1. Forensic and Investigative Accounting Chapter 9 Proper Evidence Management © 2013 CCH Incorporated. All Rights Reserved. 4025 W. Peterson Ave. Chicago, IL 60646-6085 800 248 3248 CCHGroup.com

2. Chapter 9Forensic and Investigative Accounting2 Rules of Evidence The rules of evidence are the rules governing the admissibility of evidence in a legal proceeding and the weight to be given to evidence that is admitted.

3. Chapter 9Forensic and Investigative Accounting3 What Is Evidence? Evidence is testimony, writings, and material objects offered to prove an alleged fact or proposition. Evidence is testimony, writings, and material objects offered to prove an alleged fact or proposition. Direct evidence is evidence that directly proves a fact at issue, without the need for any inference or presumption. Direct evidence is evidence that directly proves a fact at issue, without the need for any inference or presumption. Circumstantial evidence is evidence from which a fact at issue may be proved indirectly (e.g., Casey Anthony’s trial). Circumstantial evidence is evidence from which a fact at issue may be proved indirectly (e.g., Casey Anthony’s trial).

4. Chapter 9Forensic and Investigative Accounting4 Relevance Requirement Circumstantial evidence. Circumstantial evidence. Inflammatory evidence. Inflammatory evidence. Evidence about plaintiff’s character. Evidence about plaintiff’s character. Evidence of habit. Evidence of habit. Exclusionary rules. Exclusionary rules. Evidence of liability. Evidence of liability.

5. Chapter 9Forensic and Investigative Accounting5 Privileged Communications Attorney-client privilege. Attorney-client privilege. –Employee communications. –Work product rule. –Attorney-requested accounting work. Medical privilege. Medical privilege. Spousal privilege. Spousal privilege. Other types. Other types. –Religious. –Governmental.

6. Chapter 9Forensic and Investigative Accounting6 Hearsay Rule Hearsay is an oral or written assertion, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted. Hearsay is an oral or written assertion, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted. As a general rule, hearsay is not admissible as evidence in a legal proceeding (except by an expert witness). As a general rule, hearsay is not admissible as evidence in a legal proceeding (except by an expert witness). (continued on next slide)

7. Chapter 9Forensic and Investigative Accounting7 Hearsay Rule In some situations a statement that appears to be hearsay is offered to prove a fact other than the matter asserted: –Legally operative fact. –Effect on the listener. –State of mind of the declarant. –Impeachment. (continued on next slide)

8. Chapter 9Forensic and Investigative Accounting8 Hearsay Rule There are three concepts underlying the exceptions to the general rule barring hearsay: –Trustworthiness. –Unavailability of the declarant. –Practical considerations.

9. Chapter 9Forensic and Investigative Accounting9 Authentication Requirement To be admissible as evidence in a legal proceeding, a document or other material usually must be authenticated or identified as to what its proponent claims it to be.

10. Chapter 9Forensic and Investigative Accounting10 Best Evidence Rule Under the best evidence rule (also referred to as the original writing rule), to prove the contents of a writing, recording, or photograph, the original writing, recording, or photograph usually must be presented. Under the best evidence rule (also referred to as the original writing rule), to prove the contents of a writing, recording, or photograph, the original writing, recording, or photograph usually must be presented. Attorneys can get around this rule. Attorneys can get around this rule.

11. Chapter 9Forensic and Investigative Accounting11 Demonstrative Evidence Demonstrative evidence is an item that illustrates testimony but has no probative value in itself (such as a chart, diagram, photograph, video, or model).

12. Chapter 9Forensic and Investigative Accounting12 Special Rules Criminal cases. Criminal cases. Administrative proceedings. Administrative proceedings. –Tone of the proceedings. –Residuum rule.

13. Chapter 9Forensic and Investigative Accounting13 Residuum Rule The residuum rule is that no finding may be supported solely by hearsay evidence.

14. Chapter 9Forensic and Investigative Accounting14 Maximizing Client Confidentiality Michael Mostek, in Expert Witnessing in Forensic Accounting, provides the following advice for protecting the work product privilege: –The attorney should directly retain the consultant. –The agreement should be between attorney and expert. –The expert should obtain facts through, or at the direction of, the attorney. –The investigation should be done at the direction of the attorney. –The attorney should be present when the consultant first meets with the client.

15. Chapter 9Forensic and Investigative Accounting15 2013 TTI Top 10 Technology Initiatives, U. S. 1. Managing and retaining data 2. Securing the IT environment 3. Managing IT risks and compliance 4. Ensuring privacy 5. Managing system implementation 6. Preventing and responding to computer fraud 7. Enabling decision support and analytics 8. Governing and managing IT investment and spending 9. Leveraging emerging technologies 10. Managing vendors and service providers

16. Chapter 9Forensic and Investigative Accounting16 Using Technology to Gather Evidence Drill-down functionality. Drill-down functionality. Electronic imaging. Electronic imaging. Benford’s law. Benford’s law. Digital Analysis Tests and Statistics (DATAS). Digital Analysis Tests and Statistics (DATAS). Data warehousing/mining. Data warehousing/mining. Data extraction versus data investigation. Inductive vs. deductive method. Inductive vs. deductive method.

17. Chapter 9Forensic and Investigative Accounting17 Computer Evidence Protecting data in hardware seizures. Protecting data in hardware seizures. Insidious e-mails. Insidious e-mails. Documenting computer evidence. Documenting computer evidence.

18. Chapter 9Forensic and Investigative Accounting18 Evidence Management Do not mark, staple, or otherwise alter any documents or other evidence that might find its way into court. Do not mark, staple, or otherwise alter any documents or other evidence that might find its way into court. Record how the documents were obtained and who has handled it (chain of custody). Record how the documents were obtained and who has handled it (chain of custody). Use see-through holders to avoid putting fingerprints on documents. Use see-through holders to avoid putting fingerprints on documents. (continued on next slide)

19. Chapter 9Forensic and Investigative Accounting19 Evidence Management Store original documents and working papers in fireproof safes or locked cabinets. Store original documents and working papers in fireproof safes or locked cabinets. Protect material stored on a computer with a password. Protect material stored on a computer with a password. Make backup copies on a regular basis and store in a separate location. Make backup copies on a regular basis and store in a separate location. Copy, inventory, and index evidence so that it can be readily found when needed. Copy, inventory, and index evidence so that it can be readily found when needed.

20. Chapter 9Forensic and Investigative Accounting20 Questioned Documents Invoices and other documents may be fake or altered when: Font sizes or types are not consistent. Font sizes or types are not consistent. No address is shown for the vendor or customer; this situation is especially suspicious if a vendor has not identified an address to which a check can be sent. No address is shown for the vendor or customer; this situation is especially suspicious if a vendor has not identified an address to which a check can be sent. The document has no identifying numbers such as invoice number, purchase order number, or customer number. The document has no identifying numbers such as invoice number, purchase order number, or customer number. (continued on next slide)

21. Chapter 9Forensic and Investigative Accounting21 Questioned Documents All invoice numbers on invoices from vendors are numbered sequentially, with no numbers skipped. All invoice numbers on invoices from vendors are numbered sequentially, with no numbers skipped. No tax is shown for taxable items. No tax is shown for taxable items. No shipping or freight cost is shown for items that would have been shipped at the purchaser’s expense. No shipping or freight cost is shown for items that would have been shipped at the purchaser’s expense. Little or no detail is provided on the invoice or document. Little or no detail is provided on the invoice or document.

22. Chapter 9Forensic and Investigative Accounting22 Forensic Accounting Investigations “In today’s internal forensic accounting investigations, massive amounts of electronic data, transactional detail, electronic communications and historic reports comprise the full universe of information that is typically available to the forensic team to perform the fact finding and corresponding analysis of the investigation. Dealing with this enormous amount of data is time consuming, challenging and costly. However, when you add the complexity associated with a growing number of electronic data types, password cracking and restoration of information on historical media (e.g., backup tapes), the challenges of accessing the relevant information are even more difficult.” Source: Matthew Greenblatt and Stephen O’Mally, “Inside an Internal Accounting Investigation,” New York Law Journal, May 29, 2007.

23. Chapter 9Forensic and Investigative Accounting23 Computer Online Forensic Extractor Forensic accountants may be able to make use of evidence obtained by law enforcement officers by a free Microsoft device called Computer Online Forensic Extractor (COFEE). The COFEE device is installed on a USB flash drive or other external disk drive to gather digital evidence. The digital forensic tool contains 150 commands that can dramatically reduce the time it takes to gather digital evidence by decrypting passwords and analyzing a computer’s Internet activity as well as data stored in the computer. The investigator does not have to seize the computer, which would involve disconnecting from the network, turning off the power, and possibly losing data. Essentially the investigator scans for evidence on site with a pre-configured COFEE device by inserting the USB device into the suspected computer.

24. Chapter 9Forensic and Investigative Accounting24 Other Digital Multifunctional Devices Forensic accountants can obtain evidence from other digital multifunctional devices (MFDs). For example, digital copiers store thousands of records in internal memory when documents are copied, printed, scanned, and faxed. Even when the individual walks away from the machine, the information remains in memory. Billions of pages of information also are stored on printers, copiers and facsimile. Forensic auditors should conduct an inventory of data storage devices that may contain appropriate evidence.