Ran a Fraud Investigation session online for The Institute of Chartered Accountants of Pakistan. These are slides for day 1. They cover introduction and context of fraud, profile of fraudsters, fraud investigations broad appraoch etc.

1. Fraud
Investigations
ZEESHAN SHAHID
JULY 30, 2021 | SESSION 1 OF 2
This Photo by Thoufeeq Ahamed is licensed under CC BY-SA-NC

2. Zeeshan Shahid
• Chartered Accountant; Certified Fraud Examiner;
>18y experience; served as partner in Deloitte
and Yousuf Adil
• >10y running country’s first dedicated Forensic
practice in Deloitte; Experience of investigating
allegations of fraud, abuse, bribery, corruption
and misconduct in public (federal, provincial and
corporate), private (domestic and MNCs for
FCPA/UKBA), non-profit (foreign government
and NGO)

3. Overview
• Introduction and context
• Common factors in reported frauds and
Pakistan Perspective
• Perpetrator behavioral analysis
• Fraud investigations
• Fraud interviews
• Report writing
• Legal considerations during
investigations
• Roles and responsibilities
• Understanding fraud prevention
• Nuances of modern fraud investigations
• Selected specific fraud and corruption
scenarios
Photo by John Fowler on Unsplash

4. “Fraud and falsehood
only dread examination.
Truth invites it.”
- SAMUEL JOHNSON
Photo by Chris Lynch on Unsplash

5. Introduction and
Context

6. • “Fraud is an intentional or deliberate act to deprive another of property or money by deception or
other unfair means.” – The Association of Certified Fraud Examiners
• “Any illegal acts characterized by deceit, concealment or violation of trust. These acts are not
dependent upon the application of threat of violence or of physical force. Frauds are perpetrated by
parties and organizations to obtain money, property or services; to avoid payment or loss of services;
or to secure personal or business advantage.” – The Institute of Internal Auditors
• Occupational fraud and abuse is “the use of one’s occupation for personal enrichment through
the deliberate misuse or misapplication of the employing organization’s resources or assets”. –
The Association of Certified Fraud Examiners
Definition of fraud

7. Internal fraud (or
occupational
fraud and abuse)
Corruption
Asset misappropriation
Financial statements fraud
External fraud Customer frauds
Vendor frauds
Security breaches
IP theft
Fraud against
individuals
ID theft
Ponzi schemes; MLM schemes
Phishing scams
Types of frauds

8. Corruption
Conflicts of
interest
Purchasing /
Sales schemes
Bribery
Invoice
kickbacks / Bid
rigging
Illegal gratuities
Economic
Extortion
Asset
Misappropriation
Cash
Theft of cash
on hand
Theft of cash
receipts (skimming
/ larceny)
Fraudulent
disbursements
Billing schemes / Payroll
schemes / Expense
reimbursement schemes
/ Check and payment
tempering / Register
disbursements
Inventory and
all other assets
Misuse /
Larceny
Financial
Statement Fraud
Net worth/Net
income
overstatement
Net worth/Net
income
understatement
Occupational fraud and abuse classification
system (the Fraud Tree) - Extract
acfe.com/fraudtree

9. Why does fraud occur?
The best and most widely accepted model for
explaining why people commit fraud is the fraud
triangle. Developed by Dr. Donald Cressey, a
criminologist whose research focused on
embezzlers—people he called “trust violators.

10. “Trusted persons become trust violators
when they conceive of themselves as
having a financial problem which is non-
shareable, are aware this problem can be
secretly resolved by violation of the
position of financial trust, and are able to
apply to their own conduct in that situation
verbalizations which enable them to adjust
their conceptions of themselves as trusted
persons with their conceptions of
themselves as users of the entrusted funds
or property.
- DONALD R. CRESSEY, Other People's
Money (Montclair: Patterson Smith, 1973)
p. 30

11. • Motivates crime
• Financial problem (personal /
professional) unable to be solved by
legitimate means
• Examples: Inability to pay bills/debt;
Need to meet earnings / productivity
targets; materialistic desires
Pressure
• Defines the way crime can be
committed
• Control weakness or some other
opportunity allows abusing a position
of trust without perceived risk of
getting caught
Opportunity
• Vast majority of fraudsters are first time
offenders. They perceive themselves as
ordinary, honest people caught in bad
set of circumstances
• Consequently, fraudster must justify the
crime to himself in a way that makes it
an acceptable or justifiable act
• “I was only borrowing money”; “I was
underpaid, my employer cheated me”;
“My employer deserves it.
Rationalization
The fraud triangle

12. • Cressey’s fraud triangle demonstrates certain characteristics that increase the likelihood for fraud to occur, but it does not
provide perfect guidance.
• Although the fraud triangle helps explain the nature of many occupational offenders, it does not explain the nature of all
occupational offenders.
• Cressey’s study is nearly half a century old, and there has been considerable social change in the interim.
• Now many anti-fraud professionals believe there is a new breed of occupational offender—one who simply lacks a
conscience sufficient to overcome temptation.
• Moreover, some experts believe that the fraud triangle could be enhanced by considering a fourth element.
• In their article “The Fraud Diamond: Considering the Four Elements of Fraud,” David Wolfe and Dana Hermanson
incorporated the element of capability—personal traits and abilities that play a major role in whether fraud will actually
occur—into Cressey’s model, transforming it from a triangle into a diamond
• Source: ACFE
The fraud triangle enhanced

13. Fraud triangle revisited…
The fraud triangle
The three-pronged
framework
Rationalization
Frame of mind that allows one to justify their dishonesty.

14. “Opportunity opens the doorway to fraud,
and incentive and rationalization can draw
the person toward it. But the person must
have the capability to recognize the open
doorway as an opportunity and to take
advantage of it by walking through, not just
once, but time and time again. Accordingly,
the critical question is, ‘Who could turn an
opportunity for fraud into reality?’”
- DAVID T. WOLFE AND DANA R.
HERMANSON, “The Fraud Diamond:
Considering the Four Elements of Fraud,”
The CPA Journal 74, December 2004
The fraud
diamond
The three-
pronged
framework
expanded by
capability

15. Common factors
in reported
frauds and
Pakistan
Perspective

16. • Typical fraud case:
• Lasts 14 months before detection
• Causes a loss of $8300 per month
• Organizations lose an estimate of 5% of revenue to fraud each year
• Median loss per case: $125,000; Average loss per case: $1.5 million
• Corruption most common in every global region
• Asset misappropriation: Most common; least costly (86% cases; $100k median loss)
• Financial statements fraud schemes: Least common; most costly (10% cases; $954k median loss)
• Owners / executives caused only 20% of occupational frauds but with largest losses (median losses by
owner / executive: $600k; Manager: $150k; Employee: $60k)
Facts about fraud – Key findings from ACFE’s
Report to the Nations 2020

17. • 43% schemes detected by Tip; 50% tips from employees
• Whistleblowers used Telephone hotline and email in 33% of cases
• Organizations with Fraud Awareness Training more likely to gather tips through Formal Reporting
Mechanisms (56% of tips with training; 37% of tips without training)
• Certain fraud risks more likely in small businesses than in large organizations (2x in billing fraud,
payroll, check and payment tempering)
• A lack of internal controls contributed to 1 out of 3 frauds; presence of Anti-fraud controls
associated with lower fraud losses and quicker detections
• Use of targeted Anti-Fraud controls increased (Hotline, Anti-fraud policy, Fraud trainings)
Facts about fraud – Key findings from ACFE’s
Report to the Nations 2020 (continued)

18. • More than half of all occupational fraud came from four departments: Operations 15%; Accounting
14%; Executive / Upper management: 12%; Sales: 11%
• 80% of fraudsters faced internal discipline from organization; 46% victim organizations declined to
refer cases to law enforcement considering internal discipline as sufficient
• 42% of fraudsters lived beyond means; 26% of fraudsters faced financial difficulties
Facts about fraud – Key findings from ACFE’s
Report to the Nations 2020 (continued)

19. Perpetrator
behavioral
analysis

20. • Tenure: Occupational fraudsters who had been with their organizations at least 6 years caused TWICE
the loss of less-tenured employees
• Gender: Men caused 72% of all occupational fraud, and also caused larger losses than women.
• Education: 64% of occupational fraudsters had a university degree or higher and caused 2x median
loss compared to non-degree holder fraudsters
• Age: Older fraudsters cause much larger median loss (55+: $425k; 40-54: $150k; <40: $75k)
• Collusion of 3 or more fraudsters triples the median loss.
• 89% of fraudsters are first-time offenders with no criminal conviction; 86% were never
punished or terminated in prior employment
Facts about fraud – Profile of fraudsters from
ACFE’s Report to the Nations 2020 (continued)

21. • Seven most common behavioral red-flags:
• living beyond means (globally noticed in 42% of
cases;
• financial difficulties;
• unusually close association with a vendor or
customer;
• excessive control issues or unwillingness to
share duties;
• unusual irritability, suspiciousness, or
defensiveness;
• a general “wheeler-dealer” attitude involving
shrewd or unscrupulous behavior; and
• recent divorce or family problems.
• Source: https://www.acfe.com/report-to-the-
nations/2020/
• Red-flags 3-6 are more common in Pakistan
environment.
• Other red-flags less common globally but more
relevant in Pakistan:
• Complained about inadequate pay;
• Refusal to take vacations;
• Excessive pressure from within organization;
• Complained about lack of authority;
Facts about fraud – Profile of fraudsters from
ACFE’s Report to the Nations 2020 (continued)

22. Fraud
investigations

23. BRAINSTORMING PLANNING COLLECTION
EVIDENCE
GATHERING
THROUGH ANALYSIS
REPORTING AND
CLOSURE
Fraud audit /
Investigation
process

24. • A fraud investigator needs solid business operations insight as well as accounting expertise.
• In fraud investigations, perpetrator's identity is often suspected / known. The job of the fraud auditor
is to prove that the perpetrator's actions resulted in fraud.
• There usually are no transaction trails for the actual activity perpetrated (no smoking guns) and clues
to fraud cases usually come from small, seemingly insignificant inconsistencies in records, data,
suspect's speech or actions.
Key points

25. • Fraud investigator needs to gather and analyze necessary evidence required by a management and/or
legal authorities to determine the facts and circumstances surrounding the fraud / suspected fraud.
The investigation may include legal advisors.
• A fraud investigation seeks to answer the following questions:
• Who did it?
• Why did he/she did it?
• How did they gain from the fraud? What assets were taken and how were they converted into benefits?
• How, when and where was the fraud perpetrated and concealed?
• What is the extent of losses?
• Were any laws broken?
Objective of fraud investigation

26. Brainstorming
• Identify parties,
investigation
parameters and risks as
input to the plan.
Planning:
• Thorough planning
determines focus and
helps manage the
investigation
Collection phase:
• Information gathering
in a forensically sound
manner
Evidence gathering
through analyses:
• issue-tailored analyses
performed to obtain
evidence
Reporting and
closure:
• Reporting of findings
The Fraud Audit / Investigation Process
Problem recognition and definition
Refine and amend
hypothesis
Analyze data;
create and test
hypothesis

27. • Objective:
• To identify relevant parties,
• Understand and confirm scope, and
• Initiate the investigation based on initial understanding.
• Refer handout for details
Brainstorming

28. • Planning is essential to help ensure that the investigation has clear objectives and that the strategy aligns with the objectives. Investigations, by
nature, can grow rapidly and lead an investigation team in many directions - therefore it is important that each step in the investigation process is
properly considered in terms of what is going to be completed and what will be achieved.
• Planning enables the investigation team to answer critical questions:
• What are the engagement’s objectives?
• What are the fraud hypotheses which are to be tested?
• What is the engagement strategy (i.e., what actions must be taken to achieve the objectives)?
• What is the progress towards achieving our objectives during the engagement?
• Have we achieved our objectives at the conclusion of the engagement?
• What other service providers may we be working with on this engagement (e.g., Counsel, discovery service providers, etc.) and have we defined the roles
and responsibilities of each party (and evaluated related direct and indirect marketplace business relationships)?
• The work plan needs to be cognizant of specific jurisdictional issues, as well as specific limitations or requirements that are unique to the area.
• Consider Forensic Accounting and Benford Analysis. Forensic accounting is the application of investigative and analytical skills for the purpose of
resolving financial issues in a manner that meets standards required by courts of law.
• Refer handout for details
Planning

29. • Establish project management
• Identify and obtain necessary skills and resources
• Use of non-forensic professionals
• Manage data preservation and retention
• Communication
Planning

30. “A poorly planned
project will take three
times longer than the
original plan. A well-
planned project will only
take twice as long.”
- ANONYMOUS; on
a lighter note!

31. • Objective: To assemble relevant evidence in order to focus the investigation, and readily identify issues with
respect to information gathering.
• Refer handout for details
Collection phase
Electronic
information
Physical information Human information

32. • Consider Chain of Custody
• According to ACFE Fraud Examiner’s Manual, the Chain of custody is both a process and a document
that memorializes:
• Who has had possession of an object and
• What they have done with it
It is simply a means of establishing that there has not been a material change or alteration to a piece of
evidence.
Collection phase
Other parties
Investigation
team
Investigation
team main
liaison
Departmental
liaison for
investigation
Archive
custodian
Departmental
custodian
Originator of
information

33. • Collect third party information
Collection phase
Publicly available information
Government
sources
Social media
Surface web

34. BASIC EQUIPMENT EXAMPLE OF EVIDENCE
Some forensic lab snapshots

35. EXAMINATION TOOLS EVIDENCE BAGS
Some forensic lab snapshots

36. Triangulation of
information
Evaluation for forensic
soundness
Manipulate
information
for
triangulation
Triangulate
information
for analysis
Financial
analysis
Non-
financial
analysis
Evaluate
work
performed
and findings
identified
Information (data)
anlayses
Evidence gathering through analysis
Refer Handout for details

37. Additional forensic lab snapshots (analysis)

38. Additional forensic lab snapshots (analysis)

39. • Consider government, regulator and/or other third party requirements.
• Prepare for potential litigation
• Perform RCA, if required
• Follow project closure protocols
Reporting and closure

40. • Fraud investigator gather and analyze the necessary evidence required by management and legal
authorities.
• Fraud investigator answers the questions like extent of fraud and monetary value, when & where the
fraud take place along with violation of specific laws.
• Fraud investigations follow a sequence of activities that initiate with brainstorming and planning,
follow through with information collection and analysis and concludes with identification of findings
and giving recommendations.
• The process can be iterative and may lead to additional findings.
• The information collected and used need to be obtained, stored and released based on strict traceable
protocols to ensure the report withstands scrutiny
Investigation process Wrap-up

41. ONE:
Fraud definitions and
concepts
TWO:
Theory on fraudsters and
behavioral understanding
based on Fraud Triangle /
Diamond theory
THREE:
Fraud investigation process
overview
FOUR:
Nuances of evidence
collection and analyses
FIVE:
Considerations for legal
admissibility
SIX:
Prepare for litigation
Key Takeaways

42. • Reflect over what we went through for 10 minutes after session today, 10 minutes tomorrow and 10
minutes prior to next session
• Imbibe the concept of fraud, investigation formalities and considerations, and the need for
standardized approach towards fraud examination.
Call to Action

43. Thank You
LinkedIn
https://www.linkedin.com/in/zeeshan80/
Twitter
@zee_shah
Email
zeeshanshahid@outlook.com
Phone
+92 302 827 3930