CHAPTER 8

Investigating Concealment
LEARNING OBJECTIVES
After studying this chapter, you should be able to:

 Describe concealment investigation methods and

list how they relate to fraud.

 Understand the value of physical documents and

electronic records in a fraud investigation.

 List the different methods of obtaining

documentary evidence.

 Understand how to perform discovery sampling

to obtain documentary evidence.

 Explain extended procedures for hard-to-get

documentary evidence.
CONCEALMENT INVESTIGATIVE METHODS

 After the theft, additional evidential tracks occur as

perpetrators conceal their fraud by covering their
actions, obscuring evidence, and removing red flags
where possible.

 While many methods of concealment are possible,

concealment generally is accomplished by
manipulating documentary evidence.

 From an electronic perspective, concealment is

accomplished by modifying or deleting records in
corporate databases, logs, and communications.
ASPECTS OF DOCUMENTARY EVIDENCE

 Most concealment-based investigative techniques involve

ways to discover physical documents or computer records
that have been manipulated or altered.
 When faced with a choice between an eyewitness and a
good document as evidence, most fraud experts choose the
document.
 In today’s interconnected, financial world, it is nearly
impossible to transfer money without creating documents
along the process.
 Documents are almost always available to the fraud
investigator who knows where to find them because most
fraud involves money at some point.
 EXAMPLE—CANCELLED CHECK

 Information on the front and back of a cancelled check

(which is a document) is shown and listed in Figure 8.1.

 If you were investigating a kickback or a forgery

scheme, this check would allow you to complete a paper
trail of the entire transaction.

 In e-commerce situations, XML documents and other

files provide similar information.
FIGURE 8.1 INFORMATION ON CHECK
SPECIFIC ASPECTS OF DOCUMENTARY
EVIDENCE

 Investigators must understand the following aspects of

documentary evidence:

 Chain of custody of documents

 Marking of evidence
 Organization of documentary evidence
 Coordination of evidence
 Rules concerning original versus copies of documents
 CHAIN OF CUSTODY OF DOCUMENTS

 To protect the chain of custody, a record must be kept of

when a document is received and what has happened to it
since its receipt.
 Careful records must be maintained any time the
document leaves the care, custody, or control of the
examiner.
 For computer-based evidence, professional programs like
EnCase and The Forensic Toolkit calculate checksums
that support the chain of evidence.
 MARKING OF EVIDENCE

 When documentary evidence is received, it should

be uniquely marked so it can be identified later.

 A transparent envelope should be used to store it,

with the date received and the examiner’s initials
written on the outside.

 A copy of the document should be made, and the

original should be stored in the envelope in a
secure place.
ORGANIZATION OF DOCUMENTARY
EVIDENCE
 While hard copies of documents and records are
still used, they are rarely used without their
electronic counterparts.
 Web searches for “case management software”
and “litigation support software” will reveal
current products with many different features.
 CaseMap and MasterFile are example of popular
programs.
 Regardless of the system, managing the large
volume of documents in a typical case requires a
consistent organizational scheme.
 EVIDENCE DATABASE

 Evidence database should include the following:

 Creation dates of documents

 Sources of documents
 Dates when the documents were obtained
 Brief descriptions of document contents
 Subjects of documents
 Identifying or Bates number
 COORDINATION OF EVIDENCE

 Coordination of evidence can be:

 Straightforward when an investigation is simple and
involves only a few people
 More difficult for large investigations involving
investigators, legal counsel, accountants, expert
witnesses, etc.
 Investigation analysis software allows investigators to
quickly understand complex scenarios and volumes of
information in a visual, intuitive way using link
analysis.
 Two popular investigation analysis products are:
 i2 Analyst’s Notebook
 Xanalys Link Explorer
 ORIGINAL VERSUS COPIES OF
DOCUMENTS
 Originals are preferable to photocopies
 In certain jurisdictions, only the following four situations
permit photocopies:
 The original document has been lost or destroyed without the
intent or fault of the party seeking to introduce the secondary
evidence.
 The original document is in the possession of an adverse party
who fails to produce it after a written notice to do so, or when
the party in possession is outside the jurisdiction of the
subpoena power of the court.
 The document or record is in the custody of a public office.
 The original documents are too voluminous to permit careful
examination, and a summary of their contents is acceptable.
OBTAINING DOCUMENTARY EVIDENCE

 The best way to obtain documentary evidence is

through computer-based queries of accounting and
other databases.

 Another useful method of obtaining documentary

evidence is through traditional audits, including
discovery sampling.
 AUDITS

 Auditors conduct seven types of tests

 Tests of mechanical accuracy (recalculations)
 Analytical tests (tests of reasonableness)
 Documentation
 Confirmations
 Observations
 Physical examinations
 Inquiries

 Because gathering documentation is a normal part of their

work, auditors can often gather documentary evidence as
part of an investigation without arousing suspicion.
 DISCOVERY SAMPLING

 One approach to auditing documentary evidence is a

form of statistical sampling called discovery sampling.

 Using discovery (statistical) sampling allows an

auditor to generalize and make inferences from the
sample to the population, as shown in Figure 8.2.
FIGURE 8.2 DISCOVERY SAMPLING
 DISCOVERY SAMPLING STEPS

 Discovery sampling is the easiest of all statistical

sampling variations to understand and implement.

 Discovery sampling involves two steps:

1. Testing a random sample
2. Using probability theory to draw inferences about
the population from the sample
Table 8.1 Partial Table of Random
Numbers
TABLE 8.2 DISCOVERY
SAMPLING TABLE
DISCOVERY SAMPLING ILLUSTRATION

 Assume that the defense auditor wanted to use

discovery sampling to examine checks payable to
doctors.
 First, he would use a random number generator or a
random number table to select the checks to be
examined.
 A sample list of random numbers is shown in Table 8.1.
 Once the checks have been selected, the next step is to
use a discovery sampling table to draw conclusions
about the checks.
 A discovery sampling table is shown in Table 8.2.
 DOCUMENTATION OF DISCOVERY
SAMPLING

 The investigator should document the method used

for determining sample size and the method used for
selecting the sample.

 Examples of situations where such documentation

may be important:
 The investigator expands the sample later.
 Another person later reviews the sampling plan.
 The procedure later becomes evidence in court.
 EVALUATION OF ERRORS

 If the investigator finds errors using discovery

sampling, he or she must determine whether the errors
were unintentional or are indicative of fraud.
CONSIDERATION OF SAMPLING AND NON-
SAMPLING RISK
 Sampling risk is the risk that the sample was not representative of the
population.
 Two ways to reduce sampling risk:
 Increase the sample size
 Use a random number generator to select the items to be examined
 Sampling risk can be significant when looking for fraud because fraud
is often conducted in just a few transactions.

 Non-sampling risk is the risk that a finding will be misinterpreted.

 Misinterpretation can be reduced by:
 Careful planning
 Performance
 Evaluation of the sampling procedure
 HARD-TO-GET DOCUMENTARY
EVIDENCE
 Three most common examples of difficult-to-obtain
evidence
 Private bank records
 Tax returns
 Brokerage records
 Three ways to obtain documentary evidence
 Subpoena
 Search warrant
 Voluntary consent
FIGURE 8.3 SUBPOENA FOR
DOCUMENTS
FIGURE 8.4 CONSENT FORM
 DOCUMENT EXPERTS

 Sometimes it is necessary to determine whether a

document is authentic.
 Questioned documents can be
 Genuine
 Counterfeit
 Fraudulent
 Forged
 Document examination is a specialized form of
investigation that applies forensic chemistry,
microscopy, light, and photography in making
determinations about documents.
EXAMPLE OF RESULTS OF DOCUMENT
EXAMINATION
 Document experts can determine the following:
 Whether a document was written by the person whose
signature it bears
 Whether a document has been forged
 Whether a document has been altered by additions,
deletions, obliterations, erasures, or photocopying
 If the handwriting is genuine
 If one printer was used to print the entire document
 If a document was printed on the date it bears and not
before or after
 Whether two or more documents are significantly
different or substantially the same
 Whether pages have been substituted in a document
 QUESTIONS RELATED TO DISPUTED DOCUMENTS OR
DOCUMENTS OF UNKNOWN ORIGIN

 Table 8.3 lists the most commonly encountered questions related to

disputed documents or documents of unknown origin.

 Questions are grouped into six categories

 Handwriting
 Printing
 Alterations and additions
 Age
 Copies
 Other

 Table 8.3 also includes a list of 20 characteristics of handwriting.

Table 8.3 Questions About Disputed Documents—Handwriting and Printing
TABLE 8.3 QUESTIONS ABOUT DISPUTED DOCUMENTS—ALTERATIONS/ADDITIONS, AGE, COPIES
AND OTHER
TABLE 8.3 QUESTIONS ABOUT DISPUTED DOCUMENTS—CHARACTERISTICS OF HANDWRITING
FRAUD INVESTIGATORS ROLE IN DOCUMENT
EXAMINATION
 To become a skilled examiner of questioned documents,
one must acquire extensive and specialized training.

 Though most fraud investigators are not trained document

examiners, it is important that they understand two
important elements relating to document examination:
 When to have a document examined by an expert.
 What the responsibility of the investigator is with respect
to questioned documents.
WARNING SIGNS OF QUESTIONABLE DOCUMENTS

 Documents should be submitted for examination

when any of the following warning signs appear:
 Abrasions or chemical pen or pencil erasures
 Alterations or substitutions
 Disguised or unnatural writings
 Use of two or more different colors of ink
 Charred, mutilated, or torn pages
 Pencil or carbon marks along the writing lines
 Existence of lines made during photocopying
 Signs of inconsistency or disruption in the continuity
of the content
 Any suspicious appearance or unusual form
ORGANIZATIONS OF DOCUMENT EXPERTS

 Two well-known organizations of document experts

can offer help in fraud investigations:
 FBI: Questioned Documents Unit
 American Board of Forensic Document Examiners