Forensic and Investigative Accounting
Chapter 9Proper Evidence Management 2013 CCH Incorporated. W. Peterson Ave.Chicago, IL 60646-6085800 248 3248CCHGroup.comRules of EvidenceThe rules of evidence are the rules governingthe admissibility of evidence in a legalproceeding and the weight to be given toevidence that is admitted.Chapter 9Forensic and Investigative Accounting2What Is Evidence?
W. Peterson Ave.Chicago, IL 60646-6085800 248 3248CCHGroup.comRules of EvidenceThe rules of evidence are the rules governingthe admissibility of evidence in a legalproceeding and the weight to be given toevidence that is admitted.Chapter 9Forensic and Investigative Accounting2What Is Evidence?
4025 W. Peterson Ave.Chicago, IL 60646-6085800 248 3248CCHGroup.comRules of EvidenceThe rules of evidence are the rules governingthe admissibility of evidence in a legalproceeding and the weight to be given toevidence that is admitted.Chapter 9Forensic and Investigative Accounting2What Is Evidence?Evidence is testimony, writings, andmaterial objects offered to prove an allegedfact or proposition. Direct evidence is evidence that directlyproves a fact at issue, without the need forany inference or presumption. Circumstantial evidence is evidence fromwhich a fact at issue may be provedindirectly (e.g., Casey Anthonys trial).Chapter 9Forensic and Investigative Accounting3Relevance RequirementCircumstantial evidence. Inflammatory evidence. Evidence about plaintiffs character. Evidence of habit. Exclusionary rules. Evidence of liability.Chapter 9Forensic and Investigative Accounting4Privileged CommunicationsAttorney-client privilege. Employee communications. Work product rule. Attorney-requested accounting work. Medical privilege. Spousal privilege. Other types. Religious. Governmental.Chapter 9Forensic and Investigative Accounting5Hearsay RuleHearsay is an oral or written assertion,other than one made by the declarantwhile testifying at the trial or hearing,offered in evidence to prove the truth ofthe matter asserted. As a general rule, hearsay is notadmissible as evidence in a legalproceeding (except by an expert witness).(continued on next slide)Chapter 9Forensic and Investigative Accounting6Hearsay RuleIn some situations a statement that appears tobe hearsay is offered to prove a fact other thanthe matter asserted: Legally operative fact. Effect on the listener. State of mind of the declarant. Impeachment.(continued on next slide)Chapter 9Forensic and Investigative Accounting7Hearsay RuleThere are three concepts underlying theexceptions to the general rule barring hearsay: Trustworthiness. Unavailability of the declarant. Practical considerations.Chapter 9Forensic and Investigative Accounting8Authentication RequirementTo be admissible as evidence in a legalproceeding, a document or other materialusually must be authenticated or identified asto what its proponent claims it to be.Chapter 9Forensic and Investigative Accounting9Best Evidence RuleUnder the best evidence rule (also referredto as the original writing rule), to prove thecontents of a writing, recording, orphotograph, the original writing, recording,or photograph usually must be presented. Attorneys can get around this rule.Chapter 9Forensic and Investigative Accounting10Demonstrative EvidenceDemonstrative evidence is an item thatillustrates testimony but has no probativevalue in itself (such as a chart, diagram,photograph, video, or model).Chapter 9Forensic and Investigative Accounting11Special RulesCriminal cases. Administrative proceedings. Tone of the proceedings. Residuum rule.Chapter 9Forensic and Investigative Accounting12Residuum RuleThe residuum rule is that no finding may besupported solely by hearsay evidence.Chapter 9Forensic and Investigative Accounting13Maximizing Client ConfidentialityMichael Mostek, in Expert Witnessing in ForensicAccounting, provides the following advice for protectingthe work product privilege: The attorney should directly retain the consultant. The agreement should be between attorney and expert. The expert should obtain facts through, or at thedirection of, the attorney. The investigation should be done at the direction of theattorney. The attorney should be present when the consultantfirst meets with the client.Chapter 9Forensic and Investigative Accounting142013 TTI Top 10Technology Initiatives, U. S.184.108.40.206.220.127.116.11.9.10.Managing and retaining dataSecuring the IT environmentManaging IT risks and complianceEnsuring privacyManaging system implementationPreventing and responding to computer fraudEnabling decision support and analyticsGoverning and managing IT investment and spendingLeveraging emerging technologiesManaging vendors and service providersChapter 9Forensic and Investigative Accounting15Using Technology to Gather EvidenceDrill-down functionality. Electronic imaging. Benfords law. Digital Analysis Tests and Statistics (DATAS). Data warehousing/mining. Data extraction versus data investigation. Inductive vs. deductive method.Chapter 9Forensic and Investigative Accounting16Computer EvidenceProtecting data in hardware seizures. Insidious e-mails. Documenting computer evidence.Chapter 9Forensic and Investigative Accounting17Evidence ManagementDo not mark, staple, or otherwise alter anydocuments or other evidence that might findits way into court. Record how the documents were obtainedand who has handled it (chain of custody). Use see-through holders to avoid puttingfingerprints on documents.(continued on next slide)Chapter 9Forensic and Investigative Accounting18Evidence ManagementStore original documents and workingpapers in fireproof safes or locked cabinets. Protect material stored on a computer with apassword. Make backup copies on a regular basis andstore in a separate location. Copy, inventory, and index evidence so thatit can be readily found when needed.Chapter 9Forensic and Investigative Accounting19Questioned DocumentsInvoices and other documents may be fake or alteredwhen: Font sizes or types are not consistent. No address is shown for the vendor or customer;this situation is especially suspicious if a vendorhas not identified an address to which a check canbe sent. The document has no identifying numbers such asinvoice number, purchase order number, orcustomer number.(continued on next slide)Chapter 9Forensic and Investigative Accounting20Questioned DocumentsAll invoice numbers on invoices fromvendors are numbered sequentially, with nonumbers skipped. No tax is shown for taxable items. No shipping or freight cost is shown foritems that would have been shipped at thepurchasers expense. Little or no detail is provided on the invoiceor document.Chapter 9Forensic and Investigative Accounting21Forensic Accounting InvestigationsIn todays internal forensic accounting investigations,massive amounts of electronic data, transactional detail,electronic communications and historic reports comprise the fulluniverse of information that is typically available to the forensicteam to perform the fact finding and corresponding analysis ofthe investigation.Dealing with this enormous amount of data is timeconsuming, challenging and costly. However, when you add thecomplexity associated with a growing number of electronic datatypes, password cracking and restoration of information onhistorical media (e.g., backup tapes), the challenges of accessingthe relevant information are even more difficult.Source: Matthew Greenblatt and Stephen OMally, Inside an Internal Accounting Investigation, NewYork Law Journal, May 29, 2007.Chapter 9Forensic and Investigative Accounting22Computer Online Forensic ExtractorForensic accountants may be able to make use of evidenceobtained by law enforcement officers by a free Microsoftdevice called Computer Online Forensic Extractor (COFEE).The COFEE device is installed on a USB flash drive or otherexternal disk drive to gather digital evidence. The digitalforensic tool contains 150 commands that can dramaticallyreduce the time it takes to gather digital evidence bydecrypting passwords and analyzing a computers Internetactivity as well as data stored in the computer. The investigatordoes not have to seize the computer, which would involvedisconnecting from the network, turning off the power, andpossibly losing data. Essentially the investigator scans forevidence on site with a pre-configured COFEE device byinserting the USB device into the suspected computer.Chapter 9Forensic and Investigative Accounting23Other Digital Multifunctional DevicesForensic accountants can obtain evidence from otherdigital multifunctional devices (MFDs). Forexample, digital copiers store thousands of records ininternal memory when documents are copied,printed, scanned, and faxed. Even when theindividual walks away from the machine, theinformation remains in memory. Billions of pages ofinformation also are stored on printers, copiers andfacsimile. Forensic auditors should conduct aninventory of data storage devices that may containappropriate evidence.Chapter 9Forensic and Investigative Accounting24..