Forensic Focus newsletter November 2011Welcome >Counter fraud: Cutting through the smoke and mirrorsBefore investing …understand your gaps >Visualisation:Going beyond thespreadsheet >Tips for the Forensic Focusexpert witness >Legal discovery ofelectronic data >Contacts > Welcome to the last edition of Forensic Focus presented the claim as an expert witness. Lorinda shares for 2011. Christmas is, once again, rushing up some key findings from the judgement and reflects on on us and a relaxing summer break is enticingly how an expert can influence a judge. imminent. Finally, Barry Foster has been refining pre-discovery A recent highlight for our team was a visit by Toby processing following the amendments to the District Bishop. Toby is based in the Deloitte Forensic Center Court and High Court Rules that come into effect in in the United States. He was previously president of the February 2012. Association of Certified Fraud Examiners and has a vast array of knowledge that we were keen to learn from. I hope you enjoy the read and we wish you a safe and Ian Tuke and Faris Azimullah ran two Counter-fraud enjoyable festive season. workshops with Toby while he was here. In our first article Ian discusses understanding your counter Barry Jordan and the team fraud gaps. A tool that we employ, in both counter-fraud and investigation work, is visualisation. Lisa Tai attended the i2 user group conference in Canberra in September. This gave her the opportunity to enhance her data visualisation skills. Lisa shares some simple visualisation techniques you can run to detect fraud. Also in September, a judgement was issued for a case that was heard during a five week trial in February and March of this year. Lorinda Kelly and I prepared a damages claim for the plaintiff in the case and I
Counter fraudBefore investing …understand your gapsWelcome > In our last newsletter, we introduced the four • And finally “Who needs to be involved?” key areas of activity in a robust counter-fraud Underpinning any successful Counter-FraudCounter fraud: programme: planning, prevention, detection and programme is the engagement of three groups ofBefore investing … response – touching on some practical ways to people: Oversight – Depending on your size, theunderstand your gaps > address each area. Our clients are consistent in Board or Audit Committee; Senior Management – one aspect – they are all looking to apply the the senior leaders in your organisation who set theVisualisation: right level of effort and resource to treat this key right ‘tone at the top’; and Line Management andGoing beyond the business risk, without over or under ‘cooking’ it. staff – the operational leaders and staff who willspreadsheet > implement the counter-fraud measures.Tips for the Organisations of all sizes are asking us “how goodexpert witness > are we?” and “what should we have in place?” Our You may as well have some fun Counter-Fraud framework is designed to help clients in while you get across your gaps!Legal discovery of two key ways. First, it helps clients appreciate how the Below are some insights intoelectronic data > various measures they have work together to treat the the running of our workshops: risk of fraud and corruption. Second, our clients findContacts > running a gap analysis workshop is an efficient method We find getting key people from to quickly compare the measures they have in place various levels and functions across today with a better practice benchmark. This process the organisation together to assess provides a snapshot of strengths and weaknesses and your gaps is a really effective way clarity around what may need attention. of getting broad engagement and a robust outcome. The framework is based on a blend of leading guidance material1 and our decades of experience in helping To eliminate the risk of ‘big personalities’ skewing the clients plan for, prevent, detect and respond to fraud results one way or another, we use anonymous votingIan Tuke and corruption risk. technology in the interactive workshops. This provides a+64 (0) 9 303 0962 realistic view of your ‘current state’.firstname.lastname@example.org • “Why do anything?” At the core of the framework (shown in the model below) is the requirement to The team then rates approximately 100 elements. protect your reputation, culture and finances. During this process the team will be building a picture of your organisation which we use to identify the gaps in • “What to do?” – your current activity of planning, your counter fraud programme. prevention, detection and response. Feedback suggests that having an independent Counter- Fraud professional facilitating the session allows partici- pants to tap into ‘war stories’ and ask for guidance to help provide context around the elements they have been asked to review. In our next newsletter we will be looking at the next step in this process – Fraud Risk Assessments – a key preven- tion measure and what an effective one looks like. Please contact Ian Tuke to learn more. 1 AS 8001–2008: Fraud and Corruption Control; AS 8004-2003: Whistleblower Protection Programmes for entities; AS 4811- 2006: Employment Screening
VisualisationGoing beyond the spreadsheetWelcome > Tens of thousands of rows of data, hundreds Visualisation, or visual analytics, is the concept of using of worksheets, countless tables... Where do pictures, charts, diagrams and maps to reveal key rela-Counter fraud: you begin? Do you find yourself in this all too tionships, communications, trends and patterns withinBefore investing … common dilemma? You’ve received all the large amounts of data. Many companies are now usingunderstand your gaps > information you could possibly want but how do the power of visualisation to detect fraud and abuse; you best analyse it? from detecting fictitious employees and conflicts ofVisualisation: interest, to detecting inappropriate corporate credit cardGoing beyond the Although investigators and analysts are receiving and expenditure.spreadsheet > evaluating more data than ever before, insights withinTips for the the data are often difficult to achieve using traditional Increasingly, there is a myriad of sophisticated visualisa-expert witness > analytic methods. While spreadsheets offer a quick way tion tools and techniques for you to choose from – from to understand simple, one (or possibly two) dimensional heat maps to word clouds to geospatial analysis toLegal discovery of figures and facts, the ability to draw conclusions from tree maps. However, one of the pioneers and moreelectronic data > the data diminishes as the size of your spreadsheet common visualisation techniques used is ‘link analysis’. grows in volume and complexity. Link analysis explores direct and indirect relationshipsContacts > and associations by drawing ‘links’ between related Figure 1 entities or objects. (continues overleaf) Respond PlanLisa Tai+64 (0) 9 303 email@example.com Detect Prevent
Here are a couple of simple link analysis tests you can 2. Electronic Payment Data Relationshipsrun which may help you to detect fraud and abusewithin your organisation: Figure 31. Employee and Supplier Master File RelationshipsFigure 2 This analysis identifies relationships within your payment data, examini ng payee name and payee bank account details. This analysis can be used to identify instances where payments appear to have been made to a legiti-This analysis will identify relationships between mate supplier but have instead been directed to one ofemployees and suppliers based on unique identifying your employee’s bank accounts. In figure 3, suppliersfactors such as addresses, phone numbers, bank 151 and 250 are linked to two bank accounts each.accounts or IRD numbers. Unexpected relationships are Either the suppliers have changed their bank accountsquickly identified which may indicate process gaps or over time or the bottom bank accounts are fraudulentrelationships, warranting further investigation. In figure and belong to one of your finance team employees.2, ‘supplier 567’ and ‘employee 123’ are linked by acommon address and bank account number. This could We recommend this analysis is done in addition to abe a relationship known by the company, or it could be master file analysis. This is because we have found thatan undisclosed conflict of interest between a purchasing bank account numbers held on master files are oftenofficer and one of the company’s main suppliers. not kept up to date and may be different to the actual bank account receiving payment.Data required to conduct test – employee andsupplier master files Data required to conduct test – list of payments made for a reasonable period (i.e. 1 year) recording date, amount, payee name and payee bank account number. For more information please contact Lisa Tai. One of the main visualisation tools utilised by the Deloitte Forensics team is i2. In September, Lisa attended the i2 APAC User Group Conference in Canberra which was attended by hundreds of analysts and investigators from the defence, law enforcement and commercial sectors across the APAC region.
Tips for the expert witnessWelcome > When a commercial dispute arises, businesses • The Court almost universally accepted the way we and public sector entities typically reach for their calculated losses. Justice Cooper concluded that ourCounter fraud: litigation lawyers. But this is very expensive. One model was comprehensively challenged by the otherBefore investing … impact of the global financial crisis was that many side and had withstood close scrutiny. A good start.understand your gaps > organisations decided to keep any spare cash in reserve, rather than spending it on their lawyers • However, the Judge formed the view that certainVisualisation: to sue others and potentially recover some key witnesses who gave evidence for the defendantsGoing beyond the damages. Recently though, normality seems to were less than truthful, and in some cases dishonest,spreadsheet > have returned and litigation has resumed. in their dealings with the plaintiff. Not a good placeTips for the to be.expert witness > Barry Jordan and I were recently engaged to assist a plaintiff to work out the level of damages suffered • One of the accounting experts who gave evidenceLegal discovery of when their ex-Chief Executive (who was also a director) for the defendant said our calculations were “whollyelectronic data > “jumped ship” and began working with an entity that unrealistic” and not “remotely reasonable”. This was effectively a joint venture partner. Not only did he expert said in his evidence that nothing the plain-Contacts > leave in very unusual circumstances, but they conspired tiff’s lawyers might put to him in cross-examination together to form a new competing business. would change his opinion. Justice Cooper stated in his judgment that the accountant’s expert The defendant’s litigation team sought to undermine evidence was given in a language that suggested “an our evidence and engaged two other accounting overly partisan stance”. A fatal conclusion for the experts who similarly dismissed our approach. defendants. Justice Cooper released his judgment on the case in These findings in the judgement reinforce some advice September and found in our clients favour. He awarded imparted to us by another Judge a few years ago.Lorinda Kelly them $4.3 million in damages (plus a sizeable bill for For those that may from time to time get asked to+64 (0) 4 470 3749 interest and costs). Justice Cooper made a number of give evidence in Court, it is worth sharing. He firstname.lastname@example.org pertinent observations: that a judge, like anyone else, forms an early impres- sion of people. Almost inevitably the subject matter is technical. You will have two seemingly competent experts with positions that are often poles apart. This judge shared that there were two key factors that influenced him when he was assessing evidence from an expert sitting in front of him in the witness box: • #1 – If the Judge detected any hint of perceived bias in what the expert was saying, he would almost universally reject the expert’s evidence no matter how good it looked on paper. • #2 – No matter how complicated the dispute, the expert must be able to communicate key issues coherently and convincingly in the witness box. If they can’t, then the evidence will in all likelihood be rejected. Another salient reminder of how Courts’ work in practice. Contact Lorinda Kelly to discuss either this matter or any other court preparation issues.
Legal discovery of electronic dataWelcome > In recent years there has been an explosion in the The new High Court Rules (High Court Amendment amount, and type, of documents in business. Many Rules (No 2) 2011) (and District Court Rules)Counter fraud: organisations are now reliant on electronically stored promoting the use of electronic discovery come intoBefore investing … information (ESI) and communications to conduct their force on 1 February 2012. The changes to the rulesunderstand your gaps > business. Recent surveys indicate that around 90% of reflect the ever-increasing volume of data (in particular, business documents are never printed and remain as ESI electronic data) in modern litigation, and the need toVisualisation: for their lifetime and that around 70% f the ESI stored effectively and efficiently handle the discovery process.Going beyond the can be duplicates.spreadsheet > The key features of the “default” regime under the newTips for the The most obvious forms of ESI are email and efiles. Efiles rules include the following:expert witness > are your word processing and spreadsheet documents. However, they can also include databases, text • Discovered documents must be exchangedLegal discovery of messages, and even tweets and postings to blogs and electronicallyelectronic data > social network sites. Huge quantities of ESI are created during the course of an ordinary day. It would not be • Parties must provide a standardised list of discoveredContacts > unusual for someone within a business who creates documents or controls ESI (a custodian) to send, receive or handle • Documents must be provided in PDF format (unless more than 50 emails or documents in one day. Spread not possible for particular file types), with the over time this figure multiplies drastically, 1000 per document number as the filename month, 11,750 per year per custodian. • Native files must be provided if requested As a result, if a business becomes subject to litigation, the business managers and their legal counsel are often • Parties must take reasonable steps to exclude required to sort through huge volumes of ESI. In large liti- duplicatesBarry Foster gations it is common to have tens of thousands of emails • Emails and attachments are to be listed separately+64 (0) 9 303 0974 and other efiles that need to be reviewed for relevance. but sequentially on the document email@example.com As can be seen, the new rules mainly address the production and presentation stages of the internation- ally accepted e-discovery reference model. There are a number of other phases in the model which need addressing to conduct an effective discovery and this article addresses some key considerations for each of the phases. Correctly executed identification, collection and processing, reviewing and analysis of non-responsive e-mail and e-files helps you eliminate unnecessary costs and reduce time. The management of your organisations information and the identification of who controls data and where that data is stored within the business systems, are critical first steps in enabling your organisation to effectively respond to litigation. These steps are ideally conducted as a management activity before any litigation occurs. They normally involve the implementation of policy around who is responsible for data and data retention.
Welcome >Counter fraud:Before investing … Electronic Discovery Reference Modelunderstand your gaps > www.edrm.netVisualisation: ProcessingGoing beyond the Preservationspreadsheet > Information Identification Review Production Presentation ManagementTips for theexpert witness > Collection AnalysisLegal discovery ofelectronic data >Contacts > Volume Relevance Mapping data storage locations can also help reduce leged documents to withhold. There is always a need to time and costs, should a discovery activity have to occur. understand the scope of the review, and to consider the E-Discovery Readiness Reviews can also be part of this appropriate supervision and procedures for managing process. Our E-Discovery Readiness Checklist can the reviewers. The selection of the appropriate vendor, assist with identifying some of these issues. tools and platform to support the review are key consid- erations in this phase. The use of advanced technolo- Litigation, governmental inquiries and internal inves- gies like conceptual searching and relationship analytics tigations generally require that ESI and its associated can be used to support and enhance the review process. metadata (data about data, e.g. date and time infor- mation) should be collected in a manner that is legally Analysis occurs in all phases including the pre-discovery defensible, proportionate, efficient, auditable and management and identification phases. The main targeted to the matter at hand. The correct preservation purpose is to remove any irrelevant and non-responsive and collection of data ensures the sustainability of any data, identify ESI that needs special handling (confiden- ESI that is collected. If done completely, it can provide tial or privilege documents) and to focus the data for for seamless feedback into the identification phase if review and subsequent production. further information comes to light about previously unknown custodians or ESI. As identified above the requirements for production and presentation are covered under the forthcoming High Processing enables you to greatly reduce electronic data Court Rules, and this article does not attempt to circum- sizes at the earliest stages in the e-Discovery lifecycle. vent appropriate legal advice that should be obtained in For a fraction of full processing costs, pre-processing will how this should be conducted. de-NIST (removing known data sets), de-dupe (removing duplicates), and even apply dynamic date filters to We have provided some considerations for each of the quickly cull large sets of data. By removing system files phases of the full discovery model; some of the most and unwanted documents before processing begins, critical phases are the information management and you will save both time and money throughout the identification phases. If your organisation’s data is not e-Discovery process. This is the phase where non elec- managed properly, you could find yourself in a situation tronic data (scanned documents) can also be incorpo- unable to provide information that you are required to rated in to the discovery dataset especially if they have disclose. This is especially problematic when the other been processed for Optical Character Recognition (OCR). parties to litigation are able to do so effectively. Review is a critical component to most litigation. If you have any questions about E- Discovery readiness, There is often more than one review stage conducted. Pre Discovery processing or wish to discuss the forth- Reviews are conducted by legal staff and are used to coming High Court Rules please contact Barry Foster. identify responsive documents to produce, and privi-