Please give this within 30 hrs.
1. Read the Chapter 7 reading.
2. Write a write-up outlining ( small article) the major points, 3-5 point for this chapter.
3. This paper should be more than 1 page.
4. Times New Roman, 12 pont, Double space.
Due on Wednesday, September 29, 2021, befroe 11 pm, US central time (Chicago).
There are almost 36 hrs to complete this.
only one transaction. The next question I had was how the bank
account could have balanced and reconciled within QuickBooks
without the identified transaction on the bank statement.
I retrieved my laptop and booted it again, expecting to find one
of two things. Either the account was not balanced and reconciled
within QuickBooks as thought, or a transaction had to have been
entered into QuickBooks using different information from the
United Alliance payment, allowing the account to balance and
reconcile. Once I was back into the division’s QuickBooks file, I
scrolled through the operating account register to the date of the
payment on the bank statement. Sure enough there was a posted
transaction in the register for the same date and the same dollar
amount. However, rather than being a payment to United Alliance,
the transaction was posted as a general journal entry. The entry
included the following description, ‘‘Draw—Controller’s Name.’’
The entry and amount was posted to the ‘‘Office Expense’’ ac-
count. I scanned the rest of the register of the operating account
for similar entries. None were found. I printed the general journal
entry and placed it into a clear sleeve, then attached an evidence
sticker to the sleeve. I labeled the evidence sticker with the date,
time, location, and description, and placed the sleeve with the
Having found the first sign of activity relating to the United
Alliance account being concealed from detection, I realized the
lateness of the day and decided to end on that note. I put the
organized bank records back into each respective box, and brought
the boxes back to the storage room. Once all the boxes were inside, I
locked the door and sealed it with evidence tape. I noted the date
and time in my notebook, then returned to the room to make more
notes on my findings. I decided I would sit on the latest findings until
tomorrow, after I had spent more time going through the bank
statements and information in the boxes.
! ! !
At home that evening, I revisited my notebook and read through the
day’s notes. I added more details and described how I had found the
payment to United Alliance on the bank statement, as well as the
concealed United Alliance payment within QuickBooks.
Importance of Documentation (Keeping Track of Things) 93
The next morning I returned to the boxes. I met the senior
accountant and brought him up to speed with my previous day’s
findings. I left the senior accountant with the boxes and found
Tim. I reviewed the various bank accounts identified by each
bank with him. I changed my mind about waiting, and shared
with him the concealed United Alliance payment. Tim seemed
pleased that pieces of the puzzle were starting to come together. I
asked Tim where he stood with the request for the controller to
sign for the United Alliance statements, and he said the request
was finished and forwarded to counsel for review and approval.
Tim said that once the request was approved, he would contact the
controller to set up a date and time to discuss the financial analysis
of the division.
I returned to the senior accountant and went to work with the
bank account listings and boxes of evidence. I retrieved the boxes
from the storage room, noting the date and time I broke the seal on
the door. I put the piles back out on the tables from yesterday, and
started to match up the bank statements with the listed bank
accounts. I retrieved more boxes containing financial information
and sorted through the contents, putting any bank accounting
information into stacks on still more tables to ensure I kept each
box’s contents separate. It became apparent that the division main-
tained far too many bank accounts, and as an aside I made a note to
recommend the division consolidate the bank accounts into a
minimal number of accounts.
By now you should have noticed that I never left the collected evidence
alone or unattended for any time. In order to ensure the chain of custody
(discussed earlier) remains intact, protecting the admissibility of the
evidence, the evidence needs to remain secured at all times until presented
in court. In the event the evidence needs to be removed from a secured
storage location, it must be attended at all times, and never left alone in a
room, let alone in a car. Properly maintain chain of custody accounts for
the evidence’s movements, from the time it is collected to the time it is
presented in court.
94 Anatomy of a Fraud Investigation
Working with the senior accountant, it wasn’t until later in the
day that we were able to match all the piles to the listed bank
accounts, and identify the accounts that we had not found any
information for. As we found information pertaining to each bank
account, we found the same account on the lists provided by the
banks and highlighted the listed account in yellow. As I scanned the
lists for any accounts that were not highlighted, I saw one account
that was provided on the list that was labeled closed. The listing
indicated the account was closed three months earlier.
I wanted to know why I didn’t find any bank statements or other
information for this account, so I left the senior accountant with the
boxes and brought the listing to Tim. Tim indicated the identified
account was included with all the other accounts for which Tim had
already requested monthly statements. Knowing that it could take up
to 12 weeks for the bank to produce the requested statements, I
asked Tim to make a special request of the bank for that one
particular bank account, to see if we could get access to the bank
statements sooner. Tim said he would go over to the bank and see
what they would do for him for that one account.
! ! !
When I returned back to the boxes, the senior accountant indicated
the human resource director had called looking for me. He said she
was out at the division, and that I was to call her once I received
According to Black’s Law Dictionary, chain of custody is defined as ‘‘the movement and
location of real evidence, and the history of those persons who had it in their custody, from
the time it is obtained to the time it is presented in court.’’1
‘‘Chain of custody requires testimony of continuous possession by each individual
having possession, together with testimony by each that the object remained in
substantially the same condition during its presence in his possession. All possibility
of alteration, substitution or change of condition need not be eliminated. For example,
normally an object may be placed in a safe to which more than one person had access
without each such person being produced. However, the more authentication is
generally in issue, the greater the need to negate the possibility of alteration or
Importance of Documentation (Keeping Track of Things) 95
the message. I went to the phone in the corner of the room and
The human resource director told me that the office manager
called the division returning my message, and provided me with a
phone number where I could reach him. I asked her if there was any
substance to her conversation with the office manager, and she said
there was no conversation.
I hung up with her and called the number she provided. A male
answered, and I asked if I had reached the office manager. He
asked who was calling, and I told him my name. I asked him if we
could set up a time to meet to discuss the financial aspects of
the division. He asked me if he had to meet with me. I told him he
didn’t have to do anything, but also reminded him that he was still
an employee on paid administrative leave, and that if he did not
meet with me, I would forward that information to the human
resource director. He asked me what we would talk about. I told
him we would discuss the financial operations and bookkeeping
procedures of the division, as well as the roles and responsibilities
of the individuals who worked within the division. He asked me
where we would meet, and I told him we should meet out at the
division, so that if there was any information he needed to get
regarding the division, he would have access to it (he likely didn’t
know the extent to which we had removed the financial documen-
tation from the division, as the mole didn’t have access to those
areas and no one was present when we removed all the documents
that first day).
He agreed to meet, and asked when I wanted to meet. I
suggested we meet tomorrow morning, 9:00 A.M., as I already
had something to do today in the afternoon (and I knew I wanted
to ensure we had an entire day to meet if needed without running
out of time in the event he had to be somewhere today). I really
didn’t have anything in the afternoon, but he had no way of
knowing that, and I wanted time to prepare for the interview. I
also wanted to keep the office manager in suspense a bit longer,
rather than satisfy his need for knowledge on the same day he
called and spoke with me. Anxiety is a good thing.
He agreed to meet, and we scheduled our meeting for the next
day, first thing in the morning at the division. He hung up and I
retrieved my notebook to document the call. Then, I shared the
call with the senior accountant who had heard most of it anyway
96 Anatomy of a Fraud Investigation
because he was in the same room with me. I called the human
resource director, and asked that she come back to the division to
meet me early tomorrow morning to let me in, as well as to act as
a witness if needed during the interview. She said she would be
out there anyway making a deposit and going through the bills to be
paid by the division.
I left the senior accountant with the boxes and went to find Tim. I
stood in his doorway while he finished a call, and sat down in front of
his desk after he waved me in. Once he finished the call I told him I
had just spoken with the office manager, and that I would be meeting
him in the morning.
! ! !
Without the bank records for the identified account and the United
Alliance statements, I turned my attention to preparing for tomor-
row’s interview with the office manager. I returned to the senior
accountant, and together we put the records back into the boxes.
Once we returned all the boxes to the storage room, I sealed the
room again, noting the date and time in my notes. The senior
accountant went off to work on other things and I returned to my
notebook to review my notes from my initial interaction with the
I spent the rest of the afternoon preparing an outline and notes
of issues I wanted to discuss with the office manager. The three most
important questions I had to resolve were as follows:
1. How much activity went through the United Alliance account
and for how long?
2. How was the United Alliance account paid each month?
3. Where did the funds come from to pay the United Alliance
I listed out the areas where the office manager had provided
inaccurate, misleading, or outright deceptive responses during our
interview on the first day. Things like no credit card and no new
bank accounts. I wanted to see if he would tell me what his
relationship was with the controller, as well as the women in the
office, including the woman who worked right alongside him and
cried all the time, and the woman who charged personal activity on
Importance of Documentation (Keeping Track of Things) 97
the United Alliance card (a.k.a. the mole). I also wanted to deter-
mine what else may have been happening at the division beyond
the United Alliance account. It is not unusual for interviewees to
provide knowledge of other fraudulent or illegal activity, especially
if it is perceived to take the focus and heat off of them (at least for a
As I thought about the upcoming interview in the morning, I
called the human resource director to see if she was going to be out at
the division until the end of the day. I wanted to walk through the
space and offices again with this interview in mind, and select the
most appropriate location to have the meeting. She answered and
indicated she would wait for me to come out. I finished making notes
on what I wanted to accomplish and headed out to the division.
I arrived at the division to find the human resource director
working at the office manager’s desk, reviewing the mail and sorting
bills to be paid just as she said she would be doing. We talked about
my call with the office manager for a few minutes, and then I walked
through the division looking at each office. The office I had used to
conduct the interviews with the other employees was good for that
purpose, quiet and secluded, but it was a distance from the office
manager’s desk. I was concerned about being that far away should
the interview not go well. I wanted a space that was private, yet close
enough to the human resource director. It had to be away from his
work area where he could find comfort if he became stressed, and yet
To ensure an effective interview, you must prepare in advance for the
interview, provided the interview wasn’t needed to be conducted on a
spontaneous basis, which is rarely the case. Identifying the areas that need
to be covered, questions to be asked, and issues to be resolved will help ensure
nothing is missed due to a lack of memory. The entire interview doesn’t need
to be written out, but a general outline will help ensure all areas are covered
prior to ending the interview. In many cases, you will only get one chance at
an interview, so best to plan as if each interview will be the only interview that
will be conducted.
Planning should also encompass the physical environment and details
for the interview, as discussed earlier and below.
98 Anatomy of a Fraud Investigation
include no distractions. I decided on the office immediately adjacent
to the office manager’s desk. The human resource director could
work right at his desk just outside the office, and if needed, could
come in within seconds. I also figured with her working right outside
the office, she would be able to hear everything said during the
interview (my hunch was proved to be correct after the interview was
finished). I sat at the table and determined where I would sit as well
as where I would have the office manager sit. I then sat in the seat I
identified for the office manager, and looked around the office for
any distractions potentially available to him. I moved things from in
front of where he would be sitting to shelves behind him. Other
things were moved into boxes and put away, leaving as little as
possible in the office.
Once I thought I was finished, I asked the human resource
director to come in. I had her sit in the chair identified for the
office manager, and asked her what she thought were distractions. I
moved everything she identified. Then, I sat in my seat and thought
about the office manager sitting across the table from me. I asked
the human resource director a few questions, and looked to see if I
had any distractions that could take my attention from the office
manager. All the things I had moved behind the office manager’s
seat needed to be moved again, as I could see myself looking up at
them while listening to the office manager (I was looking at them
already while listening to the human resource director).
I had the human resource director return to the office
manager’s desk, and asked her to listen to me while I talked
on my cell phone. I closed the door and called a friend. I talked at
a normal tone with my friend for a minute or two, and then I went
out to ask the human resource director if she had heard what I was
saying. She had heard everything, and I wasn’t speaking loudly on
With the office chosen and set for the morning’s interview, I
turned off the lights and grabbed my things to leave. I asked the
human resource director to meet me in the morning at the division
at 8:15 A.M., to provide me with a solid half-hour of preparation time
prior to the interview. I asked her to be prepared to come into the
interview if needed, especially if the office manager confessed or
provided some information that could immediately impact the
current employment status (paid administrative leave) of any
Importance of Documentation (Keeping Track of Things) 99
She said she would be working right outside the office and
would hear everything. She said she could be in the meeting within
seconds if there became such a need. I thanked her and headed out
the door. It was the end of another long day.
Planning for an interview should also encompass how to document the
interview, having supplies on hand such as a pad and pen, and considering
‘‘what if’’ scenarios. For instance, what if the interviewee admits to some
wrongdoing during the interview? Are you prepared to have the interviewee
write out in detail his story? Will someone be available if needed to witness
and/or notarize his written statement if one is provided? What happens if the
individual admits to wrongdoing, and the plan is to place the individual on
paid administrative leave pending a decision on his fate with the organiza
tion? Will someone appropriate with human resources responsibilities be
available to place the individual on leave? Once the interview has begun, it
may be too late to have these issues addressed on the spot. The best case
scenario is to have contemplated these types of issues in advance, and if
needed, execute the plan. The worst case scenario is that resources are
prepared to act, but end up never needing to react.
100 Anatomy of a Fraud Investigation
7C H A P T E R
IMPORTANCE OF DOCUMENTATION
(KEEPING TRACK OF THINGS)
Knowing nothing was likely to happen at the division for the rest of
the afternoon, I went back to the office I had used for the interviews.
It was quiet and secluded, and I knew that I had two things to
First, I needed to check in with Tim to determine what he was
doing regarding bank accounts, credit card accounts, and other
related information. We had confirmation from the interviews that
the division used a United Alliance credit card account with multiple
cards issued on the account. We didn’t have all the credit card
statements or supporting charge information, but we had the full
account number from the statement provided by the informant. We
needed to determine how much volume had been going through
that card and for how long.
I also needed Tim to request a search of the banks for any bank
accounts we did not have bank statements for. He could start by
having the known banks provide a listing of any and all current and
past accounts in the name of the division, using the division’s federal
identification number (or tax identification number) as the identi-
fier of any accounts belonging to the division. Once we had a listing
from each bank of all the accounts, we could then compare the
records in the boxes to determine if all the statements had been
found. One goal was to determine how the United Alliance card had
been paid each month.
Second, I needed to catch up on my documentation for the files.
My notes in my notebook were good, but more detailed documenta-
tion was needed for the files to support the investigation, especially
knowing that the results and consequences of these types of investi-
gations were commonly contested by the target, likely leading to civil
litigation potentially years down the road. The better and more
It is one thing to identify unauthorized, non business related personal
charges on a company credit card. It is another to determine how the charges
were paid. Simply doing one without the other could lead the investigator
and the investigation to have problems.
It is not uncommon for a credit card to be paid with multiple checks, one
from the business and one from the person who charged personal items on
the account. It is also not uncommon for the business to pay 100% of the
credit card balance, and have the person who made personal charges provide
the business with payment to cover the personal charges. Although paying for
the charges doesn’t undo the fact that personal charges were made on the
account, the fact that the business suffered no financial loss will have an
impact on the findings.
When it comes to credit card activity, it is important to determine the
1. The business maintained a written policy regarding the permitted uses
for the credit card.
2. Individuals with access to the credit cards had knowledge of the policies,
including permitted and prohibited uses.
3. Charges on the account were identified and determined to be not
business related (i.e., personal in nature).
4. The charges were attributable to an identified individual with access to
the credit card in question.
5. Supporting receipts and documentation for the charges identifies that
the charges were personal in nature and had no business purpose.
6. The targeted individual did not personally pay for the personal charges,
either directly to the credit card company or to the business as
7. The business paid the full amount of the credit card payments, and there
were no repayments made personally by the individual to the business to
cover the personal expenses.
88 Anatomy of a Fraud Investigation
detailed my documentation was for the files while it was fresh in my
mind, the better my recollection would be two or three years down the
road when I could be potentially testifying at a trial.
I shut the door and called Tim on his cell phone. He was in his
office. I discussed the United Alliance account with him, and he
said he had already spoken with customer service at United Alli-
ance, and that they would provide the statements only to the
individual named on the account. Tim said they would also provide
the statement details if they were provided a valid subpoena or a
search warrant. I knew that since a civil or criminal matter had not
yet been initiated in this matter, the subpoena and search warrant
options were not actual options at this time. That would leave us
only the option of a request from the controller himself to United
Alliance, or at a minimum, a request signed by the controller to
United Alliance for copies of the monthly statements for the
account. Tim said he had already started drafting a request to
present to the controller to sign, and I indicated I had one from a
previous case if needed. I told Tim to make sure the request
authorized United Alliance to provide copies of the information
directly to Tim. Once drafted, the question that would remain was
whether the controller would be willing to sign the request.
I asked Tim where he stood with the division’s known bank
accounts. Tim said he had all the accounts successfully changed
earlier in the day, and that he was now an authorized signer on all the
known accounts. I asked Tim if he had already requested a search by
each bank for any and all accounts to determine if other accounts
existed. Tim said he had already obtained that information, and
reviewed the identified accounts to ensure he had been added to
each identified account. I asked Tim to provide me with a copy of
each bank’s listing of accounts, so I could compare the identified
accounts to information contained in the boxes.
Tim said he received a voice message from the informant
earlier in the day, and that he had spoken with the informant
by telephone. Tim said he asked the informant if they knew how the
United Alliance account was paid each month. Tim stated the
informant said they did not know how the United Alliance account
was paid or where the records were stored if they were not found
within the office manager’s desk along with the bank statements
and other paid bills. Tim said the informant also told him that they
had spoken with the woman responsible for program-related
Importance of Documentation (Keeping Track of Things) 89
activities (the woman who admitted to using the card for personal
purposes), and that she told the informant that she had been
talking with the controller and the office manager each day by
telephone. The informant told Tim that the controller and office
manager called her at home each night to determine what was
happening and both had assured her that they would be cleared of
any wrongdoing, that there was nothing to be found, and that they
had done nothing wrong or improper.
I finished my call with Tim and reviewed the day’s interview
notes. I went back through each page of notes, and added further
details to each interview not already documented. I added entries
for the message left for the office manager requesting to schedule a
meeting. When I finished, I went to find the human resource
director. She was sitting at the office manager’s desk going through
the division’s mail and invoices. I asked her to come into the office
for a minute, and once there, shared with her the information
provided by Tim about the woman (a.k.a. ‘‘the mole’’) at the
division. I told her we should be careful going forward about
what we talk about and where we talked so as to not provide any
further information to the controller or office manager through
the woman. I also asked her if she thought it made sense to bring
her in and ask her more questions, especially directed toward her
potential relationship with the controller, the office manager, or
both individuals. The human resource director thought we should
simply be more careful not to discuss anything at the division, and
let the woman continue acting as she has to see what if anything
happens with her. I agreed we would wait to talk with her again after
we received the United Alliance statements and knew better the
extent of her personal activity on the United Alliance account paid
by the division.
! ! !
I left the division and returned to the main office to continue
reviewing the box contents, focusing on looking for how the United
Alliance balance was being paid. I also wanted to access the Quick-
Books files again, to look for any signs of the United Alliance activity. I
found the storage room sealed with the evidence tape intact the way I
had last left it. I noted the date and time in my notebook, and broke
the seal covering the door. I found the inventory listing and identified
90 Anatomy of a Fraud Investigation
the boxes that contained bank statements and supporting informa-
tion. I carried each box into the designated room, and locked the
storage room. I also turned on my computer and accessed the copy of
the division’s QuickBooks files I had made with the forensic computer
specialist prior to returning the computers to the division.
I looked through the chart of accounts (the listing of every
account within the QuickBooks company file), the vendor listing
(for both active and inactive vendors), the ‘‘Other Names’’ listing
(one-time vendors both active and inactive), and the other lists
within QuickBooks. I didn’t find any activity for United Alliance.
Using audit tools and reports available within QuickBooks, I
reviewed the voided, changed, and deleted activity to see if the
United Alliance activity had been changed or deleted. There was
minimal activity and clearly nothing that related to United Alliance
payments. It seemed as if the United Alliance activity was never
posted by the division within their QuickBooks files.
I shut down my laptop and turned my attention to the first box in
the room. I emptied the contents on a long table and began sorting
the records. The box contained bank statements for several bank
accounts at the bank primarily used by the division. Based on the
volume of transactions, I determined that at least one of the accounts
QuickBooks is a powerful and commonly used accounting package suitable
for small to medium size businesses and organizations. Accessing informa
tion within QuickBooks and generating reports can’t be any easier. However,
the trade offs for ease of use and access come in the form of lack of controls
over the integrity of the information contained within QuickBooks. Quick
Books is the only accounting package I know that allows users to change or
delete transactions after they have already been posted, allowing transactions
and information to be easily manipulated. In the hands of an individual
committing fraud and seeking concealment of his scheme, QuickBooks easily
fits the bill for a desired accounting system. The key to relying on any
information generated from QuickBooks is corroboration. Generate the
reports, but before relying on them, you need to reconcile them to other
information, such as bank statements and canceled checks, to ensure the
integrity of the information generated from QuickBooks.
Importance of Documentation (Keeping Track of Things) 91
was the division’s primary operating checking account. I started a
pile for statements containing that account number, and segregated
the other statements and information by account number, resulting
in several growing piles on the table. Once I had sorted all the
contents into piles, with one pile designated for nonspecific infor-
mation, I re-sorted the operating statements into sequential order by
month and year. I checked through the dates of each statement, and
it appeared I had all the monthly statements as far back as the last
fiscal year-end, which made sense since the division’s files should
have been maintained by fiscal year.
Anxious to see if there was any activity relating to United
Alliance within the operating account bank statements, I started
scanning each month’s statement, starting with the earliest month.
I scanned the deposits, checks, and electronic withdrawals, looking
for any activity with United Alliance. I found nothing in the first
month. I continued to the second month, and proceeded month
after month until I had reached the end of the stack. There was
nothing paid from the operating account to United Alliance during
this fiscal year.
Still anxious to see if any payment had ever been made directly
from the division’s operating account to United Alliance, I found
another box that contained financial documents. I put the box
contents on a separate table and sorted the contents. I found similar
statements for the same bank accounts, but for the last fiscal year. I
sorted the operating statements by calendar month, and started
reviewing where I had left off, working backwards this time from the
latest month to the earliest month. It wasn’t until I reached the
eighth or ninth statement, which would be within the first few
months of the last fiscal year, that I identified an electronic payment
made to United Alliance on a statement. I knew a common method
to process credit card payments was to have them withdrawn elec-
tronically from the bank account, and had a hunch that if I looked
long enough I would find activity linking the United Alliance
account to a bank account.
The payment was not a large payment, merely a few hundred
dollars, not nearly the dollar level I had envisioned based on the
information that had been provided by the informant. It was, none-
theless, a payment, and in order for me to link the United Alliance
account to a bank account belonging to the division, I needed to find
92 Anatomy of a Fraud Investigation
Why Choose Us
- 100% non-plagiarized Papers
- 24/7 /365 Service Available
- Affordable Prices
- Any Paper, Urgency, and Subject
- Will complete your papers in 6 hours
- On-time Delivery
- Money-back and Privacy guarantees
- Unlimited Amendments upon request
- Satisfaction guarantee
How it Works
- Click on the “Place Order” tab at the top menu or “Order Now” icon at the bottom and a new page will appear with an order form to be filled.
- Fill in your paper’s requirements in the "PAPER DETAILS" section.
- Fill in your paper’s academic level, deadline, and the required number of pages from the drop-down menus.
- Click “CREATE ACCOUNT & SIGN IN” to enter your registration details and get an account with us for record-keeping and then, click on “PROCEED TO CHECKOUT” at the bottom of the page.
- From there, the payment sections will show, follow the guided payment process and your order will be available for our writing team to work on it.