CFE Exam Quiz 14

If a suspect is inadvertently informed of an investigation, a number of different adverse events might occur. For instance, the fraudster might attempt to destroy or alter evidence, making it more difficult to conduct the investigation. Additionally, a forewarned suspect might attempt to flee, cut off contact with associates, or try to place the blame on somebody else.

Here are some basic measures organizations and fraud examiners can take to avoid notifying suspected perpetrators who are under investigation:
1. Know who is being investigated and what they can access.
2. Limit the extent of any discussions.
3. Only inform those who need to know.
4. Inform employees of the consequences of a confidentiality breach.
5. Work discreetly without disrupting the office’s normal course of business so that employees do not know that an investigation is being performed.
6. Work fast.
7. Investigate during nonbusiness hours.

To preserve the confidentiality of an investigation, management might (if legally permissible) remind participants to refrain from discussing investigation information with anyone or require participants to sign a confidentiality oath vowing not to divulge any information regarding the investigation. Generally, an employer can ask employees to keep an investigation confidential when there are legitimate business justifications for making such requests.

The NLRB provided the following suggestions for cases that would justify a legitimate business justification:
1. Witnesses needed protection.
2. Evidence was in danger of being destroyed.
3. Testimony was in danger of being fabricated.
4. There was a need to prevent a cover-up.

To help preserve confidentiality, the investigation team members should guard case information. Here are some recommended procedures for protecting case information:
1. Store all confidential documents in locked file cabinets or rooms accessible only to those who have a need to know.
2. Protect all electronic information via firewalls, encryption, and passwords.
3. Clear desks of any case information before stepping away.
4. Lock computers when leaving workstations.
5. Mark all case information, whether tangible or electronic, as confidential.
6. Avoid talking about the investigation in public or in any place where other employees could hear the communications.
7. Avoid using email or other electronic means (e.g., text messages or instant messages) to transmit confidential case information.

It is important to remember that witnesses (those who testify at trial) are more important to a fraud case than documents. While
documents are important in giving a witness and the case credibility, witnesses who spend too much time focusing on a document’s details often confuse and bore the fact finders.

Information can sourced for internally or externally.
Internal sources—those generated and kept within the subject organization—are often the only resource for certain types of documents, such as accounting and business tax records, copies of canceled checks, or employee personnel files, unless the fraud examiner has the subject’s consent or a legal order to obtain those documents from other parties.
External sources can be particularly crucial in helping investigators locate missing assets; locate witnesses and suspects; determine ownership in vendors, competitors, and other related parties; research the suspects’ assets and financial condition; and document the suspects’ lifestyle and background information.

Public records are documents that a governmental agency is required to keep by law or that are necessary to discharge the duties imposed by law. Of course, not all government records are open to the public, and the fact that a document is a public record does not mean it can be accessed without restriction.
Public records are different from publicly available information. Publicly available information is information that has lawfully been published or broadcast to the public for consumption.

Much of the basic information about an individual can be found in audit documents, business records, personnel records, court records, the Internet, and conversations with people who know the subject.

When conducting a public records search of a business, the fraud examiner should consider the following:
1. Is the business incorporated?
2. Where does the company do business?
3. What type of business is it?
4. Has the business sued or been sued?
5. Does the business have real property?
6. Does the company finance equipment?
7. Does the company charge sales tax (if applicable in the jurisdiction)?
8. Is the organization required to make filings that are available to the public?
9. How long has the company been in business?

Nonpublic records are information about a person or business that is considered to be private and confidential. Some of the most valuable types of nonpublic records include:
1. Banking records
2. Tax records
3. Credit records of individuals (but not business credit reports, as this information is generally not protected)
4. Phone records
5. Credit card account records
6. Personal health care records

The following are local sources of records:
1. Building inspector records
2. Building permit records
3. Health and fire department records
4. Birth and death records
5. Public school records
6. Coroner’s register
7. Voter registration records
8. Utility records
9. Marriage records

Courts keep records of civil cases, which are noncriminal legal proceedings involving two or more parties, and many civil records are publicly available to search. Civil courts often maintain various types of records relating to civil cases, such as liens, name changes, and divorces.

Financial lawsuits are those that involve financial law. The records of such suits might contain information on the defending litigant’s debtors and creditors, business history, or ability to perform its obligations under a contract.

Criminal records can be very valuable, but their availability varies considerably between jurisdictions. In many jurisdictions, most or all criminal records are not available to the general public.
Criminal courts will maintain records of criminal filings and criminal convictions, but these types of records should not be confused with each other. Criminal filings are the records of criminal actions the government files against individuals, and therefore, there might be criminal filing records for an individual even if the person was not found guilty of a crime. Criminal conviction records, however, only include records of a final judgment of guilt for a criminal offense.

Disguise is the conscious, intentional effort to change or conceal one’s normal writings. Distortions are unintentional changes to a person’s writings that are beyond the range of natural variation.

Most attempts at disguise involve one or more of the following: change in slant, change in size, change in shapes of capital (uppercase) letters, changes in the shapes and sizes of loops in letters that contain them, use of peculiar letter designs, or block (squared) hand printing.

An autoforgery is a true-name signature by an individual who intends to deny that signature at a later time. Generally, autoforgeries are prepared in a distorted or disguised fashion. This attempt at fraud has occurred in falsely reported traveler’s check theft cases, in cases involving disputed home mortgage and other loan documents, credit card frauds, and others.

There are three basic outcomes of forensic handwriting comparisons:
1. Non-Identification: The suspected person did not write the signature or other writings on the questioned document.
2. Identification: The suspected person did write the signature or other writings on the questioned document.
3. Inconclusive: No definite determinations were possible as to whether the suspected person did or did not write the signature or other writings on the questioned document.
forensic document examiner cannot conduct a handwriting examination to determine with accuracy the writer’s age, sex, race, physical or mental condition, personality, character, or which hand the writer used.

Non-dictated writing samples include materials that are written by the individual during the everyday course of business. This type of writing tends to reveal the individual’s normal writing habits.

Dictated writing samples are those that are written at the request, and usually in the presence, of the fraud examiner.

Because expert handwriting identifications can truly prove the case, adequate pre-interview preparation by the fraud examiner is essential. At the time of the interview session, the fraud examiner should have all of the proper writing materials and should have the original or copies of the evidence documents to serve as a guide for dictating the sample text.
Here are a few tips for conducting this type of interview:
1. Do not rush through the interview.
2. Take as much time as necessary.
3. Take short comfort breaks if the suspect tires.
4. Do not allow the suspect to see the evidence documents before or during the process of taking the samples.

A photocopy is a paper copy of a document or other visual image.

It is also possible to identify the particular machine used by examining the pattern of unique and identifiable “trash marks.” Trash marks are uniquely identifiable markings on copies (e.g., specks, spots, streaks, or edge markings).

Occasionally, documents are backdated to make them appear as though they were created at an earlier date. More specifically, backdating is the process whereby an individual posts a date on a document at a time earlier than the document’s actual creation date for purposes of deception.

Alibi documents suddenly appear “from out of nowhere,” and they often appear late in the course of an investigation, inquiry, or trial. They are always favorable to the suspect and refute previously developed information or evidence that is damaging to the suspect. Often, alibi documents are fabricated.

There are four steps that fraud examiners should follow when taking photocopier samples.

There are four steps that fraud examiners should follow when taking photocopier samples. First, make six “blank” copies by leaving the glass document surface empty and closing the lid. Second, place a ruler or other calibrated measuring device on the glass document surface of the photocopier, close the cover, and make six copies. Third, place a sample document containing both typewritten and handwritten text on the glass document surface in the standard position, close the document cover, and again print six copies, initialing and numbering as previously directed. Finally, place all of the sample copies and sample documents into a large sturdy paper or cardboard envelope or folder (do not use a plastic envelope).

The second step in taking a copier sample involves placing a ruler or other calibrated measuring device on the glass document surface of the photocopier, closing the cover, and making six copies. These copies allow an expert to determine the standard amount of reduction or enlargement the machine makes when in the actual size or one-to-one mode.

Anachronisms are items located at a time when they could not have existed or occurred.