using Access 64Preparing the Histogram in Excel and Access 68Preparing the Histogram in IDEA and Tableau 72Preparing the Periodic Graph in Excel and Access 74Summary 76

Chapter 3: Benford’s Law: The Basic Tests 79

An Overview of Benford’s Law 80Some Early Discussions of Benford’s Law 83Selected Articles from the Eighties 85Selected Articles from the Nineties 88Scenarios Under Which Data Should Conform to Benford 90The Two Scenarios Under Which Accounting Data Sets

Should Conform to Benford 93Other Considerations for the Conformity of Accounting Data 94Accounting Data Examples 95Preparing the Benford Graph Using Excel 98Preparing the Benford Graph Using Access 99Summary 101

Chapter 4: Benford’s Law: Advanced Topics 103

Conformity and the Likelihood of Material Errors 103The First Digits Versus the First-Two Digits 107Measuring Conformity Using the Z-Statistic 109The Chi-Square and the Kolmogorov-Smirnoff Tests of Conformity 111The Mean Absolute Deviation (MAD) Test 112The Effect of Data Set Size of Conformity to Benford 114Using Benford’s Law in a Forensic Accounting Setting 116Using Benford’s Law for Journal Entries in an External Audit 119Using Benford for Subsidiary Ledger Balances in an External Audit 123Preparing the Benford Graph in Excel 125Summary 126

Chapter 5: Benford’s Law: Completing The Cycle 127

The Number Duplication Test 127The Number Duplications in Accounting Textbooks 132The Electric Utility Company Fraud Case 134The Petty Cash Fraud Scheme 136The Last-Two Digits Test 139

viii ◾ Contents

Contents ◾ ix

The Fraudulent Credit Card Sales Scheme 141The Missing Cash Sales Case 142Running the Number Duplication Test in Excel 144Running the Number Duplication Test in Access 146Running the Last-Two Digits Test in Excel 148Running the Last-Two Digits Test in Access 149Running the Number Duplication Test in R 151Summary 153

Chapter 6: Identifying Anomalous Outliers: Part 1 154

The Summation Test 155The Fraud That Was Red Flagged by Two Qualitative Outliers 158The Largest Subsets Test 161The Largest Subset Growth Test 165The School District Transportation Fraud 168The SkyBonus Fraud Scheme 170Running the Summation Test in Excel 170Running the Summation Test in Access 171Running the Largest Subsets Test in Excel 172Running the Largest Subsets Test in Access 173Running the Largest Growth Test in Excel 174Running the Largest Growth Test in Access 176Running the Largest Subsets Test in R 179Summary 180

Chapter 7: Identifying Anomalous Outliers: Part 2 182

Examples of Relative Size Factor Test Findings 184The Scheme That Used a Vault That Was Over Capacity 186The Scheme That Added Sold Cars to the Car Inventory Account 189The Vice Chairman of the Board Who Stole 0.5 Percent of His Salary 193Running the RSF Test in Excel 194Running the RSF Test in Access 199Running the RSF Test in SAS 208Summary 212

Chapter 8: Identifying Abnormal Duplications 214

The Same-Same-Same Test 215Duplicate Payments and Various Types of Fraud 217The Same-Same-Different (Near-Duplicates) Test 220The Near-Duplicates Fraud Scheme: Introduction 221The Near-Duplicates Fraud: The Act 222The Near-Duplicates Fraud: Getting the Legal Process Started 224The Near-Duplicates Fraud: Two Sentencing Hearings 228The Near-Duplicates Fraud: Epilogue 230The Subset Number Duplication Test 231Running the Same-Same-Same Test in Excel 233

x ◾ Contents

Running the Same-Same-Different Test in Excel 235Running the Subset Number Frequency Test in Excel 237Running the Same-Same-Same Test in Access 239Running the Same-Same-Different Test in Access 240Running the Subset Number Frequency Test in Access 242Summary 245

Chapter 9: Comparing Current Period and Prior Period Data: Part 1 247

A Review of Descriptive Statistics 249An Analysis of the Purchasing Card Data 250My Law: An Analysis of Payroll Data 255An Analysis of Machine Learning Data 257An Analysis of Grocery Store Sales 261The Scheme That Used Bank Transfers to a Secret Bank Account 263Running the Descriptive Statistics Tests in Excel 268Running the Descriptive Statistics Tests in Minitab 269Running the Descriptive Statistics Tests in SAS 270Summary and Discussion 272

Chapter 10: Comparing Current Period and Prior Period Data: Part 2 274

Vectors and Measures of Change 275An Analysis of the Purchasing Card Data 280Taxpayer Identity Theft Refund Fraud 282The Tax Return That Omitted a Million Dollar Prize 284The Tax Returns for 2000 and 2001 285The Indictment for Tax Evasion 291The Tax Evasion Trial 292The Verdict and Sentencing 298An Analysis of Joe Biden’s Tax Returns 299Running the VVS Test in SAS 303Summary and Discussion 304

Chapter 11: Identifying Anomalies In Time-Series Data 306

An Analysis of the Purchasing Card Data 307Using IDEA for Time-Series Analysis 311The Fraud Scheme That Withdrew Funds from Customer Accounts 312Employee Data Access After Termination 317A Time-Series Analysis of Grocery Store Sales 321Using Correlation to Detect Fraud and Errors 322Using the Angle θ on Trial Balance Data 324Using the VVS on Customer Rebates 327Showing the VVS Results in a Dashboard 332Running Time-Series Analysis in SAS 334Summary and Discussion 336

Contents ◾ xi

Chapter 12: Scoring Forensic Units for Fraud Risk 338

An Overview of Risk Scoring 339The Audit Selection Method of the IRS 340The Fraudulent Vendor with a Post Office Box in the Head Office 344Risk Scoring to Detect Vendor Fraud 348Risk Scoring to Detect Errors in Sales Reports 354The Predictors Used in the Sales Report Scoring Model 356The Results of the Sales Report Scoring Model 364Summary and Discussion 365

Chapter 13: Case Study: An Employee’s Fraudulent Tax Refunds 367

Background Information 368The Nicest Person in the Office 369The Early Years of Tax Refund Fraud Scheme 372The Later Years of Tax Refund Fraud Scheme 375An Analysis of the Fraudulent Refund Amounts 376The End Was Nigh 383The Letter of the Law 386Sentencing 391Mary Ayers-Zander 392Epilogue 393Appendix 13A: The Fraudulent Refunds 394

Chapter 14: Case Study: A Supplier’s Fraudulent Shipping Claims 401

Background Information 401The Fraudulent Shipping Charges Scheme 403An Analysis of the Shipping Charges 405Charlene’s Lifestyle 408The Scheme Is Discovered 409The Corley Plea 412Charlene’s Appeal for a Reduced Sentence 415The Government’s Response to Charlene’s Memorandum 417The Sentencing Hearing 417The Sentence 419Motion to Delay the Prison Term 420Conclusions 423

Chapter 15: Detecting Financial Statement Fraud 425

An Overview of Financial Statement Fraud 426Biases in Financial Statement Numbers 427Enron’s Financial Statements 430Enron’s Chief Financial Officer 432HealthSouth’s Financial Statements 433

xii ◾ Contents

WorldCom’s Financial Statements 436WorldCom’s Rounded Numbers 440Using Benford’s Law to Detect Financial Statement Misconduct 442Beneish’s M-Score 446Detection and Investigation Steps 447Detecting Manipulations in Monthly Subsidiary Reports 449Summary 454

Chapter 16: Using Microsoft Access and R For Analytics 455

An Introduction to Access 456The Architecture of Access 457A Review of Access Tables 459Importing Data into Access 461A Review of Access Queries 462Converting Excel Data into a Usable Access Format 465Using the Access Documenter 466Database Limit of 2 GB 468Reports 469Miscellaneous Access Notes 471An Introduction to R 472Installing R and R Studio 472The Advantages of Using R 474R Markdown 475Running Arithmetic Code in R 475Calculating the VVS in R 477Summary 479Appendix 16A: A Discussion of the Basic Commands 480

Chapter 17: Concluding Notes on Fraud Prevention and Detection 482

The Annual Cost of Employee Fraud 483The Legal Process 484”I’m a Lawyer, Trust [Account] Me” 485The Rights of the Defendant 487Possible Defenses Against an Embezzlement Charge 490The Economics of Crime Model 492Internal Controls 493Fraud Risk Assessments 495Detective Controls 496Crime Insurance 498Fraud Detection Methods 500Other Fraud Prevention Methods 501Final Words 504

Bibliography 507

Index 515

xiii

List of Cases

Chapter Details

Intro Ryan Homa, controller using fraudulent checks

Intro William Rullo, purchasing department misconduct

Intro Donna Gamble, purchasing cards

Intro Purchasing card data, District of Columbia

Intro Guanajuato, Mexico, grocery store daily sales

2 Purchasing card data, District of Columbia*

2 Purchasing cards, Air Force improper credits

3 Enron, financial statements 1997–2000, and 2001

3 Tax tables, secondary tax evasion

3 Compustat, revenue and inventory numbers

3 Corporate journal entries

4 NYSE, daily stock volumes

4 Census, county 2010 populations

4 Accounting textbooks, numbers used

4 HealthSouth journal entries

5 Accounting textbooks, numbers used

5 Electric utility, customer credits

5 Michelle Higson, petty cash

5 Michael Hoffner, credit card sales

5 Lynn Scheuffler, structuring bank deposits

6 Census, town and city 2018 populations

6 Corporate journal entries

6 Michael Spada, extravagant wedding and beach house

6 Massachusetts and city government, overtime claims

6 Cindy Mills, fraudulent vendor

6 School District, excessive vehicle repairs

6 Delta Airlines, SkyBonus loyalty program

7 Melodie Fallin, coin balance in bank vault

7 Patricia Smith, car dealer inventory

7 Thomas Coughlin, payments processes and gift cards

xiv ◾ List of Cases

Chapter Details

8 Ryan King, intentional duplicate payments to vendors

8 Susan Thompson, travel claims and personal expenses

9 Hotel chain, payroll data

9 Debit and credit card transactions, training and test data

9 Guanajuato, Mexico, grocery store daily sales

9 Rita Crundwell, city controller with secret bank account

10 Osula, identity theft refund fraud

10 Richard Hatch, tax evasion

10 Joe Biden, 2016 and 2017 tax returns

11 Katherine Harrell, withdrawals from customer’s accounts

11 Terminated employees, network access

11 Guanajuato, Mexico, grocery store daily sales

11 New England region, 2018 retail prices of gasoline

11 Trial balances 2019–2020, measuring period-to-period change

11 Condo company, compare tenant’s allowances to benchmark

12 IRS, audit selection model

12 Victor Sturman, fraudulent vendor

12 Wayne James Nelson, fraudulent vendor

12 William Bihr, ghost employees

12 Rita Crundwell, city controller with secret bank account

12 Fast food company, franchisee risk scoring

13 Harriette Walters, property tax refunds

13 Mary Ayers-Zander, income tax refunds

14 Charlene Corley, shipping charges

15 Compustat, sales numbers

15 Compustat, net income numbers

15 Enron, financial statements 1997–2000

15 HealthSouth, net income and assets

15 WorldCom, massive restatements and rounded EPS number

15 Henselmann sample, first digits

15 Amiram sample, first digits

15 Automotive supplier, monthly subsidiary reports

16 EIA, fuel oil data

16 Joe Biden, 2016 and 2017 tax returns

17 Timothy Provost, attorney’s trust account

17 Cisco Systems, large change from 2000 to 2001

*The purchasing card example is used again in chapters 3, 4, 5, 6, 7, 8, 9, 10, 11, and 16.

This list omits short references to cases of just a few sentences or a single short paragraph.

xv

About the Author

MARK J. NIGRINI, PHD is an Associate Professor at the John Chambers College of Business and Economics at West Virginia University. Mark teaches fraud data analysis classes in the MS Forensic and Fraud Examination and

the MS Business Cybersecurity Management programs. In the Master of Professional Accountancy program he teaches an accounting technology class and an accounting decision-making class. In the department’s accounting PhD program Mark teaches an archival accounting research class with a strong forensics’ emphasis. Mark enjoys being occasionally let loose on the undergraduate students where his accounting classes have a forensic focus that includes contemporary topics such as the college admissions scandal, and the GM strike and the subsequent indictments of UAW officials on fraud charges.

Mark graduated with a B. Com. (Hons) from the University of Cape Town and an MBA from the University of Stellenbosch. His PhD in Accounting is from the Univer-sity of Cincinnati where he first came across Benford’s Law. His PhD dissertation was titled The Detection of Income Tax Evasion through an Analysis of Digital Distributions. His minor was in statistics, and a few of the advanced concepts studied in those statistics classes (and the use of SAS for data analysis) are used in this book. Mark passed the board exam of the South African Institute of Chartered Accountants and worked as a divisional controller for a while and he also practiced professional accounting for a short time in Cape Town. At the time that Mark became eligible to use the CA(SA) designation he was the youngest chartered accountant in the country. At the time that Mark was appointed as an accounting instructor at University of Cape Town he was the youngest instructor on the faculty.

His research passion is a phenomenon known as Benford’s Law, which deals with the predictable patterns of the digits in numeric data. The smaller digits (1s, 2s, and 3s) are expected to occur more frequently in scientific and financial data. Benford’s Law has proved itself to be valuable to auditors in their quest to uncover fraud in corporate data. Mark’s current research agenda addresses advanced theoretical work on Benford’s Law, employee embezzlement, and the use of analytics in auditing and forensic accounting.

Mark’s first book was titled Digital Analysis Using Benford’s Law (Global Audit Publications, 2000). He is also the author of Forensic Analytics (Wiley, 2011), which describes analytic tests used to detect fraud, errors, estimates, and biases in finan-cial data, and Benford’s Law (Wiley, 2012). In 2014 Mark published an article in the Journal of Accountancy that was co-authored with Nathan Mueller, who at the time was

xvi ◾ About the Author

incarcerated in a federal prison. Their article later won the Lawler award for the best article in the Journal of Accountancy in 2014. His work has been featured in amongst others the Financial Times, New York Times, and Wall Street Journal, and he has published papers on analytics-related topics in academic journals and professional publications. These journals include the highly regarded Journal of Accounting, Auditing, and Finance and Auditing: A Journal of Practice and Theory. Mark published the lead article in the new premier forensic accounting journal, the Journal of Forensic Accounting Research. Another analytics-related article that received much attention was published in the leading liver disease journal Hepatology. His radio interviews have included the BBC in London and NPR in the United States. His television interviews have included an interview on a fraud saga for the Evil Twins series for the Investigation Discovery Channel. In 2019 Mark liaised closely with the researchers, the producers, the post production team, and the film crew for Netflix’s coming documentary of Benford’s Law, which will air sometime in late 2020.

Mark has been a regular presenter at the ACFE’s global conferences. He has consulted with listed international conglomerates and state and local governments on fraud detection and preventive and detective controls. He also regularly presents workshops for accountants and auditors in the United States and abroad. In 2018 he presented an IAAIA keynote session in Panama, and his 2019 overseas engagements included conferences in Bahrain and Italy. Previous international engagements included presentations in the United Kingdom, The Netherlands, Germany, Luxem-bourg, Sweden, Thailand, Malaysia, Singapore, and New Zealand.

See also https://en.wikipedia.org/wiki/Mark_Nigrini.

xvii

Preface

OCCUPATIONAL FRAUD DIFFERS FROM most other crimes because the victim doesn’t know of their loss until the scheme is discovered. The annual losses from occupational fraud in the United States are conservatively esti-

mated at over $20 billion per year. With financial statement fraud the victim usually suffers a loss when someone else discovers the scheme. The losses in the well-known cases like Enron and WorldCom amounted to billions of dollars in market capitalization.

This book outlines a framework for and a systematic series of audit data analytics tests that should function well as a starting set of detective controls. The tests are not based on complicated statistics and should be quite easy to understand for anyone that has done well in a handful of accounting courses. The tests should be quite easy to execute for someone that knows the basics of Excel or Access and has an aptitude for learning new software packages like IDEA or SAS. The underlying logic for these detection-type tests is based on the fingerprints that a specific fraud would leave in the data under review and how we can go about looking for those fingerprints. It is not cost effective to tighten internal controls to the point that all possible fraud losses are prevented. What is needed is a combination of effective and efficient preventive controls, detective controls, corrective controls, and regular fraud risk assessments.

This second edition of this book is a significant update to the first edition, which was written in 2010. Whole chapters such as the PowerPoint chapter, the correlation chapter, the Access queries chapter, and the purchasing card chapter have been axed. Enthusiastic readers should hold on to the first edition. Whole topics such as con-formity to Benford, the second-order test, and running the time-series tests in Excel have been cut down in size or cut out altogether. The across-chapters example data set from the first edition, an accounts payable payments file for a utility company, has been axed because it made that book feel a bit like a set of instructions for an accounts payable audit. The new across-chapters data set is an authentic purchasing card data set of purchases by the government of the District of Columbia. All the screenshots that survived from the first edition were updated for Excel 2016 and Access 2016, and the latest versions of the other analytics packages are demonstrated in a Windows 10 environment. Some of the analytics tests are now demonstrated in R, Tableau, and SAS for a welcome change of scenery. Some of the tests in the first edition were dem-onstrated in IDEA and Minitab and those parts were retained. I estimate that fewer than 20 figures have been simply copied over from the first edition.

xviii ◾ Preface

The most notable addition is the inclusion of about 35 fraud cases throughout the various chapters that are closely linked to the analytics tests discussed in the chapters. That is, if the tests that were just reviewed had been run by the organi-zation, then this fraud scheme would probably have been discovered sooner rather than later. Another 30 or so cases are included in the chapters to demonstrate the analytics techniques, but they are more of the demonstration type than the “fraud discovery” type of cases. The cases are not vague. Actual names, actual places, and actual dollar transactions are discussed, and these discussions are brought to life with over 200 figures and 40 tables. Some of the figures are interesting in that they are photos of the places where the fraud schemes took place or the courts where the cases were heard. For example, one interesting figure is an image of the check paid by an insurance company under an employee theft policy. Two of the new chapters each describe a major fraud scheme and the related analytics tests on the available data in detail. Chapter 13 describes a case where an employee processed fraudulent property tax refunds of $49.3 million and her scheme was discovered because of some care-lessness on her part and the professional skepticism of a banker who was not even the banker of the victim organization. Chapter 14 describes a case where a supplier claimed fraudulent shipping charges of $20.58 million and her scheme was only dis-covered because of an erroneous duplicate shipping claim on a sale of two washers for $0.38. The common thread running through the 35 fraud cases is that they were not particularly ingenious. Finally, an all-new Chapter 10 discusses the vector variation score (developed by the author and a physics department colleague) that measures the change in a set of reported values from one period to the next.

The companion site for the book is http://www.nigrini.com/forensicanalytics.htm. The website includes most of the data sets and the various tables used in the book. Links to the data tables are also included. Readers can then run the analytics tests on the same data set and can then check their results against the results shown in the book. The companion site also includes Excel templates that will make your results exactly match the results in the book. One such template is the NigriniCycle.xlsx template for all the tests in the Nigrini cycle. The templates were updated in Excel 2016. The companion site also includes PowerPoint slides for all 17 chapters. The website also has exercises and problems typical of those found at the end of college textbook chapters. These materials could be used by college professors using the book as the textbook in a formal college course. With time more sections will be added to the website, and these might include links to useful resources and demonstration videos posted on YouTube.

Forensic Analytics 2nd Edition is the result of many years of work on forensic ana-lytics projects starting with my PhD dissertation titled The Detection of Income Tax Evasion through an Analysis of Digital Distributions. This book was written so that it would be understood by most financial professionals. Ideally most readers will have some experience in obtaining transactional data and some experience with the basics of data analysis such as working with tables, combining (appending) or selecting (extracting subsets) data, and performing calculations across rows or down columns. Users should understand the basics of either Excel or Access. There are many books

Preface ◾ xix

covering these basics and many free resources on the Microsoft website. In addition to the technical skills, the ideal user should have enough creativity and innovation to use the methods as described, and to add twists and tweaks that consider some dis-tinctive features of their environment. Besides innovation and creativity the target user will also have a positive attitude and the disposition to, at times, accept that their past few hours of work have all been the equivalent of barking up the wrong tree and, after taking a deep breath (and a few minutes to document what was done), go back (perhaps with new data) and start again. Forensic analytics is more like an art than a science, and forensic accountants need to enjoy the iterative process of modifying and refining the tests.

To this day I am still thankful to my PhD dissertation committee for their guidance and supervision of my forensic-based dissertation that was a move into uncharted waters. I still remember the many Friday afternoon progress sessions with Martin Levy, a professor of Applied Statistics and Quantitative Analysis. A special note of thanks is also due to the first internal audit directors who used my forensic analytic services in the mid-1990s: Jim Adams, Bob Bagley, and Steve Proesel. I needed their vote of confidence to keep going. Thanks, too, to my friends and colleagues in our Department of Accounting for the focus on forensic accounting. I feel more at home here than at any place before now.

Mark J. Nigrini, PhDMorgantown, West Virginia, USA

November 8, 2019

xxi

Abbreviations

Chapter Long Form Abbreviation

Intro Federal Bureau of Investigation FBI

Intro Automated Teller Machine ATM

Intro Robinson Metals Robinson

Intro Certified Public Accountant CPA

Intro Transportation Authority SEPTA

Intro U.S. Securities and Exchange Commission SEC

Intro American Institute of Certified Public Accountants AICPA

1 Excel 2016 Excel

1 Association of Certified Fraud Examiners ACFE

1 Chief Financial Officer CFO

1 Chartered Professional Accountants of Canada CPA Canada

1 Audit Data Analytics ADA

1 Gigabyte GB

1 Relative Size Factor RSF

1 Enterprise Resource Planning ERP

1 Public Company Accounting Oversight Board PCAOB

1 General Services Administration GSA

2 U.S. Government Accountability Office GAO

2 Structured Query Language SQL

3 Benford’s Law Benford

3 Earnings Per Share EPS

3 Enron Corporation Enron

4 New York Stock Exchange NYSE

4 Center for Research in Security Prices CRSP

4 Kolmogorov-Smirnoff K-S

4 Mean Absolute Deviation MAD

6 Gross Domestic Product GDP

6 Current Procedural Terminology CPT

6 Fair Market Value FMV

7 Relative Size Factor RSF

7 International Air Transport Association IATA

xxii ◾ Abbreviations

Chapter Long Form Abbreviation

7 Internal Revenue Service IRS

7 Chief Executive Officer CEO

7 U.S. Securities and Exchange Commission SEC

8 Same-Same-Same SSS

8 The U.S. Department of Justice DOJ

8 Same-Same-Different SSD

8 Subset Number Duplication SND

8 Number Frequency Factor NFF

9 Generally Accepted Accounting Principles GAAP

9 Computer Assisted Audit Techniques CAATs

9 Public Company Accounting Oversight Board PCAOB

9 Coefficient of Variation CV

9 Exchange Traded Fund ETF

9 Artificial Intelligence AI

9 Bureau of Prisons BOP

10 Dow Jones Industrial Average DJIA

10 Vector Variation Score VVS

10 Internal Revenue Service IRS

11 Mean Absolute Percentage Error MAPE

11 Federal Deposit Insurance Corporation FDIC

11 American Institute of Certified Public Accountants AICPA

11 Information Technology IT

11 General Ledger GL

12 Discriminant Index Function DIF

12 Large Business and International Division LB&I

12 Merchant Audit Risk Score MARS

12 Taxpayer Compliance Measurement Program TCMP

12 Duplicate Invoice Management DIM

12 Systems, Applications, and Products SAP

13 Office of Tax and Revenue OTR

13 Real Property Tax Administration RPTA

13 Office of the Inspector General OIG

14 C&D Distributors C&D

14 Department of Defense DoD

14 Defense Finance and Accounting Service DFAS

14 Defense Logistics Agency DLA

14 Standard Automated Material Management System SAMMS

14 Enterprise Business System EBS

14 Bureau of Alcohol, Firearms, and Tobacco ATF

Abbreviations ◾ xxiii

Chapter Long Form Abbreviation

15 Financial Accounting Standards Board FASB

15 Accounting and Auditing Enforcement Releases AAER

15 Accounts Receivable AR

16 Visual Basic for Applications VBA

16 U.S. Energy Information Administration EIA

16 Gigabytes GB

16 Business Intelligence BI

17 The Committee of Sponsoring Organizations of the Treadway Commission

COSO

17 Enterprise Risk Management ERM

17 Expected Utility EU

xxv

Analytics Software Used

Chapter Excel Access IDEA SAS R Tableau Minitab

Intro X

1 X

2 X X X X

3 X X

4 X

5 X X X X

6 X X X

7 X X X

8 X X

9 X X X

10 X

11 X X X X X

12

13

14

15

16 X X

17

X, using the software to perform an analytics-related task is demonstrated in the chapter.

1

Introduction

I T WAS THE BEST of crimes, it was the worst of crimes. We live in an age of electronic data processing where the clever use of a computer no longer means that we need an ingenious heist pulled off by an organized gang of 17 people to steal £2.5 million

from a train some 50 miles north of London (the 1963 great train robbery). In August 2018 the Federal Bureau of Investigation (FBI) sent a confidential alert to various banks telling them that they had information that cyber criminals were planning to conduct “a global Automated Teller Machine (ATM) cash-out scheme in the coming days.” The alert speculated that the scheme was most likely associated with a card issuer breach. This is a twenty-first century version of a bank heist in which the criminals do not wear ski masks, do not threaten a teller, and do not set foot in a vault. Our new electronic age gives people, including employees and vendors, the opportunity to steal large amounts of money electronically.

Greek mythology gives us one of the first recorded cases of theft where Prometheus steals fire for human use and is severely punished by Zeus, the king of the Olympian gods. In those times the legal system wasn’t terribly overloaded, and the punishments handed out were quite harsh, such as being bound to a rock for eternity. This deterred many others that were not tied to rocks from pulling off similar stunts. Prometheus wasn’t an employee as such, and so we must go east and over the Euphrates to Mesopo-tamia for our first case of occupational fraud.

Soon after people began to organize and plant crops and raise flocks of animals, the flock owners realized that they needed to eat and sleep occasionally, and that they also needed time to tend to their other affairs. They hired shepherds to protect their sheep from hungry wolves and hungry people. Their shepherds were paid in barley and usually at the minimum wage of the day, which was no way for them to join the flock-owning elite. Guskin, lucky enough to be a part of a land-owning family, used the shepherd services of a young man by the name of Ishme. On Friday afternoons they would count the sheep together and the total number in the flock had to equal last week’s total plus the number of lambs born during the past week. Any shortage would be recorded as an unfavorable budget variance and these had to be kept to a minimum. Guskin would also make a record (using phonograms) of the number of heavily pregnant ewes, so that he had some idea of what to expect by way of live births in the coming week. Ishme had a brother, Amar, and they were madly in love with two young ladies, Dagan and Ningal, from the nearby town of Ebla. Unfortunately for them, the young ladies were not terribly interested in marrying the two young men,

2 ◾ Introduction

given that they had no real job and not much by way of assets, even if you included Ishme’s walking stick and his ability to count.

The brothers desperately needed their own flock of sheep before the two young ladies would even meet with the two of them for a meal of lamb chops and wine. This was way before the formal concept of pressure was known or before the word conspiracy was a part of the law. Late one night, sitting around their fire eating some delicious barley soup and drinking a beer, the brothers came up with a flock acquisition plan. Ewes give birth to either one or two lambs at a time, and their cunning plan was that each time a ewe gave birth to two lambs, Amar would take that second lamb and add it to his flock two hills down the path. Luckily for the two brothers, the owner Guskin never put one and one together and realized that he had the only flock in the region with one lamb every time ewes. Four years later, the two brothers had a large flock of sheep and Dagan and Ningal were only too happy to get married to the two successful farmers. The brothers explained that their flock of sheep was the result of some clever trading in olive oil futures. Having pulled off the first ever case of occupational fraud, the brothers lived happily, but a little nervously, ever after. They hoped that Guskin never questioned why his ewes were now regularly delivering two lambs now that Ishme was no longer the shepherd. In fact, Ishme, in his old age, as a result of not being able to fall asleep, invented the saying “counting sheep.” People have been stealing from their employers ever since. In fact, one of their sons was caught stealing dates from a farmer’s palm tree and for many years he was known as the black sheep of the family.

TEMPTATION IN AN OCCUPATION

Occupational fraud is the use of one’s job for a personal gain through the deliberate misuse or misapplication of the employer’s resources or assets. This illegal act is marked with deceit, concealment, and a violation of trust. The victim is an organization in the public or private sector. Fraud also extends to organizations with a volunteer workforce such as churches or amateur sports organizations. Fraudsters therefore do not neces-sarily have to receive a salary or a wage. Occupational fraud is an offense against an organization. It differs ideologically, politically, and economically from offenses by orga-nizations such as antitrust violations, dumping toxic waste, marketing ineffective drugs, or falsifying vehicle emission levels that victimize the public, consumers, the environ-ment, or their employees.

Our focus in this book is on the misappropriation of assets and, to a lesser extent, on bribery and corruption. From a legal standpoint four points must be proven to support a case of embezzlement:

■ That the relationship between the defendant and the aggrieved party was a fiduciary one.

■ That the lost property came into the defendant’s possession through the relationship.