This document summarizes a conference on forensic accounting that covered topics including computer forensics, current fraud schemes, Canadian employment law, and evaluating forensic accountants as expert witnesses. The conference included speakers from both the United States and Canada and discussed issues relevant to forensic accounting practices in both countries. Specific topics included analyzing file metadata and attributes in fraud investigations, common international fraud schemes involving multiple jurisdictions, Canadian law around dismissing employees and conducting misconduct investigations, and strategies for withstanding cross-examination of a forensic accountant serving as an expert witness. Contact information was provided for several of the speaker attorneys and forensic accounting professionals.

1. #aicpafvc
The State of the Union
of Forensic Accounting From
Both Sides of the 49th Parallel
AICPA
Forensic and Valuation Services Conference
November 11, 2013
Las Vegas, Nevada

2. #aicpafvc
AGENDA
Moderator/Speaker Introductions
Computer Forensics and Fraud Investigations:
File Attributes and Meta Data…Why Should I Care?
Current Fraud Schemes
Canadian HR Law: Investigating Employee
Misconduct
Evaluating Forensic Accountant’s Qualifications
as an Expert Witness
Summary
Contact Information

3. #aicpafvc
Edward Nagel
Principal and Founder of nagel +
associates, Forensic and Investigative
Accountants
Practice areas: Forensic
investigations, anti-fraud consulting
and anti-fraud training
CPA, CA, IFA, CBV
Practice focuses primarily on North
America (with some Caribbean work)
Co-author of the Canadian CPA’s
“Conversations about Forensic
Accounting”
Brad Sargent
Managing Member of The Sargent
Consulting Group, LLC.
Practice areas: Forensic accounting,
financial investigations and expert
witness
CPA/CFF, CFE, CFS, Cr.FA, FABFA
Co-author of the Canadian CPA’s
“Conversations about Forensic
Accounting”
Moderator Biographies

4. #aicpafvc
Steve Rogers
President
Digital Evidence International Inc.
Practice Areas: Forensic computer
analysis; internet investigations;
electronic discovery; major case
management database development
Credentials: EnCase Certified
Examiner, A+ Certified Professional,
Certified Novell Administrator
Eric S. (Rick) Rein
Partner at Horwood Marcus & Berk
Chartered
Practice Areas: Creditor's rights, loan
enforcement, creditor bankruptcy
representation and international asset
recovery
Bar Admissions—Illinois and Florida; Court
Admissions—1st, 4th and 7th Courts of
Appeal, US District Courts of the Northern
District of Illinois and Eastern District of
Michigan
Speaker Biographies

5. #aicpafvc
Stuart Rudner, Esq.
Founding Partner, Canadian
Employment Lawyer
Firm: Rudner MacDonald LLP
Practice Areas: Employment Law,
Human Rights, Litigation
Credentials: B.A., LL.B.
Jurisdictions: Canada
Jordan Bolton, Esq.
Partner in the Litigation Practice Group
of Clark Hill PLC
Broad-based outside general counsel
and commercial litigation practice, with
substantial experience in fraud and RICO
actions
Based in Michigan, with admissions in a
number of federal courts of appeal and
district courts throughout the country
Speaker Biographies

6. #aicpafvc
Computer Forensics and Fraud
Investigations
File Attributes and Meta Data…Why Should I Care?
Steve Rogers

7. #aicpafvc
How many would agree that during a
fraud investigation the date of a
record often requires authentication?

8. #aicpafvc
FILE ATTRIBUTES
Viewable from Windows Explorer
Created date changes on copy
• Last modified date can be earlier than created date
Last accessed doesn’t mean it was accessed

9. #aicpafvc
META DATA
Data about the data
Is different than file attributes
• MS Word: author, last saved by, revision number,, total editing
time, paragraphs
Not every file type contains meta data
• Text files, xml, exe, dll
Most meta data can be changed
Databases

10. #aicpafvc
CASE EXAMPLE #1
For the Plaintiff
Theft of intellectual property
• 2500 CAD drawings
From 1999, bankrupt the plaintiff
Subjects denied the theft
Acquired their computers/removable media
Proved continual use
Testified in Superior Court
Favourable decision

11. #aicpafvc
CASE EXAMPLE #2
For the Defendant
1996 Breach of contract
Contract not available
Alleged destruction of accounting evidence
Data recovered from unallocated space

12. #aicpafvc
CASE EXAMPLE #3
For the Plaintiff
Issuance of shares, agreements etc
Alleged 1993 corporate documents
Nearly 150 MS Word documents
Analysis shows created in 2007
Settled

13. #aicpafvc
CASE EXAMPLE #4
For the prosecution
Harassment in the workplace
Policeman downloaded internet content and gave it to
a female subordinate
Deleted and wiped content
Fragments were recovered
Vive Voce Evidence
Convicted

14. #aicpafvc
INTERNET RECORDS
Google Docs, SkyDrive, DropBox, SugarSync
Online Payment Processors – PayPal, Payza,
ClickBank, PayDotCom
E-Commerce databases
Covert accounts: EntroPay

15. #aicpafvc
WHAT NOT TO DO

16. #aicpafvc
THIS WILL WORK!

17. #aicpafvc

18. #aicpafvc

19. #aicpafvc
Current Fraud Schemes
Rick Rein

20. #aicpafvc
How many of you have been involved in
investigating a multi-jurisdictional or
international fraud scheme?

21. #aicpafvc
Current Fraud Schemes
Forged International Bank Transfer Scam
Fraudulent organization purchases via internet relevant company
information with pre-paid credit cards.
Fraudulent organization obtains email addresses, fax and telephone
numbers without persons communicating finding out organization's
location (if the target is foreign subsidiary of a French company, the
telephone and fax numbers purchased will begin with French dialing
code).
Fraudster pretends to be Senior Manager of Company (usually CFO) of
foreign subsidiary of targeted company, and tries to persuade victim to
transfer funds on a foreign account because of imminent tax and/or
stock transaction.
Funds then transfer through multiple countries:
• First to BVI as base where fraudsters operate by telephone;
• Next to France as country where targeted company is located; and
• Finally to Hong Kong as location for bank transfers.

22. #aicpafvc
Penny Stock Scheme
Fraudsters control worthless stock in 11 public
companies which are thinly traded with minimal
assets and no business operations.
Fraudsters pump up share prices by fraudulent sales
campaign, including distributing false press
releases, announcing non-existent business
ventures and false mergers, posting false
information on social media sites.
Fraudsters use “throwaway phones”.
“Investment” in stocks are transferred to Isle of Man,
Singapore and India.

23. #aicpafvc
Life Settlement Insurance
Life settlement is an investment where insured sells life
insurance policy for cash payment, which is a percentage
of the face value or death benefit.
To keep policy in place life settlement company must pay
premiums.
Investors realize profit if purchase price and additional
premium costs are less than death benefit.
BVI fund created to purchase policies.
Investment in fund sent through administrator whose
accounts were in Canada and England.
Funds are never used to purchase policies or to maintain
premiums.
Funds further transferred to Singapore, Hong Kong,
Cayman Islands

24. #aicpafvc
Obstacles to Recovery
Legal – procedural obstacle. Usually primary. Asset recovery involves
working across borders, which is tough at best of times. There are reasons
why it is hard to find and seize someone’s assets: individuals have rights
and amongst them, in most societies, are rights to privacy, due process,
protection of private property and equal and fair treatment under the law.
Informal and financial obstacle. Investigators are trying to find money that
has been deliberately concealed by a disciplined, well-funded, well-
informed individual with access to state power, global banks and smart
lawyers. And money can be moved very rapidly. It is becoming harder to
hide money because of changes in the way secrecy jurisdictions are
regarded, because of the spread of due diligence, and because of the trend
towards greater transparency. Though domestic financial institutions are
often used to hide money, the vast majority of asset recoveries involve
overseas accounts, trusts and companies. In particular, offshore
jurisdictions frequently have regulatory set-ups that are perfect to obscure
links to money, with shell companies, nominee directors, and secrecy.

25. #aicpafvc
Obstacles to Recovery (cont.)
Political obstacle. In countries where assets have been transferred, there will
also be politics. Some country’s governments are more supportive of private
action than others. Depending upon the targets of the investigation, the
political process could be a difficult barrier to overcome.

26. #aicpafvc
Asset Recovery Procedure
• The case may start with a claim, complaint or judgment.
• Investigators trace assets via documents, electronic data, informants,
accounting, and information from banks and other third parties. Some may be
available locally or via open sources; much will require help from foreign
courts. It is important that this be done discreetly and fast.
• Once the assets have been located, they must be frozen in place by a court.
Different jurisdictions have different rules. Again, it will be critical to maintain
confidentiality until the freeze is in place.
• The assets must now be taken through a confiscation or seizure order. There
are different routes depending on jurisdiction and circumstances. Again,
requires working with other jurisdictions to get orders and to enforce them.
• Assets must be transferred back to where they came from. This raises a
number of issues, like costs to other jurisdictions, compensating those who
may have lost out in other ways, and ensuring that the proceeds go to the right
place (and do not get embezzled again).
Instigating:
Start the progress:
Locating : Where
are the assets?
Freezing: Stop
assets from moving.
Seizing: Take the
assets:
Repatriating: Bring
back the assets.

27. #aicpafvc
Stuart Rudner
Canadian HR Law:
Investigating Employee Misconduct

28. #aicpafvc
How many of you have employees in
Canada?
Of those, how many have had to address
employee misconduct?

29. #aicpafvc
Dismissals
2 types: With Cause or Without Cause
If with cause, no further obligation to employee
Otherwise, need to assess employee’s
entitlements to notice/pay in lieu/severance
No “near cause”

30. #aicpafvc
For Just Cause
“Capital Punishment of Employment Law”
No absolute rules
Employer must prove:
1. that the alleged misconduct took place, and
2. that the nature or degree of misconduct warranted
dismissal, bearing in mind all relevant circumstances
Has trust been destroyed? Has relationship been
irreparably harmed?

31. #aicpafvc
The Contextual Approach
Employer must consider all circumstances, not just
alleged misconduct
• Length of service
• Disciplinary history
• Nature of position
• Mitigating Factors
Same set of facts can yield different results

32. #aicpafvc
The Importance of the Investigation
Always investigate first
Ensure fairness, objectivity, thoroughness
Give accused opportunity to respond
Use trained investigator
Often, employee response is critical factor in
determining appropriate discipline

33. #aicpafvc
Vernon v. British Columbia (Ministry of Housing
and Social Development) (Liquor Distribution Branch)
30 year employee accused of bullying/harassment
Known as “The Little General”
Investigators:
• Pre-judged
• Attacked accused and those who supported her
• Misled decision-makers in report
Result
• 18 months’ notice
• $35k in “The Damages Formerly Known as Wallace”
• $50k punitive damages

34. #aicpafvc
Plester v. Polyone Canada Inc.
Flawed investigation
all notes should have been retained — most were, but some
summaries were done and original notes shredded
interviews should all be done separately
initial report included term “wilful misconduct,” suggesting
tunnel vision or preliminary conclusion
initial draft substantively same as final report, suggesting
decision reached without full discussion
no apparent review of similar situations or comparable
outcomes
once possibility of dismissal for cause was seen as a
potential outcome, Plester should have been given an
opportunity to give a more complete statement
Dismissal not upheld

35. #aicpafvc
Jordan Bolton
Evaluating Forensic Accountant’s
Qualifications as an Expert Witness

36. #aicpafvc
How many have had an interesting
deposition/trial experience?

37. #aicpafvc
How is the Transcript From Your
Deposition Going to be Used Against You?
Daubert Motion (exclude or limit your testimony)
Dispositive motion practice
Impeach you at trial

38. #aicpafvc
Point of Attack
Absent gaping holes in education/experience, focus
will NOT be on general qualifications
Rather, focus will be on:
• (i) industry experience
• (ii) engagement type experience

39. #aicpafvc
Most Common Areas of Focus for Attorneys
Attempting to Discredit Forensic Accountant
Methodology
Not tested
Not peer-reviewed
Not published
Not generally accepted
Nothing “expert” about it (i.e., expensive calculator)

40. #aicpafvc
Bias
Typical (i.e., you say you’re independent, but
plaintiff/defendant is paying you $XXX/hour)
You formed your opinion over time working with
counsel for plaintiff/defendant (you could have
consulted with other side/their lawyers, but you
chose not to do so)
Most Common Areas of Focus for Attorneys
Attempting to Discredit Forensic Accountant

41. #aicpafvc
Common Questions
What assumptions did you make?
What is the factual basis for this opinion, and how do these facts
lead to your conclusion?
What information have you relied on that was provided by counsel
or your client?
What have you relied on that was provided by me or my client?
How many times did you communicate with the attorney/party that
hired you before forming your opinion?
How many times did you communicate with me/my client before
today?
What concerns do you have regarding your conclusions?
Under what circumstances would you use a different
methodology?
What alternative hypotheses could explain what you observed?
What other work would you have liked to have performed?

42. #aicpafvc
Common Mistakes Made During Deposition
Not asking for breaks when needed
Not seeking adequate preparation
Answering questions about a document you do not have in front
of you
Volunteering information
Fearing the words “I don’t know"
Not listening to objections
Getting totally boxed-in on opinions

43. #aicpafvc
Summary – File Attributes and Meta Data
File attributes not always what they appear on the
surface
Meta data is data about the data – most can be changed
and differs from file attributes
Case examples highlighted the power of computer
forensics, including:
• Proving ‘continual use’ of doc’s in theft of IP matter
• Data recovered from “unallocated space” (notwithstanding
alleged destruction of accounting evidence)
• Alleged 1993 corporate documents were found to be
created in 2007
• Harassment matter involved recover of fragments of data
that was deleted and wiped

44. #aicpafvc
Summary – Current Fraud Schemes
Forged international bank transfer scam – involving BVI,
France and Hong Kong
Penny Stock Scheme – fraudsters controlling ‘worthless’
publicly traded co’s and pumping up stock
Life settlement insurance – BVI fund set up to purchase
life settlement policies, never purchase policies
Obstacles to recover includes legal (procedural),
informal and financial and political obstacles
Asset recovery involves instigating, starting the
investigation, locating, freezing, seizing and repatriating
funds

45. #aicpafvc
Summary – Dismissals
Can be dismissed ‘with cause’ (no further obligation)
and ‘without’ (consider entitlement) – no ‘middle’
Cause – prove alleged misconduct took place and
nature/degree of misconduct warranted dismissal
The Contextual Approach – i.e. looking beyond the
alleged misconduct
Investigation must be fair and objective – employee has
opportunity to respond
Case: Vernon v. British Columbia (M. of Housing)–
resulted in significant damages to ‘harassing’ employee
due to apparent bias of investigation

46. #aicpafvc
Summary – Evaluating Forensic Accountants
Qualifications as Expert Witnesses
Transcript from your deposition could result in your
testimony being excluded or limited (including possible
impeachment)
Focus will be industry and engagement experience
Attacking various aspects of forensic accountant’
methodology
Looking for potential ‘bias’
Common mistakes during deposition include not being
prepared, being “boxed in” and not acknowledging
when you simply “don’t know”

47. #aicpafvc
Thank you for your attention!
QUESTIONS?

48. #aicpafvc
Jordan Bolton
Clark Hill
151 S. Old Woodward
Suite 200
Birmingham, MI 48009
jbolton@clarkhill.com
Stuart Rudner
Rudner MacDonald LLP
First Canadian Place
100 King Street West
Suite 5600
Toronto, Ontario M5X 1C9
srudner@rudnermacdonald.com
Contact Information
Rick Rein
Horwood Marcus &
Berk Chartered
500 West Madison Street
Suite 3700
Chicago, IL 60661
rrein@hmblaw.com
Edward Nagel
nagel + associates
First Canadian Place
100 King Street West
Suite 5700
Toronto, Ontario M5X 1C7
edward@nagel-forensics.com
Brad Sargent
The Sargent Consulting Group, LLC.
9550 Bormet Drive
Suite 204
Mokena, IL 60448
bsargent@scgforensics.com
Steve Rogers
Digital Evidence International Inc.
400 Queens Ave
London, Ontario
steve.rogers@dei.ca