in this issue - justice.gov · in this issue. may 2005 u ni ted s tates a tto rneys ' b ul let...

Financial Forensics II

Forensic Accounting: Counterterrorism Weaponry . . . . . . . . . . . . . . . . . . . 1By Darrell D. Dorrell and Gregory A. Gadawski

May 2005Volume 53Number 3

United StatesDepartment of JusticeExecutive Office for

United States AttorneysOffice of Legal Education

Washington, DC20535

Mary Beth BuchananDirector

Contributors’ opinions andstatements should not be

considered an endorsement byEOUSA for any policy, program,

or service.

The United States Attorneys’Bulletin is published pursuant to

28 CFR § 0.22(b).

The United States Attorneys’Bulletin is published bi-monthly

by the Executive Office for UnitedStates Attorneys, Office of Legal

Education, 1620 Pendleton Street,Columbia, South Carolina 29201.

Periodical postage paid atWashington, D.C. Postmaster:

Send address changes to Editor,United States Attorneys’ Bulletin,Office of Legal Education, 1620

Pendleton Street, Columbia, SouthCarolina 29201.

Managing EditorJim Donovan

Program ManagerNancy Bowman

Law ClerkCarolyn Perozzi

Internet Addresswww.usdoj.gov/usao/

reading_room/foiamanuals.html

Send article submissions toManaging Editor, United States

Attorneys’ Bulletin,National Advocacy Center,Office of Legal Educat ion,

1620 Pendleton Street,Columbia, SC 29201.

In This Issue

MAY 2005 UNITED STATES ATTORNEYS' BUL LET IN 1

Forensic Accounting:Counterterrorism WeaponryDarrell D. Dorrell, CPA/ABV, MBA, ASA,CVA, CMA, DABFA, CMCPresidentfinancialforensics®

Gregory A. Gadawski, CPA, CVA, CFEPrincipalfinancialforensics®

I. Introduction

This is the second of a two-part series thatdemonstrates how forensic accounting techniquesfortify the identification, analysis, investigationand prosecution of terrorist and terrorist-relatedorganizations. Note that the forensic accountingtechniques discussed apply to virtually all matterscontaining a money laundering and/or phantombusiness element such as white collar crime.

This knowledge grows in importance asterrorist money laundering migrates fromcharitable organizations into legitimate andillegitimate businesses to avoid the increasingscrutiny of AUSAs.

II. Terrorist needs

Certain conditions are necessary for a terroristto reside undetected in the United States. Theseconditions accommodate financial profiling muchlike behavioral profiling of serial killers. Theconditions and their detection via forensicaccounting are described in this article.

Effective employment of forensic accountingtools, in the financial profiling of terrorists,requires an acute grasp of the money flows thatterrorists rely upon. Forensic accounting tools canbe applied regardless of the source, disposition, oreven the nature of the money flow. The tools areequally effective among all types of flows,including electronic transfers, checking accounts,credit cards, debit cards, traveler's checks,

purchase and sale invoices, payroll records, lettersof credit, cash, and others.

The following discussion describes the natureof a terrorist's financial needs and outlines thelikely sources and disposition of the money heacquires.

A. The common thread: money

Even terrorists have basic needs that must bemet in order to execute their hideous schemes.These consist of, in descending order,physiological, communications, and mobilityneeds. Each of these basic needs requires moneyto fulfill.

Terrorists cannot effectively attack our societyunless they use our society's methods. Thesemethods typically leave financial trails that can betraced by forensic accounting back to theterrorists. Therefore, the better we understand howand where terrorists acquire and spend theirmoney, the more effective we will become indefeating their efforts.

B. Physiological needs

Every human must have air, water, and foodto survive. The human body can live about threeto five minutes without air, about eight dayswithout water, and about forty days without foodbefore death occurs. In order to survive, theterrorist must breathe, drink, and eat so that hisbody will function when called upon. Air does notrequire a purchase, but purchases of water andfood leave various trails of evidence. After thebasic physiological needs are met, the terroristalso needs shelter, clothing, and personal hygieneitems to avoid attracting undue attention.Acquisition of such items generates a trail ofevidence that can be traced by forensic accountinganalysis.

2 UNITED STATES ATTORNEYS' BUL LET IN MAY 2005

C. Communication needs

Communication needs are vital to a terroristfor three significant reasons. The most obviousreason is to coordinate with other terrorists in theexecution of their schemes. Second, since severalterrorists living together could attract attention,individual immersion in society is the mostpractical way to maintain a low profile. Therefore,periodic communication is necessary for planning.Finally, a less obvious need relates to a terrorist'spersona. Specifically, he requires continualreinforcement by and with others sympathetic tohis cause to insure that his commitment ismaintained and strengthened.

Installed landline phones require deposits,identification, and related trail indicators.Therefore, they are often avoided. Coin-operatedphones leave little evidence, but are inconvenient,provide little privacy, and leave a record ofactivities. Cellular phones can be purchased asthrowaway units that preclude tracing except atthe point of purchase and activation. Cellularphones have walkie-talkie and camera capabilitiesthat are valuable to terrorists because of theirmobility and multi-purpose functionality.

E-mail communications, typically in code, areoften used by terrorists since they are readilymade at many locations and they leave little trailevidence (except for the purchase of on-line time).E-mail also has limitations as it is not accessible atwill. Mail communication is cost-effective butslow and leaves more trail than the terroristdesires, such as fingerprints, DNA, routinginformation, timing indications, and related data.

D. Mobility needs

Mobility needs are vital to a terrorist for twosignificant reasons. First, mobility enables aterrorist to make himself a moving target which,by definition, is more difficult to track. Second, aterrorist needs mobility in order to execute plansagainst targets of opportunity. Travel modes rangefrom airline to public transportation. Automobileownership and related requirements, such as adriver's license, complicate a terrorist's mobilitysince acquisition and operation of vehiclesrequires documentation providing evidence ofactivities. Therefore, a terrorist will minimizehigh-trail modes such as airline travel andmaximize low-trail modes such as city bus routes.

E. Where did the 9/11 terrorists get andspend their money?

A summarized financial profile of thePentagon/Twin Towers financial investigationindicates that the nineteen 9/11 hijackers openedtwenty-four bank accounts at seven domesticbanks, and twelve international bank accounts.Their deposits and disbursements totaled$303,481 and $303,671 respectively, and arecategorized in Exhibits 1 and 2. ATF/FBI JointPresentation, "Money Laundering & theFinancing of Terrorism," American Institute ofCertified Public Accountants' Annual Fraud &Litigation Conference, Sept. 26-29, 2004.

It is significant that the majority of theirtransactions for money inflows and outflows werecomposed of cash. Note that Exhibit 1 indicatesthat 47% of the funds that the 9/11 terroristsreceived was in the form of cash. Exhibit 2illustrates that 42% of the terrorists' pre-9/11expenditures occurred in the form of cash.

None of the hijackers had a valid or issuedSocial Security Number (SSN). The hijackersused foreign passports/visas from Saudi Arabia,United Arab Emirates (UAE), Germany, Egypt,and Lebanon to open bank accounts. Most of thechecking accounts were opened with cash or cashequivalents (such as traveler's checks) in averageamounts of $3,000 to $5,000. Some hijackersopened joint accounts and all accounts wereaccessible with debit cards.

The 9/11 hijackers returned all unused moneyto the terrorist network immediately beforeexecuting the attacks. Marwan Al-Shehhi wired$5,400 from a Greyhound Station in Boston,Waleed Al-Shehri wired $5,215 from LoganAirport in Boston, and Mohamed Atta wired$2,860 and $5,000 from two Laurel, Marylandgrocery stores. Al-Shehhi and Al-Shehri sent theirfunds through the Al-Ansari Exchange and Attasent his funds through the Wall Street Exchange,United Arab Emirates (UAE).

In contrast, the alleged twentieth hijacker,Zacarias Moussaoui, obtained his funding directlyfrom the Al Qaeda network, while AhmedRessam, the M illennium bomber, obtained hisfunds through criminal activity.

F. Source of terrorist money

Generally, most terrorist money flows derive


from two primary sources: operating entities, legaland illegal, and individuals. In theory, legaloperating entities tend to have morecomprehensive and accessible record keepingsystems than illegal operating entities. Forensicaccounting tools, however, function regardless ofthe legality or extent of respective record keepingsystems. Perhaps a more important distinctionrelates to whether the sources are sympathetic orunsympathetic to terrorists' causes. A sympatheticsource is a party who supports the terrorist cause.An unsympathetic source could be an inner cityhomeless shelter that unwittingly meets aterrorist's survival needs. Forensic accountingtools and techniques function well regardless ofthe predisposition of the source or terminus offunds.

G. Critical success factors for terrorists

Based upon the preceding terrorist financialprofile, certain factors are critical to a terrorist'sexistence. The factors are highlighted below in adescending hierarchy of priority and serve asmarkers in support of forensic accountinganalysis.

First, terrorists must minimize the evidencetrail. Their day-to-day existence, spanning theirphysiological, communication and mobility needs,must be met in a low-profile manner thatminimizes evidence generation. In short, theyshould deal in cash as much as possible.

Second, when evidence generation isunavoidable they will use counterfeitidentification before using legitimate, but easy totrace identification. For example, airline travelthat requires identification may compel a terroristto use legitimate foreign identification sincecounterfeit identification may raise red flags.Naturally, counterfeit identification is time-sensitive since it is most effective when newlyobtained, before authorities have had a chance tobegin focusing on it.

Third, from the terrorists' point of view,engaging in criminal activities to generate funds isundesirable and should be avoided. Criminalactivities are avoided because such actions maydraw undue attention and potential disruption tothe terrorists' actions.

Fourth, terrorists will seek donations (money,goods, services) from parties sympathetic to theircause to minimize the generation of evidence.Cash receipts from sympathetic donors leavealmost no evidence trail. Receipt of goods andservices (such as food, shelter) from sympatheticdonors leaves very little evidence trail. Still, a trailcan be left from the donor source which, in turn,leads to the terrorist.

Fifth, money and/or goods and services canflow through sympathetic and/or unsympatheticparties consisting of operating entities and/orindividuals. Regardless of the source, suchactivities leave some evidence that can be traced,directly and/or indirectly.

Sixth, if sympathetic parties are not available,terrorists will extract resources through coercion,such as threatening family members residing inthe source's foreign country. Even this source mayleave a trail of activities when a comparison ofresource consumption (food, communications,shelter) indicates that the (unwilling) donor hasconsumed more resources than would otherwisebe expected.

Seventh, a terrorist will strive to continuallychange his patterns to avoid generation ofevidence and detection. Fortunately, human naturemakes change an inherently difficult task and thushelps ensure that a trail of evidence is continuallygenerated.

III. Financial statements—the sourcesof data

Virtually every business maintains some formof business activity record, whether for legitimateor illegitimate purposes. Therefore, even without astrong accounting system, internal controls, oreven honest management, transactional activitycan be used to construct financial statements thatrepresent even the most clandestine of operations.Consequently, if a source of terrorist fundingflows from an operating entity, e.g., a business,charitable organization, educational institution,governmental organization, or nongovernmentalorganization (NGO), forensic accounting toolsand techniques can be used in the analysis.


Even the most basic financial statements canyield telling indicators when skilled analysis isapplied to their composition. In order to provide astarting point for analysis, each of the basicfinancial statements found in a typical business isillustrated below, supported by examples andgenerally accepted accounting definitions, whichare offered for reference.

A. Financial statements

"A financial statement is any reportsummarizing the financial condition or financialresults of a person or organization on any date orfor any period. Financial statements include thebalance sheet and the income statement, andsometimes the statement of changes in financialposition," currently identified as the cash flowstatement. BLACK'S LAW DICTIONARY 631 (6thed. 1990). In most businesses, only a balancesheet and income statement will be available andthe cash flow statement must be constructed bythe forensic accountant.

B. Balance sheet

"The balance sheet, sometimes called thestatement of financial position, lists the company'sassets, liabilities, and stockholders' equity(including dollar amounts) as of a specificmoment in time." ROGER H. HERMANSON &JAMES DON EDWARDS, FINANCIAL ACCOUNTING:A BUSINESS PERSPECTIVE 20 (Irwin/McGraw-Hill1998).

"Assets are probable future economic benefitsobtained or controlled by a particular entity as aresult of past transactions or events." FINANCIAL

ACCOUNTING STANDARDS BOARD, CONCEPT

STATEMENT NO. 6, ELEMENTS OF FINANCIAL

STATEMENTS (1985). Assets are typicallycategorized into current, long-term, and otherclassifications, such as goodwill. Current assetsinclude cash, accounts receivable, inventory, andprepaid items, and are typically liquidated withinone year or less. Long-term assets include land,buildings, fixtures, and equipment and theirrelated accumulated depreciation. Long-termassets are expected to last longer than one yearand assets, such as goods, have an indefinite life.

"Liabilities are probable future sacrifices ofeconomic benefits arising from presentobligations of a particular entity to transfer assetsor provide services to other entities in the future

as a result of past transactions or events." Id.Current liabilities include accounts payable,accrued expenses, lines of credit, and currentportions of long-term debt and are typicallyliquidated within one year or less. Long-termliabilities include long-term debt and mortgagesand are expected to last longer than one year.Other liabilities are seldom identified since theycan consist of contingent liabilities such aspending lawsuits.

"Equity or net assets is the residual interest inthe assets of an entity that remains after deductingits liabilities." Id. If liabilities exceed assets, anegative equity results and the entity is technicallyinsolvent, depending upon other measures.

A hypothetical balance sheet for a businesswith attributes conducive to terrorist moneylaundering is shown at Exhibit 3. Exhibit 3highlights the major components of thehypothetical balance sheet and thus establishes thestarting point for financial analysis. A moreapparent view is obtained by converting the datainto a visual representation as illustrated atExhibit 4. Exhibit 4 shows the total assets, totalliabilities, and total equity contained in thebalance sheet.

A comparison technique known ascommon-sizing is provided in Exhibit 5 which, incombination with the preceding exhibits, enablesa forensic analyst to formulate observations of thekey items as indicated. Common-sizing consistsof converting all financial statement items to apercentage of assets and revenues for the balancesheet and income statement, respectively. Then,results are compared within and among oneanother over a multiperiod time horizon.

The common-sizing technique alsoaccommodates a comparison to similar businessesthat may be much larger or smaller than thesubject under analysis. Bar graphs and line chartsare useful to identify key variations warrantingfurther investigation.

The data illustrated also supports otherfinancial analysis methods such as vertical andhorizontal analysis. Vertical analysis compareseach key account category item within itsrespective fiscal period. Horizontal analysiscompares key account categories, such as officercompensation, travel, and entertainment over amultiperiod time horizon to identify changesmeriting further inquiry. The technique typically


includes percentage changes, dollar changes,comparison changes, and so forth.

The example balance sheet (Exhibit 3) andrelated visual and quantitative measures (Exhibits4 and 5) indicate steadily growing assets drivenprimarily by growing cash balances, growingfixed asset balances, and steady nonoperatingassets. The cash balances have resulted fromstable revenues (Exhibits 6 and 7) and stronggross profit performance (Exhibit 8) whileoperating expenses have remained stable (Exhibits6 and 8). Also, in comparison to the subjectcompany's peer group (not shown for ease ofillustration), the hypothetical balance sheet carriesless accounts receivable than its competitors butemploys substantially more fixed assets (Exhibits3 and 5). Finally, the total current liabilities areproportionately larger than its competitors but itslong-term debt is proportionally smaller than itscompetitors, resulting in lower total liabilities thanits competitors (Exhibits 3 and 5). Generally, suchindicators could point to money laundering sincecash balances and fixed assets are growing eventhough accounts receivable balances are small andstable. Consequently, further investigation iswarranted.

C. Income statement

The income statement, sometimes called anEarnings Statement or Profit and Loss (P&L)Statement, reports the profitability of a businessorganization for a stated period of time. Inaccounting, profitability is measured for a periodby comparing the revenues generated with theexpenses incurred to produce the revenues.HERMANSON, supra at 18. "Revenues are inflowsor other enhancements of assets of an entity orsettlements of its liabilities (or a combination ofboth) from delivering or producing goods,rendering services, or other activities thatconstitute the entity's ongoing major or centraloperations." Id.

Costs are sacrifices of assets that result in thegeneration of revenues. Costs in manufacturingoperations are comprised of materials, labor, andoverhead. Overhead is typically applied in somemanner related to the operations of the business,such as labor hours, labor dollars, machine time,

and other techniques. Costs in retail operations arecomprised of purchased merchandise.

"Expenses are period outflows or other usingup of assets or incurrence of liabilities (or acombination of both) from delivering goods,rendering services, or carrying out other activitiesthat constitute the entity's ongoing major orcentral operations." Id. They are typicallycategorized within classifications of sales, general,and administrative expenses.

A hypothetical income statement for abusiness with attributes conducive to terroristmoney laundering is presented as Exhibit 6. Thisexhibit highlights the major components of thehypothetical income statement and establishes thestarting point for forensic analysis in concert withthe balance sheet. A more obvious depiction isobtained by converting the data into a visualrepresentation as illustrated by Exhibit 7, whichshows the revenues and gross profit contained inthe income statement.

Finally, the common-sizing technique isprovided in Exhibit 8, which in combination withthe preceding exhibits, enables an analyst to makethe observations of the key items as indicated.

The example income statement and relatedvisual and quantitative measures indicategenerally that the hypothetical income statement'srevenue base has remained relatively flat since1999. The no-growth scenario results from thecompany's respective industry-related economicdownturn following the mid to late 1990s. Despitethe flat revenues, the gross profit margin hasremained healthy relative to its competitors, evenwith the 2003 decline. Consequently, the grossprofit margin peaked at 70.8% in 2001 andtroughed at 63.1% in 2003. Since this hypotheticalservice business (specialized freight-forwarding)operates in an industry notorious for aggressiveprice cutting, a relatively strong and stable grossprofit margin during flat revenues is a flagmeriting further investigation into moneylaundering.

D. Cash flow statement

The cash flow statement shows the cashinflows and cash outflows from operating,


investing, and financing activities. HERMANSON,supra at 20.

Operating activities include all transactionsand other events that are not defined asinvesting or financing activities. Operatingactivities generally involve producing anddelivering goods and providing services. Cashflows from operating activities are generallythe cash effects of transactions and otherevents that enter into the determination of netincome.

FINANCIAL ACCOUNTING STANDARDS BOARD,FINANCIAL ACCOUNTING STANDARD 95,STATEMENT OF CASH FLOWS (1987).

Investing activities include making andcollecting loans and acquiring and disposingof debt or equity instruments and property,plant, and equipment and other productiveassets, that is, assets held for or used in theproduction of goods or services by theenterprise (other than materials that are part ofthe enterprise's inventory).

Id.

"Financing activities include obtainingresources from owners and providing them with areturn on, and a return of, their investment;borrowing money and repaying amountsborrowed, or otherwise settling the obligation; andobtaining and paying for other resources obtainedfrom creditors on long-term credit." Id.

Note that the cash flow statement is perhapsthe single most powerful forensic accounting toolto deploy in money laundering investigations.Certain critical transactions will show up nowhereelse unless a cash flow statement is prepared, e.g.,cash distributions to/infusions from owners andoutside parties. Unfortunately, the cash flowstatement is very "young" relative to the balancesheet and income statement.

The balance sheet and income statements canbe traced to Luca Pacioli, a 15th centuryFranciscan Monk credited with formalizing thedouble-entry method of accounting in his 1494treatise, Summa de Arithmetica, Geometria,Proportioni et Proportionalita (Everything AboutArithmetic, Geometry and Proportion). It waswritten as a digest and guide to existingmathematical knowledge and bookkeeping wasonly one of five topics covered. The Summa'sthirty-six short chapters on bookkeeping entitledDe Computis et Scripturis (Of Reckonings and

Writings) were added in "order that the subjects ofthe most gracious Duke of Urbino may havecomplete instructions in the conduct of business,"and to "give the trader without delay informationas to his assets and liabilities." (All quotes fromthe translation by J.B. GEIJSBEEK, ANCIENT

DOUBLE ENTRY BOOKKEEPING: LUCAS PACIOLI'STREATISE (Published by the Author 1914)).

The cash flow statement was only recentlymandated by the Financial Accounting StandardsBoard (FASB) in 1987. Therefore, the 500 year-old familiarity of the balance sheet and incomestatement stand in stark contrast to the mereeighteen year tenure of the cash flow statement.Simply put, even skilled accountants often lack adeep understanding of the cash flow statement'spowerful capabilities and applications.

The cash flow statement is typically the mostdifficult statement for terrorist money launderersto manipulate since it begins and ends with cash.A hypothetical cash flow statement for a businesswith attributes conducive to terrorist moneylaundering is presented as Exhibit 9. This exhibitdetails the key components of the cash flowstatement and enhances the starting point foroperating analysis in concert with the balancesheet and income statement. Analysis is aided byconverting the data into a visual representation, asillustrated in Exhibit 10, which depicts theoperating, investing and financing flows containedwith the cash flow statement. Exhibit 11 focuseson the operating cash flows and highlights a keyforensic observation: operating cash flow isdeclining despite continual increases in cashbalances and fixed asset balances as contained inExhibits 3, 4 and 5. This condition merits furtherinvestigation.

IV. When financial statements containlaundered money

Certain types of businesses havecharacteristics that accommodate moneylaundering activities and they can be broadlycategorized into the sale of products and the saleof services. It makes little difference whether thebusiness is selling high-profit or low-profitproducts. Likewise, the products can be genuineor counterfeit.

There are four important businesscharacteristics that are conducive to moneylaundering for terrorist purposes.


• Businesses that sell consumer products.

• Businesses with a commodity-type demand.

• Businesses with low regulatory reportingrequirements.

• Businesses that deal in cash-basedtransactions.

These characteristics are common in the small-business culture of the United States' economy.

The types of businesses conducive to moneylaundering include clothing, cigarettes, perfumes,delicatessens, electronics, software, bakeries,restaurants, bars, bicycle repair, catering, andmany others. Cash from sympathetic sources canbe deposited along with the periodic deposits ofan otherwise legitimate business. Fortunately,certain forensic accounting analysis can readilyidentify the result of terrorist deposits.

A primary forensic accounting test thathighlights illicit deposits is known as the grossprofit margin comparison test. This test calculatesthe gross profit margin of the respective businessand compares it to two key benchmarks: its peergroup and itself over time. If anomalies areidentified, then further investigation can beinitiated. The following graphs illustrate theannual gross profit margin for a hypotheticalMiddle East bakery.

Exhibit 12 measures the bakery's gross profitmargin expressed as a percentage (grossprofit/sales) against its peer group and itself(history) for the years 1998 through 2003. Exhibit12 demonstrates that the bakery's gross profitmargin exceeds the industry's gross profit margin,and likewise increased in the early years. The peergroup data can be obtained from various sourcesor can be constructed on an ad hoc basis to serveas a benchmark. The percentage change in grossprofit margin analysis shown in Exhibit 12illustrates the significant change in gross profitmargin coincident with and following the eventsof 9/11.

Exhibit 13 illustrates a more dramaticcomparison resulting from applying thepercentage change on a year-to-year basis. Exhibit13 measures each individual year's increase ordecline in gross margin as a percentage change

([2003 gross profit margin - 2002 gross profitmargin]/2002 gross profit margin).

The gross profit margin comparison test isbased upon laundered monies flowing through abusiness to the owners of the business, who thenpresumably direct the funds to their respectiveterrorist sources. The same test is used todetermine when the business may have been usedto direct the funds to terrorists. Example: whenbogus payments are made to so-called vendors formerchandise, such as flour, that was neverdelivered to the bakery.

Exhibit 14 measures a different Middle Eastbakery's gross profit margin expressed as apercentage (gross profit/sales) against its peergroup and itself (history) for the years 1998through 2003. In this scenario, the bakery's grossprofit margin fell below the industry's gross profitmargin, and likewise decreased in the early years.Such a decrease in gross profit margin indicatesthat either revenues are not being reported or costsmay be diverted to other purposes besides creatingrevenues. Either way, it is a tell-tale flag requiringdeeper inquiry.

Exhibit 15 dramatizes the comparison set outin Exhibit 14 by showing the percentage changeon a year-to-year basis.

Note that exhibits 13 and 15 illustrate the twodifferent sides of the same coin. That is, Exhibit13 illustrates a dramatic one-time (2001) increasein gross profit margin when compared to its ownhistory and its peer group. A logical explanation isthat more revenues flowed through the entity thancould be explained by normal businessfluctuation—a potential money laundering flag.Exhibit 15 illustrates a dramatic one-time increase(2002) with a corresponding decrease (2001) thatcould flag timing differences in revenues and/orcosts. Both exhibits demonstrate cause for furtherinvestigation into money laundering.

As indicated by the preceding schedules, evensimple tests such as the gross profit marginanalysis comparison can identify and illustratesymptomatic indicators of money laundering forterrorist purposes.


V. When no records have beenprepared by the terrorists

In virtually all cases, terrorists do not haveany formalized records that could be used againstthem. However, transaction-generated evidencesuch as food purchases provides a rich collectionof data which can be aggregated by forensicaccounting analysis. The data will then beanalyzed and used to form both direct and indirectconclusions regarding its nature. The types offorensic accounting analysis most likely applied inthis scenario will consist of indirect methods suchas the Modified Net Worth Method, and directmethods such as the expenditures statement.

A. The Modified Net Worth Method

The Modified Net Worth Method derivesfrom the Net Worth Method long employed by theInternal Revenue Service (IRS). The mosthigh-profile application of the Net Worth Methodwas used by Department of Treasury officials tohelp convict Alphonse "Al" Capone in Capone v.United States, 51 F.2d 609 (1931). Its acceptanceby the courts has been well documented over theyears.

In order to remove the complexities of incometax law, the Net Worth Method was modified andpopularized in 1974 as the Modified Net WorthMethod by Mr. Richard A. Nossen, a former IRSSpecial Agent. R ICHARD A. NOSSEN & JOAN W.NORVELL, THE DETECTION, INVESTIGATION, AND

PROSECUTION OF FINANCIAL CRIMES (ThothBooks, 2d ed. 1993). This technique is effective indemonstrating a terrorist's apparent income bydetermining the increase in his wealth, by derivingthe year-to-year change in his overall net worth.Consequently, it can be shown that the terroristspent more than he had available from known,reported, or legitimate sources.

For many years the courts have accepted thismethod to infer, as admissible circumstantialevidence, that any excess of expenditures wasmade with funds from unknown and/orillegitimate sources. Generally, the Modified NetWorth Method compares a year-end net worthestimate with a year-end net worth estimate fromthe preceding year, identifying an increase. Nextliving expenses are added to that amount andincome from known sources is deducted from thesubtotal. The residual identifies the expenditures

in excess of known sources of funds. The generalformat is depicted in Exhibit 16.

The Modified Net Worth Method is readilyassembled from widely disparate evidence andrecords. Ordinarily the method is categorized byyear, but it can also cover unusual time horizonsto match pertinent statutory periods.

Exhibit 17 illustrates how the Modified NetWorth Method is used to demonstrate that theterrorist had unreported funds in this hypotheticalexample. The respective lines are individuallydescribed following the schedule.

B. The Source and Use of Cash Method

The Modified Net Worth Method can beuseful when a terrorist acquires big-ticket itemssuch as real estate, stocks and bonds, and tangibleassets in general. Alternatively, a terrorist living alow-profile, transient existence would require adifferent analytical technique such as the Sourceand Use of Cash Method.

The Source and Use of Cash Method listseach identified source and use of cash (or otherfunds) by category for the respective years underanalysis. As in the Modified Net Worth Method,the years can be constructed for annual or otherperiods. The results of each method are exactlythe same and sometimes the two techniques areused in combination to corroborate findings. Ahypothetical Source and Use of Cash Method isillustrated in Exhibit 18.

Exhibit 18 reflects the sources of cashattributed to the terrorist based upon the variousrecords collected and seized in a raid by federalagents. Line 12 reflects the terrorist’s estimatedliving expenses for the respective period asderived by adjusted third-party informationsources such as the Consumer Expenditure Survey(CES) available at http://www.bls.gov/cex/home.htm. Since records were unavailable forliving expenses (except in very scatteredinstances) and he refused to cooperate bydescribing his living patterns, the CES data wasapplied. Line 13 reflects the total expenditures foreach respective year. Line 14 reflects thedifference between the terrorist’s expenditures andhis claimed earnings, thus inferring that he hassignificant unknown and unreported sources ofincome. The total column aggregates the years tovalidate that the totals compare ($168,162).


Certain observations between Exhibits 17 and18 are significant. First, note that the results of theanalysis are exactly the same for both methods($168,162). Since the data used for each methodderives from the same source, no differenceshould result if the methods are properly executed.Second, despite disparate time periods (one thirty-two-month period for the Modified Net WorthMethod, and four-odd years for the Source andUse of Cash Method), the results of the analysisare exactly the same for both methods,($168,162). Finally, note the Unknown section inExhibit 18, which indicates that yearlycategorization was simply not possible for manyitems, and not even required in aggregate.

VI. Summary of forensic accountingobservations

Based upon the likely nature of terroristactivities, certain highlights regarding forensicaccounting tools are summarized below.

A. Overall approach

Generally, the approach to forensicaccounting analysis should be initiated withindirect methods that accommodate anexploratory manner so that scarce resources canbe most effectively employed. That is, indirectmethods can identify those areas offering promisein a manner comparable to exploratory surgery.After the promising areas are identified, directmethods can be employed.

B. Operating entities

Operating entities that provide financialstatements, or for which financial statements havebeen prepared by the forensic analyst, exhibitcertain key characteristics as follows.

A comparison of operating cash flow shouldbe made to reported net income. Logically,operating cash flow should lag reported netincome due to the accrual nature of GenerallyAccepted Accounting Principles (GAAP).Manipulated financial statements will exhibitoperating cash flow that trends differently fromreported net income.

Put another way, financial statements thatcomply with GAAP are prepared on an accrual,versus cash basis. Accrual-based financials reportrevenue and expenses as they are earned orincurred, whether or not they have been receivedor paid. Cash-basis financials, which, bydefinition do not comply with GAAP, reportrevenue and expenses only when cash is actuallyreceived or paid out. Accrual-based financialstatements are the antithesis of cash-basedfinancial statements.

Consequently, accrual-basis financials reportnet income before the commensurate cash isactually received. Logically, legitimate accrualbased-financials will then show the statement ofcash flow results lagging the income statementresults. An obvious example is Enron, whichreported enormous amounts of net income withrelatively flat operating cash flow. Such anomalyis a clear flag for forensic accountants.

A sustainable growth rate should becalculated based upon reported net income andcompared to actual growth. In manipulatedfinancial statements, the actual growth rate willexceed the sustainable rate since illegitimate fundsare flowing through the operation. Estimation ofthe sustainable growth rate can be achieved byapplying the sustainable-growth model. IBBOTSON

ASSOCIATES, STOCKS, BONDS, BILLS AND

INFLATION, VALUATION EDITION 2002 YEARBOOK

62 (2002). This model relies on two accountingconcepts: return on equity and the plow-backratio. The equation follows:

Gs = Bs X ROE

Gs = sustainable growth rate for a company,

Bs= plow-back ratio calculated as follows:

(Annual Earnings - Annual Dividends)/AnnualEarnings; and

ROE = return on book equity as follows:

Annual Earnings/Book Value of Equity.

Use of independent parallel indicators canidentify reporting anomalies. For example, incharitable organizations the developmentdepartment, or equivalent, typically maintains adonor log, independent of management.Comparison of the logs' entries to the reported


donations can identify undesirable donors thatrequire additional investigation.

More specifically, donor logs identify theparties responsible for individual sources ofdonation, i.e., cash, checks, credit cards, services,and others. Therefore, the logs can be compared inaggregate and individually to the financialreporting system to identify discrepancies, whichcan flag transactions meriting additional inquiry.Red flags might include the following:

• Mixing of disparate types of deposits such ascombining cash, third-party checks, wiretransfers, traveler's checks, and related itemsin a single deposit transaction.

• Large withdrawals from a business accountnot ordinarily associated with cashtransactions.

C. Individual targets

Individual targets often exhibit behaviors thatleave evidence, like those listed below, that canidentify terrorist actions.

• Postal mailings can indicate shipments of cashoutside the United States. Under currentUnited States Postal Service (USPS)regulations, a letter-class mail parcel canweigh up to four pounds when mailedinternationally, and up to sixty pounds whenmailed to Canada. A single, four-poundletter-class parcel can accommodate about$180,000 in $100 bills while a sixty-poundletter-class parcel can handle about$2,700,000 in $100 bills.

• Deposits that are followed shortly by wiretransfer of funds.

• Beneficiaries of mailings and transfers thatreside in a problematic foreign jurisdiction.

• Lifestyles inconsistent with statedemployment streams, such as irregular workhabits, without commensurate financialchallenges.

• Involvement with multiple individuals fromthe same country, some of whom exhibit thepreceding characteristics.

• Inordinate or regular cell phone conversationsand no installed landline.

VII. A forensic accounting methodologyto support counterterrorism

Forensic accounting analysis in support ofcounterterrorism efforts must be conducted in amethodical manner consistent with the highstandards of federal law enforcement. Therefore, aproposed forensic accounting methodology isdescribed that meets such requirements. Themethodology is perhaps the only one in place inthe United States today that combines the criminalinvestigation process with forensic accountingmethods and techniques.

The criminal investigative process employedis the seven step method popularized by RichardNossen and is still taught to federal lawenforcement agencies. The forensic accountingmethods are those generally accepted techniquesthat support both civil and criminal expert witnessanalysis. R ICHARD A. NOSSEN & JOAN W.NORVELL, THE DETECTION, INVESTIGATION AND

PROSECUTION OF FINANCIAL CRIMES (2d ed.Thoth Books 1993).

A. Objectives of the methodology

There are seven primary objectives intendedfor the methodology.

• First, the methodology provides a "startingpoint" for the federal law enforcementprofession to establish forensic accounting asits own discipline.

• Second, the methodology will serve asgeneralized and/or specific guidance tofederal forensic accountants, thus insuringthat ancillary disciplines are appropriatelyconsidered.

• Third, the methodology provides a frameworkthrough which forensic accounting techniquesand methods can continually be refined.

• Fourth, the methodology serves as a technicalreference to those performing forensicaccounting services on a part-time basis.

• Fifth, the methodology insures consistency offorensic accounting delivery, thus enhancingthe likelihood of successful prosecutions.

• Sixth, the methodology serves as a trainingtool for those entering the federal lawenforcement profession.


• Seventh, the methodology enhances expertwitness and prosecution testimony credibilitybefore triers of fact.

This article describes the proposed forensicaccounting methodology that enables practitionersto immediately apply its concepts. In recognitionof the investigatory nature of forensic accounting,the methodology is built upon an integrated dualfoundation of forensic accounting and criminalinvestigation.

Many aspects of forensic accounting andrelated disciplines are referenced in themethodology. Most of the techniques will befamiliar to practitioners but where practitionerslack familiarity, the methodology links relevanttechnical aspects.

The methodology's imbedded hyperlinksenable practitioners to readily access supportingdocuments to facilitate consistency and promoteefficiency. Also, hyperlinks, discussed later inSection VII. C., to explanatory text further supporta forensic accountant's need to apply methodsbeyond one's immediate skill set. Darrell Dorrell,Deposition Matrix, NATIONAL LITIGATION

CONSULTANT'S REVIEW, Vol. 2, Issue 9 at 1(2002).

B. Criminal investigation

The traditional Seven Steps of CriminalInvestigation is a process commonly taught andapplied by federal, state, and local lawenforcement authorities. Many variations of theSeven-Step method are used by law enforcementauthorities. Specifically, certain law enforcementagencies employ a three, four, or five-stepcriminal investigation process. However, theSeven-Step method is preferable due to itscomprehensive detail. This customizationcapability enables forensic accountingpractitioners to closely interface with respectivelaw enforcement agencies, thus matching theirapproach when applying forensic accounting.

The methodology is detailed below andconsists of numerous components of criminalinvestigation processes, forensic accountingtechniques, statistical methods, interviewingschema, sociopsychological constructs, andadult-learning theories. Consequently, the

methodology offers a comprehensive and dynamictool for analysis and evidentiary delivery.

C. The methodology in action—processmap

The methodology is constructed as a processmap that visually guides the practitioner throughthe logical actions of a forensic accountingassignment. The methodology starts at the earlieststage of an assignment and progresses through thefinal stage, typically testimony delivery pursuantto prosecution.

The process map flows left-to-right,top-to-bottom within the four phases and fivestages, as shown in Exhibit 19. Therefore, apractitioner merely begins with the foundational(first) phase and progresses through the fivestages where he then begins with the interpersonal(second) phase and again progresses through thefive stages. Continuing in a like manner, thepractitioner can address virtually every aspect of aforensic accounting assignment, whether complexor simple. Note the dotted line flow indicating thatthe methodology is not merely static but alsoreflects the dynamic nature of forensic accountingthat often requires "looping" back through tasks asnew data surfaces, as shown in Exhibits 20through Exhibit 32, and highlighted in Exhibit 29.

Although the process map is visuallyself-explanatory, certain items requireclarification. The language of forensic accountingcan be applied to all types of investigativeactivities to clarify one's actions and findings, thusenhancing credibility during analysis, testimony,and prosecution. Forensic accounting techniquesare readily applicable to nonfinancial data. In fact,most readers of this article have probably appliedforensic accounting techniques to nonfinancialdata without realizing it. An example would becomparing salesmen's reported call logs withcustomer sales.

Other industry specific examples arecommonly found. Note that physicians'appointment logs are often compared to billingand deposits to identify anomalies. Likewise,deliveries of sugar and flour (measured in pounds)can be compared to the output captured in abakery's cash register receipts. Also, fund raising


donor logs of charities can be compared toreported receipts of goods and services. Finally,the IRS has been known to compare the towellaundry bills of a suspected brothel to its reportedincome.

The actual methodology, contained inMicrosoft® Power Point®, includes hyperlinkedforms (e.g., Microsoft® Word®, Microsoft®Excel®, etc.) so that a user can immediatelyaccess and apply the tools to the assignment athand. Due to size limitations of this article, not allthe contents have been included, but themethodology is sufficiently populated to illustrateits intent and capabilities. Law enforcementagencies can obtain, free of charge, an electronicversion of the methodology by contacting theauthors. Also, www.aslet.org,http://www.crimelineonline.com andwww.patc.com are other sources where someancillary material can be purchased.

Due to the two-dimensional nature of thewritten word, the process map appears sequential.However, the methodology is intended to beflexible, dynamic, integrated and simultaneous,and/or iterative, thus mirroring how informationand conclusions develop. For example, interviewsand/or interrogations might not be conducted untilrather late in a forensic assignment.

D. Methodology and linkage to criminalinvestigation

The methodology was constructed using aforensic accounting/investigative linkage to theSeven-Step Criminal Investigation methodology.The Seven-Step methodology is summarizedbelow, and the respective identifiers are providedwith links to the detailed matrix.

Matrix

Investigatory Steps Identifier

1. Interviews and Interrogation I&I

2. Background Research BR

3. Electronic and Physical Surveillance EP

4. Confidential Informants CI

5. Undercover UC

6. Laboratory Analysis LA

7. Analysis of Transactions AT

Interviews and Interrogation (I&I) reflect thepersonal aspect of data-gathering, obtainedthrough personal interviews and interrogationunder law enforcement authority. It is generallyconsidered a source of primary data.

Background Research (BR) is comprised oftwo broad categories: primary data and secondarydata. Primary data (see Interviews) is acquired bythe practitioner's efforts collecting data otherwiseunavailable through secondary sources. Examplesinclude performing an NCIC database query, orperforming an Internet inquiry into a subject'sasset holdings.

Electronic and Physical Surveillance (EP) isused to obtain evidentiary data throughobservation.

Confidential Informants (CI) provideinformation that is considered primary data. Thismay include paid or voluntary informants.

Undercover (UC) is used to obtain first-handsubject data.

Laboratory Analysis (LA) can range fromstatistical analysis, such as duplicate-numbers test,to scientific analysis, e.g., ink composition, to awide range of investigatory procedures.

Analysis of Transaction (AT)compares/contrasts transactional andpattern-sensitive data measures to provide arecord for forensic analysis. Full and falseinclusion tests are used to determine theappropriate "universe" of data under investigation.This ensures that no extraneous data is includedand that no appropriate data is excluded.

E. The four phases

The methodology is structured within aprocess map organized into four logically-flowingphases covering thirteen actions, with each actioncomprising five stages. See Exhibit 19. Thethirteen actions are executed throughout theprocess and contain many distinct techniques thatclosely track the Seven-Step CriminalInvestigation methodology. The phases, actions,and stages mirror the activities ordinarilyencountered in the forensic accountinginvestigation process and are indicated below.

The foundational phase consists of assemblingand preparing baseline data that will support anddrive the investigation. The output must becontinuously updated to provide a current record


and status of the progress of the investigation.Identification of all the bank accounts that maycontain large wire transfers to offshore accountswould fall within this phase. The accounts wouldhave been identified within the full and falseinclusion test to ensure that all relevant data isexamined. The two actions in the foundationalphase include assignment development andscoping, which is an allocation of responsibilities.See Exhibits 20 and 21.

The interpersonal communications phaseconsists of interviews and interrogation,surveillance, undercover work, and the relatedactivities necessary to extract pertinentinformation about the subject(s). The typicalactivities conducted by field officers would fallwithin this phase. A reasonably strong experiencebase is necessary in order to identify theindividual traits, habits, and characteristics thatbetray a subject's deceptions. The two actions inthis phase include interviews and interrogationsand background research. See Exhibits 22 and 23.

The data collection and analysis phaseconsists of applying the various indirectquantitative and qualitative data obtained duringthe earlier phases and developing outputsupporting observations, thus arriving at anappropriate conclusion(s). If such efforts proveinconclusive, the next segment of this phase(discussed below)—direct analytical andconclusion phase, will provide additionalevidence. Therefore, this phase consists of twosub-phases, i.e. indirect (executed first as adiagnostic and/or exploratory tool), and thendirect, so that the labor-intensive efforts are mosteffectively applied. For example, by comparingthe year-to-year change in equity to theyear-to-year difference between revenues (i.e.,receipts) and expenses, the articulation of thefinancial statements can be tested. Any differenceis investigated to determine whether it is merelyan equity transaction (capital infusion), or isdetermined to be unaccounted for revenue orexpense. This technique is known as the ModifiedNet Worth Method, described in Section V.,Subsection A.

Direct quantitative and qualitative analysiscan follow the preceding indirect activities, or beexecuted either jointly with, or independent of

them. The evidence provided by this phase is, bydefinition, the most comprehensive but is notnecessary in every case. Also, since it is usuallyquite labor-intensive, it can require the highestresource usage. The six actions in this phaseinclude data collection, surveillance, confidentialinformants, undercover work, laboratory analysis,and analysis of transactions. See Exhibits 24through 29.

The trial phase consists of delivering theresults of the forensic accounting analysis. Thetypical delivery target is comprised of a trier offact, (a judge and/or jury) that deliberates theevidence within the context of the law and otherevidence. This phase also includes apostassignment activity that is intended to capturebenefits of the experiential process achieved fromeach assignment. The three actions in this phaseinclude trial preparation, testimony and exhibits,and postassignment activity. See Exhibits 30through 32.

F. The thirteen actions

The assignment development action is thefront end of a forensic assignment that shapes thecontext and defines the framework of theassignment.

The scoping action secures formalcommitments and defines responsibilities amongthe parties with (and against) whom the forensicaccountant is employed.

The interviews and interrogation actionconsists of the face-to-face contact with keyparties. These activities often comprise the mostcompelling but nonquantitative evidence and canderive from actions ranging from conversationsthrough depositions. This action can also be areentry point in the process, such as anadmission-seeking interview conducted towardthe end of an investigation.

The background research action permitsindependent verification against the oral claimsmade by the respective parties.

The data collection action is the entry pointfor several other stages and likewise reflects thereentry when necessary.


The surveillance action collects andcategorizes data ranging from objective indicatorssuch as the number of phone calls through moresubjective indicators such as behavioralsymptoms.

The confidential informants action accessesparties willing to divulge data for their ownreasons and often opens doors to other evidence.

The undercover action is a ruse used to gainconfidences in order to obtain data otherwiseunavailable. It is sometimes irreplaceable, such asin drug cases.

The laboratory analysis action can range fromstatistical to chemical techniques that determinewhether or not data converts to evidence.

The analysis of transactions action containsobvious efforts, such as tracing the evidence backto a source. However, it can also include lessobvious actions, such as establishing behavioralpatterns that demonstrate trends.

The trial preparation action is comprised ofpreemployment preparation, thus simulating thetrial testimony and insuring accuracy of content.

The testimony and exhibits action is thecrucible within forensic accounting, and perhapscarries more weight than all the other stagescombined. That is, even with superb foundationalanalysis it may all be for naught if directtestimony is poorly delivered or if witheringcross-examination succeeds in diminishing theforensic accountant's opinions.

The postassignment action recommends thateach assignment should have a postmortemlessons learned review to capitalize on theexperiences, whether favorable or disastrous.

The four phases and thirteen actions, withinthe context of the five stages, are depicted inExhibits 20 through 32 and are described insummary fashion below. Note that themethodology is constructed in an electronic,interactive format accommodating hyperlinkedexplanations that cannot be reproduced within thestatic pages of this Bulletin's text. Therefore, theexplanation is reproduced following the respectivephases of methodology.

Exhibit: 20Phase: FoundationalAction: Assignment Development

Summary: This is the starting point for themethodology and clarifies the overall intent withinthe context of the assignment. Its formalizednature mirrors military mission planning, thusenhancing the likelihood of success within theresources available.

Exhibit: 21Phase: FoundationalAction: Scoping

Summary: This is a reality check that balancesexpectations with constraints and reminds theparticipants of the ultimate output that may apply,thus establishing outcome-based efforts.

Exhibit: 22Phase: InterpersonalAction: Interviews & Interrogation

Summary: This encourages interviewers andinterrogators to hone their skills, recognizing thateven very experienced parties can always learnnew methods and techniques. Likewise it enablesless experienced parties to access the resourcesthey need to enhance their effectiveness.

Exhibit: 23Phase: InterpersonalAction: Background Research

Summary: Background research is sometimesoverlooked in the rush to proceed, but theformalization of this as a task ensures that readilyavailable information is utilized as necessary.

Exhibit: 24Phase: Data Collection and AnalysisAction: Data Collection

Summary: Output examples are used to inform allparties on the project of the expectations, thusinsuring focused efforts.

Exhibit: 25Phase: Data Collection and AnalysisAction: Surveillance – Electronic, Physical

Summary: Surveillance activities are mostproductive when deployed consistent with the


team’s overall goals and objectives.

Exhibit: 26Phase: Data Collection and AnalysisAction: Confidential Informants

Summary: Informants are most effectivelydeployed when they are directed to seekinformation in direct support of the team’s efforts.

Exhibit: 27Phase: Data Collection and AnalysisAction: Undercover

Summary: In a manner similar to surveillance,undercover activities are most productive whendeployed consistent with the team’s overall goalsand objectives.

Exhibit: 28Phase: Data Collection and AnalysisAction: Laboratory Analysis

Summary: Laboratory analysis can span the gamutof forensic analysis, including scientific, financial,psychological, biological, chemical and relatedtopical subjects.

Exhibit: 29Phase: Data Collection and AnalysisAction: Analysis of Transactions

Summary: This action pulls together all thepreceding data collection and analysis, andcoalesces it within the context of the goals andobjectives. Note also that it may be a logical pointat which to "loop back" to another, earlier task tocontinue polishing and refining the evidence.

Exhibit: 30Phase: TrialAction: Trial Preparation

Summary: This action insures that months or yearsof effort are effectively arrayed in order tomaximize the prospects of obtaining a successfuloutcome.

Exhibit: 31Phase: TrialAction: Testimony & Exhibits

Summary: This is the last opportunity for thetestifiers (experts and fact witnesses) to hone thedelivery of their findings and opinions.

Exhibit: 32Phase: Post-TrialAction: Post-Assignment

Summary: This "lessons learned" activity isperhaps the most overlooked of all prosecutionefforts. However, it may also offer the greatestbenefit to the team since virtually everyprosecution has something which improves theoverall capabilities of the team.

G. The five stages

There are five foundational stages supportingthe Seven-Step Criminal Investigationmethodology described above. These stagesmirror the activities ordinarily encountered in theinvestigation process and are indicated below.

The purpose stage establishes the reasoningbehind the necessity of the phase and itsrespective actions. Put another way, it shapes thecontext and defines the framework to ensure thatthe actions are properly focused.

The references stage lists key technicalreferences for the pertinent phase and itsrespective actions. Naturally, the referencesources will vary. For example, an excellentstarting point for any forensic accounting matter isROMAN L. WEIL , M ICHAEL J. WAGNER & PETER

B. FRANK, LITIGATION SERVICES HANDBOOK THE

ROLE OF THE FINANCIAL EXPERT (3d ed. JohnWiley & Sons 2001). However, forensicaccountants often need detail beyond thecapabilities of the HANDBOOK. Therefore,references should be considered asmatter-specific. In its electronic form, themethodology is hyperlinked to specific referencesand Internet URLs for further investigation.

The tasks to be performed stage identifies keytasks that pertain within the context of the phaseand its respective actions. Many tasks are linked


to the narrative matrix following the Process Mapin order to define and describe a generic set ofactivities. In its electronic form the Methodologyis hyperlinked to the narrative matrix for easyreference to the pertinent activities.

The potential issues stage alerts the forensicaccountant to the land mines of the respectivematter. For example, during the interviews andinterrogation action the veracity of the respectiveparty(ies) can never be taken for granted.

The deliverables stage suggests likely outputsthat document the results throughout theMethodology's Process Map. Such outputs can bemerely documentary but are likely to beeventually applied as exhibits in support oftestimony. In its electronic form the Methodologyis hyperlinked to the respective documentsimmediate application to the pertinent activities.The deliverables are incorporated into thetestimony and exhibits action since they aretypically applied during trial.

The Forensic Accounting Methodology ispresented in all four phases, thirteen actions andfive stages, in exhibits 20 through 37. After theentire Forensic Accounting Methodology ProcessMap is displayed, the selected textual narrativeprovides specific aspects of the proposed forensicaccounting techniques, e.g., full-and-falseinclusion. See Exhibits 20 through 37.

VIII. Conclusion

Forensic accounting, like most professionaldisciplines, is part art and part science. Therefore,it is most effective when applied in a methodicalmanner that considers all issues and alternatives,yet accommodates flexibility. This concept iswhat makes highly skilled professionals such aslaw enforcement, special operations militaryteams, and others so effective. They are so welltrained that they know when and how to departfrom the plan.

The extant methodology is the only knowntechnique that simultaneously combines forensicaccounting with criminal investigation. Therefore,it enhances law enforcement's technical skills inthe pursuit of their prosecutions.

ehagen

Text Box

pages 17-48 deleted in PDF copy; click on exhibit links in documents to view the exhibits that were on those pages.


Exhibit 33

ForensicTechnique

Definition/Description Data Collection DataAnalysis

I&I BR EP CU UC LA AT

Foundational Phase: This phase consists of assembling and preparing baseline output that willsupport and drive the investigation. The output will be continuously updatedto provide a current record and status of the progress of the investigation.

Full-and-FalseInclusion

Full-and-False Inclusion testsare used to determine theappropriate universe of dataunder investigation. Thisensures that no extraneous datais included, and that noappropriate data is excluded.These types of tests areparticularly useful for findingunreported assets. Also, thistechnique can/should be usedthroughout the various stages.

X X X X X X X

Genogram A Genogram is a visualrepresentation of the myriad ofinformation gathered duringbackground research,interviews, and surveillance. Itis often prepared in conjunctionwith events analysis output.It provides a commonperspective for the forensicinvestigator to demonstratepatterns of behavior andidentify other entities andparties meriting furtherinvestigation. Also, it can pointto key indicators of the subject'sbehavior, leading to additionalpoints of investigation.

X X X X X

Exhibit 33

ForensicTechnique




Entity(ies)/Party(ies) Chart

An Entity(ies)/Party(ies) Chartis a visual representationdepicting entity(ies) orparty(ies) identification, and theassociations among them. It isoften prepared in conjunctionwith events analysis output.Entity(ies)/Party(ies) charts canbe useful predictors of fundsdiversion. For example,identifying the formation dateof an off-shore entity may becompared to funds decline, thussubstantiating diversion. Also,identifying seemingly unrelatedparties can indicate wherefurther investigation ispotentially warranted.

X X X X X

BackgroundInvestigation

First, Background Investigationinvolves research (typicallyelectronic, but alsosurveillance) into a party'sidentity to identify other assetsthat may have been forgotten.The results are continuouslyupdated to provide acomprehensive record ofinformation about the target.

X X X X X


Exhibit 34

ForensicTechnique



Interpersonal Com munications Phase: This phase consists of interviews, interrogation,surveillance, undercover, and the related activitiesnecessary to extract pertinent information from/about theentity(ies)/party(ies).

DistanceCommunication

Distance Communication (orproxemic communication)consists of comparing andcontrasting the interpersonaldistance involved in queryresponses.It has been suggested that (evensubtle) movements away froman interviewer indicateavoidance, and thus meritadditional investigation.Movements toward aninterviewer can suggest a desireto be believed and/or a desirefor assistance, such as a requestfor the interviewer to delvefurther into the matter.Note that cultural differenceshave a significant impact oninterpersonal distance. Forexample, the sociallyacceptable distance in theUnited States when two adultsare communicating (whilestanding) is eighteen to twenty-four inches. European normsare much closer.

X X X

Exhibit 34

ForensicTechnique




KineticCommunication

Kinetic Communicationconsists of observing bodilyreactions to determine whereadditional investigation iswarranted.It has been suggested that aperson who averts his eyes tothe left prior to responding maybe lying. Alternatively, it hasbeen suggested that a personwho averts his eyes to the rightprior to responding may berecalling a memory. Forexample, it is well documentedthat when lying (and whenpassionate about a subject),blood flow increases to thesubject's head and neck area,thus providing a flush that maywarrant further investigation.

X X X

ParalinguisticCommunication

Paralinguistic Communicationconsists of analyzing thevolume, pitch, and voice qualityduring verbal communication.Oral communication providesfor a range of nonverbalaccompaniment that can beused to convey certain emotionswhich may not be as easilydiscerned in writtencommunication.

X X X

Expectations-based StatementAnalysis

Expectations-based StatementAnalysis consists of analyzingthe language used by subjectduring interviews to assess histruthfulness.For example, the reply "I don'tremember" may require furtherinvestigation while the reply "Idon't know" may indicate thatno further inquiry is necessary.

X X X


Exhibit 35

ForensicTechnique



Data Collection and Analysis (Indirect) Phase: This phase consists of applying the variousindirect quantitative and qualitative data obtainedduring the earlier phases and developing outputsupporting observations, thus arriving at anappropriate conclusion(s). If such efforts proveinconclusive, the next phase—Direct Analyticaland Conclusion Phase will provide additionalevidence.

Records-basedExpectations

Records-based Expectationsconsist of identifying thenature, form, extent, veracity,availability, and relatedelements of recordkeeping inorder to set expectations aboutthe entity(ies)/party(ies). For example, an entity handlinga large sum of money fromnumerous investors would beexpected, at a minimum, tohave in place very soundmanagement and internalcontrols that provide solidfoundation to the representativefinancial statements. Examplesof the minimum types ofrecords in such a case includethe general ledger, receiptsledger, cost and expenseledgers, detailed shareholderrecords, comprehensivefinancial statements, currentincome tax returns, and relatedelements.

X X X X X

Exhibit 35

ForensicTechnique




Comm on-sizing Common-sizing consists ofconverting all financialstatement items to a percentageof revenue and assets, and thencomparing the results withinand among one another over amultiperiod time horizon. This method alsoaccommodates a comparison tosimilar businesses that may beof much different size. Bargraphs and line charts areuseful to identify key variationswarranting furtherinvestigation.

X X X

HorizontalAnalysis

Horizontal Analysis consists ofcomparing key accountcategories, such as officercompensation, travel, andentertainment over amultiperiod (e.g., year, quarter,month, day) time horizon toidentify changes meritingfurther investigation. The technique typicallyincludes percentage changes,dollar changes, comparisonchanges, etc. Also, bar graphsand line charts are useful toidentify key variationswarranting furtherinvestigation.

X X X

ReasonablenessTesting

In Reasonableness Testing, theforensic investigator formulatesan expectation, (i.e. estimate) ofan account balance based uponunderstanding and assumptionsdriving the account balance.For example, a reasonablenesstest of deposits could measurethe actual deposits against theexpected deposits and couldidentify where furtherinvestigation is warranted.

X X X


Exhibit 36

ForensicTechnique



Data Collection and Analysis (Direct) Phase: This phase can follow the Indirect Phase, or beexecuted either jointly with, or independent of, theIndirect Phase. The evidence provided by the phase isby definition the most comprehensive, but is notnecessary in every case.

Benford's Law Benford's Law is a financialDNA-equivalent techniquedeveloped during the 1920s byFrank Benford, a physicist atGeneral Electric researchlaboratories. He noted that thefirst few pages of logarithmtable books were more wornthan the later pages. In thosedays, logarithm table bookswere used to accelerate theprocess of multiplying twolarge numbers by summing thelog of each number and thenreferring to the table for therequisite integer.Benford's Law states thatdigits and digit sequences in adataset follow a predictablepattern. The technique appliesa data analysis method thatidentifies possible errors,potential fraud or otherirregularities. For example, ifartificial values are present ina dataset the distribution of thedigits in the dataset will likelyexhibit a different shape (whenviewed graphically), than theshape predicted by Benford'slaw.

X X

StatementAnalysis(Written)

In Statement Analysis(Written) investigatorsexamine written documents ina manner similar to theStatement Analysis (Verbal) as

X X

Exhibit 36

ForensicTechnique




described above. However,when analyzing writtendocuments focus on the wordsand the nature of thedocument, including the age,condition, and related physicaldocument factors.

Accept-Rejecttesting

Accept-Reject Testing issimilar to sampling but differssince sampling involves theprojection of a misstatement.

Stratified MeanPer Unit (MPU)

A Stratified Mean-Per-Unit(MPU) technique can improvethe precision of themean-per-unit techniquewithout increasing the samplesize. The technique usesstratification of the populationand samples each stratumseparately.By stratification, the forensicinvestigator segments thepopulation into groups ofitems exhibiting similar valueamounts. Once mean and standard errorin each stratum are calculated,the results are combined forthe individual strata to createan overall estimate. The firstfew strata reduce the necessarysample size, but diminishingreturns and certain otherfactors result in from three toten strata as sufficient in manycases.

X X

Exhibit 36

ForensicTechnique




AttributesSampling

Attributes Sampling is used tospecifically identify occurrencesthat fall within and/or outside ofpreviously established norms. Itcan be app lied either globallyand/or statistically using samplingtechniques. Its most common use in forensicinvestigation is to test the rate ofdeviation from a prescribed (orexpected) control perspective tosupport the forensic investigator'sassessed level of assurance. In attributes sampling eachoccurrence of, or deviation from,a prescribed control perspective isgiven equal weight in the sampleevaluation, regardless of thedollar amount of the transactions. In addition to tests of controls,attributes sampling may be usedfor substantive procedures, suchas tests for underrecordinginterbank cash transfers ordemand deposit accounts.However, if the audit objective isto obtain evidence directly abouta monetary amount beingexamined, the forensicinvestigator generally designs avariables sampling application.Substantive tests consist of testsof details of account balances andrelated transactions, andanalytical procedures. They areintended to gather evidenceregarding thevalidity/appropriateness of thetreatment of transactions.Generally, such tests areperformed in combination duringinvestigation.

X X

Exhibit 36

ForensicTechnique




Ratio Estimationor Extrapolation

Ratio Estimation (sometimesExtrapolation) is often used inconnection with variablessampling and can estimate (ona statistically significant basis)the projected results basedupon analytical sampling viaProbability-Proportional-to-Size Sampling.

X X

Reperform The forensic investigator mayReperform, sometimes on atest basis, proceduresperformed by employees,primarily to determine that atransaction was accuratelyrecorded. Reperformance ofcomputations, such as a bankreconciliation, also providessome assurance about theexistence of the accountbalance, and solidifies areference point for furtherinvestigation.If judgment drives the basis ofa computation, such as in thevaluation of accountsreceivable, the forensicinvestigator reperforming thecomputation also shouldunderstand, evaluate, andapply the reasoning processunderlying the judgment.

X X

Exhibit 36

ForensicTechnique




Reverse Proof This examination of forensicinvestigation matters isapproached from twoperspectives: that a fraud (orother deceit) has occurred, theproof must include attempts toprove it has not occurred,andthat a fraud has not occurred,that proof must also attempt toprove it has occurred. The reason for reverse proof isthat both sides of fraud mustbe examined. Under the law,proof of fraud must precludeany explanation other thanguilt.

X X


Exhibit 37

Trial Phase: This phase is perhaps the most critical and is highly experience dependent. One exampleof an actual (blinded and redacted) trial exhibit follows in order to provide the practitioner withillustrations of exhibits that have proven successful.

T h e f o l lo w i n g e x a m p l e"Expectations Attributes" tablehas been successfully used in awide variety of civil and criminalmatters. It illustrates the gapbetween expected financialc i r c u m s t a n c e s s u c h a smanagement involvement andthe actual in-place conditions(indicated by bold text) that maybe found during investigation. Itis only one of numerousexamples of trial exhibits thatcan be made available to thereader in order to "jump start"ideas for trial.

ehagen

Text Box

Click here for rest of exhibit


Exhibit 37


ABOUT THE AUTHORS

�Darrell D. Dorrell, holds the distinctions ofCertified Public Accountant/Accredited inBusiness Valuation (CPA/ABV), Masters inBusiness Administration (MBA), AccreditedSenior Appraiser (ASA), Certified ValuationAnalyst (CVA), Diplomate, American Board ofForensic Accounting (DABFA), CertifiedManagement Accountant (CMA), and CertifiedManagement Consultant (CM C). Mr. Dorrell isthe founder and president of financialforensics®in Lake Oswego, OR, a highly specializedforensic accounting firm. He has practicedexclusively in the forensic accounting, litigation,and valuation related expert witness arena since1977, and is a nationally recognized author andspeaker on forensic accounting, litigation,valuation, and related civil and criminal matters.He can be reached at 503-636-7999, or by e-mailat [email protected]. His InternetURL is www.financialforensics.com.

�Gregory A. Gadawski is a Certified PublicAccountant (CPA), Certified Valuation Analyst(CVA), and Certified Fraud Examiner (CFE).Additionally, he is a member of the OregonSociety of Certified Public Accountants (OSCPA)and American Institute of Certified PublicAccountants (AICPA). Mr. Gadawski became aprincipal of financialforensics in the year 2000.He has practiced exclusively in the areas offorensic accounting, litigation, and valuation since1999. Mr. Gadawski has spoken nationally andlocally to various professional groups andauthored/co-authored multiple articles regardingforensic accounting and litigation-relatedmatters.a


Notes

Request for Subscription UpdateIn an effort to provide the UNITED STATES ATTORNEYS' BULLETIN to all federal law enforcement

personnel who wish to receive it, we are requesting that you e-mail Nancy Bowman([email protected]) with the following information: Name, title, complete address, telephonenumber, number of copies desired, and e-mail address. If there is more than one person in your officereceiving the BULLETIN, we ask that you have one receiving contact and make distribution within yourorganization. If you do not have access to e-mail, please call 803-576-7659. Your cooperation is appreciated.

in this issue - justice.gov · in this issue. may 2005 u ni ted s tates a tto rneys ' b ul let...

Documents