CFE Exam Quiz 16

To establish litigation hold procedures, management should:
1. Identify the scope of litigation hold procedures (i.e., the locations that the litigation hold
procedures will cover).
2. Examine how information moves through the organization.
3. Determine how to identify relevant documents.
4. Develop a process to ensure such information is preserved.

The report log should include information on the following items:
1. How the organization became aware of the suspected fraud, including the name of any
complaining party
2. The date the issue was raised or reported
3. The nature of the suspected fraud
4. Department or divisions involved
5. Suspect employees or parties
6. Actions taken

When a suspicion or allegation of fraud comes up, management is required to respond quickly. Failure to do so could result in litigation, enhanced penalties, and enforcement actions by government regulators.

But generally, when evidence of fraud arises, management should respond by engaging in the following actions:
1. Activate the response team.
2. Engage legal counsel, if necessary.
3. Consider contacting the insurance providers.
4. Address immediate concerns.
5. Conduct an initial assessment.
6. Document the initial response.

In a fraud investigation context, the term documents typically refers to, but is not limited to, contracts, invoices, correspondence, memoranda, weekly reports, presentations, telephone messages, emails, reports, performance reviews, performance improvement plans, medical records, and other written or recorded material.

The response team and management must take action to preserve evidence as soon as the decision to investigate is made. This can be achieved by:
1. Issuing a litigation hold to notify employees to suspend destruction of potentially relevant document.
2. Temporary suspension of the organization’s record retention policy to avoid evidence accidentally being destroyed.
3. Restriction of access to emails or digital files that employees might want to conceal or destroy.

Spoliation is defined as “the intentional or negligent destruction or alteration of documents relevant to litigation.”

When investigating fraud, management and the response team should identify whom to inform. This however, depends on the facts of the case and it is best to involve a team rather than leave the tedious task of investigation to an individual unit.
When responding to an allegation of fraud, it is important to consider the interests of each of the departments involved to ensure that designated employees are notified immediately and to enable a prompt response. Information about incidences, however, should be shared only on a need-to-know basis.

An initial assessment should be quick and, unless complications arise, completed within a few days. Ideally, action should be taken within three days of learning about an incident.

The initial assessment should be a limited fact-finding analysis focused on the specific allegation or incident. It does not require an investigation plan or report, unlike a formal investigation. Thus, the initial assessment should seek to:
1. Determine if fraud occurred.
2. Identify the status of the fraud (e.g., When did it begin? Was it internal or external? Is it still occurring? If it is no longer occurring, when did it stop?).
3. Identify potential claims and offenses.

Those involved in the initial assessment must review any applicable internal controls and organizational policies, including any anti-fraud auditing and testing policies and procedures, to determine the best method and processes for continuing the investigation.

The investigation portion of the initial assessment involves:
1. Contacting the source, if the investigation was triggered by a report or complaint
2. Interviewing key individuals
3. Reviewing key evidence

When interviewing the source during an initial assessment, the interviewer should seek to determine whether there is any reason to suspect the complainant’s credibility. Also, if there are any weaknesses in the complainant’s information, the interviewer should ask the complainant to explain what he expects the subject would say in defense of the allegations and ask the complainant to explain why such a response is not sufficient to dispose of the matter. Additionally, the interviewer should ask the source what he wants the organization to do about the complaint.
Witnesses should be interviewed as early as possible because it limits the harm arising from loss of memory, witnesses becoming unavailable, and inadvertent loss or destruction of key evidence.

As soon as it is determined that an allegation will be investigated, those responsible must begin the formal investigation. The steps involved in this process are listed below:
1. Completing engagement letters or contracts
2. Issuing advisory letters
3. Assembling the fraud team
4. Learning about the organization at issue
5. Developing an investigation plan

Engagement letters are also called retainer agreements or contracts. They state the terms of the specific task.

Engagement letters or retainer agreements are beneficial for various reasons. Firstly,they maximize a fraud examiner’s protection in the event of a client dispute or misunderstanding, making later disputes about the engagement’s terms easier to resolve. Also, they help manage client expectations by making the assignment’s objectives clear.

There are two primary forms of engagement letters: the long form and the short form. The long form gives details of the examination technique to be used, while the short form does not.

Engagement letters should be written with certain standards in mind, and they should address a variety of items; including: the client’s identity, the scope of the services, the timing of the work, deliverables, payment terms and fee structure, communication with the client, governing law, jurisdiction, termination and a limitation of liability through indemnity clause.
There are two primary forms of engagement letters: the long form, which spells out the details of what examination techniques the fraud examiner intends to follow, and the short form.
Although formal written engagement letters are preferable, they are not always practical.

The short form engagement letter outlines the general scope of the engagement. It is best for work that requires an opinion on the fraud allegation.

There should be an indemnity clause in every letter of engagement. This serves to protect the fraud examiner if the client is sued and the examiner is included as a party to the suit. The clause should not be boilerplate; it should be tailored to fit the particular terms of the engagement. The indemnity must be broad enough to cover the fraud examiner’s legal expenses, provide for independent counsel, and protect the fraud examiner from liability in case of an adverse finding, and it should also provide for the cost of time and expenses of the fraud examiner at the fraud examiner’s usual hourly rate.

The don’ts for selecting team members include:
1. Don’t select team members based on friendship.
2. Don’t select team members to repay a favor.
3. Don’t select team members with negative attitudes.
4. Don’t overlook team members with untraditional knowledge that can contribute to the investigation (e.g., people with experience in a particular industry).
5. Don’t select members who might have personality conflicts with other members.
6. Don’t select members with a vested personal or corporate interest in the matter.
7. Don’t select members with a close personal or professional relationship with the subject or the complainant.
8. Don’t select members who lack restraint and a sense of discretion.

When tasked with conducting a fraud examination involving an organization, the team must become familiar with (if it isn’t already) the organization, its industry, its competition, its market share, its financing structure, its vendors (suppliers), its customers, its methods of receipts (i.e., cash or on account) and disbursements, its procurement methods, its economic climate, its recordkeeping system, it s policies and procedures, its organization chart and job responsibilities of key employees, and other matters that might be relevant to a fraud examination.

Once it is determined that an allegation or issue will be investigated, those responsible should develop an investigation plan. Each member of the team should be involved in the planning process. This increases the likelihood that everyone will accept the plan. Planning is not a one time event; it is an ongoing process that requires constant attention, and the team must refine their plan as the facts and client’s (or employer’s) needs change. Each fraud investigation is different, and no single plan can cover every situation.

When developing an investigation plan, those responsible should:
1. Review what is known and gain a basic understanding of key issues.
2. Define the goals of the investigation.
3. Identify whom to keep informed.
4. Determine the scope of the investigation.
5. Establish the investigation’s time frame.
6. Address the need for law enforcement assistance.
7. Define members’ roles and assign tasks.
8. Address operational issues.
9. Outline the course of action.
10. Adapt the necessary resources to conduct an investigation.
11. Prepare the organization for the investigation.

Typical questions to answer before beginning a fraud examination include:
1. What period is under review?
2. What is the time frame?
3. What is the nature of the suspected fraud?
4. Who are the targets?
5. Does the issue predate any of the key players?
6. What other entities, departments, or regions might be involved?
7. How long has the issue existed?
8. What is the culture of the industry or department at issue?

The basic goal for most fraud investigations is to determine whether fraud occurred, and if so, who perpetrated it. However, fraud investigations might be designed to achieve a number of different goals, such as to:
1. Prevent further loss or exposure to risk.
2. Determine whether there is any ongoing conduct of concern.
3. Establish and secure evidence necessary for criminal or disciplinary action.
4. Minimize and recover losses.
5. Review the reasons for the incident, investigate the measures taken to prevent a recurrence, and determine any action needed to strengthen future responses to fraud.

Factors to consider when determining whom should be kept informed include the severity of the incident under investigation, the suspect’s role in the organization, and the tasks that will be required to conduct the investigation.

To determine the scope, those responsible should use the following guidelines:
1. Consider the ultimate goals of the investigation.
2. Develop a list of key issues raised in the initial assessment.
3. Determine the level of discretion that is required.
4. Determine whether there are any constraints (e.g., time, resource, authority, procedural, legal, or practical).
5. Consider the quality of the organization’s anti-fraud program and policies.
6. Consider the organization’s actual culture of compliance.

It is important to determine whether there are constraints to an investigation (e.g., time, resource, authority, procedural, legal, or practical). Identifying these limitations helps ensure that the team can meet realistic objectives and develop alternative strategies.

When planning the investigation, the team must establish proper time parameters with start dates and due dates for tasks and deliverables. An established time frame helps the team provide a quick and appropriate response, which can help the subject organization avoid future legal disputes and minimize adverse impact on employee morale. In addition, time parameters help the team members structure their plans, providing information to help develop concrete, short-range actions to reach the investigation’s goals.