The challenge of forensic accounting in the digital economy

Owen Hawkes FCPA does not like secrets, especially those that involve money.

Hawkes is the forensic practice partner at KPMG in Singapore and a former barrister with the British Government’s Serious Fraud Office. He has spent much of his career leveraging what he describes as his chief character flaw.

“I’m basically a very nosy person,” he says. “I like to know what’s happening, especially if it’s a secret, and fraud is obviously a secret no one else is ever supposed to find out about.”

Hawkes has more than 20 years’ experience in regulatory investigation and risk management and has investigated crimes involving bribery, corruption and fraud. He has also undertaken a variety of financial crime and regulatory risk-management engagements to help clients assess and upgrade their organisational controls.

Like many areas of the accounting profession, Hawkes says forensic accounting is evolving with the rise in digitisation. However, while digital technologies are presenting huge advantages for forensic investigations, the speed of change can also make a money trail much harder to follow.

Forensic accountants are typically engaged to investigate fraud or financial manipulation. Their role involves meticulous research and analysis of copious documents and datasets. This can include transaction records and bank accounts to invoices, tax returns, emails and financial statements.

Their investigations can help to trace and recover investor money lost in Ponzi schemes, or to uncover patterns in company financial reporting practices. Forensic accountants may also be called upon to uncover hidden divorce and marital assets or to determine that the books are in order during mergers or acquisitions.

Some companies engage forensic accountants if they suspect a worker has stolen money. They could also potentially be engaged to investigate the authenticity of environmental, social and governance (ESG) reporting.

Not all forensic accounting engagements end in a formal litigation. However, forensic accountants are generally required to produce information that would stand up in court and that clearly explains complex information.

Some forensic investigations do not uncover criminal activity, Hawkes adds. Sometimes, people make innocent mistakes.

“You may launch a fraud investigation and come to the conclusion that a system isn’t perfect, or someone has misfiled things or misrecorded things,” Hawkes says.

“One of the core skills for a forensic accountant is an ability to distinguish between what you actually know and what you might assume you know.”

More data, more evidence

Digital technologies are helping to answer “challenging and thorny questions” during investigations, and sources of data have grown exponentially, says Nick Maginot, partner in EY’s forensic and integrity services and leader of EY Oceania’s forensic data analytics offering.

“About 15 years ago, you were relying primarily on standard ERP [enterprise resource planning] systems for things like payments data and general ledgers,” Maginot says. “Now, the variety of data sources has exploded.

“If you think of a workplace investigation, you are now no longer just looking at somebody’s emails. You might have online chats, badge swipes in and out of the office and other system artefacts that show how someone interacted with different systems or accessed different files.

“It is this variety of data that can support investigations and help to either prove or disprove allegations,” Maginot says. 

Hawkes adds that digitalisation is also improving the quality of evidence.

 

"You are now no longer just looking at somebody’s emails. You might have online chats, badge swipes in and out of the office and other system artefacts that show how someone interacted with different systems or accessed different files. It is this variety of data that can support investigations and help to either prove or disprove allegations."

 

“The more processes that are digitised, the more audit logs there are that go with those processes,” he says. “You may be able to tell when somebody is cheating on the data by whether they have amended it, for example.

“It can be high-quality evidence, because a person who creates it may not know that it is being created. If you are interviewing someone and they do not know that data has been automatically created by a system, you will catch them lying much more easily. They won’t know the information is there to contradict them.”

Fraudsters can also fail to hide their digital footprints.

“I think back to investigations that I’ve done where we’ve collected someone’s mobile phone, but they’ve deleted everything from it,” says Maginot.

“They will say that they do not have messages or photos on their phone, or that maybe it fell in the bath. However, what they have not thought through is that they had plugged that phone into their laptop and created a backup at a point in time.

“We can go onto their laptop and get access to everything that they have recently deleted from that phone.”

The digital economy has broadened the scope and quality of forensic evidence, but it has also presented new challenges.

Forensic accountants used to take a copy of the contents of a company’s server for analysis.

Today, data is often stored on a remote server managed by a third-party vendor, and Hawkes says there may be legal issues around downloading it.

“More potential evidence is not always a good thing,” Hawkes says. “It can certainly expand the amount of time you spend on investigations.”

When forensic investigations rely more on physical evidence, Melissa Lau FCPA carefully studies documents for signs of fraud.

A partner at Jirsch Sutherland in Brisbane, Lau specialises in corporate insolvency and restructuring, as well as fraud, forensic investigations, due diligence and business valuation. She recalls noticing something “fishy” while examining paper invoices during a due diligence case several years ago.

“In this particular case, a company was faking invoices to bump up their sales figures,” she says.

“I could see that invoices had been outstanding for more than five or six months.

 

"One of the core skills of a forensic accountant is an ability to distinguish between what you actually know and what you might assume you know."

 

“When I asked to look at them, the paper looked very new, like the invoices had been printed a few days ago. A real invoice would have had finger marks or coffee stains on it, but I could almost smell the ink on these ones.

“Now, when invoices exist in the cloud, it’s harder to tell if they’re fake,” says Lau.

Hawkes adds that the pace of technological change also presents challenges for forensic accountants.

A significant part of the general public do not fully understand some businesses or their processes, he says.

This lack of understanding can create an inability to identify what a fraud risk is or when something unusual is happening.

“The speed of transactions also means that you can have stolen money and have moved it around the world 50 times before I’ve finished my morning coffee,” he says. “Tracing the proceeds of crime has become very difficult and recovering it has become near impossible in a lot of cases.”

The introduction of digital currencies creates further complications.

“Cryptocurrencies are mostly stored on a blockchain, which is generally public, so, theoretically, all the information is there for you to access,” says Hawkes.

“The challenge with cryptocurrencies is linking an account to an individual. Until you know who owns the accounts that are engaging in the transactions, you have a problem.”

Tools of the trade

When forensic investigators have gathered their evidence, they need to present it in a way that people can clearly understand. Hawkes says there are three main ways to do this. The first is to simplify the information.

“Forensic accountants are generally not speaking to people who understand or care exactly how you go about your work or the nuances of the data,” he says.

“They just want to understand what has happened.”

Clarity is also vital, Hawkes adds.

“You might not know the answer to a question, but your client needs to come away with confidence about why you don’t know. Ambiguity is fine if it is evidentially correct.”

Information must also be actionable, Hawkes says.

“What you communicate has to be strategic, based on what your client needs to do as a result of the incident that’s being investigated,” he says. “Usually, it’s to decide how to get money back, whether they’re going to have to report to a regulator, or whether they’re going to have to fire someone.”

A curious mind

Digital technologies are reshaping the work of forensic accountants, but Lau believes the role will always demand a curious mind and a willingness to get to the truth.

“Forensic accountants like to get their hands dirty in order to get a view of the numbers,” Lau says. “In the due diligence case I worked on, when I was not satisfied with the authenticity of the invoices, I visited the warehouse to look at the stock movement.

“Where was the evidence or the matching documents to prove that there were goods being delivered to these parties?

“I think it’s important to understand how a business operates, and then if you see that something’s missing, it triggers a red flag,” Lau explains. 

Hawkes believes there are other principles of forensic accounting that more finance professionals can apply to their own work.

“Professional scepticism is one of them, but you also need to accept that people have different perspectives.

“One person’s recollection of the same set of events will be different from the next. You also need to have a willingness to bring secrets and lies out into the open,” he says.

“You have to be curious and willing to pull on threads to see what unravels at the end.