An investigative audit, as its name implies, combines two professional elements with essentially different attributes: accounting auditing and investigation. Auditing is a professional methodology founded on accounting principles, standards and theory. Investigation, on the other hand, is based on general principles that serve as guidelines and requires an investigator that is capable of "thinking outside the box", preferably in combination with the use of intuition. What is this "thinking outside the box" and "use of intuition" that are considered so important in investigative work, and especially in investigative auditing?

An investigator may be equated to a hunter who wishes to hunt the offender. The investigation, like a hunt, requires the development and application of several skills:

  • A critical approach, flexible thinking and the ability to doubt assumptions and suppositions (open mind)
  • Ability to develop and implement solutions for changing situations (practical dynamic)
  • Ability to understand and study the way of thinking and behavior of the person being investigated
  • High level of professional integrity
  • An approach based on appreciation of the person being investigated
  • Independent, low profile work

On the other hand, the auditor's work is based on professional methods and standards in which there is usually no room for personal development and they must be applied as-is, while cooperating with the person being audited. The need, therefore, to combine the skills is not self-evident, and therefore a professional specializing in investigative auditing must, first and foremost have the natural as well as acquired skills of an investigator who uses know-how in the field of auditing.

In quite a few cases, investigative auditing is conducted by accounting firms that provide external auditing services on an ongoing basis. In such cases, the professionals may use professional work methods and approaches that are accepted in auditing, but are not suitable for investigative auditing, and therefore may cause failure of the investigation.

In this article, I will present an example of this type of investigation, analysis of the causes of the failure, and offer an alternative way to conduct the investigation:

In a large manpower agency, large scale embezzlement by the company's HR manager was discovered. The manager served as the company's acting VP. The embezzlement and its perpetrator were discovered by chance, after one of the owners (the CEO) noticed in the bank account that a check was paid out to an employee that was fired six months before. When he checked the identity of the person cashing the check, he discovered that this was the HR manager. In addition, they found that the employee had been issued salary slips for the entire period during which he no longer worked for the company. The checks issued for these salary slips were also cashed or forwarded by the same HR manager. This senior employee, that had been working for the company for many years, and was actually its acting manager, was immediately summoned by the owners and shown the evidence – she admitted to the embezzlement of the specific checks, but refused to cooperate with information about additional checks. The employee was asked to leave work immediately, and other employees were informed.

The business owners contacted our accounting firm and requested an investigation (external audit) to determine the scope of the embezzlement, how it was performed and to collect evidence against the employee for the purpose of a possible lawsuit. It should be noted that over the years the auditing accountants had noted an improper accounting level and breaches in the internal control, especially relating to this specific employee, but had not managed to affect a change in the situation.

The investigation by an accounting firm was performed by two accountants that were assigned to this task exclusively in order to accelerate the investigation, because the owners viewed this as urgent and wished to receive an estimate of the scale of the embezzlement as quickly as possible. During two weeks the accountants tried to find a "clue" or lead as to the manner of execution of the embezzlement by tracking the transactions performed in the financial reporting system, especially at the end of the year and beginning of a new year, before the annual audit, yet they did not focus on the logistic computer system that was actually at the center of the company's operations. The accountants' assumption was that examining bank reconciliations would provide the lead based on which it would be possible to track the employee's method and formulate an estimate of the scope of the embezzlement. After two weeks that the accountant tried to find the source of the embezzlement in the accounting ledgers of the previous years – they realized that due to inadequate accounting reflected in forced bank reconciliations that were usually made without any valid references, and with essential deficiencies in the recording of accounting transactions, it was absolutely impossible to identify the sources and the scope of the embezzlement this way. When they realized that the financial system would not produce the solution – emphasis shifted to the logistics system that the accountants hoped to use to identify embezzlement using additional fictitious employees or fictitious work hours. This method did indeed reveal several checks that were cashed that belonged to the same embezzlement, yet it also indicated breaches that existed in both the logistics system and its interface with the financial system. These breaches made it significantly harder to identify, in a reasonable period of time, the scope of the embezzlement and estimate of the number of years that it has been going on. At this stage, the owners lost faith in the accountants' ability to give them what they asked for, and therefore approved only a few more days for the investigation.

It should be noted that the accountants began their investigation based on an assumption that the embezzling employee had no accounting knowledge, and therefore inferred that she was not sophisticated – and assumed that this would facilitate the investigation and attainment of the goals.

At this stage, an old checkbook was found that did not contain any more checks. Examination of the check stubs found 5 additional checks, that were allegedly given to the employee who was fired 6 months earlier, and were cashed, as well as other checks that further investigation found were either assigned or cashed by the senior employee. Examination of the accounting system found that details about the cashing of these checks were missing.

The accountants did not place great importance on this, and continued to conduct their investigation in the company's office with the goal of uncovering additional cases related to this embezzlement. A few days later, the owners notified the accountants that they no longer wished them to continue the investigation, since they do not believe that the accountants have an affective investigation direction that will lead to the goals they set.

What exactly happened, and how could this outcome have been avoided?

  • Embezzlements are usually classified as white collar crimes that have different characteristics than ordinary crimes. In the case of ordinary crimes, the nature of the offense is usually known, and it is necessary to find the criminal. In white collar crime, the criminal is known, but it is necessary to find and consolidate evidence related to the scope and implications of the crime. In both cases evidence serves as the basis for convicting the criminal.

    As important as evidence is in the conviction of an ordinary criminal, its importance is even greater in the conviction of white collar criminals, with the investigation usually starting with meager evidence about the nature and scope of the crime. In addition, the standing in the organization of white collar crime defendants enables concealment of the crime for long periods of time. In such cases, conducting a low profile investigation is an essential condition for the investigation's success. This did not occur in this case, as reflected in:
  1. The investigation was conducted, from the very beginning, in the company' offices.
  2. The employees were notified that the senior employee has been dismissed and the reason for her dismissal.
  3. The employee was dismissed hastily before consolidating additional evidence that was required, especially in light of the company's accounting system.

Choosing an alternative approach, that includes:

  • Using much more discrete investigation methods
  • Postponing the confrontation with the senior employee, that was held in the manager's office, to a later stage (preferably not in the company's offices)
  • Considering leaving the senior employee in her position and tracking her actions (low profile) – this could have enabled the accountants to uncover the embezzlement method and even expose additional evidence that may perhaps have cut the investigation short and improved its chances of success.
  • Lack of a guiding principle for conducting the investigation - in light of examination of the existing data, the logistic system and the company's actions.

The accountants remained fixed on the accounting tools at their disposal, and did not examine the existing data and other findings that could hint at more focused investigation directions that are based on a proper assessment of the employee's skills. The investigators evaluated the defendant's skills based on the professional tools they are familiar with, and did not try to understand her way of thinking. This fixed, rigid approach that was also apparent in how they evaluated her – was one of the elements that contributed to the investigation's lack of success. Looking at the situation from an objective point of view, it seems reasonable to assume that an embezzlement that was conducted over a long period of time, at the scope that was revealed, and one that was not discovered by the owners and not by accountants during two annual audits – means that we are dealing with a sophisticated suspect requiring suitable preparation. The waste of time due to the rigid approach of the accountants caused the investigation to lag and be one step behind , and finally to fail.

  • Additional findings: the accountants obtained significant information during the investigation from the checkbook that contained the checks that were issued to fictitious parties and then assigned or cashed by the employee – but unfortunately they did not make proper use of this valuable information. It is reasonable to assume that had they made astute use of the information, they would have discovered a clue or lead that may have enabled them to quickly determine the scope of the embezzlement and the method that was used.

How?

On the one hand, the case involves an accounting system characterized by irregularities that allowed extensive breaches and precluded effective control and monitoring. On the other hand, the checkbook that was found could explain how the HR manager carried out the embezzlement. Firstly, in order not to leave tracks, she apparently wrote all the checks that she cashed or assigned in separate checkbooks, whose stubs were not forwarded to accounting, and therefore their identifying details were not recorded. This faithfully reflects the actual findings on the ground.

The HR manager ensured that she would have full control, as long as no orderly bank reconciliation were conducted, and she was well aware that she was capable of creating conditions in which it would not be possible to conduct updated bank reconciliation for the audit date by debiting salaries on several dates every month, with her excuse being logistic constraints. Her exclusive control of HR and the trust placed in her allowed the HR manager to do as she liked. This trust was reflected in the fact that she was given signed, non-computerized checkbooks by the owners. In fact, she was given free access to the business' bank account, and her situation was superior to that of each of the owners, since each owner needed to obtain his partner's signature to withdraw money from their joint account.

A proposed alternative line of investigation in light of the findings uncovered

In light of the finding, there is a real chance (that must be examined) that had a mapping of the checkbooks been undertaken, with their copies being sent to accounting (external) for the purpose of recording and then returning them to the company, it would have been possible to identify the missing checkbooks and their numbers. Sending the numbers of the checks to the bank may have taught us that the checks were assigned or cashed by the HR manager, and it would have been possible to quickly estimate the scope of the embezzlement, to obtain references that would serve as evidence for the lawsuit, and even to learn the method the HR manager used based on the evidence gathered. This would have prevented the barren attempt to find a needle in a haystack, and could possibly have minimized damages, including the damage that the investigation caused to the other employees.

Some people would claim that such a strategy does not require in-depth accounting know-how – and this is true, but also irrelevant! An investigator is supposed to complete his assignment, which in this case included estimating the scope of the embezzlement, collecting quality findings and exposing the manner of operation, as far as possible. In order to do this, he must use the most suitable legal tools to attain the objective – and this is the only consideration that should guide him!

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.