AMS Corporate Assets on Review
In carrying an investigation on possible employee(s) fraud in the accounts receivable, the following corporate assets will be crucial. Firstly, and most importantly, all customers’ accounts should be under scrutiny. The number and the authenticity of the accounts should be verified to check on the possibilities of fictitious accounts.
Secondly, the investigator should know AMS’s policies relating to terms, method, and time of making payment. As a result, the investigator will get to understand what happens to old and slow payers as well as accounts written-off.
Additionally, the investigator should review the sales made by the company over a certain period. The amount together with the value of goods sold should be carefully checked. Further, all costs related to sales, and the value of goods returned should be reviewed. The review on the sales should be done together with the review of inventory’s amount and value to check on possibilities of ‘inventory shrinking’.
The investigator should also check on bank deposits and the cash receipts issued concerning all the invoices.
Tools needed in the review
The investigator should use a combination of tools and techniques for effectiveness in their task. The tools vary from the old-fashioned to the modern and more sophisticated ones. They may include the following:
Basic accounting skills
The investigator ought to be equipped with basic accounting skills. These skills will help the investigator check the cash flows of the business as well as check on the inventory and sales relations. Checking and verification of statements of accounts will greatly require accounting skills.
Employee(s) Psychology
The investigator should study employees’ behaviors and try to check for all the possible reasons behind them. For instance, an employee volunteering for overtime without pay, or even offering himself or herself to work over the holidays should be considered as a red flag. Moreover, employees with a lifestyle that is beyond their incomes should be under scrutiny.
Technology
An investigator should make use of sophisticated technologies since employees suspected to be involved in fraud use them more often than not. Technological tools that can be of use to an investigator include; Passware Kit Forensic, ACL desktop, Helix among other sophisticated software solutions. With these tools, an investigator can carry out data mining as well as data analysis. Some of these software tools such as Passware can get information from password-protected items. When it comes to the use of the ACL desktop, an investigator can access and analyze files from diverse databases. The ACL tool will help the investigator to trace the whole process from identifying suspicious trends to getting tangible proof of fraud.
Ways to review each of the assets
Review of customers’ accounts
The investigator should check on each account of all customers, paying key attention to the authenticity of each transaction and cash flows. This process will aim at checking on the existence of fictitious accounts. The time that each customer pays and the paying routine should also be a key area of scrutiny. Additionally, each customer’s account should be under independent review to check on the possibilities of lapping. Passware and ACL software are some of the tools the investigator should need.
Review of written-off accounts and delayed payments
With basic accounting skills, the investigator should check on the AMS’s policies on writing-off accounts in comparison to what happens on the ground. The written-off accounts should be under severe scrutiny and by use of the available tools, check on possible late payments. This, if possible, will need the investigator to liaise with all affected parties including the customers whose debts have been written-off.
Review on sales in comparison to the inventory
As mentioned earlier, ‘inventory shrinking’ is one of the manifestations of employee schemes and possible fraud. Therefore, the investigator should get the values of the inventory and recorded sales. This may include physical stocktaking as well as accessing the sales. The investigator should then check on aspects concerning sales and inventory that includes sales returns. This will be done by accessing all the databases from the employees at all levels.
Review financial statements and bank deposits
It is of paramount importance that the investigator verifies all the financial statements, more so sales, inventory, and accounts receivables. Concurrently, the scrutiny of all bank deposits and cash receipts should be done. Matching of the bank deposits and the invoices should be conducted by searching all cash flow channels and invoicing systems. The investigator should also check on the possibilities of modification of invoice figures.
How far in history to go
The sufficiency and relevance of the data to be collected dictate how far in AMS’s history the investigator should go. The top management as well as the magnitude of the manifestation of schemes and possibilities of fraud will be important factors to consider in the process of determining the appropriate period for review. The investigator should ensure that the time they decided on should provide conclusive and sufficient data. For instance, this investigation may cover the past five financial periods to gather adequate evidence.
Verification of findings
The investigator should give authentic findings, a task that is only possible if they have enough proof. Evidence linking suspected employees with scheming should be made available to only concerned dependencies.
Therefore, the investigator should have all the collected evidence, which may include witness statements, modified documents and altered data, photos, charts, and phone call records, as well as on-line payment proofs implicating the suspected employee(s) (Greene 1).
Project Plan
The steps and dependencies in the investigation
The forensic investigation of accounts receivable for American Marketing Systems (AMS) is meant to secure crucial evidence that can be used against the suspected employees.
The first step involves the evidence collection requirement. This step involves the production of evidence statement requirements to ensure that the VP of IT, the company controller, and the CEO can communicate and understand the purpose of the forensic investigation of accounts receivable (Rowlingson 1-28). This would facilitate the collection of IT audit logs to determine if they correspond with the business policies.
The second step involves determining the capability of collecting secure evidence that can be used legally. Currently, AMS is not aware of the totality of available evidence detected in accounts receivable skimming. Thus, the focus is to ensure that the evidence is gathered from relevant sources within the accounting department and must be kept as original material. The investigator will ensure that evidence is legally collected without any interference with business activities.
The third step entails the development of policies for securely handling and storing collected evidence. This step is necessary to ensure that evidence can be kept for a longer period after collection. The appropriate methods would involve physical security and file encryption.
The fourth step focuses on an investigation that would be used to prevent and deter possible skimming on accounts receivable. That is, the investigator will also focus on various sources of evidence to detect potential later threats. This process requires an information audit to determine the level of exposure and business risks. The investigator will identify and classify all accounts receivable components marked as suspicious for further analysis. For instance, further financial data analysis, content checking, and e-mail communications may be investigated to detect skimming.
The fifth step involves establishing conditions that would lead to a full formal investigation of accounts receivable in the company. Digital evidence will be gathered during this process. The investigator will record all suspicious transactions and escalate the process when serious evidence is available. Besides, monitoring of communications and accounts receivable will be escalated. The investigator will inform the companies’ executives and dependencies on how to proceed with the investigation.
Given the discreet nature of this investigation, internal dependencies may be restricted to the line and profit managers, the suspected employees, legal advisers, and the senior executives. Other external dependencies will include customers, partner organizations, IT vendors, law enforcement authorities, and the media if there is a need to control the PR consequences of the investigation.
The investigator will prepare evidence, incident, and impacts. Also, the investigator will provide vital answers to fundamental questions and demonstrate their credibility through evidence and logical conclusions. The section generally focuses on the evidence-based investigation.
Finally, the investigator will engage a legal team to review the evidence and facilitate an appropriate response. In this regard, the issues should be determined from a legal position and legal advice sought to ensure that actions will achieve intended goals. The legal team should be able to determine the case strength based on the available evidence.
Time estimate for each task
The investigation will take approximately six months.
Potential risks and challenges to the investigation and how they should be handled
The investigator will majorly focus on digital data, mainly the hard drive to collect reliable evidence. However, the extent of skimming, incident, and related impacts could go further. A full-scale investigation could lead to some risks to the investigator and AMS.
For instance, the investigator is most likely to face threats, harassment, privacy invasion, and issues related to evidence storage. Besides, it might also be difficult to extract evidence from mobile devices and other damaged sources (Casey 63).
The forensic investigator is expected to observe integrity to preserve methods of data collection and evidence. Thus, the methods used must conform to standards applied in digital forensic investigation. Hence, the investigator must not violate the Fourth Amendment.
Another issue may emanate from the chain of custody and evidence preservation to ensure that the evidence is admissible based on the law. Thus, the investigator must observe strict and standard practices based on the chain of custody provisions that focuses on the collection, protection, analysis, and reporting of evidence.
Determining individuals involved
People within AMS
For accounts receivable schemes, the investigator will focus on any employee of AMS who is engaged in cash collection after-sales. Thus, salespersons and consultants who may collect cash in the field would persons of interest during investigations.
The investigator should also investigate accounts receivable clerks for potential skimming because they also receive cash on behalf of AMS (Wells 1).
Also, the investigator must focus on the controller. The controller’s duties may include cash receiving roles, perform cash posting to accounts receivable, and then reconciliation. All these amalgamated roles for an individual could lead to fraud. Fraud is most likely to happen if AMS lacks sufficient internal control mechanism and role segregation.
People external to AMS
It is most likely that some rogue customers may engage with employees to steal from the company. In such instances, customers may receive services from AMS at favorable terms while skimming with employees to divert earnings from ‘scrap services’ because they may be considered less important for accounts receivable.
Such scrap sales may lack proper control and documentation.
Methods employed to conduct skimming operation
Employees have often used lapping to conduct internal fraud schemes, and it involves diversion of payments made by the first customer while payment by another customer is used to conceal the diverted cash. Workers are most likely to forge clients’ receipts and write other different figures compared to real ones paid by clients to cover up for the diverted payment.
Lapping requires a significant amount of time and energy to develop the scheme processes and cover-up strategies. Employees who engage in fraud must take time to ensure that the next payment for cover is available. It has been established that employees who work for long hours or do not take any vacations to prevent any other employees from performing their roles and avoid being caught. They can even intercept any communication from customers to avoid being caught.
For AMS, lapping can be rampant if the only member of the staff is involved in various activities such as record keeping and cash custody. It is suggested that lapping can be controlled through role separation. To detect lapping at AMS, the investigator will also conduct simple procedures. For instance, determining the age of receivables alongside turnover receivables would help to establish lapping because the age would be increased while turnover would below.
Fictitious Receivables
The fraud usually sets up a fictitious account receivable to cover up for fictitious sales. Shell companies may be used for this purpose. Workers would order a sale but put the related entries in an account that is fictitious and will be finally written-off as impossible to collect (Greene 1).
Inappropriate posting
Credit posting is classified both as theft and as a cover-up because they are entered in non-existing accounts, written-off or inventory returned (Greene 1). For instance, the fraudster will collect cash from clients’ written-off accounts, fail to report it, and then use it for personal needs.
Kiting
The fraudster may use cash or check to meet kiting goals by exaggerating figures and then presenting them to many banks. The ‘float period’ necessary for the check to clear offers the best opportunity for fraud. The investigator will focus on bank transfer schedules, bank account reconciliation, and evaluate statements of bank accounts.
Understating sales
The fraud will provide low prices through forged customers’ receipts, record the lowest amount, and divert the rest of the cash. The sales scheme appears simple but has several areas of investigation and reviews.
Shell companies for collection
AMS may hand over its delinquent accounts to a collection agency because in most instances there is no guarantee that the collection will be realized partially or fully. Frauds will rely on this uncertainty and forge a relationship with a disreputable collection firm based on kickbacks. The collecting firm may collect and report low figures for AMS. Hence, AMS misses collection that was remitted to settle the receivable debts, whereas the fraudster and the shell company continue to draw huge cash.
Employees may even decide to assign a regular account to a shell company to ensure that they have a constant flow of earnings from diverted funds.
Other considerations
The forensic investigator should go beyond employees of AMS when investigating schemes. For instance, relationships with vendors or collection agencies, who owns these firms and determine lengths of periods of relationships. Also, employees are becoming creative about fraud. Thus, the forensic investigator will use a wide range of tools and software for various roles based on the extent of fraud and types of accounts receivable affected. Most of these software tools will assist the investigator to extract and analyze data from the suspected employees’ storage devices, including mobile devices and an active computer. If the fraud is based on advanced techniques, including hacking, then the investigator must use more sophisticated tools.
Handling potential evidence
Chain of custody and preservation
AMS will use the collected evidence to prove that internal fraud takes place in accounts receivable. The investigator will ensure that all individuals involved in the handling of evidence do so with great care. Thus, establishing a chain of custody and preservation of evidence would assist the investigator to account for and maintain clear records, the status of evidence, and show why every item was collected, protected, preserved, and disposed of.
All the original evidence items and their copies should be kept in a proper state. The investigator will establish a history of custody of evidence and create a file for the investigation.
All documents and records collected from all suspected employees must be kept in a secured way. Second, there are sensitive financial documents protected by the Right of Financial Privacy Act. The Right requires confidentiality of all financial information, but it also allows any investigator to gain access to such documents in a legal manner. At the same time, these documents may not be provided to other dependencies working with the investigator because of specific prohibitions on such documents. Hence, the investigator will separate such documents from other less sensitive documents during the investigation.
Any other documents obtained at any time during the investigation will only be accessible to authorized individuals.
The investigator will also recognize that some items will be exempted from exposure because they contain commercially confidential information. AMS executives should request for such exemption and subsequent protection when documents are supplied. The investigator will ensure that all documents are kept in a way that protects and sustain their identities. Further, the investigator will indicate that certain documents have exemption claims and, therefore, not open to mass review.
In any cases of confidential complaints, the investigator will ensure that specific procedures are observed when they are brought presented.
The investigator will destroy all copies of documents (duplicate of documents containing evidence and notes) at the end of the investigation unless an extremely important reason is provided for further storage.
For materials considered as evidence, the investigator should only use secure modes of transfer when transmitting them to other concerned parties. The trace should establish a comprehensible chain of custody to legitimize the process and protect the evidence.
The investigator will also send a note with a detailed explanation of the evidence and materials. At the same time, it is expected that the investigator and other dependencies will maintain the confidentiality of information by ensuring that information is disclosed to the right personnel, through the right channel, and under expected circumstances.
Analysis and reporting
After the investigator has collected all the possible available materials, the contents will be analyzed to determine evidence that can support the management of the AMS hypothesis that fraud is rife in the company. This process can be viewed as an in-depth and systematic analysis of evidence that supports the fraud after obvious evidence has been identified (Reith, Carr, and Gunsch 1-12).
The investigator will apply various analysis techniques and tools to analyze materials, including deleted ones. With specialized tools, analysis of e-mail, transaction documents, and Internet history will be relevant for the investigator.
The investigator may also apply some techniques to recover materials that were deleted, even if they were considered as permanently erased from the storage devices (Grubor, Ristić, and Simeunović 1-9).
Once the investigator has collected information of interest, the analysis would involve the reconstruction of issues, events, and actions to formulate a logical conclusion. The investigator will rely on his expert knowledge, opinion, and data collected to arrive at a reliable conclusion. In the US, for instance, a qualified investigator is allowed to testify based on personal expertise and evidence so long as the testimonies rely on adequate information and facts, are obtained through dependable techniques and guidelines of analysis and the witness has used dependable techniques to determine the conclusion.
After the completion of the analysis, the investigator will present the report to senior executives of AMS who commissioned the work. The investigator, however, must use suitable, less technical language in the report with sufficient details and documentation as evidence.
Also, the investigator presents the report dependencies such as law enforcement agencies and the company to decide if criminal proceedings against the suspect should commence using the available evidence supported with a precise conclusion.
Other items
It is imperative to recognize that several tools (software tools) are available in the market to assist investigators to conduct their work. As fraudsters become more creative, the investigator should find the best investigative solutions for their work to retrieve and conduct an in-depth analysis of such materials.
Works Cited
Casey, Eoghan. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet. Waltham, Massachusetts: Academic Press, 2004. Print.
Greene, Craig L. Accounts Receivable Fraud. 2015. Web.
Grubor, Gojko, Nenad Ristić and Nataša Simeunović. “Integrated Forensic Accounting Investigative ProcessIntegrated Forensic Accounting Investigative Process Model in Digital Environment.” International Journal of Scientific and Research Publications 3.12 (2013): 1-9. Print.
Reith, Mark, Clint Carr and Gregg Gunsch. “An examination of digital forensic models.” International Journal of Digital Evidence 1.3 (2002): 1-12. Print.
Rowlingson, Robert. “A Ten Step Process for Forensic Readiness.” International Journal of Digital Evidence 2.3 (2004): 1-28. Print.
Wells, Joseph. “Enemies Within.” Journal of Accountancy. 2001. Web.