The first step in uncovering fraud in the auditor's bailiwick: analyzing financial information.

If Sherlock Holmes--the world's most famous fictional detective--were solving today's biggest corporate crimes, he probably would be a CPA, too. That's because it takes both accounting knowledge and the unique skills of a detective to resolve allegations of fraud. This article addresses how investigating fraud differs from the field of auditing.

The scenario: During a routine audit of your client, you discover the price the company pays for widgets has doubled in the past year. Moreover, you notice all of the business is going to a new vendor. You check further and find the price of widgets on the open market is half what your client is currently paying. Maybe there is a legitimate reason for this anomaly. Or maybe it's a fraud. What do you do now?

As a CPA your responsibilities are clear: Statement on Auditing Standards no. 99, Consideration of Fraud in a Financial Statement Audit, requires independent auditors to assess the risk that the financials are materially misstated as a result of fraud. As in the scenario above, most frauds aren't obvious.

Most CPAs can determine whether an error has a material effect on the financials. But fraud is something else; its hallmark is intent. "Accidental frauds" don't exist. To prove intent almost always requires going beyond the numbers. In the simplest terms, books don't commit fraud; people do.

The process of resolving these allegations is called fraud examination. The discipline involves a unique body of knowledge that is related to auditing but differs in significant ways (see exhibit 1, page 87). Most fraud examiners actually are hybrids--accountants with significant investigative experience or investigators with solid accounting skills. Certified fraud examiners (CFEs), many of whom also are CPAs, must demonstrate knowledge in four areas: an understanding of fraudulent financial transactions, the legal elements of fraud, criminological concepts and fraud investigative skills. Or, at the risk of quoting myself, "A good fraud examiner is part cop, part accountant, part psychologist and part lawyer."

You can't become an expert by reading this two-part series. But you can learn the process that fraud examiners put into play.

Investigators frequently must defend themselves against allegations of invasion of privacy, libel and slander, public disclosure of private facts and a host of other torts, That's the adversarial nature of fraud examination. Someone being investigated for fraud frequently feels cornered and adopts the strategy that the best defense is a good offense.

Fraud examination methodology assumes from the outset that all fraud cases will end in litigation. This places the burden on the fraud examiner to see that his or her actions can withstand the harsh light of the courtroom. Evidence must be gathered legally, witnesses may not be threatened or coerced and confessions must be obtained voluntarily.

The fraud examination process centers on the fraud theory approach, which has four sequential steps: analyzing the available data, developing a fraud theory, revising it as necessary and confirming it.

ANALYZE THE DATA

The first step is familiar ground for accountants: analyzing financial information gleaned from the books and records. In the scenario above, you typically would gather documents reflecting all of the business the company did with the new vendor: invoices, purchase orders, vendor files, shipping and receiving reports and canceled checks, for example. Then you would closely examine these data, conduct ratio analyses, vouch and trace transactions and perform other audit tests to look for anomalies.

DEVELOP A FRAUD THEORY

Based on what is discovered during your analysis, a fraud examiner will develop a theory--always assuming a worst-case scenario--of what could have occurred. The theory addresses one of the three major classifications of occupational (internal) fraud: asset misappropriations, corruption or fraudulent financial statements.

In our example, the fraud scheme likely involves the misappropriation of assets (cash) or the possibility a corrupt purchasing agent is taking kickbacks to favor one particular vendor who is selling widgets to the client at an artificially high price. Each of these two schemes has its own unique clues but the same result: losses for your client. Considering that at least two possible schemes could account for the significant increase in the price of the widgets, let's start with a list of what the fraud examiner might find if the fraud involved a corrupt purchasing agent in a kickback scheme.

Paying higher than market prices for goods or services. When a crooked vendor pays bribes to get business, the money actually comes out of your client's pocket, not the vendor's. The charge is passed along to the victim with higher prices.

Favoritism toward one vendor to the exclusion of others. If a purchasing agent is getting paid to buy something from one vendor, he or she knows where his or her bread is buttered. As a result the fraudster has the motivation to make all purchases from the corrupt provider.

Increasing levels of purchasing and billings. Similarly, if a crooked employee is getting a piece of the action, he or she has the motive to buy more volume and more often, which will lead to

Substantial inventories. A payoff based on volume sometimes means the dishonest employee will buy much more than necessary. Thus, if the company has a seven-year supply of widgets, there could be a sinister reason why.

Slow service and/or substandard products. Once a crooked vendor is paying off a dishonest purchasing agent, there is little motivation for the vendor to remain competitive. After all, the crooked employee isn't in much of a position to complain.

Lack of controls over the purchasing function. Most corruption schemes are committed by one person acting alone. That means the dishonest purchasing agent either has too much authority, lacks proper oversight or both.

Excessive spending or indebtedness by a purchasing agent. For reasons known only to those who commit fraud, illicit income rarely is concealed or hoarded; fraudsters generally either pay debts or purchase luxury items such as expensive homes, cars, vacations, clothing and jewelry.

REVISE THE THEORY

If the facts do not point to a kickback scheme, the fraud examiner will look for the possibility of a billing scheme. Although both schemes have several common elements, the latter raises its own red flags.

For example, if the price of widgets has increased significantly, a crooked employee could be buying the merchandise from its original source, marking up the price and reselling the widgets to the victim company at an inflated price through a shell company. This is called a pass-through billing scheme, which typically will display the following earmarks:

* A shell company. The most likely scenario for this particular fraud might involve a bogus company formed by the crooked employee. If such a shell exists, it probably won't be listed in the phone book or have a credit rating. A quick check can answer this question.

* Inadequate controls over vendors. A billing scheme depends on getting a bogus vendor approved and on the books. In almost all of these cases, the person approving new vendors and the person approving payments to them is one and the same. Otherwise, secondary approvals frequently are forged.

Once the fraud examiner has developed and tested a fraud theory or theories, he or she will determine whether to proceed further. If he or she chooses to go forward, the fraud examiner will need to interview potential witnesses to gather evidence to sustain an allegation of fraud.

Before proceeding to this next step, the fraud examiner likely will recommend you advise your client and legal counsel of the possibility of an illegal act. Many organizations and attorneys prefer fraud examinations be conducted in anticipation of litigation, which provides a confidential legal privilege for the work. Moreover, some investigations are covered under provisions of the U.S. Fair Credit Reporting Act, which may require the target of an investigation to be notified. And if the employee in question belongs to a union, there may be additional considerations. See your attorney for details.

The law has little patience for fishing expeditions, so the fraud examiner must be on solid legal ground before proceeding. After developing a fraud theory, the antifraud expert must be able to answer a simple but important question: "Do we have sufficient basis to continue?" Predication, the standard adopted by certified fraud examiners, asks: "Would the totality of the circumstances lead a reasonable, prudent and professionally trained person to believe that a fraud has occurred, is occurring or will occur?" If the answer to your question is "no," then the fraud investigator must discontinue the examination. If the answer is a confident "yes," the fraud examination can proceed to the interview stage. But adequate predication is so important that the fraud examiner will continually assess it throughout the process (see exhibit 2, page 88). If, at any point, it becomes clear the predication can no longer be supported, the work must stop. Otherwise, the fraud examination continues to the next step: confirming the theory through interviews.

[ILLUSTRATION OMITTED]

THE INTERVIEW ORDER

If Dr. Watson, Holmes' trusty sidekick, was investigating the possibility of a crooked purchasing agent, he might be tempted to save effort by interviewing the suspect first. But Watson never investigated a case by himself, and going straight to the purchasing agent is something Sherlock never would do. Experienced fraud examiners rarely confront a suspect until they've talked to everyone else who could be in the loop and gathered every scrap of paper or other evidence that could relate to the case.

There are a number of reasons for this approach, with practicality topping the list: The fraud examiner will assume there will be only one chance to interview any suspect, so he or she will be well-prepared. This important interview assuming adequate predication still exists, will be much more productive if all of the related facts and documentation have been gathered in advance. Sometimes when a suspect gets wind of ark investigation, key evidence has a way of disappearing. The antifraud expert also must assume the target will find out about the inquiry from the other witnesses who were interviewed. The goal is to postpone this inevitability until the time is right. But if the client is under the mistaken impression that the work can be completed under a cloak of secrecy, it is necessary to refute this notion before conducting the first interview.

In understanding the order in which fraud examiners normally conduct interviews, it is helpful to view your suspect in the center of several outer rings (see exhibit 3, below). Interviews start with the least culpable persons and end with the most culpable. There are two reasons for this approach. First, if it becomes clear the fraud examiner is on the wrong track, he or she can discontinue the work before accusing people of a crime they didn't commit. Second, the antifraud expert cannot assume the target will confess, although many do. So if interviews are conducted in their logical order, there may be sufficient evidence to prove or disprove the case even without the cooperation of the target.

[ILLUSTRATION OMITTED]

THIRD-PARTY WITNESSES

Fraud interviews usually begin with people who can provide evidence by virtue of their positions but who have no involvement in the alleged offense--they are called neutral third-party witnesses.

In the example of the crooked purchasing agent, a fraud examiner would start by interviewing witnesses who can furnish information of a general but important nature: for example, the personnel clerk who maintains the suspect's pay records, the supervisor who defines the suspect's duties and responsibilities or the sales man who sold the suspect an expensive new automobile. The reasons for proceeding in this manner are twofold.

* Documents must be introduced by a witness. If, for instance, it is discovered there are checks the suspect paid to his shell company, the person who is actually in charge of maintaining the original checks will be interviewed. In court, that person would testify to the authenticity of the originals.

* The second point concedes the intrusive nature of the process: If there is insufficient predication to proceed to the next level of interviews, the fraud examination can be stopped before people become needlessly upset.

CORROBORATIVE WITNESSES

Once the neutral third-party witnesses have been interviewed, the fraud examiner will move on to corroborative witnesses, people who have knowledge of the scheme but are not involved in it. In our example of the purchasing agent, these witnesses would typically include coworkers, supervisors and subordinates. To avoid any legal issues such as possible defamation, the fraud examiner will only ask questions and will not share the fraud theory. (Defamation is the disclosure of dam aging untrue statements. By definition, questions cannot be defamatory. See your attorney for a more complete explanation.)

THE TARGET

The final phase in confirming the fraud theory is to confront any coconspirators and the suspect, in that order. The expert will interview them separately, knowing there is little chance of getting them both to confess collectively. This procedure, called an admission-seeking interview, involves a deliberate process that lays out the evidence to the coconspirator and target in a specific order. Similarly, experts have to precisely phrase their questions and correctly interpret the answers. In next month's column, we will cover the methods fraud examiners use to obtain voluntary and legally binding confessions.

PRACTICAL TIPS TO REMEMBER

* Independent auditors are required by Statement on Auditing Standards no. 99, Consideration of Fraud in a Financial Statement Audit, to assess the risk that financials are materially misstated.

* The fraud examination process begins with the auditor's analyzing financial information taken from the books and records.

* Auditors untrained in finding the roots of a fraud and interviewing techniques should call in an antifraud specialist in the face of suspicious evidence.

Exhibit 1: Auditing vs. Fraud Examination

Issue          Auditing

Timing         Recurring
               Audits are conducted on a regular,
               recurring basis.

Scope          General
               The scope of the audit is an examination
               of financial data.

Objective      Opinion
               An audit is generally conducted for the purpose
               of expressing an opinion on the financial
               statements or related information.

Relationship   Nonadversarial
               The audit process is nonadversarial in nature.

Methodology    Audit techniques
               Audits are conducted by examining financial
               data and obtaining corroborating evidence.

Standard       Professional skepticism
               Auditors are required to approach audits with
               professional skepticism.

Issue          Fraud examination

Timing         Nonrecurring
               Fraud examinations are nonrecurring. They are
               conducted only with sufficient predication.

Scope          Specific
               The fraud examination is conducted to resolve
               specific allegations.

Objective      Affix blame
               The fraud examination's goal is to determine whether
               fraud has occurred or is occurring and to determine who
               is responsible.

Relationship   Adversarial
               Fraud examinations, because they involve efforts to
               affix blame, are adversarial in nature.

Methodology    Fraud examination techniques
               Fraud examinations are conducted by (1) document
               examination: (2) review of outside data such as public
               records: and (3)interviews.

Standard       Proof
               Fraud examiners approach the resolution of a fraud by
               attempting to stablish sufficient proof to support or
               refute a fraud allegation.

Source: Fraud Examiners Manual, Association of Certified Fraud
Examiners, 2003.

JOSEPH T. WELLS, CPA, CFE, is founder and chairman of the Association of Certified Fraud Examiners and a professor of fraud examination at the University of Texas at Austin. Mr. Wells is a member of the Journal of Accountancy Hall of Fame for winning the Lawler Award for the best JofA article in both 2000 and 2002. His e-mail address is [e-mail].