The CPA As Sleuth: Working the Fraud Beat

CPAs can trade in their spreadsheets for trenchcoats and fedoras. They'll need to if a client ever requests help with a business fraud investigation. In fact, often it's a CPA who finds the "smoking gun"—the forged check or the purchase orders for nonexistent goods. Because most frauds usually have a financial component, CPAs can be of great help in solving them.

But those uncovering fraud need to take care to avoid costly missteps. Accountants who serve as consultants to their clients, or even those who work as controllers or CFOs, need to be aware of the key legal issues, so they can work effectively with a company's lawyers. Their reward? CPAs who know their way around fraud investigations greatly increase the likelihood of financial restitution to clients, and thus provide a value-added service.

FIRST, THE LAWYER
Once a company has asked a CPA to look into a business fraud, the first step he or she needs to take is to advise the client to hire an attorney, specifically to establish privilege of information. (Of course, CPAs who suspect fraud while performing an audit are bound by additional rules and regulations. See "The Auditor and Fraud," JofA, Apr.97, page 32, and "The CPA as Fraud-Buster," JofA, May98, page 69.) Basically, privilege of information means attorney/client privilege will cover any information the CPA discovers. (Also see "A Matter of Privilege".) The CPA's engagement letter must specify that he or she will work on the case at the direction of the client's attorney. The letter also should clearly state the legal purpose of the accounting services to be provided; failure to do this could result in the loss of privilege.

Additionally, upon learning more about just how complex the fraud case is, the CPA may want to advise the client to hire a professional investigator with a law enforcement background. While CPAs bring a knowledge of the client's financial transactions and systems to the investigative effort, the professional investigator also brings expertise-in proper investigative procedures, interviewing techniques and civil and criminal laws.

PLAN OF ATTACK
Early in the investigation, the attorney and the CPA need to agree on an appropriate legal strategy. For example, if they're contemplating a civil suit, who-what individuals or corporate entity-would the suit be filed against and what charges would be brought? Likewise, if they want to pursue criminal charges, what jurisdiction has venue and what statutes have been violated?

The attorney understands the legal elements the client needs to win a civil suit or criminal case. Thus, at a very early stage, the CPA and the attorney must determine what type of evidence they need. For instance, if they want to file a federal mail fraud case, the CPA must gather evidence to meet the necessary elements of proof under that statute. In such cases, establishing that a document traveled through "the mail" is essential. Specifically, the CPA must establish who prepared the document, who mailed it, that it went through the mail, that it was fraudulent and that the preparer knew it was fraudulent. CPAs should be aware that any private or commercial interstate carrier, such as UPS and Federal Express, may qualify under the federal mail fraud statute. The envelope is critical because it bears the carrier's name and the mailing date. Also, it may be necessary to dust the fraudulent document for fingerprints.

Select the jurisdiction. The attorney and CPA need to carefully consider the many factors that can come into play when selecting the case's jurisdiction. For example, has a federal or state law been violated? One problem: With state cases witnesses normally cannot be subpoenaed across state lines; in federal cases they can. The dollar amount of the fraud is important, as well. In the Chicago area, a $10,000 fraud case may barely interest local prosecutors, but prosecutors in a rural jurisdiction may relish the opportunity. Another consideration is the court precedents of the various jurisdictions where a case might be filed.

A matter of privilege. At the investigation's outset, the client needs to maintain control over the information generated during the fact-finding phase. If all of the information-gathering is done at the direction of the client's attorney, all information gathered could be considered "privileged" and may not be readily available to the opposing side in a civil lawsuit. However, if criminal prosecution occurs, the court may grant the defense attorney access to the information even if the privileged material is marked "attorney-client work product." In all cases, it is in the client's best interest to maintain control of what is turned over to the other side. Although laws vary from jurisdiction to jurisdiction, the client's attorney should issue a letter to the CPA advising him or her to maintain the privilege of the information. This letter should direct the CPA to investigate the situation and report the findings only to the attorney, not directly to the client. In addition, any briefings the CPA gives to top management regarding the fraud investigation's status should be done only at the attorney's direction. The CPA needs to clearly mark all work papers as "attorney work product," and should not disseminate any of them without discussing the situation with the attorney.

Best evidence rule. This rule requires that if any original documents, for instance, invoices, receipts or checks, are available, they—not copies—must be used in court. Therefore, CPAs need to either obtain original documents as the investigation progresses or be sure they will be available when needed. Obviously, these original documents must be safeguarded.

Chain of evidence. Maintaining a proper chain of evidence means CPAs need to be able to document where all of the evidence has been at all times and who had custody of it. For example, if a canceled check is a critical piece of evidence, the CPA must prepare a receipt for the person or institution from which it was obtained indicating the time and date the check was turned over. From this point forward, the CPA has to keep a detailed log of the whereabouts of the check. If it is sent out for handwriting analysis, it must be sent by registered mail, with the times, dates and parties involved documented. These procedures help ensure that the evidence's integrity will not be questioned in court.

Investigative report. One of the major purposes of the CPA's investigative report, in addition to documenting the chain of evidence, is to provide an organized presentation of the evidence collected to facilitate potential court proceedings. The attorney can help with the report's format.

Generally the report should arrange the various fraudulent transactions by witness and by document. It should carefully isolate all evidence related to a particular witness to prevent the opposing attorney from obtaining unintended information upon subpoena. If, for instance, the report presents evidence from two witnesses on the same page, the opposing side's attorney gains access to evidence from two witnesses by subpoenaing the documentation related only to one.

KEEP THE CLIENT IN CONTROL
After a client and CPA have established that a fraud occurred, the client's next decision is whether and when to notify outside authorities. (Note that in certain highly regulated industries, such as banking or insurance, statutes may require that the client notify the proper outside authorities. Some insurance policies—for example, bonding policies—also may require timely notification.) This is not to suggest that the client can postpone forever dealing with outside authorities when a suspected fraud has occurred. However, it is usually in everyone's best interest if the client determines the timing. Client control of both case referral and timing is important for the following reasons:

• CPAs conducting fraud investigations before notifying outside authorities are not required to comply with the same rules as law enforcement personnel when interviewing individuals. This is true because CPAs are not acting as law enforcement personnel or, in other words, as "police agents." For example, non-law-enforcement personnel do not have to comply with the Miranda decision when interviewing people. However, any statements obtained from suspected perpetrators must be "voluntary" in order to be admissible in court. For example, a court may rule certain evidence inadmissible if a CPA obtained it from a suspect who was threatened with dismissal for not providing an honest response. On the other hand, if the CPA begins the interview by saying, "Would you be willing to discuss the events that have taken place?" then any incriminating evidence obtained probably is admissible in court. The point is to obtain the information on a voluntary basis.

• Searches for evidence by CPAs, as opposed to law enforcement officials, generally are much simpler to carry out. A CPA may search an employee's desk, work area or computer files for incriminating evidence as long as the employee does not have a "reasonable expectation of privacy." Searches of an employee's car or home are potentially problematic; it's best to first obtain the employee's or business owner's voluntary "consent." If an employee or owner does not consent, the only other remedy is a search warrant or subpoena. Searching an employee's car or home without consent may leave the client and the CPA open to a civil suit for invasion of privacy or trespass.

• A CPA can complete a great deal of investigative work, and thus give the client a fairly clear and complete picture of the fraud early in the process. The CPA can report to the client what took place, where it took place, how it took place and who was involved. The client then can control the pace of the investigation to ensure it is conducted on a timely basis. The client has the time and pertinent facts to develop an appropriate strategy for handling the potential negative publicity if the case becomes public. The CPA also can provide a thorough analysis of the loss, and the client can then decide how it wants to deal with that loss. The client may seek financial restitution from a bonding company or may choose to put together a civil suit to attempt recovery. When the investigation is complete, the client has all the facts to decide how, in the best interest of the company, the case should proceed and can choose whether to initiate a civil lawsuit, turn the case over for criminal prosecution or pursue some other disposition.

• Once the case is turned over for possible criminal prosecution, the client for the most part relinquishes control. Criminal cases tend to move very slowly through the court system.

WHEN TO CALL THE COPS
As mentioned above, once a case is turned over to outside authorities, any additional fact-finding may have to conform to the same rules that law enforcement officers must follow. Therefore, the client should make it a point to inform the CPA and anyone else involved in the investigation exactly when the case is to be turned over to the authorities.

If the CPA has conducted a thorough and complete inquiry into the fraud up to that point, he or she inevitably becomes an invaluable resource to the law enforcement personnel or prosecutor handling the case. In most instances, the CPA will be required to testify in court-testimony taken by deposition from witnesses normally is not acceptable in criminal court cases. At this point, the CPA needs to inform the client how much more time he or she will need to spend and how much more money it will cost the client.

CPA WITH A BADGE?
It is of utmost importance that the CPA understand the significance of the police agent issue. Remember, the rules of the game change after notifying law enforcement. Therefore, a CPA who takes work directions from law enforcement personnel can easily be considered a "police agent." As such, the CPA must follow all the same evidence-gathering rules as the police.

From jurisdiction to jurisdiction, courts have ruled differently on exactly when a non-law-enforcement person becomes a police agent. Nonetheless, once a case is turned over to civil authorities, any additional fact-finding by the CPA may have to conform to the same rules that law enforcement officers must follow. An example-of particular interest to CPAs-involves the gathering of business documents. Before outside authorities are notified, the client's work policies may allow the CPA access to suspected fraud perpetrators' desks, company files and records, as well as any other company resources on company property under the perpetrators' control. However, once the case has been turned over, search warrants or subpoenas may be necessary to gain access to those same items.

KNOW BEFORE YOU GO
If any profession knows about following rules, it's the CPA profession. The AICPA, FASB, SEC, ASB and IRS all govern a CPA's professional life. And CPAs, like police officers, get their authority from the state. Also, no professional knows more about taking care of a client than an accountant in public practice—it's a CPA's badge of honor. The fraud investigation brings these two skills—following the rules and working with the client—into a new arena. The successful practitioner will keep in close touch with client and lawyer to help recover the cash and put the felons behind bars.