[Chapter In Litigation Services Handbook, Third Edition]

THE ROLE OF THE FORENSIC ACCOUNTANT IN INTERNAL CORPORATE INVESTIGATIONS

Jonny J. Frank, J.D., LL.M.Michael D. Carey FCA, CFE*

Contents

1 Introduction2 Categories of Fraud3 Whether to Conduct an Investigation4 The Accountant's Role In The Investigation5 The Investigative Plan6 The Planning Phase6.1 Role of the Accountant6.2 Assembling the Investigative and Legal Team6.2.A Independence6.2.B Experience and Abilities of Team6.2.C Familiarity with Employee6.2.D Investigative Resources6.3 Scope of the Investigation6.4 Legal and Business Implications6.4.A Legality of Investigative Techniques6.4.A.1 Electronic Surveillance6.4.A.2 Workplace Searches6.4.A.3 Polygraphs6.4.A.4 Restrictions on Employee Interviews6.4.A.5 Corporate Miranda Warnings6.4.A.6 Defamation6.4.B Business Implications6.4.B.1 What To Do With The Employee6.4.B.2 Informing The Troops and Others6.4.B.3 Disclosure of Allegations of Law Enforcement Authorities6.4.B.4 Third Party Liabilities6.5 The Engagement Letter7 The Covert Phase7.1 Role of the Accountant7.2 Investigative Techniques

* Jonny J. Frank and Michael Carey conduct corporate investigations at PricewaterhouseCoopers LLP. Mr. Frank served as the Executive Assistant United States Attorney in the Eastern District of New York and is a member of the law faculties of Brooklyn Law School and Fordham University School of Law, where Mr. Frank co-founded the Fordham University Law School International Criminal Law Center. Michael Carey was an audit partner at Ernst & Young and Assistant Director of the Serious Fraud Office of the United Kingdom.

- 1 -

7.2.A Forensic Accounting7.2.B Commercial Databases/Internet/Public Records 7.2.B.1 Commercial Databases vs. The Internet7.2.B.2 On-Line Media Sources7.2.B.3 On-Line Public Records7.2.B.4 Other On-Line Sources7.2.B.5 The Internet7.2.C Computer Forensics7.2.D Workplace Evidence7.2.E Field Interviews7.2.F Surveillance7.2.G Undercover Operations8 The Transition Phase8.1 Role of the Accountant8.2 Who Confronts The Subject8.3 Location of the Confrontation8.4 Confrontation of the Subject8.5 Contingency Planning9 The Overt Phase9.1 The Investigative Mentality9.2 Advice to Employees9.3 Document Gathering and Examination 9.4 Interviews9.5 The Investigative Report10 The Remedial Phase11 Conclusion12 Notes

1. Introduction

It happens eventually to almost every company. An anonymous letter, a phone call or perhaps an audit tips the company off to serious employee wrongdoing. Sometimes the wrongdoing exposes the company to civil or criminal liability. More frequently, the wrongdoing involves theft of company assets, including proprietary or confidential information critical to the company’s financial well being. In either event, the company must investigate the allegations.1

Nobody instructs you on conducting corporate criminal investigations when you go to school to become an accountant. Yet corporate clients routinely turn to accountants for guidance when these situations arise. This chapter discusses the issues that face an accountant when allegations arise of misconduct by or against the corporate client.

2. Categories of Fraud

- 2 -

The potential for fraud and misconduct reaches far and wide within any company, including procurement2, sales and marketing3, finance and accounting4, operations5, foreign and domestic subsidiaries, portfolio companies, joint ventures, merger and acquisition targets.

Generally, the categories of corporate fraud and misconduct include:

External Fraud and Misconduct External/Internal Fraud: Collusion With Insiders Internal Fraud and Misconduct

Within each of these categories, the accountant and investigative team must distinguish fraud/misconduct, which exposes the company to potential criminal or civil liability from fraud/misconduct, which victimizes the company. Sometimes, the company can simultaneously lose money and face potential liability to third parties.

Examples of external fraud and misconduct include (i) procurement fraud, (ii) theft of inventory and property, (iii) theft of intellectual property and proprietary information and (iv) false statements of acquired companies and strategic relationships.

Examples of frauds involving collusion between outsiders and insiders include (i) conflicts of interest schemes, (ii) commercial bribery and (iii) accounts payable fraud schemes.

Examples of internal frauds include (i) travel and expense schemes, (ii) phantom vendors, (iii) misappropriation of corporate assets, and (iv) theft of trade secrets.

3. Whether to Conduct An Investigation

The client may first ask for counsel as to whether even to initiate an investigation. One of the most important factors in deciding whether to conduct an investigation are the circumstances giving rise to the allegations. Has the company learned of the allegations from the commencement of legal proceedings such as the execution of a search warrant or receipt of a grand jury subpoena? Typically, if a prosecutor is conducting an investigation or has served a subpoena or executed a search warrant, a company has no choice but to conduct an internal investigation and assess the viability of the allegations.

The more difficult decision is when the company is aware of internal allegations of wrongdoing, but no private lawsuit has been filed, or the government has not initiated an investigation. Should the company investigate claims, which, if true, may subject the company to civil or criminal liability? Should the company throw good money after bad when it has been the victim of a fraud? Is it better to ignore the problem and hope that the allegations will never become public?

- 3 -

While there is no hard and fast rule, generally the law, good business judgment and common sense favor conducting an investigation. Knowledge of the facts will enable management to examine options and respond effectively, and enable the company to decide whether it is necessary to disclose the allegations and the company's findings in response to the government. An internal investigation enables management to fulfill its duty of care and receive the protection of the business judgment rule.

The disadvantage of conducting an internal investigation must also be considered. For example, an investigation may yield damaging information that may be subject to discovery in litigation. In addition, the cost of conducting the investigation, of both the actual expenditures as well as lost in management and employee time can be quite high. Further, the company must be aware and be prepared to deal with the consequences if what begins as a narrow, focused inquiry leads to discovery of deeper, broader-based corporate misconduct.

Notwithstanding the potential disadvantages of conducting an internal investigation, on balance the advantages of commencing an investigation clearly outweigh the disadvantages in most circumstances. When confronted with allegations of wrongdoing, an internal investigation is necessary to uncover the facts so the viability of the claim can be assessed, and appropriate remedial action taken.

4. The Accountant's Role In The Investigation

The accountant's role in the investigation will depend upon the nature of the allegations, the resources of the accounting firm, and the relationship with the client. The accountant frequently will assume a primary role with responsibility for managing the investigation. This typically occurs where the allegations involve a crime or fraud against the company. As the project manager, the accountant will devise the investigative plan, supervise the investigation and advise the client regarding the business implications as well as the short-term and long-term consequences of the investigation.

In many instances, the accountant will serve in a supporting role. For example, where the allegations involve allegations of misconduct by the company, it is likely that in-house or outside counsel will be leading the investigation. In these instances, the accountant typically will be performing forensic accounting and auditing either in relation to determining the ultimate facts and/or quantifying damages. The accountant likely will be assisting to develop controls to prevent a recurrence of the misconduct. These tasks are discussed separately in this chapter as well as other chapters of this book.

5. The Investigative Plan

- 4 -

Investigative engagements are generally organized into progressive phases, namely, the planning phase, a covert phase, a transition phase, an overt phase, and a remedial phase. The role of the accountant in these phases is discussed below.

The planning phase requires both short-term and long-term planning and involves an evaluation of the investigative needs and objectives. The covert phase consists of investigative activity taken before the subject of the investigation becomes aware that an investigation has been implemented. The transition phase occurs just immediately before or contemporaneous to the subject's learning of the investigation. The overt phase, which occurs after the subject is aware of the investigation and typically is the most extensive phase for the accountant, involves more traditional investigative and audit techniques. The remedial phase involves both financial recovery and/or settlement of criminal and civil liabilities as well as the development of controls to ensure that the misconduct does not recur. While these phases generally follow one another, in a larger internal investigation the investigative plan must allow for the flexibility to switch back and forth between phases; that is, changing the circumstances may require the investigative team to return to the covert or transition phases even though the investigators and accountants are already conducting an overt investigation.

6. The Planning Phase

There will be a natural tendency and almost immediate and irresistible impulse to confront and/or suspend the individuals alleged to have engaged in wrongdoing. Understandably, management will want to get to the bottom of the problem as quickly as possible. Where internal fraud is alleged, the prospect of having a criminal continue his employment, and perhaps his wrongdoing, is intolerable. Indeed, management must consider the prospect of criticism from regulators, law enforcement authorities and civil attorneys if immediate, aggressive action is not taken, especially if the illegal conduct continues. Accordingly, management will frequently opt to confront and/or suspend the suspected employee(s) and confront third parties at the outset of the investigation.

While such a decision may appear to be entirely appropriate and perhaps necessary under the circumstances, it must be balanced against the extent to which critical fact-finding will be impeded at an essential stage in the investigation. Pre-confrontation investigation will frequently uncover important facts reflecting the nature and extent of the misconduct, enabling the company to assess the harm it has suffered. Facts directly or circumstantially implicating the subject may also be uncovered, thereby enhancing the likelihood of a successful confrontation. Additionally, prior to the confrontation, the company must consider and evaluate the legality of certain investigative techniques, the subject’s rights and the business implications of the employee’s possible dismissal. Moreover, in situations where substantial funds are stolen, the company should determine if it

- 5 -

can recover a portion or all of the funds through asset searches and legal process. In short, when serious allegations of misconduct arise, a company and its management must address a myriad of investigative, legal and business issues that have both short-term and long-term consequences. Only by carefully considering these issues in advance can a company effectively design a strategy for confronting the employee, remedying the damage caused by the wrongdoing and instituting measures to prevent it from happening again.

6.1 Role of the Accountant

The accountant should seek a major role in the planning phase regardless if serving a primary or support role in the investigation. Invariably, there will be a financial aspect to the alleged wrongdoing. The accountant's advice will be necessary regarding the staffing of the investigative team, defining the scope of the investigation, devising an investigative plan, and counseling on the business consequences of the investigation.

6.2 Assembling the Investigative and Legal Team

The decision as to who will participate in the investigation is crucial and merits considerable thought and discussion. Corporate counsel and management have a number of options to choose from: in-house resources such as legal, human resources or security departments, and/or outside resources, such as law, investigative and accounting firms. If the allegations are significant, the company must assemble a multi-disciplinary team. Professionally trained investigative resources will be needed to develop the facts and evidence. Experienced legal counsel may be necessary to manage the various legal issues affecting the investigation, including issues of labor law and corporate civil and criminal liability. Among the factors that must be considered in making this determination are:

Independence

The issue of independence must be considered in determining who conducts the investigation. An in-house investigator may have difficulty maintaining his or her independence when interviewing employees and providing the employees with legal advice. Further, an in-house investigator’s judgment may be affected or criticized by previous biases or political considerations, whether real or not. For example, it may not be desirable for an in-house professional to investigate the conduct of his or her superiors. Also, in-house professionals who have witnessed the underlying conduct should not participate in an internal investigation.

- 6 -

Lastly, in-house professionals must be cognizant of appearances should litigation ensue. The objectivity and independence of an “insider,” may be questioned by the employee’s counsel or in legal actions initiated by other interested parties such as shareholders or investors. These parties will invariably claim that the in-house investigative team was partial and attempted to scapegoat an employee to cover up more serious corporate misdeeds.

Experience and Abilities of the Investigative and Legal Team

The ability to investigate and interview effectively is an acquired skill. Only through experience and training can one prepare and execute an investigative plan designed to gather evidence logically and efficiently. Such a plan may encompass obtaining information from internal sources such as employee interviews, financial records, computers, travel and expense reports records and personnel files, as well as external sources such as former employees, vendors, industry sources, on-line databases and public records. Specialized resources and expertise will be required to conduct the investigation, including access to and experience in database research, computer forensics and electronic surveillance.

In addition to the “nuts and bolts” of the investigation, the investigative team must be mindful of the various legal and business implications of the investigation and the techniques used to gather evidence relevant to the allegations. Structuring an interview to obtain maximum information, either through careful questioning or through exploiting the weaknesses in an interviewee’s story requires substantial preparation and analysis of all available evidence. The company must consider the circumstances of the interview and the backgrounds of the interviewees in selecting the interviewer.

Familiarity with Employee

The working relationship between an in-house corporate investigator and suspected employee may create an awkward investigative atmosphere. Investigations led by in-house representatives may create or exacerbate morale problems. In the event the allegations are not proven, the future working relationship with the employee(s) may well be strained. The hiring of outside consultants to respond to allegations may be viewed as responsible corporate conduct rather than politically or personally motivated acts if led by corporate insiders.

Investigative Resources

Outside firms are generally better equipped to investigate allegations of misconduct by or against a corporation, having substantial staff dedicated to and experienced in corporate fraud investigations. Depending upon the nature of the allegations, the company must consider the geographic resources as well as the

- 7 -

industry expertise in assembling the investigative and legal team. Moreover, sophisticated computer database research is now the norm, with detailed background information readily available on individuals and entities, including, asset ownership, civil litigation, criminal convictions, bankruptcy filings and business relationships. Outside firms also provide services such as forensic accounting and computer data retrieval which are frequently necessary to learn the particulars of a fraudulent scheme.

6.3 Scope of the Investigation

The company will have more flexibility if the company if the company learns of the allegations of wrongdoing before the government has initiated an investigation, or a private lawsuit has been filed. The company will need to investigate all plausible allegations of misconduct and ensure that the investigative leads are followed. All potential witnesses should be interviewed, and potentially relevant documents should be reviewed.

But there are limits. Credibility and common sense are determinant. The company should not finance a wild goose chase or investigate baseless or frivolous allegations. It must, however, be prepared to expand the investigation as needed and to justify any limitations placed on the investigative team.

6.4 Legal and Business Implications

The investigative advisers must carefully consider and plan for a host of legal and business implications. Chief among these concerns is the propriety of the investigative techniques, the rights of the suspect employee, the company’s relationships with third parties and the company’s ability to function in the wake of the investigation.

A recent addition to the list of issues that must be addressed concerns whether a report will be produced following the investigation. Although companies frequently request a report, especially if negative employment action or referral to law enforcement agencies is contemplated, a recent Federal Trade Commission (“FTC”) staff opinion letter concluded that outside attorneys or investigators might be considered “consumer reporting agencies” under the Fair Credit Reporting Act, thereby obligating the employer to notify employees under investigation and furnish them with copies of the investigative report.

Following publication of the staff letter, a number of commentators and practitioners expressed concern that the staff letter would inhibit companies’ ability to hire experienced attorneys and investigative firms to fully investigate allegations of wrongdoing. In response, the FTC issued a letter that sought to “clarify, and perhaps soften,” the implications of the staff opinion letter. The letter, however, did not suggest that the staff letter was incorrect in its interpretation of the FCRA; instead, it merely provided advice for dealing with the

- 8 -

FCRA’s provisions. For example, the letter recommended that employers obtain employee consent at the start of employment to procure consumer reports, thereby relieving the employer of the duty to disclose. Although the FTC’s opinions regarding the FCRA do not have the force of law, its interpretation of the FCRA must be considered prior to issuing an investigative report.

Legality of Investigative Techniques

In most circumstances, an aggressive investigation is necessary to uncover the full extent of the wrongdoing and damages sustained by the company. As described below, investigators must be familiar with statutory and common-law prohibitions or restrictions on certain investigative techniques.

Electronic Surveillance

Tapping telephones is perilous – the federal wiretap statute, commonly known as Title III, makes it a crime to “intentionally intercept any wire, oral or electronic communication.”6 An employer, however, may use an extension telephone to monitor employee calls made in the ordinary course of business.7 Criminal conduct overheard during the course of monitoring could be used by the employer to take remedial employment action and would be admissible in court. However, it is important to note that the recording must be related to legitimate business interests and cannot be used merely as a pretext for conducting an investigation into suspected wrongdoing.8

Title III also permits the taping of telephone conversations as long as one of the parties to the conversation has consented.9 However, state laws vary, with twelve states requiring approval by all parties to the conversation prior to taping.10

Workplace Searches

Generally, the workplace is under the control of the employer, and property provided by the employer to the employee, such as lockers and desks, typically may be searched without the employee’s consent.11 Computer hard drives and networks, as well as e-mail, are generally subject to search12, although companies in at least two states, Maryland and Florida, cannot monitor e-mail absent employee consent.

However, the ability to search work areas and items within those areas is not absolute. Searches may be limited depending upon the employee’s privacy expectations and the employer’s express or implied recognition of those expectations. For example, allowing employees to use personal locks on lockers may restrict an employer’s ability to search for evidence of wrongdoing.13 Unless the employer has written policies concerning unannounced searches, and

- 9 -

obtains signed waivers by employees, careful consideration should be given to the scope of searches conducted in the course of the investigation.

Polygraphs

In anticipation of the suspected employee’s denial of wrongdoing, consideration should be given to a polygraph examination. Although the use of polygraphs in the workplace was severely restricted by the Employee Polygraph Protection Act of 1988 (“EPPA”)14, polygraphs are permitted if their use is related to the investigation of a specific incident. Employers may request that an employee submit to a polygraph examination if: (1) the test is part of an ongoing investigation involving economic injury; (2) the employee had “access” to the property that is the subject of the investigation; (3) the employer has a reasonable suspicion that the employee was involved in the activity under investigation, and (4) the employer executes a statement detailing requirements (1) through (3).15

Although evidence obtained from the polygraph may not, in itself, constitute the basis of an adverse employment action16, the results may, when taken with other

1 See generally, W. Schmidt and J. Frank, Uh-oh, Now What: Responding to Allegations of Corporate Misconduct, Directorship, April 1997.2Common external fraud schemes include: (i)kickbacks and Illegal payments, (ii) bid rigging, (iii) defective pricing, (iv) fictitious, false and inflated invoices, (v) product substitution, (vi) mischarging. Common internal fraud schemes include (i) conflicts of interest, kickbacks and illegal payments, (iii) phantom vendors and purchases for personal use, and (iv) unjustified sole source awards.

3Common sales and marketing schemes include (i)travel expense fraud, (ii) kickbacks and other illegal payments, (iii) foreign corrupt practices act violations, and (iv) conflicts of interest schemes. 4 Common finance and accounting schemes include (i) misappropriation of cash, (ii) payroll fraud, (iii) accounts receivable schemes, (iv) accounts payable schemes, (v) revenue recognition schemes, and (vi) improper treatment of costs and expenses.5 Common fraud schemes affecting operations include (i) management fraud, (ii) misappropriation of inventory, (iii) misappropriation of intellectual property, (iv) external thefts and frauds and (v) procurement fraud.

6 18 U.S.C. §2511(1)(a)7 18 U.S.C. §2510(5)(a)8 United States v. Murdock, 63 F.3d 1391 (6th Cir. 1995), cert. denied 116 S.Ct. 1672 (1996)9 18 U.S.C. §2511(2)(d)10 See, e.g., Cal.Pen.Code §§631, 63211 O’Bryan v. KTIV Television, 868 F. Supp. 1146 (N.D. Iowa 1994), rev’d in part 64 F.3d 1188 (8th

Cir. 1995).12 Smyth v. Pillsbury Co., 914 F. Supp. 97 (E.D. Pa. 1996)(“We find no privacy interests in [e-mail] communications”); see also, United States v. Simons, 29 F. Supp 2d 324 (E.D. Va. 1998)(Court found that CIA employee had no reasonable expectation of privacy in Internet use nor in files downloaded to his computer hard drive.)13 See e.g. O’Connor v. Ortega, 480 U.S. 709 (1987)(doctor evidenced privacy interest in office desk and file cabinets by clearly barring others from these areas)14 29 USC §§2001-200915 29 U.S.C. §2006(d)(1) - (d)(4)

- 10 -

evidence, justify suspension or termination. The employer has little recourse, however, should the employee refuse to take a polygraph examination. Many states prohibit employers from requiring that employees take polygraphs as a condition of continued employment, and frequently grant employees the right to counsel if a polygraph examination is sought.17 Lastly, the Department of Labor, which administers the EPPA, can assess civil penalties of up to $10,000 against the employer and seek remedial relief for the employee. The employee is also authorized to file suit.18

Restrictions on Employee Interviews

Although employees of private entities do not, in the context of an internal investigation, enjoy constitutional protections such as the right to counsel, they may possess contractual rights that must be respected during the course of the investigation. For example, a union member may be entitled to have a union representative present during an interview that may lead to disciplinary action.19 The collective bargaining agreement may contain other employee rights and benefits and should be reviewed prior to interviewing union members.

Notwithstanding any bargained for rights, employees are obligated under state statutes or common law to cooperate in the employer-employee relationship, including complying with reasonable requests during an internal investigation.20 If the employee refuses to cooperate, the company generally may terminate the employee. It is prudent, however, to review all aspects of the employer-employee relationship, including company policies, contractual relationships and prevailing law in plotting the investigation’s course.

Corporate Miranda Warnings

If an attorney for the company interviews the employee, the attorney must advise the employee that the interview is being conducted on behalf of the company and that the attorney represents the company, not the employee. Further, the employee should be told that the information obtained from the interview will be protected within the company’s attorney-client privilege, but that the company may choose to waive the privilege and disclose the contents of the interview without the employee’s consent. In sum, there should be no confusion on the employee’s part as to which counsel is representing in the investigation.

Defamation

The threat of defamation lawsuits always looms overhead when accusations of wrongdoing are leveled at employees. Assuming the employee can establish 16 29 U.S.C. §2007(a)17 See, e.g. N.J.S.A. 2C;40A-118 29 U.S.C. §200519 NLRB v. Weingarten, Inc., 420 U.S. 251 (1975)20 See e.g., Cal.Lab.Code § 2856 (West 1989)

- 11 -

that defamatory statements were made and “published,” i.e. communicated to at least one other person, the most frequently raised defense is that of qualified business privilege. This privilege requires that the statement (1) was made in good faith; (2) concerned a subject in which the person making the statement had an interest or duty; and (3) was made to a person having a corresponding interest or duty. Accordingly, statements made in the context of an internal investigation generally will be protected, provided the investigation is conducted properly and discreetly.

Business Implications

Allegations of criminal conduct frequently result in a disruption of the company’s business, as senior management directs its energies toward the problem and away from company’s daily operations. Moreover, a host of issues concerning the ongoing business in the wake of the allegations must be considered prior to confronting the employee.

What To Do With the Employee

When serious allegations of misconduct are directed toward an employee, the company must react. Absent the rights and benefits accorded union members, the company may generally choose to suspend the employee with or without pay, terminate him or allow him to continue working. Because of the tremendous impact this decision will have on the course of the investigation, management should consult with its investigative team before taking any action.

Generally, suspending or terminating an employee will severely limit the investigator’s ability to confront the employee under conditions carefully designed and structured to maximize the likelihood of a confession. In other words, it is vitally important for the investigator to control the environment in which the interview is to take place. The element of surprise is critical, as the employee will not have had an opportunity to plan and rehearse an explanation for the conduct. Moreover, the interviewer will be able to gauge the employee’s reaction to particular questions, and will be prepared to present contradictory evidence if necessary.

If the employee is alerted to the allegation, which is inevitable if he is suspended or terminated, the likelihood of a successful confrontation is diminished, especially if counsel is retained. In addition, proactive efforts to obtain damaging evidence against the employee through surveillance or sting operations will, in all likelihood, are lost. Lastly, the employee may make efforts to influence witnesses or third parties with knowledge of the misconduct, or destroy documents or other evidence relevant to the investigation.

Of course, there will be circumstances in which the company will have no choice but to suspend or terminate an employee. For example, if the company will

- 12 -

suffer irreparable harm by allowing the employee to continue working, even for one day, suspension is appropriate. These situations arise most frequently in the intellectual property area, where disclosure of trade secrets or other confidential information can spell financial ruin for the company. In the absence of a genuine threat to the company’s financial well being, the better course is to wait until the confrontational interview has taken place.

Informing the Troops and Others

If the employee performs an important function, the company must prepare contingency plans to deal with his possible departure. A temporary or permanent replacement should be waiting in the wings to ensure minimal business interruption. Statements should be prepared informing company personnel of the termination and assuring them that the situation is under control. Although perhaps ineffective, personnel should also be instructed not to discuss the matter further amongst themselves or with third parties. Plans to contact and inform customers and third parties affected by the misconduct must be developed. If called for, the company should consider hiring a crisis management team to advise it during this period.

Disclosure of Allegations to Law Enforcement Authorities

At the outset of the investigation, the company must begin its evaluation of whether or not it will disclose the misconduct to law enforcement authorities. If there is no legal obligation to report the misconduct, voluntary referral requires careful consideration of the effect disclosure may have on the company’s business operations.

Generally, absent a statutory reporting requirement, such as in the case of federally insured financial institutions or publicly traded companies21, a company is not required to report knowledge or evidence of criminal conduct to law enforcement authorities.22 The misprision of felony statute is violated only if an individual, having knowledge of the commission of a felony both fails to notify authorities and deliberately takes and affirmative step to conceal the crime.23 Mere silence is insufficient to establish the affirmative step element of the crime.24

Although the company may not be required to report criminal conduct, it must consider voluntarily disclosing the conduct to the authorities. In determining whether voluntary disclosure is appropriate, the company must first assess any liability it may incur through the criminal behavior of its employee. For example,

21 The Securities and Exchange Act of 1934 requires the disclosure of “material” facts in certain filings and reports. Counsel should be consulted to determine whether facts discovered during the investigation are material within the meaning of the statute. States and stock exchanges may also impose similar disclosure requirements. 22 United States v. Baez, 732 F.2d 780 (10th Cir. 1984)23 18 U.S.C. §4; United States v. Hodges, 566 F.2d 674 (9th Cir. 1977)24 Id.

- 13 -

if the conduct appears isolated, aberrant and restricted to a lower-level employee, it is unlikely that a prosecutor would pursue criminal sanctions against the company.

If, on the other hand, the criminal activity is pervasive and implicates senior management, or if it victimizes the government, law enforcement authorities may very well consider prosecuting the organization. Under these circumstances it may be prudent for the company to voluntarily disclose the conduct and take the opportunity to present mitigating circumstances, possible defenses and exculpatory evidence. Coming forward before any government investigation is initiated, coupled with evidence that the company promptly responded to the allegations and instituted remedial measures, may persuade the prosecutor to proceed against the individual wrongdoers and not the company. In the event the company is prosecuted, enters a guilty plea, cooperates and accepts responsibility for its wrongdoing, it will benefit from its voluntary disclosure under the United States Sentencing Guidelines.25

Lastly, if the company does business with the federal government, a number of agencies, including the Department of Defense and the Internal Revenue Service, have created formal voluntary disclosure programs. Again, promptly disclosing the improper activity may enable the company to argue persuasively that declination of prosecution is appropriate.

Another factor the company must consider in determining whether or not to report the allegation is the effect a government investigation will have on its business. Government prosecutors and agents are very busy, with many matters under investigation and prosecution. Unless the magnitude of the misconduct at issue is such that prosecutor and investigator deem it a priority, the investigation will proceed at a deliberate pace, leaving an ominous cloud hanging over the company for an extended period of time.

A lengthy law enforcement investigation will also distract employees and result in workplace inefficiencies and morale problems. Most important, the existence of a criminal investigation may have serious business implications for the company, including, restrictions on third-party financing, vendor reluctance to supply materials other than on a C.O.D. basis, customer concerns about timely shipping and receipt of products, and reputation damage in the business community.

In most circumstances, the decision as to whether or not to report the conduct to criminal authorities, and when, is complex and requires a weighing of many factors. It is important to evaluate these factors at the earliest stages of the investigation.

Third-Party Liabilities

- 14 -

The company must also evaluate whether any potential liabilities exist with respect to its suppliers and customers. If, for example, customers were defrauded, efforts must be made to make the customers whole and restore confidence in the business relationship. Other times the company will be the victim, and consideration must be given to the manner in which remedies will be pursued, if at all, against third-parties.

6.5 The Engagement Letter

The accountant should not participate in an active investigation until an engagement letter has been executed. Issues to be addressed in the engagement letter include:

The Scope of Services Timetable Fees Confidentiality Ownership of Working Papers Liability and Indemnification

7. The Covert Phase

The initial confrontation of the suspect individual(s) is critical. A company frequently has only one opportunity to confront an officer, employee or third party. Oftentimes, the company enjoys the benefit of the element of surprise, which enables management to obtain information and gauge an individual's reaction and responses when confronted. Accordingly, great care should be taken to ensure that that opportunity presented by the confrontation is not squandered. Obtaining accurate information about the wrongful conduct at an early stage of the investigation enables the company to immediately deal with the problem, remedy damage caused by the wrongdoing and institute measures to prevent its reoccurrence.

Initially, facts should be developed discreetly to avoid possible obstructive conduct such as document destruction, records’ alteration and witness tampering. A variety of investigative techniques have been developed to gather facts before the subject of the investigation becomes aware that an investigation has been implemented.

7.1 Role of the Accountant

An accountant generally performs a very limited role in the covert phase of the investigation with the exception of analysis of records and the preparation of a visual link analysis. It is essential, however, that an accountant be familiar with the availability of covert techniques so that he can advise the client as needed.

- 15 -

Moreover, the accountant needs to work in tandem with the covert investigative team.

7.2 Investigative Techniques

Forensic Accounting

Forensic accountants piece together financial data and search for anomalies and irregularities that are the hallmarks of fraud. Depending upon the circumstances, the client may be about to furnish the forensic accountant with key data without jeopardizing the secrecy of the investigation. Financial transactions that directly implicate the subject or corroborate evidence obtained through other investigative techniques constitute powerful ammunition with which to confront the alleged wrongdoer.

Commercial Databases/Internet/Public Records

The explosion of information sources available on the Internet and through commercial online services has revolutionized the investigative process. Virtually every business investigation now begins with some form of online research. In a matter of hours, a skilled investigator can develop information, which can provide critical leads and make connections that may never be found through traditional field investigation.

As a practical matter, an accountant will probably not be trained in these various database sources. The accountant, however, needs to be familiar with the sources of information that are available so that he can bring the proper resources to the investigation. The subject is discussed at some length because this investigative resource has become so crucial.

Commercial Databases vs. the Internet

For certain types of information, the Internet cannot match the offerings of commercial services. For others, the Internet is the best and only place to find information. Knowing when to use the commercial databases and when to use the Internet is key to developing a comprehensive and thorough investigative strategy.

Whether to rely on the Internet or commercial databases will depend on the nature and extent of the information you are seeking. Before going online, the investigator will need to identify which databases or Internet sites are most likely to contain information most relevant to the target of your investigation, in terms of both geographic location and subject matter. As more information is made available on the Internet, the best approach is to use these research tools in

- 16 -

tandem, and to become familiar with the best sources of information to suit the particular needs of the investigation.

On-Line Media Sources Whether retrieved from commercial databases or the Internet, the most valuable sources of information fall into two main categories, news and media sources, and public record sources. It is usually best to start the online investigative process with a media search, one of the key sources for historical and background information regarding entities and individuals. These sources include local, national and international newspapers, magazines, trade publications, and television and radio broadcast transcripts. Often, a subject’s legal, financial or business troubles are written about in the news media in well-researched and thoughtful articles. Media can also be helpful in identifying a subject’s prior employment and personal history.

When using the commercial media databases, the researcher should give careful thought as to which databases to use. In general, Lexis-Nexis26, Dialog27, Datastar28 and Dow Jones29 provide the most extensive news and media coverage. Each database provides different levels and types of local, national and international coverage. The database vendors are constantly adding new and removing underused sources. Paying attention to content must be an ongoing process. Researchers must check their habits and change their search strategies accordingly. 26 Nexis, the news database of Lexis-Nexis, provides a massive collection of news sources, with extensive archives of national newspapers and business and industry news sources. Nexis has the largest archive of the New York Times, and a growing number of local newspapers. It also offers access to the Bloomberg Newswire, a highly respected and fast growing provider of business news. Its strong content, combined with software that make both searching and reviewing documents quick and simple, makes this a good first source in any investigation.

27 In terms of news content, Dialog rivals Nexis in scope. It has various full-text local newspapers not available on Nexis (for example, the Philadelphia Inquirer and the Detroit Free Press) and an extensive collection of industry-specific newsletters (IAC Newsletter database, file 636), unique to Dialog. In addition, Dialog, in conjunction with Dow Jones and Financial Times Information, recently added a vast collection of international news sources (World Reporter Database, file 20).

28 International news sources, primarily from Europe, represent Datastar’s greatest strength. Although recently merged with Dialog, many of these European news sources have not yet been included in the Dialog database. These include unique newspapers, newswires and business magazines from Switzerland, Germany, Italy and the Baltic States, among others. Datastar’s search language can be a challenge to use, and requires much practice to master.

29 Dow Jones is the only database, which provides full-text access to the Wall Street Journal, the Dow Jones Newswire and Barrons, essential sources for any business investigation. It also boasts an extensive collection of local newspapers, industry publications, and international news sources.25 United States Sentencing Guidelines Manual 8C2.5(g)

- 17 -

On-Line Public RecordsAfter exhausting online media sources, the next stop in the online investigation is to search the vast compilation of abstracted public record information. This resource includes: federal and state civil court proceedings, federal criminal records, federal bankruptcy court records, UCC filings and other asset locators, corporate records, property records, judgment indices, motor vehicle records, regulatory agencies actions, professional registration and licensing information, Securities and Exchange Commission (SEC) records and other business databases. On-line public records information is perhaps the fastest growing area of online information and is routinely included in any business investigation.

The availability of on-line public records information varies from state to state and covers variable time periods, so the extent of coverage in a particular jurisdiction must be carefully considered. Another word of caution: online records are often inaccurate and incomplete. While a great source of leads, online research should never be exclusively relied upon. Investigators encounter situations in which a manual search of the public record reveals significant litigation matters that were not identified online, despite the fact that court records were supposedly online for that particular jurisdiction and time period. Additionally, many of the online records, most of which are abstracted, are likely to contain only a portion of the information available from the original document. A combination of online searching and onsite searching at relevant courthouses or agencies is the best approach.

Further, in international investigations, only limited public records information is available online. The reasons for this are twofold. First, many records, such as lawsuits and bankruptcies, are not considered public information. Second, other countries tend to lag behind the U.S. when it comes to automating their publicly available information into searchable online databases. Even in those foreign countries that do have some information available online, it is generally limited to corporate records, some Dun & Bradstreet company reports, and varying degrees of media. There are also CD-ROM products available that have international corporate records. Again, it is important to know specifically what is available in the jurisdictions you are concerned about in order to maximize the information you can obtain from these sources.

In general, the most used public records database providers are Lexis-Nexis30, CDB Infotek31, Information America 32, Autotrack33, Pacer34, Courtlink 35, and Superior Information Services.36 All of the commercial database providers provide some form of “global” search capability, which allows the user to search simultaneously millions of records from across the country. Because there is a great deal of overlap in the content of these databases, however, the accountant must retain an on-line database and Internet investigator who is well acquainted with the unique public record sources that each database provides. In cases of overlap, an investigator may base the decision to use one over the other on cost and search features, which differ widely across the public record databases.

- 18 -

In addition to the commercial vendors, many state and federal regulatory agencies now make records available directly on the Internet.37 Some of the commercial vendors also offer a web-based product.38

While the availability is increasing at a fast pace, presently public records offerings on the Internet remain insignificant when compared to the commercial services. Even though some public record information is available, the Internet is not a viable alternative to the commercial vendors. However, used in tandem with

37 The SEC's website (www.sec.gov) provides instant access to quarterly, annual, and other reports filed by public companies, as well as the adjudication of any disciplinary matters relating to individuals or public entities. The NASD website (www.nasdr.com) allows one to research the licensing status of any individual or firm broker/dealer, including any potential disciplinary history. The Better Business Bureau website (www.bbb.org) provides access to business and consumer alerts. The Federal Trade Commission website (www.ftc.com) maintains a compilation of news briefs and warnings relating to illegal business practices. Perusing these sites can make the investigator's job much easier as it eliminates having to spend hours on the phone with governmental regulatory agencies.

38 For example, Information America, one of the pioneers in providing public records data, has a website (www.knowx.com) that allows Internet users without a commercial account to search these records and bill the costs to a credit card. The Web product, however, does not offer certain powerful search capabilities available on the proprietary dial-in system, such as a global search across all available public records.

31 This database provides bankruptcy filings, civil lawsuits, limited criminal case information, liens, judgments, property records, UCC filings, professional licenses, corporate records, voter registration information and aircraft and vessel ownership records. CDB Infotek includes records from most states in the country, and is particularly strong in California, with its inclusion of criminal cases and municipal court civil cases. The database also has unique regional public record search features, which allow the user to search all available records in specific groups of states. CDB Infotek also has a feature that allows you to locate individuals nationwide; and it has the ability to trace social security numbers.

32 This service provides the most extensive coverage of state-level civil lawsuits, covering selected counties in all 50 states, the District of Columbia, Puerto Rico and the US Virgin Islands. The vendor also provides county level records, liens, corporate records, bankruptcy filings, UCC filings, liens, judgments and real property, some of which are not available through any other online sources. It also provides very powerful global search features, which allow the researcher to cover virtually all the public records on the database, nationwide.33 AutoTrack is one of the best online resources for locating individuals anywhere in the U.S. The national report feature provides the social security number, and month and year of birth for the subject. It also lists all of the business and residential addresses associated to the subject within the last 8-10 years. The report will also include a list of all individuals associated with the addresses listed for the subject, as well as telephone numbers. AutoTrack is particularly strong in Florida and the Eastern region of the U.S.

This online service provides critical identifying information on a subject, which then allows the investigator to focus subsequent searches in the appropriate jurisdictions. For example, if the

- 19 -

commercial databases, the Internet can provide valuable leads and critical information about individuals and entities.

Other On-Line Sources

In addition to media and public record sources, several other online investigative sources deserve mention. These include Dun & Bradstreet, which provides self-reported business and credit information on both public and private, domestic and international companies39, and people locator services, which can be critical in locating key witnesses.40

subject is known to reside in New York, but AutoTrack also lists addresses in Colorado and Florida, the investigator will know to look for property, litigation, criminal records, businesses, and other public records in those additional jurisdictions.

For both individuals and businesses AutoTrack can quickly identify property ownership information, boat and aircraft registration, DEA controlled substance licenses, firearms and explosives licenses, professional licensing information, motor vehicle records, business affiliations, bankruptcies, liens, judgments, driving records, phone listings, secretary of state filings, and other useful records. AutoTrack, as well as CDB Infotek, maintains a service whereby they will manually retrieve relevant public records if the information is not readily available online. The information is then reported back to the user online, typically within a day or two.

34 Pacer provides access to the U.S. District (criminal and civil) and Bankruptcy courts in 49 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Unlike federal court records that might be found in other databases, which are limited to case citations, PACER usually provides a complete docket sheet. While PACER recently introduced a nationwide search capability, the search is limited to identifying the court where a case is located. Each court must then be dialed into separately to retrieve relevant court docket sheets. The ability to search the majority of federal court indices across the country in a just a few minutes is an extremely powerful search tool. Remember, however, that each court has a different archiving policy so careful attention should be paid to coverage dates in each district.

30 Lexis-Nexis provides bankruptcy filings, state and federal civil lawsuits, tax liens, judgments, UCC filings, corporate records, and property records in most jurisdictions. Lexis-Nexis’ greatest strength in searching public records is its “full text” search feature. For example, if you have a post office box number used by a subject, the number could be searched in Secretary of State records to identify other companies or Dab's associated with the subject that may not turn up through a search of the subject’s name. This type of search cannot be conducted through other database service providers, which limit searches to specific information fields within the database record, such as the name of the company.

The Lexis database also contains reported legal decisions at the federal and state levels. Even though most often used by law firms for general legal research, a search in Lexis can also be used to find court cases relevant to an investigation. These opinions often have extensive factual information that may not have been reported in the media.

Another feature of the Lexis-Nexis public records library is the "Finder" file, which can be used to locate/identify individuals from over 300 million credit header and telephone records nationwide. Other noteworthy files include the military locator file which allows one to investigate an individual's reported military service; driver license information for 24 states; and the Social Security Death Master File, which can quickly tell you whether your subject is using a social

- 20 -

The Internet

Despite its shortcomings when compared to the commercial online databases for purposes of media and public record searching, the Internet has spawned a number of unique research resources. By virtue of the extraordinary pace at which it reinvents itself, this medium demands creative thinking for use as an investigative tool.

Message Boards

Most search engines, as well as many Internet sites, "message boards", "bulletin boards" or “discussion groups” locate sites where people can inquire about and respond to various topics. Researchers can both monitor ongoing discussion or search the vast pool of archived postings. These sites can provide a wealth of information, particularly in a litigation context.

Home Pages

security number that has already been retired.

Disciplinary actions and sanctions from various federal and state agencies including the NASD, the SEC, HUD, state real estate regulators and other agencies are covered in the Sanctions file in Lexis-Nexis. Additionally, the FEDSEC library in Lexis-Nexis contains civil lawsuits and administrative proceedings initiated by the SEC.

Real property ownership and sale records can be reviewed in a global search that covers the District of Columbia and the majority of counties in every state except Maine. These records, which can be searched by name or address, are often very useful when quickly attempting to identify assets in relation to a bankruptcy or other fraudulent transfers.

35 This service also provides access to U.S. District Court and Bankruptcy cases and, like PACER, provides full docket sheets. Courtlink’s advantage lies in its proprietary software, which allows the researcher to more easily navigate the PACER system. For example, Courtlink allows the user to search combinations of disparate courts simultaneously, a feature not available on PACER. In addition to federal court records, Courtlink provides the most comprehensive access to criminal cases and civil lawsuits in Washington and Oregon, dating back in some instances to the 1970s, as well as limited coverage of civil suits in Texas.

36 This system provides the most comprehensive source of civil litigation, judgments, tax liens, and foreclosures for the Mid-Atlantic region, including New York, New Jersey, Pennsylvania, Maryland, Washington, D.C. and Delaware. Because the database gathers its information from primary sources, it has a high degree of reliability. Superior also offers a very powerful search engine, which returns names that are similar to the user’s search terms that may be relevant. The search engine also picks up name synonyms when searching individual names (for example Tom/Thomas; Maggie/Meg). Further, the database includes bankruptcies, UCC filings and corporate records.

- 21 -

Most companies, and even many individuals, have their own website. These sites can provide a wealth of information relating to a company’s sales information, geographic territory, biographical information of corporate officers, names of joint venture partners, and updated product information. A private company may provide a more detailed history or corporate structure on its home page than it provided to a commercial credit reporting service. It may also inadvertently leave outdated – but perhaps useful – information on its Web site that a commercial vendor will delete once the information is updated.41

Other Sites The Internet investigator can use the Internet for other purposes. If the company or individual being investigated does not have a website, information might be located in other websites. Websites exist to allow the investigator to quickly locate individuals or businesses across the country as well as conducting reverse telephone directory services. There are even web services available, which, for a nominal fee, will verify an academic degree and professional certifications. The Internet is also a useful tool for locating outside experts to assist in difficult investigations.

Computer Forensics

Frequently, computer forensic professionals are able to retrieve deleted, encrypted and password sensitive files, as well as e-mail, that may bear directly on the alleged wrongdoing. Potential sources include the subject's desktop and laptop computers, the subject's secretary's computer, the subject's electronic organizer, the server, backup tapes, voicemail systems, floppy disks, and home computers.

This data often includes "smoking gun" evidence. The investigative team must ensure to retrieve the data in a manner that meets evidentiary requirements for admission in subsequent legal proceedings.

Workplace Evidence

Frequently, more traditional evidence gathering techniques can prove even more successful than the high tech efforts described above. Desk and file searches frequently yield incriminating evidence, as do personnel files, travel and expense reports, telephone records and statements (including office, cellular and calling card) and company credit card statements.

Field Interviews

Interviews of employees, former employees and third parties such as vendors, suppliers and customers many times provide insight into the suspected employee’s activities and, perhaps, the alleged wrongdoing itself. However, the

- 22 -

risk that the suspected employee will learn of the investigation and attempt to subvert the fact-finding process through document destruction and/or witness manipulation must be considered.

Surveillance

Physical, audio and video surveillance should be considered provided the activity is ongoing and susceptible to this investigative technique. Surveillance is generally most successful when the improper activity involves theft of physical property or trade secrets.

Sting Operations

If circumstances permit, sting operations should be considered as a means to obtain unequivocal proof of misconduct. For example, in the case of ongoing misconduct, undercover operatives may pose as willing purchasers of stolen trade secrets or merchandise or as vendors seeking to obtain business from a purchasing agent suspected of taking kickbacks in exchange for the awarding of contracts.

8. The Transition Phase

The transition phase is a critical, albeit very brief, phase of a corporate internal investigation. It is that moment that the subject of the investigation becomes aware that he or she is the subject of an investigation.

The investigator has a distinct advantage - - only he is aware that an investigation has commenced. A skilled investigator seeks to exploit that advantage and the element of surprise by careful planning including:

Selecting the person(s) to confront the subject

Choosing the time, order and location of the confrontation

Determining the best approach toward the confrontation

The transition phase also requires contingency planning for next steps. The investigative team must plan and guard the preservation of documentary, physical and electronic evidence. Additionally, the investigative team, together with the client, must plan for the on-going operation of the business, including the possibility of a disruption of relations with employees, vendors and customers and, where the circumstances are newsworthy, the public.

8.1 Role of the Accountant

- 23 -

The accountant performs a vital role in the planning of the transition phase. The accountant's role in the actual confrontation of the subject varies depending upon the accountant's experience and the circumstances of the investigation.

An accountant's presence, for example, is absolutely critical in internal investigations of finance and accounting personnel as well as in investigations of accounting irregularities. Effective confrontation of the subject in these sort of cases demand the technical expertise of an accountant.

Investigators and lawyers frequently, however, consider the confrontation of the subject to be within their exclusive domain. The accountant should gauge the facts and circumstances to determine whether his presence is essential and, if so, be prepared to insinuate himself even if uninvited.

8.2 Who Confronts The Subject

Planning the transition phase requires careful consideration of the most effective team for confronting the subject. Usually a two-person team is most effective. Two people are required so that there is a witness if the subject later disavows his or her earlier statements. More than a two person team risks being too intimidating.

An experienced interviewer should lead the confrontation of the subject. The more difficult decision usually concerns the second person. Depending upon the circumstances, the second team member might include the subject's immediate supervisor, a senior company official, a human resources representative, another member of the investigative team, or counsel.

The presence of an attorney has its benefits and disadvantages. In most situations, the attendance of counsel heightens the seriousness of the matter. Conversely, including an attorney can have a chilling effect. Moreover, counsel is likely to administer corporate Miranda warnings. Counsel will warn the subject that lawyer represents only the company and not the employee.

Note that these warnings arise solely from an attorney's obligations under the lawyers' code of ethics. The warnings are not required as a matter of law nor are they required if a non-attorney is conducting the interview. Rather, the warnings are designed to ensure that the subject understands that the attorney does not represent his interests. No warnings are thus required where a non-attorney conducts the interview.

Although it may not be desirable to have counsel present with the subject, it is helpful to have counsel available for consultation during the confrontation. The subject frequently will pose questions or seek guarantees concerning potential civil/criminal liability and/or severance agreement. Legal input is necessary if such questions arise.

- 24 -

8.3 The Location of the Confrontation

The confrontation of the subject ordinarily occurs in a neutral setting in the facility where the subject is employed. The investigative team should consider whether there would be a tactical advantage in having the subject travel to company headquarters or to an off-site location. Occasionally, it is advantageous to confront the subject at home.

Off-site and home visits are most useful when the investigative team is seeking to gain the subject's cooperation to further the investigation. Maintaining the secrecy of the confrontation enables the investigation to remain secret if the subject agrees to cooperate. An off-site location might also be chosen if there is any concern about violence or other disruption of the workplace as a result of confrontation of the subject.

The investigative team should also consider the psychological impact of an off-site confrontation. Confronting a subject at home, for example, can be very effective if the team is concerned that the employee will give false information to protect the company. A home confrontation conversely can backfire as it might offend the subject. The team must balance the benefits and disadvantages.

8.4Confronting the Subject

The investigative team must plan on how best to approach and question the subject. In this regard, there really is no substitute for investigative experience.

A critical question is how much information should be disclosed to the subject. Sometimes, it is most effective simply to confront the subject with the allegation and gauge the reaction. In other instances, it is more effective to disclose some or all of the evidence that has been adduced in the discreet phase. The hope is to persuade the subject to capitulate and cooperate.

There is no bright line rule or easy answer. More often than not, a subject will admit culpability (or partial culpability) if he or she believes that the investigative team will ultimately be successful in finding evidence of guilt.

It is essential, of course, to consider how the investigation might be affected by disclosing information to the subject. The investigative team must strike a balance between the effort to secure a confession with compromising the investigation.

Other critical issues are the method and type of questioning. We address these topics in the discussion on interviewing.

8.5Contingency Planning

- 25 -

Both the investigation and the business environment will change significantly once the investigation moves from the covert to the overt phase. The investigative team must plan prior to the confrontation of the subject with a plan contingent upon the results.

An effective confrontation of the confrontation usually leads to some admission of wrongdoing by the subject. The admission, however, is likely to be partial and frequently contains additional facts and information not previously known or suspected.

It is common for the subject to implicate others in the company or the company itself. A subject frequently will seek to justify his or her own misconduct by pointing to unrelated misconduct by the company.

A succession plan needs to be established since it is likely that the subject will resign, be dismissed or suspended following the confrontation. Additionally, the client must take precautions to change the physical and computer security to ensure that the subject does not have access to company property or proprietary information.

The investigative team must also plan for the post-confrontation investigation. Confrontation of the subject frequently involves simultaneous or almost simultaneous physical searches of the subject's work area as well as his personal computer, e-mail and computer network.

Additionally, the company must plan for external communications. Depending upon the allegations and results of the confrontation, the company needs to be prepared to inform employees, vendors and customers. Where the allegations are newsworthy, it is critical that the client includes its public relations network to respond to inquiries from the media.

9. The Overt Phase

The overt or open phase involves more traditional investigative techniques and typically is the most extensive phase of a corporate internal investigation. It is during this phase that the accountant and other members of the investigative team conduct witness interviews, analyze and reconstruct data, financial records and other documentary evidence, examine physical evidence and issue an investigative report.

9.1 The Investigative Mentality

- 26 -

Corporate internal investigations rarely require highly sophisticated technical accounting skills. Rather, the challenge for most accountants and auditors is developing the necessary investigative mentality. The investigative mentality will be counterintuitive to some.

Materiality, for example, means something quite different to an investigative accountant than to a financial auditor. Financial auditors primarily are interested only on issues that have a potential material financial impact. An investigative accountant maintains a much more expansive view. Even the smallest detail can be material to an internal investigation.

An accountant who joins an investigation thus must be prepared to shake his or her traditional orientation and assume an investigative mindset. The characteristics of an effective investigator should include:

• skepticism, the investigator does not assume that management or employees are honest and telling the whole truth until the facts are gathered and the inquiries are complete;

• imagination, sufficient to develop theories against which to compare factual evidence as it develops;

• communication skills, that will enable the investigator to encourage people to be helpful and volunteer useful information;

• determination, to persevere until the anomalies are resolved and the fact pattern is thoroughly understood; and, most importantly,

• patience, to attend to the smallest detail that less experienced people may overlook but that can provide that vital clue or inconsistency.

9.2 Advice to Employees

- 27 -

The first step in the open phase frequently involves advising company employees of the existence of the investigation. Some practitioners believe that it is better to refrain from announcing the investigation to corporation employees generally. They believe that the disadvantages of making an announcement are too great. Disadvantages include:

the possibility of starting a rumor-mill,

allowing potential witnesses to talk about the issues, compare notes and perhaps develop positions with respect to their activities, and

danger of making unfounded or untrue allegations against the subject of the investigation, which could result in legal actions against the company.

While it is certainly the case that these concerns have some merit, we take the view that, in most circumstances, the results achieved from properly communicating the existence of an open, honest, ethically undertaken internal corporate investigation often outweigh the potential disadvantages.

One of the benefits of an internal corporate investigation is that the company is provided with a good opportunity to reinforce their message with respect to the culture, integrity and ethical compass of the organization. For this benefit to be obtained, it is vital that the conduct of the investigation itself is undertaken in a way that employees and management alike can view as fair and equitable.

The announcement itself should probably be brief, should indicate that the investigation is being undertaken by outside expert consultants and should indicate that the Board of Directors or a special committee of the Board will supervise the investigation and consider findings from the investigation. The text of the announcement should discourage employees from internal discussion, especially if the investigation is being done by lawyers under privileged conditions, although it is naïve to expect there to be no conversations about the news.

It is always a good idea in this initial announcement to advise employees that no documentation in the relevant departments or for the relevant periods should be destroyed. It may be necessary to be more specific about exactly what documentation should be retained. Internally, a hold should be placed on the normal routine of record destruction activities.

The extent to which the announcement of the investigation is distributed will depend heavily on the nature and scope of the investigation itself. It is often unnecessary to advise every employee of the company. Frequently, it is sufficient to advise members of only the relevant departments or divisions. Finally, the initial announcement should contain encouragement for any

- 28 -

employee to discuss information or concerns that might be relevant to the investigation. It is helpful for the announcement to provide the name and telephone number of a person to contact, under confidential conditions, in such circumstances.

9.3 Document Gathering and Examination

Documents generally fall into two categories: paper and electronic. The investigative accountant frequently assumes a lead role in document gathering and examination. The process must be thorough and well documented.

The investigative team should be careful to search for all relevant documents. The investigative team must develop an understanding of how the client maintains and stores records. Moreover, the search should include informal as well as formal company records. In many companies, for example, employees maintain their own personal desk files in addition to the official company file. These need to be included in the search.

The gathering of electronic documents, including e-mails, information stored on networks, floppy discs, back-up tapes and personal computers, requires special attention. Evidentiary rules and best practices for the handling of electronic evidence change constantly. Computers frequently contain smoking gun evidence. The company needs to ensure that such evidence is obtained in a way that will later stand up in court.

The investigative team needs to meet with appropriate information technology personnel to ensure that all potentially relevant sources have been searched. The team will need to know (i) the type, make and model of computer used, (ii) the capacity of the internal hard disk and the external disk drives, (iii) the operating system, (iv) the applications used on the computer and where they are stored, the network system, and (v) the computer literacy of the subject(s). Electronic document searches frequently result in the recovery of too much data. Using selective word searches, the investigative team can filter large volumes of records and data into manageable amounts.

There will be multiple copies of some documents. Retain copies of every important document - - they may include important margin notes; it may become important to know which individuals maintained a copy in his or her files; and one must compare versions of what appears to be the same document for alterations.

If possible, the investigative team should personally collect or supervise the collection of documents. Many companies leave document collection to business operations personnel. This can be a serious mistake.

Business operations personnel rarely appreciate the need for an exhaustive search for documents. Important documents can be inadvertently (and

- 29 -

sometimes intentionally) missed. The business units rarely make a precise record of the date and location of where documents are obtained. This casualness can create serious problems if the matter eventually ends up in court.

The investigative team should obtain originals wherever possible. It is essential, however, that no member of the investigative team mark an original document in any way apart from the formal identification mark that may be employed. Accordingly, it is very useful to photocopy a set of documents to show witnesses and for inclusion in the investigative working papers.

The investigative report should record the document collection efforts if this later may become an issue. The investigative working papers should include memoranda detailing the methodology and execution of the gathering of electronic and paper document gatherings.

The examination of the records and documents naturally will vary upon the nature of the investigation. Specific techniques are addressed elsewhere in this and other books.

As a general matter, the investigator needs to be observant about the details regarding the substance as well as the context and circumstances in which documents are prepared and maintained. Additionally, the team needs to be on the look out for alterations, white-out areas, erased margin notes, earlier drafts and documents that should be present but are missing.

9.4 Interviews

Because of their background and training, accountants are vulnerable to focusing too much attention to document analysis and too little on obtaining information from people. Our experience is that the most essential information most often comes from interviews of current and former employees, outsiders and the subject himself.

Witness statements generally comprise the most critical evidence in internal investigations. Documents often serve as the corroboration for witness testimony. Interviewees can steer the investigator to the key documents and explain the details and nuances.

Effective interviewing is a skill that requires training and experience. There are entire courses, textbooks and programs dedicated to the subject.

There is no single right or wrong method for conducting an interview. What might work for one interviewer will be wrong for another. Following are some common characteristics of an effective interview:

- 30 -

Preparation - An effective interviewer has a mental or written list of the areas to be covered. Copies of relevant documents are prepared in advance - sometimes with key sections highlighted. It usually is ineffective to write out precise questions or to follow a script. The interviewer must listen and follow whatever paths the interviewee takes.

Order of Interviews - As a practical matter, most individuals are interviewed only once, although key individuals can be re-interviewed. The investigative team usually chooses between working up or down the ladder; that is, does the team interview the most senior people first and work down the hierarchy or does the team begin with interviews of junior staff? An early "tell me what you know" session is often effective where multiple interviews with the principal subjects are anticipated. Record analysis and junior interviews should follow. The closing interview then provides the investigator with the opportunity to compare the subject's statement and position with the statements of other witnesses and documents. Inconsistencies can then be challenged.

Number of Interviews - Err on being over-inclusive rather than under-inclusive. It is essential to interview all individuals with potential knowledge. Most importantly, it is often the low-level employee and/or former employee who provide the most valuable information. Too many investigations do not uncover critical information because the investigative team failed to interview secretaries, clerks, etc . . .

Number of Interviewees and Interviewers - The investigative team should interview only one person at a time. Interviewees frequently will request to be interviewed together to assist each other in the recollection of the events and to avoid making inconsistent statements. As a practical matter, interviewees can assist each to jog their memories. Nonetheless, group interviews should be avoided, particularly where there maybe a later concern or claim that the evidence was manufactured.

Optimally, there should be two interviewers present. One interviewer should take the lead. Interviews conducted alone run the risk to avoid disputes over who said what. Moreover, it is difficult simultaneously to conduct an interview and take effective notes. Nonetheless, many clients are unwilling to bear the extra cost of having more than one interviewer.

With critical witnesses, the problem sometimes is that too many interviewers wish to be present. More than two interviewers should be avoided, and rarely should there be more than three interviewers.

- 31 -

Skill Set of Interviewers - The combination of interviewers should be flexible and depend upon the background, age, gender, seniority and personality of the interviewee as well as the need for continuity among the investigative team.

80:20 Rule - An effective interview, even of the principal subject, ordinarily is more akin to an interview than an interrogation. The interviewee need not like the interviewer, but should at least have respect for the professionalism and preparedness of the investigative team.

It essential that the interviewer remember that the purpose of an interview is to acquire knowledge, not disclose it. As a general rule, the interviewee should be talking 80% of the time, and the interviewer only approximately 20%.

What To Ask - Naturally, the specific areas of interview depends upon the nature of the allegations. A couple of general points:

Determine the interviewee's basis for information. The interviewee does not necessarily have to have personal knowledge, and it is acceptable to obtain hearsay information. The investigative team, however, needs to know upon what basis information is being provided.

With respect to events (meetings, telephone calls, etc…) try to

obtain the exact date, time, location, other attendees, and subjects discussed.

Do not expect the interviewee to have an exact recollection of events that occurred sometime ago. It is the interviewers' obligation to refresh the interviewee's recollection with documents or other information.

Avoid disclosing the sources of information received from other interviews. If possible, confirm information by reference to documentation and then refer to the document as a support for the fact.

Types of Questions - There are several types of interview questions. While they go under different names, the general categories include:

Open - Open questions are the most effective for eliciting information because it is difficult to answer them "yes" or "no". One

- 32 -

way of ensuring to ask an open question is to begin with the words, "who", "what", "where", "when" , "why" or "how"

Illustration: What was the weather yesterday?

Closed - Closed or leading questions, in contrast, are designed to be answered only by the words "yes" or "no".

Illustration: Was it raining yesterday?

Confirmatory - A confirmatory question validates a prior statement or fact.

Illustration: It was raining yesterday, correct?

Challenging - A challenging statement, in contrast, disputes a factual assertion.

Illustration: It wasn't raining yesterday - was it?

Restatement - This type of question tends to be used toward the end of interview session and confirms or restates what the witness had previously stated.

Illustration: One of the subjects that we discussed was the weather yesterday. You indicated that it was raining yesterday. [Pause to allow interviewee to respond before moving to next topic.] You also indicated that . . . [next topic].

There are several ways of memorializing an interview just as there are several methods for conducting them. The most common and traditional method is for one person to make handwritten contemporaneous notes of the interview. The interview team then follows with a formal memorandum of interview. The original, handwritten contemporaneous notes may or may not be maintained.

The investigative team should, however, be consistent. If contemporaneous notes are maintained for one interview, they should be maintained for all interviews. The investigative team will be subject to attack if handwritten notes are preserved only for selected interviews.

The memorandum of interview should begin with the time, location and list of participants at the interview. The memorandum should note if certain participants join late or leave early. The memorandum should also record any promises, representations or assurances provided to the witness.

- 33 -

The memorandum should summarize the themes and subjects discussed during the interview. It is more important for the memorandum to contain a clear summary of the subjects discussed than it is for it to re-state each question and response in the order that it was asked and answered.

An interview frequently will raise the same subject more than once during the interview. For example, the interviewer may return to a subject two or three times during the interview both for clarification and to test the consistency of the interviewee's statement. It is clearer if the interview memorandum discusses the subject as a whole rather than in the actual order discussed during the interview.

Handwritten notes are preferred over notes keyed into a computer. Keying notes into a computer discourages an informal atmosphere. From the perspective of the interviewee, it appears that a stenographic transcript is being taken. Moreover, interviewers who key rather than write notes by hand are vulnerable to producing poor interview memoranda. Our experience is that keyed notes frequently result in "blow by blow" interview memoranda rather than well thought out discussion of the subjects.

The investigative team will need to decide whether to record (voice, video, stenography) the interview. Recording of interviews is not recommended in most instances. Recording discourages the development of a rapport between the interviewer and interviewee.

Recording of interviews is recommended when formality is desired or an exact record of what was asked and answered is needed. For example, recording the interview can be useful for foreign speaking interviewees who may later claim that they did not understand the question being asked. Similarly, recording the interview can be useful if the investigative team seeks to impress upon the interview the seriousness and importance of the interview.

Absent unusual circumstances, the investigative team should obtain the consent of the interviewee prior to recording the interview. It certain States it is illegal to record an interview without consent.

9.5The Investigative Report

The organization, contents and style of the investigative report will vary from case to case. Some clients and companies will desire no written report.

Some internal investigations require no more than a short letter or discussion outline. More significant investigations often require lengthy reports including volumes of working papers.

Discuss In Advance - Discussions concerning the content and form of the investigative report should be discussed very early in the engagement.

- 34 -

Whether a report will be required will affect how the investigation is conducted as well as the budget.

Assume That A Report Will Be Required - It is good practice to assume that a report will be required. Companies and clients frequently request a report even when their initial instruction is that no report will be needed. Additionally, anticipating a report provides a good structure for organizing the investigation and ensuring that all necessary investigative steps have been completed and properly documented.

Begin Immediately - Many investigators make the mistake of postponing the preparation of the report until the investigation has concluded. They believe that the report cannot be written until all the facts have been determined.

Report writing is very time consuming and can take as long as the investigation itself. The investigative team rarely will have the time to delay writing the report until all the facts have been gathered. The preparation of the report gives structure to the investigation. Experience shows that the investigations proceed more efficiently and effectively if the investigative report is written concurrently with the investigation. The report, moreover, will be more thorough.

Elements of the Report - Following are various features that the accountant should include in the preparation of the report:

Predication for Investigation - Predication refers to the basis upon which an investigation has been initiated. There is no legal requirement that there be a basis to commence an investigation. Nonetheless, it is useful

39 The information available includes the names of officers and directors, the date and place of incorporation, type of business, annual sales, and in some cases, limited public records information such as bankruptcies, judgments, liens and UCC filings. There is often biographical information on the officers and directors. Ownership information may also be provided. One important item worth noting, however, is that the basic company information and biographical information is self reported by the company and is not necessarily verified through independent investigation.

40 Finding a witness or a former employee of an adversary in litigation can be critical. Databases such as Autotrak, CDB Infotek, Lexis-Nexis and Metronet are powerful in this area, primarily because of their inclusion of information provided by the credit bureaus, which is not restricted by the federal Fair Credit Reporting Act. Autotrak and CDB Infotek provide access to personal information such as address histories, telephone listings, neighbor listings, social security numbers and dates of birth. Even though access to this information is limited to “qualified” customers, this includes investigators and attorneys. Metronet provides a comprehensive collection of telephone listings, addresses and neighbor information in the United States. A researcher again may be tempted to use the various people locator databases available on the Internet. In our experience, however, these fall considerably short when compared to the commercial offerings.

41

- 35 -

to document the predication if a concern exists that a party will later allege that the company acted maliciously.

Assignment and Disclaimers- It is common for an investigative report to begin with a summary of the scope of the assignment. The investigative team should also consider whether any disclaimers are appropriate. Public auditing firms, for example, frequently include the disclaimer that investigation does not constitute an audit conducted in accordance with generally accepted auditing standards, an examination of internal controls, or other attestation or review services in accordance with standards established by the AICPA. The investigative team should also consider including disclaimers regarding the confidentiality of the report and the appropriate use that can be made by third parties.

Executive Summary - An executive summary of the findings and recommendations often is a very useful, and, in a lengthy report, essential element of the report.

List of Acronyms and Abbreviations - It is very useful to have a single list of acronyms and abbreviations at the front or back of the report as an easy reference guide for the reader.

Chronology - A detailed chronology of the key events ordinarily should be included either in the body or appendix of the report.

Methodology - A detailed summary of the investigative methodology ordinarily should be included either in the body or appendix of the report.

Visual Link Analysis - Visual link analysis depicts connections between and among people, entities, bank accounts, etc… A visual link analysis is very useful in cases involving numerous parties or in funds tracing engagements. Virtually any computer graphics presentation software can be used.

Statement of Facts - The statement of facts can be separate from or a part of the discussion section. It is useful, however, to have a separate section for the statement of facts in a complex report.

The statement of facts is a neutral narrative of the key events uncovered by the investigation. The investigative report should include exhibits to support assertions in the statement of fact. For example, if an assertion in the statement of facts is supported by a document, the investigative report should include as an exhibit a copy of the relevant portion of the document. Similarly, the investigative report should include interview memoranda as exhibits where reliance is made upon the statements of

- 36 -

interviewees. Alternatively, the reader should be referred to the working papers containing this information.

Discussion - The discussion section usually is organized around the findings or themes. Unlike the statement of facts, the discussion section need not be neutral. Rather, this section can be more akin to a closing statement in a trial and explain why the investigative team has reached its findings and conclusions.

Recommendation - The report should include the investigative team's recommendation for additional investigation and remedial changes.

10. The Remedial Phase

The remedial phase occurs either contemporaneous to or at the conclusion of the fact investigation. The accountant participates to one degree or another in:

Quantifying damages Negotiating subject's resignation of employment or disciplinary action Negotiating financial recovery from the subject and other parties Negotiating financial recovery with third party victims Advising on business implications of investigative results Lobbying prosecutors and other law enforcement authorities to file

criminal charges against the subject Providing litigation support to counsel in criminal, civil and regulatory

proceedings Conducting fraud audits of other business units for vulnerability to

similar misconduct Developing controls to deter recurrence Monitoring of future business activities

Many of these subjects are discussed elsewhere in the text.

11. Conclusion

Internal corporate internal investigation are rewarding and exciting. Accountants serve and will continue to serve major roles in these investigations. But they are not for the faint hearted or amateur sleuth. The accountant joins a multidisciplinary team upon which the client is relying to solve what is often the greatest crisis that a business must overcome.

.

- 37 -

- 38 -