Investigations – Forensic Inquiry

November 7, 2016November 7, 2016

Securities and Exchange Commission’s voting record on legal actions

Since tomorrow is election day in America I thought it would be appropriate to talk about the Securities and Exchange Commission’s voting record with respect to legal actions.

As a background, there are five Commissioners who are appointed by the President with the advice and consent of the Senate. Terms of these Commissioners last five years and are staggered so that one Commissioner’s term ends on June 5 of each year. The Chair and Commissioners may continue to serve approximately 18 months after terms expire if they are not replaced before then. What’s interesting is that to ensure the Commission remains non-partisan, no more than three Commissioners may belong to the same political party. The President also designates one of the Commissioners as Chair. As of the time of this blog post there are three Commissioners, Mary Jo White, Chair, Kara M. Stein, and Michael S. Piwowar. Two vacancies currently exist on the Commission.

The Division of Enforcement, whose activities are overseen by the Commission, has had a milestone year in terms of both enforcement actions and whistleblower awards. Before the SEC staff brings enforcement actions the Commission must vote and approve the staff to take action. To provide insight into this process the SEC posts voting results of the Commission on its website.

In analyzing these voting results following are some interesting trends:

Since January 2016, the Commission voted on 804 proceedings
Between January 1, 2016 and the date of today’s post, the Commissioners have nearly a 98% “Approved” voting record on these proceedings
In only 20 of the 804 proceedings did any Commissioner vote “Not Approved”
In every proceeding when a “Not Approved” vote was cast, a majority of the Commission voted “Approved”
In only 20 of the 804 proceedings did a Commissioner vote “Approved with Exception” (reasons for the exception included the amount of corporate penalty or the bar sanctions, for example)
When a Commissioner voted “Not Approved,” it was generally Commissioner Piwowar

With this in mind, there are multiple ways of thinking about potential explanations for the high rate of conformity in voting, such as large caseload juxtaposed against a lack of sufficient time to truly vet cases to bring or political pressure to increase actions. Although interested parties may make different conclusions about these findings, they are, nonetheless, important to take note of.

Photo credit

October 3, 2016

Responding to accounting restatement risk

A fundamental tenet of financial reporting is that a company’s internal controls over financial reporting (ICFR) are sufficiently robust to ensure transactions are properly recognized and disclosed in its financial statements. The appropriateness of financial statements hinges on the fair presentation in conformity with GAAP. Furthermore, the concept of materiality is the deciding factor of what is “fair” and what is not.

However, at times companies misstate their financial statements. In some situations these misstatements are simple, unintentional errors; whereas, in other cases they may be intentional. When misstatements occur, companies must determine whether or not these misstatements result in materially misleading financial statements. For purposes of clarity, an error is defined in ASC 250, Accounting Changes and Error Corrections as “[a]n error in recognition, measurement, presentation, or disclosure in financial statements resulting from mathematical mistakes, mistakes in the application of [GAAP], or oversight or misuse of facts that existed at the time the financial statements were prepared.”

Because identified misstatements that relate to the current period can be addressed by management without any required restatements, today’s post will address certain risk areas and requirements that companies will want to address in assessing misstatements in prior periods.

Materiality

In a previous post I wrote about materiality considerations, which should be considered in assessing whether or not the prior period financial statements are materially misstated. Indeed, it is well established that calculating a quantitative threshold of materiality is an important step in a materiality assessment (such as 5-10% of pre-tax income). However, companies should give consideration to qualitative factors as well. The SEC’s staff issued SAB No. 99 to provide some guidance to considering qualitative factors. Notwithstanding its guidance, SAB No. 99 does not address what might be considered not material.

Types of restatement

Depending on the outcome of a materiality assessment, companies may find themselves in one of two categories:

Reissuance restatement – referred to as “Big R” restatement because this means the previously issued financial statements were materially incorrect and, therefore, are unreliable and must be reissued/restated. In these cases, the prior period financial statements must be amended.
Revision restatement – referred to as “Little r” restatement because, although there are errors in the previously issued financial statements, they were not material to the prior periods. A company may choose to either make the error correction in the current period or it may recast its prior period financial results in connection with issuing its current period financial statements. When a company elects to recast its prior period financial statements in connection with issuing its current period financial statements, it revises its financial statements. In these circumstances, the prior period financial statements do not need to be amended.

Sarbanes-Oxley Act certification requirements

In the context of restatements, SEC registrants must be aware of risk exposure related to Sarbanes-Oxley Act (SOX) certification requirements. As a refresher, as early as 2004 SEC registrants were required to implement certain provisions of SOX. These provisions address requirements that the principal executive officer or officers (CEO or equivalent) and the principal financial officer or officers (CFO or equivalent) must certify. The first requirement, Section 302, is found in SOX’s Title III – Corporate Responsibility. The second requirement, Section 906, is found in SOX’s Title IX – White-Collar Crime Penalty Enhancements.

SOX Section 302 – In connection with filing of periodic financial reports with the SEC, the CEO and CFO (as signing officers) are required to certify in each quarterly and annual report:
- the signing officer has reviewed the report;
- based on the signing officer’s knowledge, the report doesn’t contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading;
- based on the signing officer’s knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of operations of the issuer as of, and for, the periods presented in the report;
- the signing officers:
  - are responsible for establishing and maintaining internal controls
  - have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared;
  - have evaluated the effectiveness of the issuer’s internal controls as of a date within 90 days prior to the report; and
  - have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date;
- the signing officers have disclosed to the issuer’s auditors and the audit committee of the board of directors (or persons fulfilling the equivalent function):
  - all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer’s ability to record, process, summarize, and report financial data and have identified for the issuer’s auditors any material weaknesses in internal controls; and
  - any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer’s internal controls; and
- the signing officers have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

SOX Section 906 – In connection with filing of periodic financial reports with the SEC, the CEO and CFO (as signing officers) are required to certify in each quarterly and annual report:
- the periodic financial report containing the financial statements fully complies with the requirements of section 13(a) or 15(d) of the Securities Exchange Act of 1934 and that information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.

Section 906 provides for criminal penalties if the CEO and/or CFO:

certifies any statement within Section 906 knowing that the periodic report accompanying the statement does not comport with all the requirements set forth in Section 906 shall be fined not more than $1,000,000 or imprisoned not more than 10 years, or both; or
willfully certifies any statement as set forth in Section 906 knowing that the periodic report accompanying the statement does not comport with all the requirements set forth in Section 906 shall be fined not more than $5,000,000, or imprisoned not more than 20 years, or both.

In light of these certification requirements and the potential criminal penalties, signing officers must be confident that their financial reporting controls are reliable. With this in mind, when Big R restatement risk is heightened, companies should be cognizant of the regulatory and legal exposure associated with potential non-compliance.

Furthermore, when it comes to material misstatements in the company’s prior period financial statements, there is a rebuttable presumption that a material weakness in ICFR exists. Another thing to keep in mind is that even though a Little r restatement may end up being the correct solution to addressing misstatements, the SEC registrant may end up concluding that a material weakness still exists in ICFR. This gets at the concept of the “could” factor in assessing deficiencies in ICFR, which I previously wrote about.

Tips for companies

I recently listened to a webcast discussing 10 pitfalls to avoid when navigating a Big R restatement (replay link). For convenience, I’ve listed these 10 pitfalls:

Engaging inexperienced counsel and advisors for the investigation
Forming a special committee when the audit committee might suffice
The run-away or open-ended investigation
Failing to keep auditors apprised of the investigation and errors found
Indecisiveness and inability to reach conclusions
Waiting too long to deal with wrongdoers
Not self-reporting findings to the SEC
Audit committee micromanagement of the restatement
Failing to remediate
Creating an unnecessarily detailed SAB 99 materiality analysis

In addition to these tips, companies should ensure they follow the standards governing accounting restatements in ASC 250 and that they assess misstatements for each reporting period. Although certain misstatements may be insignificant in any given reporting period, they could aggregate to a material amount over time (such as the impact to the balance sheet).

When restatements arise, SEC registrants will need to disclose relevant information on SEC Forms 10-K/A and 8-K (for Big R) and SEC Form 10-K (for Little r).

Influencing the narrative

I’m going to fast forward the process of restating financial statements to communicating with outsiders what the facts are. When management becomes aware of material misstatements in prior periods, the company should be clear and assertive with users of its financial statements about the nature and extent of the misstatements identified. In connection with its assessment, management should be able to, at a minimum, address the following concerns:

explain the magnitude of the misstatement;
identify which accounts were affected;
describe what was done to remediate the misstatement (both in the financial statements and in ICFR);
explain what programs and controls have been put in place to avoid misstatements from occurring in the future; and
explain the implications of misstatements on the company’s future financial reporting and forecasts

It goes without saying that if companies do not take active measures to effectively management the risks I’ve discussed, users of their financial statements may call into question whether or not the root-causes in the company have been addressed.

Photo credit

August 22, 2016August 31, 2016

Payout trends in the SEC’s whistleblower program

In July 2010, the U.S. Congress enacted and President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act. In connection with reform on investment protection, the Dodd-Frank Act provided for the establishment of a new whistleblower program. The program provides for financial incentives for individuals to report potential federal securities laws violations to the SEC and provides for protection from employment retaliation.

Adoption of whistleblower rules

On May 25, 2011, the SEC adopted the new whistleblower rules, codified as Section 21F of the Securities Exchange Act of 1934, entitled “Securities Whistleblower Incentives and Protection.” Pursuant to these rules, the SEC has ability to provide monetary awards to eligible individuals who come forward with high-quality original information that leads to an SEC enforcement action in which over $1 million in sanctions is ordered. The range for awards is between 10% and 30% of the money collected.

The rules clarify that “original information” must be:

(i) Derived from your independent knowledge or independent analysis;

(ii) Not already known to the Commission from any other source, unless you are the original source of the information;

(iii) Not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation, or from the news media, unless you are a source of the information; and

(iv) Provided to the Commission for the first time after July 21, 2010 (the date of enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act). See Rule 21F-4(b)(1)

Furthermore, the rules state that information submitted to the SEC is provided “voluntarily” if:

…you provide your submission before a request, inquiry, or demand that relates to the subject matter of your submission is directed to you or anyone representing you (such as an attorney):

(i) By the Commission;

(ii) In connection with an investigation, inspection, or examination by the Public Company Accounting Oversight Board, or any self-regulatory organization; or

(iii) In connection with an investigation by the Congress, any other authority of the federal government, or a state Attorney General or securities regulatory authority. See Rule 21F-4(a).

Discretionary payouts

As mentioned previously, the range of awards that the SEC will pay out is between 10% and 30% of the money collected, not of the monetary sanctions ordered. With this in mind, the SEC considers the following factors to determine the size of the award:

The significance of the information
The assistance provided by the whistleblower
Law enforcement interest that might be advanced by a higher award
Whistleblower’s participation in internal compliance systems

In addition, the SEC considers the following factors to decrease the payout percentage of the award:

Culpability
An unreasonable reporting delay by the whistleblower
Interference with internal compliance and reporting systems

SEC’s payout trends

From its inception through July 2016, the SEC’s whistleblower program has issued 24 final award orders and 51 final denial orders. Of these 24 final award orders, the largest award amount disclosed was over $30 million (announced September 22, 2014) and the smallest award amount disclosed was $125 thousand (announced August 30, 2013).

Of the 19 disclosed award amounts, the median payout is approximately $700 thousand.

Furthermore, of the nine awards disclosing the payout as a percentage of the monetary sanctions collected, the SEC has ordered payouts of 30% on five occasions, a payout of 28% once, payouts of 20% twice, and one payout of 15%. It should be noted that these figures represent the total payout percentages for each matter (regardless of the number of claimants).

Seven of the 24 final award orders mentioned more than one claimant for payout, with three of these awards naming two claimants and four naming three claimants. The distribution of the payout to each of these claimants varied from equal proportion of the award among the claimants (33% or 50% to each claimant in final award orders naming three and two claimants, respectively) to as dispersed as 50% of the award to one claimant, 33% to another, and 17% to the third claimant within the same final award order.

Another interesting observation is that, of the 24 final award orders, the SEC disclosed the whistleblower profiles for 11 of them. Of these 11 awards, two were in the compliance function, one was an officer, seven were non-descriptive insiders/employees, and one was an outsider. There does not appear to be any correlation between the whistleblower profile and the payout percentage or amount of the award.

I have prepared a schedule that summarizes key information for each final award order. This schedule includes all final orders through July 2016.

Photo credit

July 5, 2016July 3, 2016

Effective interviewing techniques

Recently I attended a training by my local Association of Certified Fraud Examiners (ACFE) chapter addressing the topic of conducting interviews. I thought the topic was interesting and certainly applicable in my line of business. For this reason I’m writing today’s post on this topic.

To begin, television shows and movies too often seem to portray interviewing techniques that are wholly ineffective in most circumstances. For example, in the movie L.A. Confidential the good cop-bad cop scene shows essentially every signal of aggression. As expected, the bad cop plays really tough with the subject, who eventually submits to his wishes. In reality, when faced with such drastic circumstances, an interviewee may say whatever the interviewer wishes, even giving a false or unreliable admission. Experience dictates that this is not truly effective interviewing.

Rapport

Effective interviewing requires rapport building with the interviewee. Indeed, there are various techniques to do this. Examples include listening, asking follow-up questions, understanding the interviewee psychologically, saying “I want you to relax,” and asking the interviewee “tell me about your life/yourself.”

Of course, not having a checklist mentality is very important as well. This is because a checklist mentality does not sufficiently accommodate for changes in plan or approach that often times are necessary on the fly. I discuss the practice of check listing in another post.

Another key aspect of building rapport is deciding the best approach to take. Appealing to reason or logic, rather than fear, is more likely to create an effective bond with the interviewee. Moreover, the interviewer generally shouldn’t dominate the conversation, but rather seek to make the power neutral between the interviewer and the interviewee.

Interviewers should also think about what type of support network the interviewee may have. For example, one might ask if there are other perpetrators or victims that may not already be identified.

What’s going on in the interviewee’s mind?

As a means of trying to anticipate potential issues or identify appropriate questioning techniques during an interview, interviewers should understand what is going on in the interviewee’s mind. There are at least three things that an interviewee is thinking through, whether consciously or sub-consciously. These include an interviewer assessment, a subject assessment, and asking him or herself “what about me” questions.

The interviewer assessment

Do I like the interviewer?
Do I trust the interviewer?
Is the interviewer judging me?

The subject assessment

Why is the interviewer talking to me? The interviewer has responsibility to explain this up front.
Do I have the information that the interviewer seeks?
How much does the interviewer know?
How much can the interviewer find out from other sources?

“What about me” questions

What happens if I disclose the information?
What happens if I do not disclose the information (fired, jail, fine, etc.?)
Am I comfortable?

Voluntary disclosure

Of course we want the interviewee to voluntarily disclose information. As such, an interviewer should take an approach that encourages the interviewee to do this. Think of the art of persuasion, using the sales pitch to appeal by being genuine, compelling, and using logic and reason.

Awareness

Equally important to effective interviewing is situational awareness. Sun Tzu, a 6th century BC Chinese military strategist, identified three attributes of awareness that are relevant to this topic and the ACFE training adapted these attributes to effective interviewing as follows:

Know yourself as an interviewer

As an interviewer, I need to identify my strengths and weaknesses, mold my techniques to my strengths, and create my style of interviewing.

Know your “enemy”

As an interviewer, I need to understand the interviewee’s motivations, strengths, and weaknesses. Furthermore, I need to try to answer the 10 questions (listed above) on behalf of the interviewee beforehand. Finally, I should acknowledge that every interviewee is different and that my approach should be fluid and flexible to accommodate changes in plan.

Know the terrain

As an interviewer, I need to understand the laws applicable to the facts and circumstances (e.g., employment law, criminal law). In addition, I need to understand company policy and procedures as well as the corporate culture. Ultimately, I need to understand the BIG picture in focus.

Application

When one gets into the details of effective interviewing, today’s post identified a number of factors to consider. For some, thinking through each factor can be overwhelming. With this in mind, consistent practice is what I believe makes an interviewer more effective.

I received permission from the authors of the training (Travis Boyd, CPA, Johnnie Bejarano, DBA, CPA, CFE, and Doug Laufer, PhD, CPA, CFE) to share the slide deck here.

Photo credit

June 27, 2016June 27, 2016

What an in-house fraud investigation looks like

Because in-house fraud investigations can vary in terms of structure, resources, and performance, sometimes we wonder what does an in-house fraud investigation typically look like. Well, thanks to the Association of Certified Fraud Examiners (ACFE), we can answer this question.

Last year the ACFE released a report entitled Benchmarking Your In-House Fraud Investigation Team, which analyzed various engagement metrics from over 800 survey responses. I think you’ll find the results quite interesting.

To frame today’s post, I’ll cover the report’s findings for each of the following critical components of a fraud investigation:

Oversight of fraud investigations
Outsourced vs. in-house investigation team
Time to resolution
Disciplinary actions against or prosecution of perpetrators, and
Recovery of fraud losses

Oversight of fraud investigations

As for structure, approximately half of survey respondents indicated that the investigation team reports either to internal audit leadership (28.3%) or senior management (22.1%). Interestingly, only 6.4% reported to in-house legal counsel. The below chart demonstrates that there is diversity in oversight of fraud investigations, perhaps dependent on the nature of the fraud (financial statement fraud, compliance fraud, asset misappropriation, etc).

Outsourced vs. in-house investigation team

When it comes to in-house fraud investigations, overwhelmingly the survey respondents (68.2%) indicated they are always performed in-house as opposed to being outsourced. Furthermore, approximately 23% of organizations outsource their investigations up to 25% of the time. One reason for organizations infrequently outsourcing fraud investigations could be due to the fact that over 73% of survey respondents indicated their organizations had over 1,000 employees. Perhaps larger organizations (those with over 1,000 employees) generally have sufficient personnel capacity to perform the investigations.

Time to resolution

As practitioners understand, resolving investigations in a timely fashion is paramount to (1) effective detective internal controls and (2) setting an appropriate tone within an organization. According to the report, nearly six in 10 fraud investigations (59.8%) were closed within 30 days. Conversely, just over 10% of fraud investigations took more than one quarter to close. Of course, the duration and extent of a fraud investigation is heavily based on the degree of complexity of the alleged fraud.

Disciplinary actions against or prosecution of perpetrators

Although organizations prefer to prevent fraud from occurring, the reality is that fraud is impossible to completely eliminate from all organizations. Therefore, when it comes to effective internal controls, management should strive to set a “zero tolerance” policy for fraud. In essence, how management reacts to known or suspected fraud, therefore, is critical to setting an appropriate tone within the organization.

The following chart shows the percentage of investigations that resulted in disciplinary action. Less than a third (31%) resulted in disciplinary action between 76% and 100% of the time. On the other hand, approximately the same amount of investigations (31.6%) resulted in disciplinary action between 0% and 25% of the time.

The next chart shows an interesting trend in prosecution referrals. The majority of investigation teams (59%) decided to refer their case for prosecution between 1% and 25% of the time. Conversely, 9.8% of investigation teams referred their case for prosecution between 76% and 100% of the time. As one may expect, there are a number of factors involved with the decision to prosecute. These may include sufficiency of evidence to prosecute, reputational risk, and cost vs. benefit analysis. Hence, the decision to prosecute must be weighed carefully by an organization.

Recovery of fraud losses

In the end, just because investigation teams substantiate allegations of fraud does not mean the losses are automatically recovered. In light of this, I believe the following chart is one of the most relevant statistics in this report. According to the survey results, the majority of investigation teams surveyed (54.6%) indicated that less than a quarter of the fraud losses were recovered. In contrast, 13.0% and 13.9% of investigation teams indicated that 51% to 75% and 76% to 100% of fraud losses were recovered, respectively.

Final observations

These results are interesting, to say the least. With a focus on continuous improvement, fraud investigation teams should think about how these findings could affect their existing structure, resources, and performance.

In the end, fraud investigation teams will vary in their look and feel, depending on the nature and complexity of the fraud being investigated. Having adequate staffing of in-house investigations with the right level of experience and bandwidth will put teams in the best position to be efficient as well as thorough in their efforts.

Photo credit

May 9, 2016June 3, 2016

The power of walk throughs in investigations

As a former auditor, I performed walk throughs of certain key account processes or cycles to gain a complete understanding of a transaction from start to finish. Sometimes it became quite cumbersome because certain processes were complex or lengthy. However, after walking through a process I was able to gain a solid understanding of the areas of risk exposure and, most importantly, I could answer the question, “what could go wrong in this area.” This informed me further in planning my audits and responding to risks.

As a basis for framing my post today, the PCAOB AU No. 5 at ¶ 37, describes a walkthrough as follows:

In performing a walkthrough, the auditor follows a transaction from origination through the company’s processes, including information systems, until it is reflected in the company’s financial records, using the same documents and information technology that company personnel use. Walkthrough procedures usually include a combination of inquiry, observation, inspection of relevant documentation, and re-performance of controls.

Although this guidance is intended to apply to audits of internal controls over financial reporting, implemented by an entity in preparing its financial statements, the principles gathered from walk throughs can be applied to a variety of circumstances.

As basic as they may seem, walk throughs I believe are the bedrock to understanding the flow of transactions in accounts, particularly complex ones. Following are some powerful things that can be gathered from a walk through:

Build rapport with the interviewee through conversation that can be transitioned from “formal” (early on in the walk through) to “informal” or more “relaxed” (once enough questions have been discussed and the anxiety of meeting someone for the first time can be overcome)
Identify “types” of documentation not previously known
Assess the competency of an account owner/interviewee
Assess the body language of the interviewee and gather relevant information therefrom
Identify improper segregation of duties (custody, record keeping, and authorization/verification)
Identify exposures to fraud and/or error

To do effective walk throughs, it’s critical that the person conducting the meeting have sufficient experience to understand what types of questions to ask and, maybe more importantly, if answers are satisfactory or if probing is necessary. Depending on the risks/allegations, a walk through may encompass a portion of or an entire process, including: initiation, authorization, recording, processing, and reporting.

I’ve found the following types of questions to be helpful in a walk through (of course, adapting the questions to the relevant facts/allegations and circumstances is critical to an effective discussion):

Please describe your role in this process.
Who else is involved in this process (preparers, reviewers, approvers, etc.)?
What happens when a transaction is not approved?
What systems (internal or external) do you use or rely upon to perform your duties? This type of questioning can assist in identifying the areas of manual intervention, which often times are the areas of highest exposure to fraud and/or error.
Where do you understand the areas of judgment or estimate to be?
Have you or anyone you know been asked to override any controls?
If there were a questionable transaction or request, who would you go to for guidance or advice?

Depending on the situation, I recommend two interviewers in attendance. For example, in an investigative scenario, it may be appropriate to have two persons in attendance, one to ask the questions and interact with the interviewee and another to take notes, but also to stand as a “witness” should allegations come back against the interviewer.

Sometimes a walk through may not be possible because access to the person(s) may be restricted. In these scenarios, the best available information should be considered and, using an experienced professional’s understanding of the flow of similar business transactions, one should formulate an “expectation” for how transactions are processed and then refine that “expectation” as new information becomes available.

As a reiterative point, having an experienced professional involved in the process greatly increases the odds of a successful outcome (“successful” of course being a relative term) and is critical in sorting through what is relevant, what is not, and what may be an intentional diversion.

Photo credit