1. 9-1

2. 9-2 09 Fraud Examination Evidence I: Physical, Documentary, and Observational Evidence McGraw-Hill/Irwin Copyright © 2012 by The McGraw-Hill Companies, Inc. All rights reserved.

3. 9-3 Advanced Evidence Concepts As previously discussed, evidence from the point of view of an investigator is anything that relates to the truth or falsity of an assertion made in an investigation or legal proceeding; it includes physical objects, documents, observations, and interviews. In an investigation, “evidence” has absolutely no meaning at all unless it relates to some fraud theory. In a court room setting evidence is defined in terms of the courts’ rules of evidence, what is admissible in court, trial strategy, and how it is viewed by judges, juries, and attorneys. Courtroom lawyers may refer to physical, testimonial, documentary, and demonstrative evidence.

4. 9-4 Physical Evidence Physical Evidence is tangible Refers to a relative broad category of evidence that includes fingerprints and trace evidence. For example, physical evidence can include forged signatures on documents Physical evidence must not be contaminated

5. 9-5 Documents and Records Documents (including records in electronic format) are the most often used type of evidence in fraud investigations. Basic rules for documents: 1. Obtain original documents if possible (the credibility of a case is enhanced by having original documents). 2. Keep them in a secure location so that access is restricted. 3. Make copies of the original documents; use copies in the investigation, originals in court. 4. Handle originals as few times as possible; they might later be used for fingerprint analysis. 5. Maintain appropriate chain of custody records.

6. 9-6 The Application of Link Analysis to Document Evidence Link analysis is a process that allows information in various databases and files to be evaluated and integrated in such a way that associations become apparent. Various software programs are available for link analysis. The analysis can be used to point to suspects, locate hidden assets, or point to areas or issues that require additional investigation.

7. 9-7 Analytical Procedures When a suspected fraud is either, for example, an embezzlement or a misstatement of financial statements, the forensic accountant can use analytical procedures to gather evidence that can lead to the determination of who, what, when, and why regarding the fraud. Analytical procedures provide evidence of areas that are likely to contain fraud. The do not prove fraud. Analytical procedures can be used for both detection and investigation.

8. 9-8 Common Types of Analytical Procedures Five common types of analytical procedures: Comparison of financial data with prior period financial data Comparison of financial data with industry data Comparison of expected financial results with nonfinancial data Comparison of financial data with results expected by the entity itself Comparison of data with results expected by the forensic accountant (e.g., expected decline due to downturn in economy)

9. 9-9 Questioned Document Analysis – Suspicious Documents Examples of suspicious document symptoms: Signature appears to be contrived. Date on document is not consistent with other evidence. Paper does not seem to be the type usually used for the purpose. Document is a copy when original was expected. Erasures or a covering agent, such as a fluid correction cover- up, is present. If document is in electronic form, different styles or sizes of fonts were used. Document numbers appear to be out of sequence. Checks have second endorsements.

10. 9-10 Questioned Documents Documents that generate suspicions are called questioned documents Documents are questioned because their authorship or authenticity, or both, is in doubt Document examiners specialize in analyzing questioned documents. They may consider things such as handwriting, printer output, and ink and paper used in documents Altered documents may have either deletions or insertions, or both Document forgery is greatly facilitated by personal computers and desktop publishing software

11. 9-11 Observation Observation involves the use of the senses to assess the propriety of the behavior of persons and other activities such as business processes that have a tangible component. Three types of observational evidence: surveillance, invigilation, and co-worker testimony. Evidence provided through observation is often the most convincing and the easiest evidence for juries to understand.

12. 9-12 Choosing the Appropriate Evidence-Gathering Technique To choose the appropriate technique, the forensic accountant should consider the following factors: The type of fraud believed to have been perpetrated; The fact that the fraud is or is not ongoing; The extent of the fraud; The extent to which the investigation can be kept secret; The condition of the financial records, other source documents, and physical evidence; The sophistication of the suspect and whether collusion exists; The cost of applying a given method; The psychological and organizational impact of applying the given method; The objectives of the investigation.