#aicpafvc

The State of the Unionof Forensic Accounting FromBoth Sides of the 49th Parallel

AICPAForensic and Valuation Services ConferenceNovember 11, 2013Las Vegas, Nevada

#aicpafvc

AGENDA

Moderator/Speaker Introductions

Computer Forensics and Fraud Investigations: File Attributes and Meta Data…Why Should I Care?

Current Fraud Schemes

Canadian HR Law: Investigating Employee Misconduct

Evaluating Forensic Accountant’s Qualifications as an Expert Witness

Summary

Contact Information

#aicpafvc

Edward Nagel

Principal and Founder of nagel + associates, Forensic and Investigative Accountants

Practice areas: Forensic investigations, anti-fraud consulting and anti-fraud training

CPA, CA, IFA, CBV

Practice focuses primarily on North America (with some Caribbean work)

Co-author of the Canadian CPA’s “Conversations about Forensic Accounting”

Brad Sargent

Managing Member of The Sargent Consulting Group, LLC.

Practice areas: Forensic accounting, financial investigations and expert witness

CPA/CFF, CFE, CFS, Cr.FA, FABFA

Co-author of the Canadian CPA’s “Conversations about Forensic Accounting”

Moderator Biographies

#aicpafvc

Steve Rogers

President

Digital Evidence International Inc.

Practice Areas: Forensic computer analysis; internet investigations; electronic discovery; major case management database development

Credentials: EnCase Certified Examiner, A+ Certified Professional, Certified Novell Administrator

Eric S. (Rick) Rein

Partner at Horwood Marcus & Berk Chartered

Practice Areas: Creditor's rights, loan enforcement, creditor bankruptcy representation and international asset recovery

Bar Admissions—Illinois and Florida; Court Admissions—1st, 4th and 7th Courts of Appeal, US District Courts of the Northern District of Illinois and Eastern District of Michigan

Speaker Biographies

#aicpafvc

Stuart Rudner, Esq.

Founding Partner, Canadian Employment Lawyer

Firm: Rudner MacDonald LLP

Practice Areas: Employment Law, Human Rights, Litigation

Credentials: B.A., LL.B.

Jurisdictions: Canada

Jordan Bolton, Esq.

Partner in the Litigation Practice Group of Clark Hill PLC

Broad-based outside general counsel and commercial litigation practice, with substantial experience in fraud and RICO actions

Based in Michigan, with admissions in a number of federal courts of appeal and district courts throughout the country 

Speaker Biographies

#aicpafvc

Computer Forensics and Fraud InvestigationsFile Attributes and Meta Data…Why Should I Care?

Steve Rogers

#aicpafvc

How many would agree that during a fraud investigation the date of a

record often requires authentication?

#aicpafvc

FILE ATTRIBUTES

Viewable from Windows Explorer

Created date changes on copy• Last modified date can be earlier than created date

Last accessed doesn’t mean it was accessed

#aicpafvc

META DATA

Data about the data

Is different than file attributes• MS Word: author, last saved by, revision number,, total editing

time, paragraphs

Not every file type contains meta data• Text files, xml, exe, dll

Most meta data can be changed

Databases

#aicpafvc

CASE EXAMPLE #1

For the Plaintiff

Theft of intellectual property• 2500 CAD drawings

From 1999, bankrupt the plaintiff

Subjects denied the theft

Acquired their computers/removable media

Proved continual use

Testified in Superior Court

Favourable decision

#aicpafvc

CASE EXAMPLE #2

For the Defendant

1996 Breach of contract

Contract not available

Alleged destruction of accounting evidence

Data recovered from unallocated space

#aicpafvc

CASE EXAMPLE #3

For the Plaintiff

Issuance of shares, agreements etc

Alleged 1993 corporate documents

Nearly 150 MS Word documents

Analysis shows created in 2007

Settled

#aicpafvc

CASE EXAMPLE #4

For the prosecution

Harassment in the workplace

Policeman downloaded internet content and gave it to a female subordinate

Deleted and wiped content

Fragments were recovered

Vive Voce Evidence

Convicted

#aicpafvc

INTERNET RECORDS

Google Docs, SkyDrive, DropBox, SugarSync

Online Payment Processors – PayPal, Payza, ClickBank, PayDotCom

E-Commerce databases

Covert accounts: EntroPay

#aicpafvc

WHAT NOT TO DO

#aicpafvc

THIS WILL WORK!

#aicpafvc

#aicpafvc

#aicpafvc

Current Fraud Schemes

Rick Rein

#aicpafvc

How many of you have been involved in investigating a multi-jurisdictional or

international fraud scheme?

#aicpafvc

Current Fraud SchemesForged International Bank Transfer Scam

Fraudulent organization purchases via internet relevant company information with pre-paid credit cards.

Fraudulent organization obtains email addresses, fax and telephone numbers without persons communicating finding out organization's location (if the target is foreign subsidiary of a French company, the telephone and fax numbers purchased will begin with French dialing code).

Fraudster pretends to be Senior Manager of Company (usually CFO) of foreign subsidiary of targeted company, and tries to persuade victim to transfer funds on a foreign account because of imminent tax and/or stock transaction.

Funds then transfer through multiple countries:• First to BVI as base where fraudsters operate by telephone;• Next to France as country where targeted company is located; and• Finally to Hong Kong as location for bank transfers.

#aicpafvc

Penny Stock Scheme

Fraudsters control worthless stock in 11 public companies which are thinly traded with minimal assets and no business operations.

Fraudsters pump up share prices by fraudulent sales campaign, including distributing false press releases, announcing non-existent business ventures and false mergers, posting false information on social media sites.

Fraudsters use “throwaway phones”.

“Investment” in stocks are transferred to Isle of Man, Singapore and India.

#aicpafvc

Life Settlement Insurance

Life settlement is an investment where insured sells life insurance policy for cash payment, which is a percentage of the face value or death benefit.

To keep policy in place life settlement company must pay premiums.

Investors realize profit if purchase price and additional premium costs are less than death benefit.

BVI fund created to purchase policies.

Investment in fund sent through administrator whose accounts were in Canada and England.

Funds are never used to purchase policies or to maintain premiums.

Funds further transferred to Singapore, Hong Kong, Cayman Islands

#aicpafvc

Obstacles to Recovery Legal – procedural obstacle. Usually primary. Asset recovery involves working across borders, which is tough at best of times. There are reasons why it is hard to find and seize someone’s assets: individuals have rights and amongst them, in most societies, are rights to privacy, due process, protection of private property and equal and fair treatment under the law.

Informal and financial obstacle. Investigators are trying to find money that has been deliberately concealed by a disciplined, well-funded, well-informed individual with access to state power, global banks and smart lawyers. And money can be moved very rapidly. It is becoming harder to hide money because of changes in the way secrecy jurisdictions are regarded, because of the spread of due diligence, and because of the trend towards greater transparency. Though domestic financial institutions are often used to hide money, the vast majority of asset recoveries involve overseas accounts, trusts and companies. In particular, offshore jurisdictions frequently have regulatory set-ups that are perfect to obscure links to money, with shell companies, nominee directors, and secrecy.

#aicpafvc

Obstacles to Recovery (cont.)

Political obstacle. In countries where assets have been transferred, there will also be politics. Some country’s governments are more supportive of private action than others. Depending upon the targets of the investigation, the political process could be a difficult barrier to overcome.

#aicpafvc

Asset Recovery Procedure• The case may start with a claim, complaint or judgment.

• Investigators trace assets via documents, electronic data, informants, accounting, and information from banks and other third parties. Some may be available locally or via open sources; much will require help from foreign courts. It is important that this be done discreetly and fast.

• Once the assets have been located, they must be frozen in place by a court. Different jurisdictions have different rules. Again, it will be critical to maintain confidentiality until the freeze is in place.

• The assets must now be taken through a confiscation or seizure order. There are different routes depending on jurisdiction and circumstances. Again, requires working with other jurisdictions to get orders and to enforce them.

• Assets must be transferred back to where they came from. This raises a number of issues, like costs to other jurisdictions, compensating those who may have lost out in other ways, and ensuring that the proceeds go to the right place (and do not get embezzled again).

Instigating:

Start the progress:

Locating : Where are the assets?

Freezing: Stop assets from moving.

Seizing: Take the assets:

Repatriating: Bring back the assets.

#aicpafvc

Stuart Rudner

Canadian HR Law:Investigating Employee Misconduct

#aicpafvc

How many of you have employees in Canada?

Of those, how many have had to address employee misconduct?

#aicpafvc

Dismissals

2 types: With Cause or Without Cause

If with cause, no further obligation to employee

Otherwise, need to assess employee’s entitlements to notice/pay in lieu/severance

No “near cause”

#aicpafvc

For Just Cause

“Capital Punishment of Employment Law”

No absolute rules

Employer must prove:1. that the alleged misconduct took place, and

2. that the nature or degree of misconduct warranted dismissal, bearing in mind all relevant circumstances

Has trust been destroyed? Has relationship been irreparably harmed?

#aicpafvc

The Contextual Approach

Employer must consider all circumstances, not just alleged misconduct• Length of service• Disciplinary history• Nature of position• Mitigating Factors

Same set of facts can yield different results

#aicpafvc

The Importance of the Investigation

Always investigate first

Ensure fairness, objectivity, thoroughness

Give accused opportunity to respond

Use trained investigator

Often, employee response is critical factor in determining appropriate discipline

#aicpafvc

Vernon v. British Columbia (Ministry of Housing and Social Development) (Liquor Distribution Branch)

30 year employee accused of bullying/harassmentKnown as “The Little General”Investigators:• Pre-judged• Attacked accused and those who supported her• Misled decision-makers in report

Result• 18 months’ notice• $35k in “The Damages Formerly Known as Wallace”• $50k punitive damages

#aicpafvc

Plester v. Polyone Canada Inc.Flawed investigation

all notes should have been retained — most were, but some summaries were done and original notes shredded

interviews should all be done separately

initial report included term “wilful misconduct,” suggesting tunnel vision or preliminary conclusion

initial draft substantively same as final report, suggesting decision reached without full discussion

no apparent review of similar situations or comparable outcomes

once possibility of dismissal for cause was seen as a potential outcome, Plester should have been given an opportunity to give a more complete statement

Dismissal not upheld

#aicpafvc

Jordan Bolton

Evaluating Forensic Accountant’s Qualifications as an Expert Witness

#aicpafvc

How many have had an interesting deposition/trial experience? 

#aicpafvc

How is the Transcript From Your Deposition Going to be Used Against You?

Daubert Motion (exclude or limit your testimony)

Dispositive motion practice

Impeach you at trial

#aicpafvc

Point of Attack

Absent gaping holes in education/experience, focus will NOT be on general qualifications

Rather, focus will be on: • (i) industry experience• (ii) engagement type experience

#aicpafvc

Most Common Areas of Focus for Attorneys Attempting to Discredit Forensic Accountant

Methodology

Not tested

Not peer-reviewed

Not published

Not generally accepted

Nothing “expert” about it (i.e., expensive calculator)

#aicpafvc

Bias

Typical (i.e., you say you’re independent, but plaintiff/defendant is paying you $XXX/hour)

You formed your opinion over time working with counsel for plaintiff/defendant (you could have consulted with other side/their lawyers, but you chose not to do so)

Most Common Areas of Focus for Attorneys Attempting to Discredit Forensic Accountant

#aicpafvc

Common Questions What assumptions did you make?

What is the factual basis for this opinion, and how do these facts lead to your conclusion?

What information have you relied on that was provided by counsel or your client?

What have you relied on that was provided by me or my client?

How many times did you communicate with the attorney/party that hired you before forming your opinion?

How many times did you communicate with me/my client before today?

What concerns do you have regarding your conclusions?

Under what circumstances would you use a different methodology?

What alternative hypotheses could explain what you observed?

What other work would you have liked to have performed?

#aicpafvc

Common Mistakes Made During Deposition

Not asking for breaks when needed

Not seeking adequate preparation

Answering questions about a document you do not have in front of you

Volunteering information

Fearing the words “I don’t know"

Not listening to objections

Getting totally boxed-in on opinions

#aicpafvc

Summary – File Attributes and Meta Data

File attributes not always what they appear on the surface

Meta data is data about the data – most can be changed and differs from file attributes

Case examples highlighted the power of computer forensics, including: • Proving ‘continual use’ of doc’s in theft of IP matter• Data recovered from “unallocated space” (notwithstanding

alleged destruction of accounting evidence)• Alleged 1993 corporate documents were found to be

created in 2007• Harassment matter involved recover of fragments of data

that was deleted and wiped

#aicpafvc

Summary – Current Fraud Schemes

Forged international bank transfer scam – involving BVI, France and Hong Kong

Penny Stock Scheme – fraudsters controlling ‘worthless’ publicly traded co’s and pumping up stock

Life settlement insurance – BVI fund set up to purchase life settlement policies, never purchase policies

Obstacles to recover includes legal (procedural), informal and financial and political obstacles

Asset recovery involves instigating, starting the investigation, locating, freezing, seizing and repatriating funds

#aicpafvc

Summary – Dismissals

Can be dismissed ‘with cause’ (no further obligation) and ‘without’ (consider entitlement) – no ‘middle’

Cause – prove alleged misconduct took place and nature/degree of misconduct warranted dismissal

The Contextual Approach – i.e. looking beyond the alleged misconduct

Investigation must be fair and objective – employee has opportunity to respond

Case: Vernon v. British Columbia (M. of Housing)– resulted in significant damages to ‘harassing’ employee due to apparent bias of investigation

#aicpafvc

Summary – Evaluating Forensic Accountants Qualifications as Expert Witnesses

Transcript from your deposition could result in your testimony being excluded or limited (including possible impeachment)

Focus will be industry and engagement experience

Attacking various aspects of forensic accountant’ methodology

Looking for potential ‘bias’

Common mistakes during deposition include not being prepared, being “boxed in” and not acknowledging when you simply “don’t know”

#aicpafvc

Thank you for your attention!

QUESTIONS?

#aicpafvc

Jordan BoltonClark Hill

151 S. Old Woodward

Suite 200

Birmingham, MI 48009

jbolton@clarkhill.com

Stuart RudnerRudner MacDonald LLP

First Canadian Place

100 King Street West

Suite 5600

Toronto, Ontario M5X 1C9

srudner@rudnermacdonald.com

Contact Information

Rick ReinHorwood Marcus & Berk Chartered500 West Madison StreetSuite 3700Chicago, IL 60661rrein@hmblaw.com

Edward Nagelnagel + associates

First Canadian Place

100 King Street West

Suite 5700

Toronto, Ontario M5X 1C7

edward@nagel-forensics.com

Brad SargentThe Sargent Consulting Group, LLC.

9550 Bormet Drive

Suite 204

Mokena, IL 60448

bsargent@scgforensics.com

Steve RogersDigital Evidence International Inc.

400 Queens Ave

London, Ontario

steve.rogers@dei.ca