Recovery of Embezzled Assets Half a World Away

EXECUTIVE SUMMARY

THE FIRST STEP IN A FORENSIC INVESTIGATION is to gather as many details as possible about the facts of an alleged misappropriation. But CPAs need to be systematic to guard against “information overload,” which can lead to important factors being overlooked. CPAs, INVESTIGATORS AND ATTORNEYS need to develop a work plan and pool what they learn about the core facts every day. FORENSIC CONSULTANTS SHOULD EXPECT their work to be scrutinized in litigation since it’s impossible to know whether a case will be tried or settled out of court. The lead attorney may consider at the beginning who on the financial team would make the most suitable expert witness. UNDERSTANDING BUSINESS CUSTOMS before commencing a forensic investigation in another country will help an investigating CPA. Knowing the language is an important asset. A SIMPLE BUT EFFECTIVE WAY to track the developing understanding of the normal movements of cash in an organization is to use a flowchart. Once CPAs know how cash was supposed to move between all the parties, they can more readily see how the process was circumvented. THE FINAL REPORT SHOULD SHOW that the CPA consultants in the investigation exercised objectivity. It should describe both sides of any issue and document that the conclusions reached were based on data to which both sides in the dispute had equal access.

MARC A. SIEGEL, CPA, is a director at Andersen LLP. He specializes in complex claims and events and forensic accounting investigations. His e-mail address is marc.a.siegel@us.andersen.com .

n August most Persian Gulf businesses and government agencies shut their doors as key officials vacation elsewhere to escape daily temperatures that often reach 115 degrees or more. That seasonal standstill caused us to schedule our Middle East arrival for September even though our client would have preferred us to start in midsummer. The crime was an embezzlement. The client’s attorneys engaged our firm, Arthur Andersen, to work closely with them in building a case for recovering the property.

The situation under investigation was high profile and contentious. Someone allegedly had taken huge sums of money from agencies within a sovereign government in the Persian Gulf for more than a decade. The assets had been dispersed to financial institutions that included investment banks and brokerage houses in several European countries, including Germany and the United Kingdom.

Our team of financial consultants consisted of two CPAs and an information technology specialist. We were working with six attorneys from the United States and the United Kingdom. Our mission was to help track down the transactions in which funds had been misappropriated and determine the total amount that was missing. We quickly found it was not a typical forensic accounting exercise. Tracing the assets while subject to extreme cultural and language constraints—including the sensitive nature of the information we had to review and the fact that the money was still on the move—was a challenging task. This is how we conducted the investigation.

POOL CORE FACTS EARLY

Our first step was to gather as many details as possible. This vital data gathering was performed under tight time limits and difficult circumstances. A hearing in the United Kingdom was scheduled in a mere seven weeks.

“Information overload” is a significant danger when the pressure is on to obtain and assimilate a great deal of data in too short a period of time, and it can lead to important factors being overlooked. To counter this, we needed to compare notes each day about what we learned.

It was helpful to have the investigators, attorneys and our financial consulting team pool what they knew about the core facts. Each morning the team met to decide on objectives. This permitted the lead attorney to delegate responsibility and direct how everyone would be deployed in the field that day. With the CPAs and investigators dedicated to marshalling the evidence and following the asset trail, counsel could better focus on the legal strategies in the case.

For example, one team, consisting of a CPA and a lawyer, was sent to meet with members of a local bank. The objective was to ascertain what information relating to the bank accounts in question was available. We wanted to know what statements the bank had retained, what language they were in, whether any information was available electronically and, generally, what the institution’s record-retention policy was. Our first on-the-job culture shock came from finding the financial records were in Indian numerals instead of the Arabic numerals we were accustomed to. We solved the problem easily by using a conversion chart.

ASSUME YOU’LL TESTIFY IN COURT

Forensic consultants should proceed as if their work will be scrutinized in litigation since it’s impossible to know what evidence will be unearthed or if a case will be tried or settled out of court. We went about our tasks assuming someone from the team would be cross-examined about our procedures and results (see “An Expert Witness Can Make or Break a Case” ).

We worked with the attorneys to consider who from our team would make the most suitable expert witness. Among the factors taken into consideration were

The jurisdiction(s) where the litigation was likely to be brought.

Whether the case might be heard by a jury or some other trier of fact.

The witness’s appearance, demeanor and experience.

As any investigation progresses and more information comes to light, the lawyer’s strategy for using an expert witness may change. Not knowing whether all the data gathered will help a case, some attorneys choose to control the flow of information to a designated expert. If the case subsequently goes to court, this expert—shielded from certain details—is then positioned to present testimony that is truthful but focused on the points the attorneys consider most helpful. The expert must, of course, disclose the information that he or she considered, and the opposing side gets the opportunity, during cross-examination, to bring out other information. All the members of our team, however, were kept in the loop during the investigation.

TAILOR THE APPROACH

Before commencing an investigation in another country, it helps to understand regional business customs. Our law firm associates briefed us on these. The local entities operated during the hours of 7 a.m. to 1 p.m., Saturday through Thursday. We had to adapt to this schedule as well as to customs such as the serving of strong tea at the beginning of high-level conferences.

We structured our approach to the investigation using the following guidelines:

Assemble a qualified team. The case required extensive information technology and data-mining skills, as key information detailing the money trail was hidden deep in databases at financial institutions. Our financial consulting team possessed a necessary mix of accounting, finance, investigative and information technology skills. For example, some electronic information was available for downloading from a key bank, and we needed to be able to access it. Other information was available only on paper ledgers and bank statements, for which more traditional accounting skills were useful. But, at the outset of the investigation, none of that was clear.

Where possible in a forensic accounting engagement, members of the investigative team should be drawn from a “deep bench.” Tasks and direction may evolve in unpredictable ways as more facts are uncovered. Various resources and skill sets became necessary as we learned which banks we needed to investigate and what information was available at each. Our project required people who were computer literate, particularly in Microsoft Access database software and the Monarch transfer software used for importing financial reports from one system to another. Also, throughout the process, we made do with translators, but fluency in languages would have been helpful.

Assess the environment. Understanding how money nominally flows within the entity being investigated was key; this knowledge provided the basis for identifying the transactions in which assets were misappropriated. To do this, we had to interview in depth client personnel at all levels and—to the extent possible—employees in the banks and brokerages used by the client. We also needed to understand how the money flowed outside the entity, so we met with and interviewed staff at the downstream (that is, linked by transaction) financial institutions where the cash might have been channeled. One useful question we asked was, What were the recurring withdrawals or transfers? from the targeted accounts.

Often the particulars considered easiest to ascertain proved to be the thorniest. For example, when tracing the missing government assets in the case, one of the most complicated issues was to accurately identify which bank accounts were government accounts and which were personal. In some cultures, bank employees make little distinction between a high-ranking government official’s personal account and a “government” account from which he or she has the authority to withdraw funds. Until we could distinguish between the accounts, it was impossible to reach any conclusions about the extent of the cash defalcations. We looked at the documentation used for opening suspect accounts, which provided us with clues.

Exhibit 1: Sample Flowchart for Tracking Cash Management in an Organization

Flowcharts can be used to depict how money normally moves within an organization. In this one, money flowed in from revenues and was deposited in the entity’s bank accounts. This flowchart shows that after going through a disbursement approval process, cash either was sent to vendors (who provided goods and services) or was transferred to other accounts (investment accounts) or, through the payroll process, to employees.

Use visual aids. Once we were able to differentiate between government and personal accounts, we made a list showing which were which. Another useful tool was a flowchart. This was a simple but effective way to record our developing understanding of the normal movements of cash in a large, complex organization (see exhibit 1, above). The flowchart also helped the team decide how the investigation should proceed. Once investigators determined how cash should move between all the parties, they had a better picture of how the process had been circumvented.

Develop the approach to the investigation. As the team began to understand nominal asset flows, it made a work plan for identifying and tracking the misappropriated funds. A work plan designed to the particulars of a case may, for example, look like a table, with different theories of how the defalcation took place on the left and the actions the team needs to take to prove, or disprove, the theory on the right. That’s what we used. While not an actual work plan, exhibit 2, below, depicts some of the elements a work plan might include.

Exhibit 2: A Sample Approach to Investigation

Regardless of the format, a plan should be a fluid document that allows the team to change its approach as other facts are brought to light. Deciding how to ultimately quantify damages usually is a joint effort between CPAs and the client’s attorneys. The plan should break out tasks thoroughly enough to permit different team members to work on them as needed.

One step in such a work plan might be to interview the client’s information technology support staff to discover how much electronic data are available. To build a claim for misappropriated assets, the team needs to gather extensive detail at all levels. Investigators also may be able to obtain substantiating information from the banks and brokerages the client has used.

We developed and refined the work plan after the business and government offices closed each afternoon. This was an ideal time for team members to reconnect, to share what had been learned that morning and to update the plan.

NOWHERE TO HIDE

Use interviews to identify suspect transactions. Our case hinged upon a large number of transactions occurring over a long period of time. It was crucial therefore to find a way to distinguish between the day-to-day money transfers and those that were suspect. To accomplish this, we interviewed the relevant personnel in the client’s financial and/or treasury departments, and, to the extent possible, their counterparts in the downstream financial organizations. These interviews—some of which were with officials in government—had to be properly planned. Those conducting them thought through their objectives and developed questions designed to elicit key facts.

Generally, wherever possible two team members attended the interviews. This allowed one to concentrate on the inquiry and the other to document the answers. Afterwards, they compared notes to clarify what was learned. We had to bear in mind that some interviewees might have collaborated in the embezzlement.

CPAs who are forensic consultants will find that some interviews will yield better results than others. The team may talk to people who are tired, fearful or reluctant to say anything. It is necessary to learn what they know about the transactions and to narrow the search for suspect transactions to a focused and manageable level.

Sometimes an entity’s archiving policies are the only barrier to obtaining the necessary data. In this case, more than a dozen financial institutions were involved, and some had paper records going back 20 years. Others had purged their files, both electronic and paper, at far shorter intervals. This required us to find alternate sources for data, which meant court orders or other such intervention. The records, of course, were not necessarily in English.

As interviews proceeded, we had to keep two questions at the forefront of the inquiry:

What does a “suspect” transaction look like?

Based on the information that’s being learned in the interviews, how can such transactions be tracked?

In some cases, the transactions might have been wire transfers made to a location abroad. Or they could have been checks made out to a specific payee. Once a few suspect transactions had been identified, the team was able to look systematically for others of that type.

Gather data on the transactions. Our claim for recovery of assets was supported by a database of suspect transactions gleaned from the cash-flow records during the relevant time period, starting with the earliest.

The majority of financial institutions and organizations we encountered maintained their data in electronic format in a variety of ways: for example, on a mainframe, within archived data tapes or in some type of data warehouse. Converting a financial institution’s original electronic files was worth the time and effort. This allowed us to cull the suspect transactions directly from the source data, and it provided a clear audit trail as to how the damages from the fraud were to be calculated. In some circumstances, investigating CPAs must manually enter data from paper records when electronic files are not available.

Data entry can dramatically slow the process, subject it to errors and increase cost. It is important to ultimately capture the information in a flexible database application that allows analysis by sorting and summarizing the transactions by year, financial institution, payee, transaction type or in other ways. A common error is to manually enter data for the damages claim in a word processing program using the table function. (It can’t be analyzed electronically, and, because every line must be individually reviewed, it is the most difficult to assess for accuracy.) In our case, with the help of counsel, we retrieved information electronically from one bank, though we manually entered data from others.

Sources of data included the entity’s accounting and treasury departments, financial institutions, regulatory agencies, vendors, customers and others. During this phase of the investigation, CPAs will find it useful to keep a log of when and how information is received. Preserving the “chain of custody” for data may be important if the results of the analysis ultimately are argued in court. In that event, the jury or judge will need to follow the entire process in order to understand the amount of damages being claimed, especially in a complex case.

The circle of financial institutions from which information is needed will expand outward based on the data being gathered. The rule is to follow the trail of additional destinations for the cash wherever it leads. This process is continuous, and it does not end until the situation is resolved.

Our team used a flowchart—created during the initial assessment of the environment—to keep track of how the assets were distributed. This record helped to reveal the trail and identify new financial institutions through which the embezzled assets had been channeled. Forensic consultants will find that, at a later date, a modified flowchart can be a highly effective courtroom exhibit if needed. Another exhibit idea is to use pushpins on a map of the world to indicate where the money has traveled and what locales might require on-site visits.

Quantify the claim. We used a database application to hold the multitude of suspect transactions so that the team could quickly quantify the claim for damages at any time during the data gathering and afterward. We were able to summarize the database in reports that showed the total amount of the alleged misappropriation over time by destination and other categories that illustrated a pattern and established the size of the claim. We put together in binders samples of suspect transactions, as well as the underlying support documents, and verified the accuracy of the amounts in the database.

Produce a thorough report. Although in our case it wasn’t required, the client’s lawyer may request a report (expert or otherwise) outlining the procedures and results of the investigation. It should be sufficiently detailed to allow the reader to follow the approach and flow of the investigation. Be sure to include all steps taken to verify the accuracy and completeness of the analyses created. Any error—no matter how inconsequential—can become a lightning rod for an opposition challenge and could significantly damage the overall credibility of the results.

The report should show that the consultants exercised objectivity in the investigation. Describe both sides of any issue, and document that the conclusions arrived at were based upon sufficient, relevant information to which both sides in the dispute had equal access.

EPILOGUE

Almost everything about forensic investigations is challenging and exciting—even fun. This particular case gave the CPAs the opportunity to be bona fide detectives. We dug into records and turned over rocks to find out how much was missing and who knew what when. In an alien environment and in the midst of hardball litigation, we followed our system, using many of the steps discussed above.

What happened in the case? Our investigation had revealed hundreds of suspect transactions in which funds, originally in government accounts, were transferred out of the country apparently for personal use. The string of allegedly fraudulent transactions went back more than ten years. Money had been moved all over the world, and our database contained entries in a variety of currencies that included British pounds, French francs, Swiss francs, German marks and several types of Arabic money.

We prepared our documentation for the first court hearing of the case, which was to have taken place in the United Kingdom. There, the defendant’s assets already had been frozen in connection with the allegations. We were boxing up our files to be sent to London when we learned that the plaintiff and defendant had arrived at a settlement—prior to any salvos being fired directly in court.

As a bonus to our work well done, we became familiar with a fascinating culture, met exotic people, learned a new numbering system—and in our off hours spent a little time zooming around the desert under its vast sky.