Forensic Focus newsletter August 2011Welcome >Evidence on the move > Cutting through theCounter Fraud – A moreaggressive programmemakes sense > smoke and mirrorsBusiness Interruption –Contentious Areas > Forensic FocusContacts > Welcome to the August 2011 edition of Forensic Focus. As we write this issue of Forensic Focus, Wellington (and We have seen a marked even Auckland) is experiencing snow for the first time in increase in clients and a generation (or three); financial markets are increasingly volatile as the price of gold soars, and those at work businesses coming to us who were completely disinterested in the Rugby World Cup 2011 are starting to show signs that they may to help them with fraud re-think their decision not to “get involved”. and litigation before it Life and business are unpredictable. If you are not good at predicting what the future holds, a key quality is actually hits. being agile enough to move quickly and to adapt when changes evolve. We have seen a marked increase in and refine his thinking around the curly topics that we clients and businesses coming to us to help them with are seeing within business interruption insurance claims fraud and litigation before it actually hits. As a result, we arising from the Canterbury earthquake. Finally, Barry needed to adapt and brought Ian Tuke into our Forensic (B2) Foster gives his insights into using data from mobile team. Ian provides our investigators working on reactive devices with forensic investigations. investigations, with sufficient bandwidth to allow them Stay warm, stay solvent and “Go the All Blacks” to help clients before their problems hit the front page of the morning newspapers. Jason continues to develop Barry Jordan and the team. Barry Jordan +64 (0) 4 470 3760 firstname.lastname@example.org
Evidence on the moveWelcome > Computers, email accounts, and mobile phones are These traces can contain very rich evidence for the very rich sources of evidence It is critical that employers, investigator. When the mobile device is correctlyEvidence on the move > litigators and investigators have a good understanding handled and examined by a data forensic specialist, of what evidence can be found. it can assist with all aspects of a dispute includingCounter Fraud – A more employment, fraud and misconduct matters. Some ofaggressive programme Mobile devices, in particular, have become standard the evidence that could be found may include itemsmakes sense > issue for most people in business, so when things go which are no longer available on business servers which wrong investigators have to consider them as a source the mobile device connects to.Business Interruption – of evidence.Contentious Areas > Investigators may discover emails that have been Until recently the use of mobile phone evidence deleted from the users’ mailbox on the server, laptopsContacts > was limited to criminal proceedings. The tools and or desktops. Most mobile devices now have the ability techniques needed to extract evidential data from to connect to, and download email and chat from web mobile phones was practically restricted to the few Law based email (like Hotmail) or from social media sites Enforcement Labs in the country. like Facebook. The older and now simpler, second-generation (2G) Investigators can also recover photo and video files, mobile phones contained a wealth of evidence such as as well as the metadata contained in them. In some call histories, contact lists and short text messages, as cases, like iPhones, the mobile device will include GPS well as user and device information. This information coordinates, which indicate not only when the picture had to be extracted from the phone and put into was taken but where. formats like reports and spreadsheets to enable investigators to understand the information. GPS systems within the mobile device often stamp onto emails and text messages the coordinates of where messages were sent and received. Often the GPS coordinates can be extracted and plotted ontoMobile devices have become standard a map to show where the user was when certain activities occurred.issue for most people in business, so Mobile devices include removable storage (such aswhen things go wrong investigators microSD cards), which can provide additional storage capacity of up to 32GB. These storage devices canhave to consider them as a source of contain various files and documents, which examinersevidence. analyze using the same methods and tools used to examine other data storage devices, like computers. However, electronic evidence is volatile and the volume Now third and fourth generation (3G/4G) smartphones of data involved can often be staggering. You should are on the market and being utilised in the workplace. consult with a specialist to ensure the evidence is safely Mobile devices like iPhones, iPads, Android and handled and the most efficient ways of reviewing the Windows Mobile Smartphones contain much more data are used. Barry Foster and Jon Pearse from our than a simple mobile phone. They can access telephone Analytic and Forensic Technology team both have and wireless networks, they enable the user to email, extensive experience in dealing with cellular phones and take photos and videos (sometimes in High Definition), mobile devices. create review and edit electronic documents, browse the internet and use instant messaging and social networking sites. Often the devices also include Global Positioning Systems (GPS) and atmospheric sensors as well. All these features make the phones extremely useful and fun to have, they can also make the device a very useful and productive business tool. A valuable Barry Foster Jon Pearse by-product is that every action taken by the user on +64 (0) 9 303 0974 +64 (0) 9 303 0838 such a device leaves a trace. email@example.com firstname.lastname@example.org
Counter FraudA more aggressive programme makes senseWelcome > As the tough economy continues to see NZ Plan what steps you will take over the next 2 years to organisations prudently search for efficiencies avoid, identify and respond to fraud and corruption.Evidence on the move > and strip out costs, there are inevitably fewer Assign a Fraud Control Officer and Whistleblower people responsible for protecting your reputation Protection Officer from your team. Review the plan atCounter Fraud – A more and assets from fraud and corruption. least every couple of years.aggressive programmemakes sense > The ongoing trend of ‘trimming back’ support functions Prevention is King requires those who remain to deliver more with less. Our Conviction checks for all new employees, and forBusiness Interruption – experience suggests that as personnel adjust to more personnel who are promoted or move to higher riskContentious Areas > ‘lean’ operating environments, the risk of dishonest roles. employees exploiting the control gaps increases.Contacts > The CEO and senior management team must This is backed up by the 2010 Association of Certified demonstrate a positive counter fraud culture. A quick- Fraud Examiners Global Fraud Study, where the number fire 10 question survey can give you enormous insight one response following fraud was increasing the around your culture. segregation of duties. Fraudsters under financial stress Have experienced counter fraud professionals facilitate were the top red flags across the 2000 frauds, which a fraud risk assessment to understand and target your comes as no surprise. greatest fraud & corruption risks. A trusted yet dishonest employee presents the greatest • Average loss: NZ$200,000 threat. Ensure your ‘honest majority’ take part in • Frauds lasted 18 months before being detected meaningful, compelling education to understand • Employee education is the foundation of what the warning signs are and how to report their preventing and detecting fraud suspicions. Don’t leave the senior management team • No.1 detection method: Employee tips, regardless out, they are critical and they will enjoy the training with of the sector their colleagues. 2010 Report to the Nations on Occupational Fraud & Abuse: Association of Certified Fraud Examiners Detection – the faster the better Give your people a voice - they want to be heard. Correctly deployed whistleblower hotlines are effective Take a ‘counter-fraud’ position and inexpensive as they double as a deterrent for According to clients who have been there, it makes employees who may now think twice about crossing sense to avoid the reputational, financial and morale the line. stress by stopping the fraud or, at the very least, identifying it in a timely manner. Here are the 4 areas Examine your data from a fraudster’s perspective to to address to improve your resilience to this topical identify fraud that may be taking place now. To be business risk: effective involve people who have caught fraudsters, and have the best tools to produce the goods. Have a plan The line in the sand is important: A policy statement1 ....and Response, a rapid one from the CEO committed to seeking out fraud and Make sure you have planned in advance who you will corruption should include a message encouraging rapidly deploy to prevent further loss,secure evidence employees under financial stress to seek help. and unpick what has happened in an evidentially sound manner that will satisfy the courts. This is not the time to learn on the day. Please contact Ian Tuke to learn more. 1 See our September 2010 edition featuring an article on Fraud Policies Ian Tuke +64 (0) 9 303 0962 email@example.com
Business InterruptionContentious AreasWelcome > In the last Forensic Focus we provided an overview of how Business Interruption (“BI”)Evidence on the move > insurance works. We discussed what business owners and their advisers can do to ensureCounter Fraud – A more payment is obtained as quickly as possible.aggressive programme Read the previous article here.makes sense > Given the inherent complexity in BI insurance, the sizeBusiness Interruption – and number of the claims, and the scale and nature ofContentious Areas > devastation, it is inevitable that disputes and litigation will arise over BI insurance claims. The purpose of thisContacts > article is to highlight some of the more contentious areas in assessing BI insurance claims 2. “De-population” There has been some media coverage since the Christchurch earthquake in February about depopulation not being covered by BI insurance policies. BI insurance policies typically cover the loss arising from the interruption caused by damage to the business premises. However, most policies do not contemplate covering any loss arising from decline in population or demand • opulation decreases and several businesses move P following an earthquake. Given the extent of the into the surrounding area, occupying premises financial losses suffered by some Christchurch businesses, that were vacant prior to the earthquake. These this concept may well be tested in the New Zealand relocations actually increase the working population courts in future. within easy walking distance of the business (for The practical challenge is quantifying what the turnover example a cafe). All other things being equal, the would have been but for the damage to the property. insured’s turnover again would likely have increased Clearly there will be many cases where the claim will following the earthquake. need to be decreased to reflect reduced demand in In our opinion, any adjustments to turnover for Christchurch following the earthquake. However, uniform “de-population” will need to be considered on a case adjustments to expected turnover to reflect de-population by case basis and be supported by robust research and are likely to be challenged. Consider three examples: analysis. Regardless of the quality of the underlying • Population decreases (by say 10%) but the insured research and the robustness of the financial modelling to provides services that are in high demand following determine the expected turnover (i.e. what the turnover the earthquake (e.g. demolition services). All other would have been, but for the damage to the property), things being equal the insured’s turnover would have there will never be “one” right answer. Experience and actually increased following the earthquake if it was judgement will be critical. able to operate. So, in this situation, it is unlikely Multiple branches there would be grounds for reducing the claim due to Quantifying the financial loss for a business with a de-population. single site is comparatively straight forward. But it is • opulation decreases but supply is reduced by a much P much more difficult for businesses with multiple sites. greater level (i.e. your competitors are now unable to Consider a situation where a retailer’s CBD premises are operate). All other things being equal the insured’s destroyed, but another suburban store has continued turnover would have increased, but for the damage to operate. It would be necessary to determine and to the property, so again it is unlikely there would be account for the CBD turnover that has been successfully grounds to reduce the claim. transferred to the suburban store. >> 2 This article is not intended as a substitute for professional advice. No liability is accepted. The issues and the best approach to solving them will vary depending on a variety of factors including the business, the challenges faced, the policy and the amount of money at stake. Professional advice should be sought to assist resolving issues with BI insurance claims.
Business InterruptionContentious AreasWelcome > The practical challenge lies in determining how much of the CBD store’s turnover has been transferred to theEvidence on the move > suburban store. The approach taken will depend on Clearly there will be someCounter Fraud – A more the size of the claim and the information available. In situations where the claim is very large, an intensive, businesses that will neveraggressive programmemakes sense > almost granular approach to determine the level of turnover attributable to the CBD store is probably trade again following theBusiness Interruption – necessary. 22 February earthquake,Contentious Areas > Mitigation Some landlords are delaying the repair of properties in despite having BusinessContacts > order to maximise the period of time that rent is covered by the BI policy. The commercial logic being the landlord Interruption cover in place. would prefer to have the insurer paying the “rent” rather than the tenant, particularly if the trading outlook Interruption for the tenant appears poor or uncertain. These actions Clearly there will be some businesses that will, regrettably, have a multiplier effect as the tenant also looks to claim never trade again following the 22 February earthquake, the extended loss being suffered under its own BI policy. despite having BI cover in place. There has been some media commentary that BI policies do not provide any However, there is an underlying requirement for the cover if the business does not trade again. The logic is insured to mitigate the loss being suffered. In our that the business has to trade again for there to be an opinion, there appears to be a high likelihood of “interruption”. If this approach is uniformally applied, litigation in circumstances where the insurer and insured it is likely to generate litigation and/or create perverse party hold vastly different opinions about the extent and incentives to trade for a short period of time at the end of timing of loss mitigation strategies. This risk is probably the indemnity period to safeguard the BI cover. lessened by clear communication between the insurer and insured party during the indemnity period. Wages/salaries In most businesses the three largest expense categories are rent, cost of goods sold (i.e. purchase of stock/ materials) and wages. Businesses claiming BI insurance are often not paying rent or incurring cost of goods sold during the period they are unable to trade. The largest remaining cost in most circumstances is wages (or salaries). Accordingly, how these costs are managed during the indemnity period will have a significant bearing on the amount of the claim. It is therefore necessary to consider if: • Staff should be made redundant, especially if it appears likely that there will be a very long delay until the business can trade again (see the comments on mitigation) • nnual leave balances can be run down during the A indemnity period. Ideally these issues will be avoided or resolved through good communication between the insurer and insured party. However, resolution for some cases will clearly require input from specialist insurance lawyers and experienced forensic accountants.Jason Weir+64 (0) 9 303 0966 Please contact Jason Weir if you would like to firstname.lastname@example.org this matter further.