Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
Advisory: Forensic & Compliance Services
Project Alpha
Forensic Transaction
Review
19 January 2017
Privileged and Confiden...
PricewaterhouseCoopers AG, Birchstrasse 160, CH-8050 Zürich
T: +41 (0) 58 792 44 00, F: +41 (0) 58 792 14 15
Privileged & ...
The relevant transactional data from the database download concerning the Forensic Transaction Review has
been made availa...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 3
1. Executive Summary
Approach
...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 4
• Sixteen Seven suppliers loca...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 5
Bank Accounts
LCS held current...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 6
Table 2 – Overview of Sourcing...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 7
iii. From December 2013 to Aug...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 8
Intermediary – Firas Tlass
LCS...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 9
Payment channel Greenway Ecode...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 10
the authorities recorded with...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 11
2. Background
1. On the 7th a...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 12
3. Approach
4. Assess and und...
Privileged and Confidential – client attorney work product
Project Alpha January 2017
PwC 13
4. Limitations of our work
9....
Privileged and Confidential – client attorney work product
January 2017
PwC 14
4.1.1.5. Suppliers linked to Al-Raqqah
12. ...
Privileged and Confidential – client attorney work product
January 2017
PwC 15
4.1.2. Open Searches performed
14. A search...
Privileged and Confidential – client attorney work product
January 2017
PwC 16
Product /
Service (per
accounting
records
w...
Privileged and Confidential – client attorney work product
January 2017
PwC 17
Product /
Service (per
accounting
records
w...
Privileged and Confidential – client attorney work product
January 2017
PwC 18
Prochain SlideShare
Chargement dans…5
×

Project alpha forensic transaction review_ memorandum_data validation_19 january 2017

1 901 vues

Publié le

Rapport confidentiel

Publié dans : Données & analyses
  • Soyez le premier à commenter

  • Soyez le premier à aimer ceci

Project alpha forensic transaction review_ memorandum_data validation_19 january 2017

  1. 1. Advisory: Forensic & Compliance Services Project Alpha Forensic Transaction Review 19 January 2017 Privileged and Confidential – client attorney work product Validation of data obtained from the live JD Edwards Enterprise One accounting records This Forensic Transaction Review and its contents (including the Appendices and Exhibits, which are an integral part of this document) are strictly private and confidential; and subject to Legal Privilege. The Review was prepared solely for the information and use of Baker & McKenzie ("BM" or "you") as counsel to the Finance and Audit Committee of LafargeHolcim Ltd (Switzerland) for the purposes and in the manner contemplated at the time of the engagement. The Forensic Transaction Review is strictly confidential and (to the extent required by applicable law and/or regulation) must not be released to any third parties without PwC’s prior written consent, which PwC may withhold at its absolute discretion or may grant subject to conditions including any “hold harmless” letter which PwC may require.
  2. 2. PricewaterhouseCoopers AG, Birchstrasse 160, CH-8050 Zürich T: +41 (0) 58 792 44 00, F: +41 (0) 58 792 14 15 Privileged & Confidential Baker & McKenzie Attn: Dr. Thomas Grützner Partnerschaft von Rechtsanwälten Wirtschaftsprüfern und Steuerberatern mbB Theatinerstrasse 23 80333 Munich Germany Validation of data obtained from the live JD Edwards Enterprise One accounting records Dear Dr. Grützner In accordance with our letter of engagement dated 6th July 2016 and the amendment of 3rd November 2016; PwC performed a comparison of the Forensic Transaction Review findings1 obtained from the live JD Edwards Enterprise One accounting records to the equivalent records held within a database download of JD Edwards Enterprise One. The exercise has: • Validated that the findings from the Forensic Transaction Review obtained from the live JD Edwards Enterprise One accounting records are the same as the download of accounting data records • Validated the prior assumptions in respect of Electronic Banking Transactions (counterparty bank account details are not included within the accounting data) and the absence of authorisations • Identified additional data fields and data tables within the database download: i. Data within the database download connects Document Numbers (within the accounts receivable data table) and Payment Identification numbers (within the payment file). This connection makes possible end-to-end tracing through the accounting ledger ii. A data table containing information on the nature of the goods and services included within Supplier Purchase Orders. This data showed that several of the Suppliers linked to Al-Raqqah provided goods and services that are unrelated to the sourcing and supply of raw materials. The content of the Executive Summary of the Forensic Transaction Review report has been updated in track changes to incorporate the findings and validation performed (see Section 1 below). Section 2 ‘Background’ and Section 3 Approach within this memorandum set out the approach taken in respect of the validation exercise. Section 4 sets out the limitations of the work undertaken. Section 5 ‘Suppliers linked to Al-Raqqah’ reproduces the relevant content of the Forensic Transaction Review report with updates in track changes to incorporate the review of new information from Purchase Orders. 1As set out within the Forensic Transaction Review report dated 14 December 2016
  3. 3. The relevant transactional data from the database download concerning the Forensic Transaction Review has been made available in the secure Relativity environment – see Table A below. Yours sincerely PricewaterhouseCoopers AG Table A: Data made available in Relativity Exhibit No. Appendix Description Accounting Records Table B Supplier Payment Inquiry for Mass Co. (Payee Number: 100128 and Payee Address Number: Mass Co.) Table F0413 – Supplier Payment Inquiry D Accounts Payable Ledger for Mass Co. (Payee Number: 100128 and Payee Address Number: Mass Co.) Table F0411 - Accounts Payable Ledger D1 (New) Accounts Payable Matching Document2 for Mass Co. (100128) Table F0414 - Matching Document Detail I Supplier Payment Inquiry for expense account 951683 ("Bruno Pescheux - O") Table F0413 - Accounts Payable Ledger I1 (New) Accounts Payable Ledger for expense account 951683 ("Bruno Pescheux - O") Table F0411 - Accounts Payable Ledger I2 (New) Accounts Payable Matching Document Expense Account 951683 ("Bruno Pescheux - O") Table F0414- Matching Document Detail Z (New) Supplier Payment Inquiry expense account 99230001 (Bruno Pescheux) Table F0413 – Supplier Payment Inquiry Z1 (New) Accounts Payable Ledger for expense account 99230001 (Bruno Pescheux) Table F0411 - Accounts Payable Ledger Z2 (New) Accounts Payable Matching Document for Expense Account 99230001 (Bruno Pescheux) Table F0414- Matching Document Detail J Supplier Payment Inquiry - Ahmad Jamal (acc. 928617) Table F0413 – Supplier Payment Inquiry K Supplier Ledger Inquiry Report - Ahmad Jamal (acc. 928617) Table F0411 - Accounts Payable Ledger K1 (New) Purchase Order Detail File Ahmad Jamal (acc. 928617) Table F43199 - P.O. Detail Ledger K2 (New) Accounts Payable Matching Document Ahmad Jamal (acc. 928617) Table F0414- Matching Document Detail L Supplier Payment Inquiry –Amro Taleb (acc. 100284) Table F0413 – Supplier Payment Inquiry M Supplier Ledger Inquiry Report - Amro Taleb (acc. 100284 ) Table F0411 - Accounts Payable Ledger M1 (New) Accounts Payable Matching Document for Amro Taleb (acc. 100284 ) Table F0414 - Matching Document Detail N Supplier Payment Inquiry - Greenway Ecodevelopment pvt ltd (acc. 105191) Table F0413 – Supplier Payment Inquiry O Supplier Ledger Inquiry Report - Greenway Ecodevelopment pvt ltd (acc. 105191) Table F0411 - Accounts Payable Ledger O1 (New) Accounts Payable Matching Document Greenway Ecodevelopment pvt ltd (acc. 105191) F0414 Matching Document Detail P Supplier Payment Inquiry - Mohammad al Taweel Bn Ibrahim (acc. 928616) Table F0413 – Supplier Payment Inquiry Q Supplier Ledger inquiry Report- Mohammad al Taweel Bn Ibrahim (acc. 928616) Table F0411 - Accounts Payable Ledger Q1 (New) Accounts Payable Matching Document Mohammad al Taweel Bn Ibrahim (acc. 928616) F0414 Matching Document Detail Q2 (New) Purchase Order Detail File - Mohammad al Taweel Bn Ibrahim (acc. 928616) Table F43199 - P.O. Detail Ledger S Activity extract: account 511001 “Int Co Acc&cash adv - LMEA" Table F0911 - Account Ledger T Supplier Payment Inquiry – Suppliers linked to Al-Raqqah Table F0413 – Supplier Payment Inquiry T1 (New) Purchase Order Detail File – Suppliers linked to Al-Raqqah Table F43199 - P.O. Detail Ledger T2 (New) Accounts Payable Matching Document for Suppliers linked to Al-Raqqah Table F0414 - Matching Document Detail 2 This report allows for the matching of transactions within the Supplier Ledger to Supplier Payments. This data supports end-to-end tracing/investigation of identified transactions
  4. 4. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 3 1. Executive Summary Approach The accounting records within the live instance of the JD Edwards Enterprise One related to the Lafarge operation in Syria (“Lafarge Cement Syria”) were reviewed to identify potential transactions sourced from documents provided by Baker & McKenzie. The review covered the period from 1 January 2010 to 31 October 2016. 80 documents were provided by Baker & McKenzie as potentially relating to “Security Payments” and a further 59 documents as potentially relating to “Sourcing Payments”. The review work has also considered 40 additional documents provided by Baker & McKenzie. The documents and materials provided included emails, invoices and working files obtained from potentially relevant data sources located in Paris, Zurich, Damascus, and Cairo. The terms “Security Payments3” and “Sourcing Payment4” ascribed by Baker & McKenzie have been adopted within this report. The identification of potential transactions from documents is a subjective exercise. Other parties reviewing the same documents may draw different conclusions. Key Findings Transactions totalling USD equivalent 15’348’80415’562’261 (USD amounts plus USD equivalents for SYP and EUR transactions5) were identified within the live instance of the JD Edwards Enterprise One accounting records which directly match some of the potential transactions within the documents provided. These included payments to: Table 1 – Overview of payments identified “Sourcing Payments” • Ahmad Jamal Moustafa alhasan bn Mohammad (“Ahmad Jamal”) from 24 October 2013 to 1 July 2014, (SYP 165’116’229: USD equivalent 1’158’885) • News reports have identified one supplier, Ahmad Jamal, as an Islamic State of Iraq and the Levant (“IS”) - related source of heavy fuel oil, sand and pozzolana for LCS • Mohammad al Taweel Bn Ibrahim from 30 November 2013 to 2 July 2014 (SYP 190’879’086: USD equivalent 1’319’853) • The review suggests that pozzolana supplier Mohammad Taweel may have had similar ties to IS (as Ahmad Jama). Mohammad al Taweel Bn Ibrahim made deliveries of pozzolana between October 2013 and January 2014 3 Payments to Prohibited Groups for Security 4 Purchases of Raw Materials from Suppliers with Connections to Terrorist Organizations 5 All USD equivalent amounts are shown for illustrative purposes only and have been calculated as the sum of each payment converted using the USD to SYP (and EUR) exchange rate prevailing at the date of payment as published by Reuters. LCS may not have been able to access USD at these rates. The SYP devalued significantly against the USD from 1 January 2011 (USD/SYP 50.28) to 31 October 2016 (USD/SYP 213). See Appendix 3 – SYP Foreign Exchange rates.
  5. 5. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 4 • Sixteen Seven suppliers located in Al- Raqqah SYP 382’423’773 407’048’806 (USD equivalent 3’087’392300’849) for the period July 2010 to February 2015; • We observed that the transactions for six four of the alleged suppliers, USD equivalent 399416'642028, occurred exclusively in the period of Al-Raqqah’s occupation by Al Nusra (and subsequently IS). • In March 2013 the Syrian government lost control of Al-Raqqah to a local faction that reportedly became Al Nusra “Security Payments” • Mass Co.6 (a company understood as linked to Mr Firas Tlass); including apparent payments via employee advance accounts named ‘Bruno Pescheux’ and ‘Bruno Pescheux -O’ alleged to be paid for the onward benefit of US designated and non-designated terrorist groups (USD equivalent 5’384’365 from July 2012 to August 2014) Payments to “Intermediaries” • Amro Taleb and Greenway Ecodevelopment pvt ltd. (a company linked to Amro Taleb). (total SYP 7’828’774 (USD equivalent 151’924), USD 3’240 and EUR 2’910 (USD equivalent 3’871) for Amro Taleb and total USD 10’356 and EUR 51’500 (USD equivalent 67’479) for Greenway Ecodevelopment pvt ltd for no ostensive purpose • Former LCS consultant and self-acknowledged IS intermediary Amro Taleb • Firas Tlass (USD equivalent of 4’161’439) • Syrian business partner who was generally relied upon to negotiate with leaders of groups and local factions All USD 15’348’804 562’261 - Total equivalent of all SYP and EUR payments and USD payments No evidence was identified within the live instance of the JD Edwards Enterprise One accounting records that showed the monies paid to the above parties or made available as Employee Advances were distributed onward to US designated and non-designated terrorist groups. However, documents identified by Baker & McKenzie indicate that monies paid to Mass Co. and through employee advances were provided onward to US designated and non-designated terrorist groups for the purposes of securing the safety and security of the Jalabiyeh plant. Furthermore, documents identified by Baker & McKenzie connect a minority of LCH suppliers of raw materials to US designated and non-designated terrorist groups. 6 Mass Co. is the vendor name identified within the accounting records. Documents provided by Baker & McKenzie refer to MAS Invest.
  6. 6. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 5 Bank Accounts LCS held current and financing accounts with Audi Bank in Syria (USD, EUR and SYP) and Lebanon (USD and EUR). LCS also held current accounts with alBaraka Bank in Syria (USD, EUR and SYP). From July 2013, LCS maintained a dedicated account with Lafarge Middle East & Africa Building Materials (“LMEA”) to receive USD and EUR from clients and make payments on LCS’ behalf. Approximately USD 13.2 million and EUR 0.9 million was paid and received from the LMEA account. Only two transactions, receipts of USD 102’025 and USD 205’965 dated the 1st September 2013, were considered relevant as the written explanation within the accounting records stated “Adv to Mr. Bruno/LMEA Acc”. LCS maintained 54 separate banks accounts. While some of the bank accounts were used exclusively for term deposits, 54 accounts is a large number which could be considered both usually and excessive. Funding In excess of USD 86 million was lent to LCS pursuant to loan agreements with Lafarge Cement Holding Limited; a group company registered in Cyprus. These funds were received in LCS’s bank accounts in Syria and Lebanon in nine separate drawdowns from 28 April 2011 to 10 June 2014. Funds within the receiving bank accounts were used by LCS for capital expenditure and operating expenses and also to pay the monthly USD remuneration of Firas Tlass, make USD payments to Amro Taleb and for three alleged USD Security Payments. It appears that funding provided was paid based on the needs of the entire business rather than to reimburse specific transactions. The remitting (sender) account(s) of Lafarge Cement Holding Limited used to transfer the funds to LCS cannot be identified from the data within the live instance of the JD Edwards Enterprise One accounting records for Lafarge Cement Syria. Within the original loan agreement dated 7 April 2011, Michel Bisiaux represented Lafarge Cement Holding Limited (as this time Michel Bisiaux was the Group General Counsel and Corporate Secretary of Lafarge SA). Seven amendments to the agreement were signed by either Michel Bisiaux or, for the more recent amendments, Jerome Vitulo (Assistant General Counsel at Lafarge). Sourcing Payments The review identified that SYP 165’116’229 (USD equivalent 1'158'885) was paid to Ahmad Jamal across seventeen payments from 24 October 2013 to 1 July 2014, most frequently using cash held at the Jalabiyeh plant (herein referred to as “the plant”). The review identified that SYP 190’8769’086 (USD equivalent 1’319’853) was paid to Mohammad al Taweel Bn Ibrahim across 13 payments from 30 November 2013 to 2 July 2014, most frequently using cash held at plant and ‘cash in transit’ (which was likely paid by distributors). The review identified that SYP 382’423’773 407’048’806 (USD equivalent 3’087’392300’849) was paid to sevensixteen apparent suppliers located in Al-Raqqah from July 2010 to February 2015, most frequently using cash held at plant. Formatted: Font: Bold
  7. 7. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 6 Table 2 – Overview of Sourcing payments identified Payment channel Ahmad Jamal Mohammad al Taweel Bn Ibrahim Sixteen Seven apparent suppliers located in Al- Raqqah Total for Supplier Payments Electronic Bank Transfer (SYP) 26'492'700 (USD equivalent 187'394) 166’677’962174'852'412 (USD equivalent 1’511’371 1'612'934) 182’170’662201'345'112 (USD equivalent 1’698’7651'800'328) Cash held at the Damascus headquarters (SYP) 70'006'929 (USD equivalent 484'843) 70’006’929 (USD equivalent 484'843) Cash held at the Plant (SYP) 68'616'600 (USD equivalent 486'649) 63'003'170 (USD equivalent 438'379) 215’745’811 232'196'394 (USD equivalent 1’576’021 1'687'916) 347’365’581 (USD equivalent 2’501’049)363'816'164 Cash in Transit (SYP) 127'875'916 (USD equivalent 881'474) 127’875’916 (USD equivalent 881'474) Total (SYP) USD Equivalent SYP 165'116'229 (USD equivalent 1’158’885) SYP 190’8679’08668 (USD equivalent 1’319’853) SYP 382’423’773 407’048’806 (USD equivalent 3’087’3923’300’849) SYP 738'419'088SYP 763’034’103 (USD equivalent 5’779’5875’566’130) Security Payments Security Payments made through Firas Tlass The review of the documents provided by Baker & McKenzie as relevant to ‘Security Payments’ indicated that monies were paid to Mass Co. for “supposed...channel[ling] to the various beneficiaries…”7. The same document referred to the donations as distinct from the “monthly remuneration of our partner”. The review of data within the live instance of the JD Edwards Enterprise One accounting records indicated that LCS did not fully populate the vendor fields within JD Edwards. Beneficiary bank details for suppliers do not appear to have been recorded. Specifically for Mass Co. only the name of the vendor8 was observed (in both English and Arabic). No evidence was observed within the accounting records which links Mass Co. and Firas Tlass. While we observed no consistent practice, generally for other vendors we observed that the vendor data fields were populated more extensively than was the case for Mass Co. Documents provided by Baker & McKenzie indicated that over time the methods of channeling monies to Firas Tlass evolved, not least to protect the anonymity of the LCS staff members processing the transactions. A document provided by Baker & McKenzie indicated that as of July 2014 that there were “Three types of monthly payment” 9. The review identified four payments routes: i. From July 2012 to November 2013 monies were paid via electronic bank transfer and cash in response to apparent invoices received (without an approved Purchase Order); and recorded to the Mass Co. vendor account ii. From February 2013 to November 2013 monies were advanced through Suppliers Advances where no invoice is referenced/received; and recorded to the Mass Co. vendor account. 7 N0014R01-00002028 8 Exhibit C - JD Edwards Enterprise One _ Supplier Info of Mass Co. screen-print 9 Relativity ID: N0014R01-00001453 Formatted: Highlight Formatted: Font: Calibri, 8 pt, Bold, Font color: Text 1 Formatted: Highlight Formatted: Font: Bold
  8. 8. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 7 iii. From December 2013 to August 2014 monies were advanced through Employee accounts These transactions appear not to have been recorded to the Mass Co. vendor account at the time each transaction occurred. iv. In September 2013 monies were advanced to Bruno Pescheux allegedly for the personal benefit of Firas Tlass via an USD account held in Lafarge Middle East & Africa Building Materials. Observations from the review of the live instance of the JD Edwards Enterprise One accounting records and documents provided by Baker & McKenzie have been used to identify potential Security Payments. Table 3 – Alleged Security Payments arranged by Firas Tlass Period Vendor: Mass Co. Employee Advances LMEA Account in Egypt Section in Report Potential “Security Payments” through Employee Advances December 2013 to August 2014 - SYP 425’440’000 (USD 2’911’012) - Error! Reference source not found.3.2.3 Employee Advances: Potential Security Payments and Remuneration; and 3.2.4 USD Payments recorded to Mass Co. Potential USD “Security Payments” 23. July 2014 USD 125’000 USD 50’000 - Additional Potential “Security Payments” otherwise traced from documents provided by BM July 2012 to November 2013 SYP 236’450’000 (USD equivalent 2'298'353) - - 3.2.1 Payments to Firas Tlass (and his linked companies) Total (USD equivalent) USD 2’423’353 USD 2’961’012 - USD equivalent 5’384’365 Alleged potential Security Payments to IS and other groups No evidence was identified within the live instance of the JD Edwards Enterprise One accounting records showing that the monies paid to Mass Co. or made available as Employee Advances were distributed onward to US designated and non-designated terrorist groups. Transactions within the accounting records that occurred at or around the same dates and had similar payment values as the alleged potential Security Payments to US designated and non-designated terrorist groups identified within the documents provided by Baker & McKenzie. It is possible that these transactions relate to the alleged payments to US designated and non-US designated terrorist groups. This connection has been inferred from documents provided by Baker & McKenzie. Connecting documents with transactions is a subjective exercise; other parties reviewing the same documents may draw different conclusions. A Microsoft Excel spreadsheet titled ‘Chart of Payments’ has also been provided. The spreadsheet shows the payments identified within the live instance of the JD Edwards Enterprise One accounting records linked to the alleged potential Security Payments to IS and other US designated terrorist groups as well as non US-designated groups identified within the documents provided by Baker & McKenzie. No open searches for “IS” (or “ISIS”) or other identified groups were performed within the live instance of the JD Edwards Enterprise One accounting records. Key word searching against a data download of the JD Edwards Enterprise One system could provide assurance that all / any transactions involving IS and other designated parties have been identified. Intermediaries
  9. 9. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 8 Intermediary – Firas Tlass LCS paid monthly fees to Firas Tlass for his services. The fees appear to have been intended for the benefit of Firas Tlass himself. Observations from the review of the live instance of the JD Edwards Enterprise One accounting records and documents provided by Baker & McKenzie have been used to characterize the payments to Mass Co. Table 4 – Remuneration of Firas Tlass. Period Vendor: Mass Co. Employee Advances LMEA Account in Egypt Section in Report Monthly payments of 1% of turnover April 2011 to June 2013 SYP 175'620'408 (USD equivalent USD 3'028'449) - - 3.2.2. Payments of 1% of turnover to Mass Co. Monthly payments of USD 75’000 November 2013 to July 2014 USD 225’000 USD 600’000 USD 307’990 3.2.3 Employee Advances: Potential Security Payments and Remuneration; 3.2.4 USD Payments recorded to Mass Co. 3.1.2 LCS USD bank account opened in Lafarge Middle East & Africa Building Materials Total (USD equivalent) USD 3’253’449 USD 600’000 USD 307’990 USD equivalent 4’161’439 Intermediary - Amro Taleb The work identified monies paid to Amro Taleb (EUR 2’910 (USD equivalent 3’871); SYP 7’828’774 (USD equivalent 151’924) and USD 3’240) and his linked company Greenway Ecodevelopment pvt10 (EUR 51'500, (USD equivalent 67’479) and USD 10'356). The payments to Amro Taleb date from 6 January 2010 to 1 October 2012 appear to relate to his work as a LCS consultant. Payments to Greenway Ecodevelopment pvt occurred from 4 December 2011 to 31 January 2015. The accounting records pertaining to a sub-population of these transactions indicate that the payments were linked to “fees” or apparent “consultancy services”. A document11 provided by Baker & McKenzie indicated that some of the money paid to Amro Taleb via Beirut might be for the benefit of Ahmad Jamal. Documents identified by Baker & McKenzie indicate that some of the monies paid to Amro Taleb are monthly commissions based on the raw materials supplied by Ahmad Jamal and Mohammad al Taweel Bn Ibrahim. Table 5 – Overview of payments to intermediary Amro Taleb and his company Greenway Ecodevelopment Payment channel Greenway Ecodevelopment pvt Amro Taleb Total for Intermediary Payments (USD equivalent) Electronic Bank Transfer (USD) 10'356 10’356 Cash held at the Damascus headquarters (USD) - 3’240 3’240 Total (USD) 10'356 3’240 13’596 10 See Error! Reference source not found. 11 N0037R01-00000879
  10. 10. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 9 Payment channel Greenway Ecodevelopment pvt Amro Taleb Total for Intermediary Payments (USD equivalent) Cash held at the Damascus headquarters (EUR) 51'500 850 52’350 Electronic Bank Transfer (EUR) 2’060 2’060 Total (EUR) 51'500 2’910 (USD equivalent 3’871) 54’410 Electronic Bank Transfer (SYP) - 7’828’774 (USD equivalent 151'924) 151’924 Cash held at the Damascus headquarters (SYP) - - Cash held at the Plant (SYP) - - Cash in Transit (SYP) - - Total (SYP) USD Equivalent - SYP 7’828’774 (USD equivalent 151’924) USD 219’930 Electronic Banking Transactions within the live instance of JD Edwards Enterprise One The review of data within the live instance of the JD Edwards Enterprise One accounting records indicated that Lafarge Cement Syria (“LCS”) did not utilize the Data Transfer File (“DTA”) functionality that automatically initiates Electronic Banking Transactions through a link to JD Edwards. Payment entries were posted manually within JD Edward without including the beneficiary’s bank account details (nor the originator if applicable). Furthermore, electronic banking transactions are also likely to have been processed manually. In the absence of bank statements, no validation has been performed to validate if the payments indicated within the accounting records agree to the actual transactions that occurred. The electronic transfers observed within the documents provided by Baker & McKenzie pertained to the electronic transfer of cash to a branch of an external bank for subsequent collection by a named individual. In such instances the original payment instruction12 from LCS may necessary to identify the beneficiary (i.e. the beneficiary may not be stated on the bank statement). The review of data within the live instance of the JD Edwards Enterprise One accounting records indicated that LCS did not consistently utilize functionality within JD Edwards to store electronic documents (including scanned documents) and link them to transactions. Audit trail and authorisations within the live instance of the JD Edwards Enterprise One There is limited no information within live instance of the JD Edwards Enterprise One accounting records concerning the initiator and approver of transactions. A “Transaction Originator” (both short name and user ID) is available for each cash and electronic payment transaction recorded in JD Edwards however no link to Bruno Pescheux or Frederic Jolibois was identified. The exercise determined that one bank account only had two unique ‘Transaction Originators’ and consequentially there is a higher potential risk of collusion (account 22251.513100.ABLB30 Audi Bank LB Ac No. 997976-30$). The review indicated that the approval functionality within the live instance of the JD Edwards Enterprise One accounting records wasdid not appear to be used by LCS. Bank transfers were physically signed off per 12 For example N0029R01-00000177
  11. 11. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 10 the authorities recorded within an Authority Matrix13. The necessary approvals are value dependent where the highest authority required is two members of the LCS EXCO. Cash payments made at plant and at HQ were recorded within ERP as they occurred and were then retrospectively approved by the CEO at a Monthly Treasury meeting. Invoices received without an approved Purchase Order “vouchers on hold” also required approval (authority level unknown) which was provided through a signature on the invoices. Recommendations for further work JD Edwards database dump / Key word searching The scope of work agreed with Baker & McKenzie did not include running searches within the live JD Edwards Enterprise One accounting records for the designated and non-designated groups named within the Security Payment and Sourcing Payments documents provided by Baker & McKenzie. These searches are most effectively be performed against the restored JD Edwards database. Bank Statements The work performed has not included the review of Bank Statements and any other transactions related documentation. A review of such documentation would validate the transactions indicated within the live instance of the JD Edwards Enterprise One accounting records. Bank Statements could be obtained in respect of all transactions identified such that the actual occurrence of each payment could then be validated and the destination account identified, including in respect of group financing. This exercise could also review the approval process and sign-offs associated with cash and bank payments. Bank Statements may be identified from a review of the Finance Folder restored from LCS’s server. The Folder was described by a former LCS employee as an extensive repository of finance information; including bank statements. Sales Fictitious customer accounts and non-market price sales are used as a mechanism of transferring value to third parties and / or to creating slush funds. Reviewing sales activity has not formed part of the scope of the work. It may be beneficial to conduct an analytical review of the sales activity in relevant period to identify and investigate: • Customer account sales for which no monies were received or credit lines extended (including sales for which bad debt was subsequently written off); • Sales transactions at non-market prices; and • Fictitious customer accounts and/or customer accounts with similar names. Ransom payments A review of the 69 documents identified by Baker & McKenzie relevant to kidnapping and ransom payments may identify potential transactions. To date we have not been asked to identify any potential transactions from these documents or to subsequently search the live instance of the JD Edwards Enterprise One accounting records for any potential transactions identified. 13 Page 7 of N0130R01-00000133 shows the Authority Matrix as of 12 July 2012
  12. 12. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 11 2. Background 1. On the 7th and 8th of July 2016, Craig Dorosewicz (LafargeHolcim Head of Global Cloud and Data Centres EMEA Zone) in Madrid generated a full data download of the JD Edwards Enterprise One accounting system of Lafarge Cement Syria. 2. The data download was transferred to PwC France via FTP on the 19th of July 2016, and afterwards to PwC Switzerland via encrypted disc on the 12th of October 2016. 3. The database download was restored on a plain oracle installation from 16th to 21st of December 2016.
  13. 13. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 12 3. Approach 4. Assess and understand the content of the tables in the back end database (including with reference to the descriptions provided on “jderef.com”). 5. Validation of records retrieved in live system. i. Determine the back end tables corresponding to the front end reports ii. Running queries on the back end tables equivalent to the front end searches iii. Comparing the resulting back end exports with the front end reports 6. Research whether the records found in the live system can be linked to each other using the back end database. iv. Determine key columns in the back end tables that identify a record. v. Explore the back end tables to find a table containing multiple keys, which would allow a mapping. vi. Validate whether the mapping found is consistent. 7. Explore the back end database for history files displaying information on modifications of entries. vii. Determine key columns in the back end tables that identify a record. viii. Identify other tables containing columns corresponding to these keys. ix. Check whether the identified tables contain multiple records with the same key and the same information containing columns as the original table. 8. Identify and Extract Information on Procurement Orders from the back end database. x. Identify Procurement related tables in the back end database. xi. Query the identified tables for the known account numbers and extract the results.
  14. 14. Privileged and Confidential – client attorney work product Project Alpha January 2017 PwC 13 4. Limitations of our work 9. The current analysis on the back end data has provided further data in respect of the known findings. The analysis does not look into the identification of similar transaction patterns, which might lead to the identification of additional transactions, individual and entities. 10. We validated the completeness of the back end records only against the information relevant to the findings of the Forensic Transaction Review. 11. The existence of missing records in history files is very hard to detect if they were deleted consistently. To do so would require a general assessment of how difficult it is to delete records in a consistent manner and the determination of the necessary steps to do so.
  15. 15. Privileged and Confidential – client attorney work product January 2017 PwC 14 4.1.1.5. Suppliers linked to Al-Raqqah 12. Two searches were completed within the “Supplier Master Inquiry – Work with Supplier Master” report within the live instance of the JD Edwards Enterprise One accounting records to identify Supplier accounts potentially linked with supplier names provided by Baker & McKenzie. Payments and general ledger transactions pertaining to each supplier account identified were then obtained. We subsequently reviewed the nature of the goods and services as described within the relevant Purchase Order. Table 6 –Named Suppliers identified by Baker & McKenzie as linked to Al-Raqqah Vendor Name provided by Baker & McKenzie as linked to Al- Raqqah Potential related Supplier account identified within JD Edwards Transaction overview Total value of Payment USD equivalent Exhibit Reference containing transactional detail Product (per Baker & McKenzie review) Supplier Account No. Account Name Product/Service (per data within the accounting download) First payment Last payment Pozzolana, Gypsum and Yellow Sand Muslem Sedo 857406 Moustafa Mouslem Bin Suleiman Logistic Services Plant / Gardening Services- Conclusion: Account 857406 does not match to Muslem Sedo 28.05.13 24.12.14 32'315.55 Exhibit T Supplier Payment Report – Suppliers linked to Al- Raqqah Pozzolana and Gypsum Khalil Ali 100716 Khalil Al Ali River Sand, Gypsum, Pozzolana; Heavy Mobile Equipment Rental, Road Transport 05.07.10 29.12.14 1'765'975.92 Pozzolana, Black Sand and Gypsum Bassam Shoukri No match identified to date No match identified to date n/a No match identified to date Pozzalana Mouhammad Khalfow 101094 Mazen Mahmoud Al Khalaf Logistic Services (including furniture) Conclusion: Account 101094 does not match to Mouhammad Khalfow 10.11.10 10.11.10 7'098.23 Pozzolana and Black Sand Shaker Shkree 811249 Shaker Shukri Ben Abdelkader River Sand; Black Sand 18.03.13 25.01.14 114'561.81 13. Accounts for which the only payments observed relevant to the period of Al-Raqqah’s occupation by Al Nusra and subsequently IS are highlighted orange (from March 2013). Formatted: Heading 1, Indent: Left: 0 cm, First line: 0 cm Formatted Table Formatted: Strikethrough Formatted: Font: Italic Formatted: Strikethrough Formatted: Font: Italic Formatted Table Formatted: Strikethrough Formatted: Strikethrough
  16. 16. Privileged and Confidential – client attorney work product January 2017 PwC 15 4.1.2. Open Searches performed 14. A search was performed within the live instance of the JD Edwards Enterprise One accounting records14 for transactions concerning “Mohammad al Taweel Bn Ibrahim”, “Ahmad Jamal” (and various iterations thereof) and “Amro Taleb”. The results of these searches identified payments to accounts held for Amro Taleb (account 100284); Greenway Ecodevepment pvt ltd. (account 105191); Ahmad Jamal Moustafa alhasan bn Mohammad (account 928617) and Khalil Al Ali (account 100716). The relevant findings are included within section Error! Reference source not found.. Open searches for Suppliers linked to Al-Raqqah 15. A “Supplier Master Inquiry – Work with Supplier Master” report within the live instance of the JD Edwards Enterprise One accounting records was run to return the address and phone’ details of all suppliers. The data was then searched for addresses containing *rak* or *raq* to identify sourcing suppliers with potential links to Al-Raqqah. 16. The searches identified sixteen eight suppliers, three two of which were also provided by Baker & McKenzie. One supplier identified had no associated transactions. 17. Note that the Supplier Master report also included addresses written in Arabic that were excluded from the report. 17.18. We subsequently reviewed the nature of the goods and services as described within the relevant Purchase Order. Table 7 – Additional Suppliers identified from an open search as linked to Al-Raqqah Product / Service (per accounting records where provided) Account Account Name Address Line 1 Address Line 2 First Payment Date Last Payment Total value of Payment USD equivalent Exhibit Reference containing transactional detail Maintenance, Logistics and equipment rental Conclusion: Not related to raw materials 129079 Moutaz Ibrahim Al Shamoti Al Raqa Al Raqqa 06.06.12 27.01.13 5'687.70 Exhibit T Supplier Payment Report – Suppliers linked to Al-Raqqah Logistic Services / Other Spares Conclusion: Not related to raw materials 143638 Mohamed Al Hasem Bin Ali Al Raqa 18.10.12 18.09.14 80'567.27 Black Sand, River Sand, 779226 Bassam Contracting Office Al Raqa Al Raqa 10.12.12 11.09.14 367'984.43 14 Static data tables: “Account Master Inquiry”, “Supplier Catalog Price - Work with Supplier Catalogues” and “Customer Master inquiry” Formatted Table Formatted: Font: Italic Formatted: Font: Italic
  17. 17. Privileged and Confidential – client attorney work product January 2017 PwC 16 Product / Service (per accounting records where provided) Account Account Name Address Line 1 Address Line 2 First Payment Date Last Payment Total value of Payment USD equivalent Exhibit Reference containing transactional detail Gypsum, Pozzalana, Heavy Mobile Equipment 100040 Al Mohanad Co Tareek Al Bab-Suran Village Rakka n/a No transactions found Nitrogen cylinder, oxygen, potan and other gasses 103269 Obied Kader bin Rasheed Address: Ain Issa Raqqa 12.01.12 01.02.15 553'790.00 Maintenance Services Conclusion: Not related to raw materials 113725 Mohammed Al Otry - Al Raka 14.02.12 10.12.12 42'979.71 Temporary Cleaning Services Conclusion: Not related to raw materials 784822 Suleiman Al Daleel - Al Raqa 27.01.13 02.06.14 22'542.79 Muriatic acid (HCL) 30%; Caustic Soda (Noah) 50% 820517 Mohamed Ibrahim Naser Alsokhni [telephone no.] Al Raqa 07.03.13 30.06.13 209'006.61 Donations, Outsourced Services and Logistics Services Plant Conclusion: Not related to raw materials 857406 Moustafa Mouslem Bn Suleiman [telephone no.] Al Raqa Vendor Name provided by Baker & McKenzie – See above Pozzalana, Sand 928616 Mohammad al Taweel Bn Ibrahim Address: tal abiad St.next to fawaz Mosq Raqqa Vendor Name provided by Baker & McKenzie – See above Heavy Fuel Oil, Pozzalana and Sand 928617 Ahmad Jamal Moustafa alhasan bn Mohammad Address: Industrial zone Raqqa Vendor Name provided by Baker & McKenzie – See above Formatted Table Formatted: Font: Italic Formatted Table Formatted: Font: Italic Formatted: Font: Italic Formatted: Font: Italic
  18. 18. Privileged and Confidential – client attorney work product January 2017 PwC 17 Product / Service (per accounting records where provided) Account Account Name Address Line 1 Address Line 2 First Payment Date Last Payment Total value of Payment USD equivalent Exhibit Reference containing transactional detail Safety Supplies, Gas, Oil, Angle Steel, Battery Acid and Building Maintenance 932957 Khalil Al Abou [telephone no.] Raqqa 05.11.13 14.09.14 67'389.39 Heavy Fuel Oil 951357 Abdul Razzak al Ahmad al Dahho Address: Mamoun Set. Raqqa December 2013 8'683.88 Water and other maintenance Conclusion: Not related to raw materials 951669 Fawaz Mahmoud Abedalkader [telephone no.] Raqqa 4'294.08 Vehicle Rental and Logistic Services Conclusion: Not related to raw materials 974595 Mohammad Almousoleem Bin Ismael Address: Salouka Village, eastern lafarg Raqqa 23.04.14 16.02.15 11'885.86 Heavy Mobile Equipment Rental, Donations, Other Supplies Opex and Safety Supplies Conclusion: Not related to raw materials 974597 Moutstafa Houseen Bin Hassan Address: Ain Arab - Kojak Vilage Raqqa 23.04.14 16.02.15 6'086.20 18.19. Accounts for which the only payments observed relevant to the period of Al-Raqqah’s occupation by Al Nusra and subsequently IS are highlighted orange (from March 2013). 19.20. Accounts “928616 - Mohammad al Taweel Bn Ibrahim” and “928617 - Ahmad Jamal Moustafa alhasan bn Mohammad” have adjacent account numbers which implies that they were established at the same time. Formatted Table Formatted: Font: Italic Formatted: Centered Formatted Table Formatted: Font: Italic Formatted: Font: Italic Formatted: Centered Formatted Table
  19. 19. Privileged and Confidential – client attorney work product January 2017 PwC 18

×