Forensic Accounting using IT

Forensic Accounting using IT

Introduction
Under contemporary conditions of business activity, securing reliable financial information through disclosing
financial statements is considered a generally accepted objective. Numerous financial frauds from the past and
the beginning of the century have seriously disrupted the trust of numerous users in financial information
contained in financial statements. Forensic accounting is hardly a new field, but in recent years, financial
organizations, banks, insurance companies and even police agencies have increased the use of these experts. In
the wake of high-profile corporate scandals as well as new regulations worldwide, many business leaders are
increasingly aware of the need to create company-specific antifraud measures to address internal corporate
fraud and misconduct. The system of internal control, internal auditing and audit committee are the key
elements for preventing frauds that are created through property misuse as well as those that use financial
statements as instruments of fraud. External auditing and forensic accounting perform retrospective control of
financial data with the aim of detecting omissions and frauds and the aim of securing the reliability and credibility
of financial statements.

Forensic Accounting
"Forensic" means "suitable for use in a court of law", and it is to that standard and potential outcome that
Forensic Accountants generally have to work. Forensic accountants, also referred to as forensic auditors or
investigative auditors, often have to give expert evidence at the eventual trial.

“Forensic Accounting is the application of accounting principles, theories and discipline to facts or hypothesis at
issues in a legal dispute and encompasses every branch of accounting knowledge”- AICPA.

“Forensic Accounting is a science that deals with the relation and application of finance, accounting, tax and
auditing knowledge to analyse, investigate, inquire, test and examine the mater in civil law, criminal law in an
attempt to obtain the truth from which to render an expert opinion”- Horty.

Forensic Accounting encompasses the use of accounting/ auditing, investigative skills, data mining and the use of
computer as an audit tool. It emphasizes a forensic approach in place of a risk management/ control approach to
the analysis of corporate governance. It entails a check-up for cyber frauds, prevention and detection.

Forensic Accounting Profession

Due to spate of corporate failures all over the world in recent times, accounting and finance professionals have
greater responsibilities to equip themselves with advanced skills to identify and act upon the indicators of poor
corporate governance, mismanagement, fraud and other wrongdoings.

Forensic accounting is the practice of utilizing accounting, auditing, and investigative skills to determine whether
fraud has occurred. In this capacity, the forensic accountant quantifies damages sustained by parties, whether or
not involved in legal disputes and can assist in resolving disputes, even before they reach the courtroom. If a
dispute reaches the courtroom, the forensic accountant may testify as an expert witness.

Forensic Accounting and Fraud Detection involves extensive use of CATT/GAS, Data Mining and other computer
tools as most data is now processed through computer, in short, forensic accounting requires the most important
quality a person can possess: the ability to think. Chartered Accountants, with their sound grounding in
accounting/ auditing/ business requirements/ legal requirements, are the most appropriate professionals to offer
Forensic Accounting and Fraud Detection services.

Neha Gupta | 1
 Forensic Accounting using IT

Role of Forensic Accountants

Forensic accounting consists of a broad area of financial statement investigation and litigation support. Various
positions including consultants, internal auditors, bankruptcy specialists, bank examiners, and valuators of closely
held businesses, as well as lawyers and professors, can be held by forensic accountants. Among the many services
offered by forensic accountants are:
Litigation Support
Investigative Accounting
Fraud Detection
Computer Forensics
Expert Witness Engagements
Divorce Business Valuations
Lost Earnings Engagements

Some of the other areas in which the Forensic Accountants are involved are:
Criminal Investigations
Shareholders' and Partnership Disputes
Personal Injury Claims / Motor Vehicle Accidents
Business Interruption / Other Types of Insurance Claims
Business/Employee Fraud Investigations
Matrimonial Disputes
Business Economic Losses
Professional Negligence
Mediation and Arbitration

What characteristics should a Forensic Accountant possess?

A capable Forensic Accountant should have the following characteristics:
Curiosity
Persistence
Creativity
Discretion
Organization
Confidence
Sound professional judgment

Techniques in Forensic Accounting

The conventional accounting and auditing with the help of different accounting tools like ratio technique, cash
flow technique, a standard statistical tool examination of evidences are all part of forensic accounting. In cases
involving significant amounts of data, the present-day forensic accountant has technology available to obtain or
source data, sort and analyze data and even quantify and stratify results through computer audit software
applications and various other techniques. Some of the techniques involved in Forensic Accounting are:

Benford’s Law
It is a mathematical tool, and is one of the various ways to determine whether variable under study is a
case of unintentional errors (mistakes) or fraud. On detecting any such phenomenon, the variable under
study is subjected to a detailed scrutiny. The law states that fabricated figures (as indicator of fraud)
possess a different pattern from random (or valid) figures. It states that the leading digit in some

Neha Gupta | 2
 Forensic Accounting using IT

numerical series follows an exponential rather than normal distribution. It applies to a wide variety of
figures: financial results, electricity bills, street addresses, stock prices, population numbers, death rates,
lengths of rivers.

Theory of relative size factor (RSF)

It highlights all unusual fluctuations, which may be routed from fraud or genuine errors. RSF is measured
as the ratio of the largest number to the second largest number of the given set. In practice there exist
certain limits (e.g. financial) for each entity such as vendor, customer, employee, etc. These limits may be
defined or analyzed from the available data-if not defined. If there is any stray instance of single
transaction that is way beyond the normal range, then there is a need to investigate further into it. It
helps in better detection of anomalies or outliners. In this method the records that fall outside the
prescribed range are suspected of errors or fraud. These records or fields need to relate to other
variables or factors in order to find the relationship, thus establishing the truth.

Computer Assisted Auditing Tools (CAATs)

CAATs are computer programs that the auditor uses as part of the audit procedures to process data of
audit significance contained in a client’s information systems, without depending on him. CAAT helps
auditors to perform various auditing procedures such as:
• Testing details of transactions and balances;
• Identifying inconsistencies or significant fluctuations;
• Testing general as well as application control of computer systems;
• Sampling programs to extract data for audit testing,
• Redoing calculations performed by accounting systems.

Data Mining techniques

Data mining has also been called database reporting, data analysis, and other similar names but generally
can be defined as "the automated extraction of hidden predictive information from databases."
It is a set of computer-assisted techniques designed to automatically mine large volumes of data for new,
hidden or unexpected informations or patterns. Data mining techniques are categorized in three ways:
Discovery, Predictive modeling and Deviation and Link analysis. It discovers the usual knowledge or
patterns in data, without a predefined idea or hypothesis about what the pattern may be, i.e. without
any prior knowledge of fraud.

The two recognized tools of data mining are:

• Use of Spreadsheets
Data mining in its simplest form may take the form of a "sorted" Excel spreadsheet where the fraud
examiner tries to identify the largest suppliers or customers. A further development of this is to track
expenditure with the largest suppliers over time. This can be achieved using pivot tables in Excel followed
by the charting function.

• Use of Databases
The next stage in data mining is the use of databases to run complex queries. Microsoft Access is an
extremely powerful tool which many fraud examiners will be able to use. More complex databases
include ACL and WinIdea. These may require specialist knowledge. However, they can analyze large
amounts of data and produce complex queries that can be automated.

Neha Gupta | 3
 Forensic Accounting using IT

Database basics
A database is an organized collection of information that can be easily accessed, managed, and updated.
A database management system (DBMS) such as Access, FileMaker Pro, SQL Server, or Oracle provides
software tools to organize data in a flexible manner. It includes facilities to add, modify, or delete data
from the database, ask questions (or queries) about the data stored in the database and may have
internal tools to produce reports summarizing selected contents.

Relational databases organize data in multiple related tables. Relational databases are NOT "super"
spreadsheets but have some similar functionality. A relational database may be made up of hundreds of
tables that organize different types of information. For instance, in a typical retail operation there are
tables that keep track of customers and others that keep track of orders, but there's not a single table
that contains all customer information. One table has basic customer information such as names,
addresses, and phone numbers, another tracks customers' credit histories, and yet another tracks
individual contact information such as the name of the contacts, the types of discussion, and customers'
special requests. These tables are tied together using a key field such as a customer number.

Designing databases is a detailed science that's outside the scope of this article. But suffice it to say that a
database administrator has techniques that make it easy to pull up information quickly and keep
"normalized" data in tables in specific locations. One rule of normalization dictates that data should be
stored in only one place within a database. Imagine the confusion if a customer's credit limit was stored
in two separate tables or could be updated by multiple processes. It would be hard to determine that
customer's actual credit limit if the data didn't match exactly.

Transactional databases, which have relatively simple record structures, allow many users to read and
make changes. It's easy to quickly pull up on computer screen standard information on a transactional
database such as a customer's order history or other business application. But it's difficult to reconstruct
historical or trend information. Most entities' systems record virtually all transactions, but the data isn't
typically located in one single, comprehensive location.

For mining purposes, data can be pulled from these transactional tables just as if they were stored in a
single table by linking them together through fields that are common to both tables. Fields to be linked
should be of the same data type, and the string/text fields should be the same length. These links are
created through the use of keys.

By using data mining tools, users connect remotely to their database through a method of Open
DataBase Connectivity (ODBC). After the data has been connected through one of the reporting tools and
linked correctly, one needs to narrow the data down to the information that will be most helpful. A query
is a set of criteria that you specify to identify and retrieve data records that meet those criteria.
Structured Query Language (SQL) is a standard interactive and programming language for obtaining
information from databases and updating them. SQL allows users to access data in relational database
management systems, such as Oracle, Sybase, Informix, Microsoft SQL Server, Access, and others by
allowing users to describe the data that the user wants to see.

Some IT tools that help mine for gold

Plenty of third-party reporting tools can help you analyze large amounts of data. But here we'll discuss
some of the important tools which are easy to use, relatively inexpensive, and perform well.

• Crystal Reports

Neha Gupta | 4
 Forensic Accounting using IT

Crystal Reports has been the gold standard for database reporting. It has the flexibility to connect to
almost any data source with a user-friendly interface that makes the digging much easier. Crystal Reports
can graph the data visually at the same time the query returns. It's a tenth-generation reporting tool
originally developed by Seagate Software and now owned by Business Objects. Crystal Reports can
connect to virtually any data source through ODBC or PC data connections. Most importantly, the
connection is read-only when connecting through ODBC. This means that no matter what is done in the
Crystal report, there's no possible way one can corrupt or change the data.

Crystal Reports allows the creation of reports quickly by dragging fields onto a blank report, group and
sort based on database fields or calculated fields, and format a presentation quality report in a matter of
minutes. The report can be quickly refreshed as data is added.

• Microsoft Access
Microsoft Access provides users with one of the simplest and most flexible database solutions on the
market today. Access’ three major components that most database miners require are tables, queries,
and reports. Unlike Crystal Reports, MS Access allows to update the source data and change the data
through queries and manual data entry into tables. In MS Access, one can intentionally or accidentally
change the data. Therefore, while Crystal Reports is purely a reporting and analysis tool, MS Access is
actually a database application that can contain other features to control data rather than a simple
connection to it.

• Outlier Detection
One of the primary methods of detecting fraud is discovering data values that are outside the normal
course of business. The simplest method of outlier detection is the statistical zscore calculation. This
formula, given as (value mean)/ standard deviation, provides a simple and compact method of measuring
outliers. The numerator shifts each point to a zerobased scale, and the denominator adjusts the
distribution to a standard deviation of one. Once the data are transformed into this standardized scale,
generalized statements can be made.

• Advanced Statistical Techniques

These are advanced methods for fraud detection in statistical and computer science field. These methods
include Bayesian Networks, genetic algorithms, state transition analysis, rule matching, and cluster
analysis. Though most of these advanced technical methodologies are not generally used in typical
business systems, they are most often used in highly specialized areas like credit card fraud, health care
claims, and voter fraud.

Investigation tools
Forensic accounting in conducting investigation in this internet era uses many investigation tools. Ranging from
data mining software to data analysis and sometimes the same tools that used by hackers. Here some of those
tools used by forensic accountants:

Helix
Helix is “an internal tool to provide the ability to acquire forensically sound images of many types of hard
drives and partitions on systems running unique setups such as RAID arrays”. However, Helix is different
from many other software imaging because, Helix is developed based on Knoppix (one variant of Linux)
which are open source and free. Helix offers six main options to examine the system under investigation.
These options are described below:

Neha Gupta | 5
 Forensic Accounting using IT

• Preview System Information

• Acquire a “live” image of a System using dd
• Incident Response tools for Operating Systems
• Documents pertaining to Incident Response, Computer Forensics, & Computer Security
• Browse contents of the CD-ROM and Host OS
• Scan for Pictures from a system

ACL Desktop
Audit Command Language (ACL) is the market leader in computer-assisted audit technology and is an
established forensics tool. ACL provides immediate visibility into transactional data critical to
organizations enabling to analyze entire data populations for complete assurance; identify trends,
pinpoint exceptions and highlight potential areas of concern; locate errors and potential fraud; identify
control issues and ensure compliance with organizational and regulatory standards; age and analyze
financial or any other time sensitive transactions; and cleanse and normalize data to ensure consistency
and accurate result.

UltraBlock
UltraBlock is a brand name for forensic write blocker hardware. The purpose of this hardware is to
prevent the digital forensic accounting to modify the data that they accessed. It is very important for
digital forensic accounting to maintain the data submitted to a court as evidence remain authentic.
Therefore when they access and analyse the evidence they have to be very careful not to modify, change
or alter the data. UltraBlock is compatible with all leading software imaging application including Helix,
EnCase or other software imaging.

Advance Hash Calculator

Maintaining integrity of evidence is one of the most things that should be concerned by forensic
accounting. Once the integrity of evidence is questionable, the evidence will lost its power in the court.
The worst case, the admission of evidence in the court will be rejected. One method that can be used to
maintain integrity data in terms of digital forensic is by using hash value. The common hash value
methods are MD5 and SHA-1. These hash value program, are include in forensic software imaging such as
Helix and EnCase. However, Advance Hash Calculator offers more than MD5 and SHA-1 method to
calculate hash value.

Passware Kit Forensic

Passware Kit Forensic is a tool for evidence discovery solution reports all password-protected items on a
computer and gains access to these items using the fastest decryption and password recovery algorithms.
Passware can recovered many password in all files including difficult and strong type password. Passware
Kit Forensic includes a Portable version that runs from a USB drive and finds encrypted files, recovers files
and websites passwords without modifying files or settings on the host computer. Passware Kit Forensic
also able to decrypts BitLocker and TrueCrypt of hardisk. Passware Kit Forensic is suitable for forensic
purpose and maintain the authenticity of evidences.

Other tools
Some other IT tools used by Forensic Accountants are: Encase, FTK, PTK Forensics, The Sleuth Kit, The
Coroner’s Toolkit, COFEE, Selective File Dumper

Neha Gupta | 6
 Forensic Accounting using IT

Evaluation of Digital Forensic Tools

The investigation tools describe above may help forensic accountant to detect, deter and resolve fraud faster.
Golden, Skalak and Clayton (2006) state that handling digital evidence requires establishment chain of custody as
with documentary evidence. Further Golden, Skalak and Clayton (2006) propose the ways to establish chain of
custody such as: by keeping documentation on all procedures and/or applications performed on the digital
evidence, by storing the electronic media in a secure location, by making bit-by-bit image copy of the hard drive
rather than a file system copy, by analysing the copy rather than the original, and by using forensic software to
prove the integrity of the original contents. Most of forensic tools used by forensic accounting can maintain the
data integrity so the authenticity of evidence can be protected. The authentic evidences are admissible in the
court and that is the goal of forensic accounting engagement.

Conclusion
Under contemporary conditions of business activity, frauds and omissions appear as causes of inaccurate
financial statements. Frequent omission are created because of the wrong application of accounting principles in
relation to amounts, types and ways of presenting and publishing certain data with no intention whatsoever to
do the same .In contrast to omissions, frauds represent acts undertaken with the intention to falsify financial
statements. Corporate management, systems of internal control, internal auditing and audit committee
represent the forefront of defense against financial frauds. External auditing and investigations by forensic
accountants represent the second defense line against frauds. It goes without saying that performing the above
defined task presumes the building of a proper system where each segment-institution would have its place and
role.

By applying accounting principles, auditing skills and investigative procedures in solving certain legal problems,
forensic accountants help lawyers, courts, regulatory bodies and other institutions in investigating financial
frauds. Therefore, in order to perform tasks efficiently and compose reports on undertaken investigation,
forensic accountants must possess solid knowledge and skills in the area of accounting and auditing.

References:
- Wiley: Fraud Auditing and Forensic Accounting, 4th Edition- By Tommie W. Singleton, Aaron J. Singleton, G.
Jack Bologna, Robert J. Lindquist
Forensic Accounting and Fraud Investigation for Non-Experts- By Howard Silverstone, Michael Sheetz
- http://www,kpmg.com
- http://www.ey.com
- http://www.indiaforensic.com
- http://www.all-about-forensic-science.com
- http://www.acfe.com

Neha Gupta | 7