Forensic Audit

Case studies
ICAI Vadodara 2013

Chetan Dalal

A WARM WELCOME TO
ALL
Thank you to Vadodara Branch
and members of ICAI
From Chetan Dalal

Very Important to
remember:

All case studies / exhibits / example are

adaptations of real life situations, and any
resemblance or use of any name, logo or
symbol of any entity is purely for academic
purposes and to facilitate better
understanding. Case studies discussed in the
seminar are imaginery and at no point is
there any direct or indirect implication of
fraud in or by any entity referred to
anywhere.

Agenda
1.

2.
3.

4.

5.

Forensic Audit: introduction and traits of a

forensic accountant and forensic
accounting and examples of some unusual
frauds in business world
Fraud and manipulations in excel reports
Simple forensic tests which can be
conveniently used to detect fraud
Red flags and early warning bells of
possible fraud
Unusual methods of investigating

1. FORENSIC AUDIT: WHAT IT

MEANS AND WHAT ARE THE
TRAITS OF A GOOD FORENSIC
ACCOUNTANT OR AUDITOR?

Forensic Audit-

Technical definition-Wikipedia, the free encyclopedia

Forensic accounting is the specialty practice area
of accountancy that describes engagements that
result from actual or anticipated disputes or litigation
. "Forensic" means "suitable for use in a court of
law", and it is to that standard and potential outcome
that forensic accountants generally have to work.
Forensic accountants, also referred to as
forensic auditors or investigative auditors,
often have to give expert evidence at the eventual
trial.

Forensic Audit is all

about examination and
collection of evidence
admissible in a court of
law. It utilizes the
following skills of CAsAccounting
Auditing
Investigating

What distinguishes a forensic

audit from a normal audit?

Forensic audit is issue based or related to a specific

problem
It has several components and could include any or
all of the following:
Financial and accounting review
Digital forensic analysis
Field investigations
Data mining at an advanced level
Application of Interviewing skills
Technical assistance such as handwriting, specimen
signatires, QC evaluation etc

Audit relies on documentary evidence, whereas a

forensic audit actually examines the reliability of
documentary evidence itself

For example a bank manager

committing suicide on desk with a
suicide note under his hand

The most important traits of an

investigator

Distrust the Obvious

Think differently and Develop an open
mind
Look from different angles and all sides.
You will get a different revelation

Common reasons why fraud goes

unnoticed and forensic audits are needed

1.
2.
3.
4.

Fraudsters/ deceivers are Intelligent

Technology
Stale procedures syndrome
Lack of perseverance

Two facets which are applicable

to all investigations

Use of desktop internet investigation (useful

in audit too)

Use of the theory of impossibility and

absurdity to detect fraud.

If an investigator habitually applies these his

success rate will increase phenomenally.

Concept of desktop audit and

investigation
This is a technique you must use to conduct
verifications, research and information
regarding vendors, products, third parties,
and almost anything you are auditing or
investigating
Do this as frequently as possible to spot
forgeries or establish the authenticity of
third parties, entities, documents such as
invoices, letters, agreements, wills, old
records, title deeds, letters of guarantee,
LCs, and on rare occasions forgeries in
passports, treasury bonds, fixed deposit
receipts from banks etc

Apply the theory of absurdity

and impossibility
When you identify what is not possible or
very unlikely, the fallacy or deceit in given
submissions will be exposed.
Also, in investigations evidence is often
destroyed or changed or altered or hidden.
To find the supporting evidence is therefore
practically difficult.
Make it a habit to think of what is not
possible or impossible or unreasonable

2. MANIPULATIONS AND
FRAUD IN SPREADSHEETS
Example using Excel Sheets

An illustration of presentation
fraud in a spreadsheet

Consider a spreadsheet containing some

data of two years comparisons
The CEO wanted to show a good
performance.Excel-Book1_cd.xlsx
Excel Forensic.xls
Star-Contest-Result.xlsx

3. SOME SIMPLE FORENSIC TESTS

- Juxtaposition test for testing authenticity of documents
format and content
Test of reasonableness or absurdity
Test of replication of content
Test of impossibility
Scrutiny of suspicious documents particularly those
having alterations

Test of IMPOSSIBILITY:
identify events which are not
possible and check them out
For example: Can be applied on volume of
stocks in a warehouse or production with
actual machine capacity

Scrutiny of Alterations and

suspicious documents or
large value cash payments
Forensic study of alterations try and
discern consistency of cancellations,
smudges, spaces and overwritings

Juxtaposition test

In simple words it means placing side by

side for comparison and spotting
differences, where there should be none.
This can be very effective in spotting
manipulations

Where would one apply the juxtaposition test?

Document comparisons: Contracts agreements copies

lying with different departments
Vendor letterheads, bills and letter formats- all bidderss
documents and search for common addresses, telephone
numbers, fax numbers, fax/tel numbers, email addresses?
HR frauds- Juxtapose degree certificates, signatures on
certificates, multiple reference letters, etc
Fictitious Expense or purchase bills. Juxtapose bills from
large volume vendors
Documents lying in multiple departments- eg copies of
minutes of meetings or letters or memoes issued to
different departments
Signatures on important documents

Test of absurdity or
reasonableness
Think of events which may be
possible but not probable. Can a
person arrive and depart at exactly
the same time every day ? If
smart/swipe card analysis shows
such a pattern it is likely to be a
phantom employee

4. EARLY WARNING BELLS AND RED

FLAGS

Close nexus with suppliers, customers and third parties

Missing records, details, etc
Discrepancies in inventories, cash, and assets
Behavioural indicators- chronic late sitting, arrogance and known
bad habits like gambling, alcoholic traits etc
Too much of power and authority in one or few individuals

Mismatch between standard of living and known sources of income

Arrears and sloppiness in bookkeeping, reconciliations etc

Common accounting
manipulations likely in
Cash Contras
Stock in transit
Accounting favours to debtors
Non reversal of stale cheques to create
secret reserves
Not redepositing unpaid cash expenses
such as wages, reimbursements etc
Recycling of petty cash advances or IOUs

Bombay Br

Purchases
Staff Recruitment & Training

Delhi Br

2076689

Kolkatta

1427286

Chennai

BOM-ser

Lucknow

Pune

1041919
576109

1972854
501215

1017578
365887

1723652
547304

1993621
282293.4

Travelling Exp - Foreign

493068

428969

313147

468415

241603.3

409246

473345

Repairs & Maint

437968

381032

278153

875936

214604.3

363513

420449

Printing & Stationery

379100

329817

240766

360145

185759

314653

363936

Travelling Exps

301765

262536

191651

286677

147864.9

250465

289694

Tel / Mobile / Internet

116954

101750

74277.5

111106

57307.46

97071.8

112276

Electricity Charges

120000

104400

76212

114000

58800

99600

115200

Communication - FBT

106953

93049.1

67925.9

101605

52406.97

88771

102675

Discounts given

105873

92109.5

67239.9

100579

109023

87874.6

101638

Discounts on sales
Vehicle Running & Main - R

206902

180005

131403
249529

196557
217090

101382
158476

171729
237053

198626
122269.2

Subscription Charges

143399

91072.7

136229

70265.51

119021

137663

124757

Funds transferred- Kolkatta

250000

Funds transferred- Pune

50000

Funds transferred- Chennai

125000

Funds transferred- Delhi

Stock in transit to Kolkatta

1437477
500000

5. UNUSUAL METHODS OF
INVESTIGATING

Thirteen point programme to

detect symptoms of fraud during
audit of financial statements
1.
2.
3.

4.

5.
6.
7.
8.
9.
10.
11.
12.
13.

Secret reserve search

Mirror image evaluation approach to find inconsistent results
Relative Size Factor in stocks, debtors, creditors to detect error or
manipulation
Illogical events- loans taken when huge liquid assets are available such
as fixed deposits
Impossibility of certain results based on events known
Duplicate Numbers- could stem from error or fraud
Cash /stock shortages indicated by illogical withdrawing/purchasing
Negative asset / expense balances could be errors or fraud
Ghost workers search
Use Test Packs to check software bugs where audit train is invisible
Benfords theorem test results
Spreadsheet forensics and Ratio Analysis for trends
Physical verifications of assets, processes, and walk through tests,
including tiger team tests

Forensic Testing of spreadsheet data

eg even MIS reports can be falsified
The excel UFSRD method
U- unhide
F- font coloration
S-Show Formula
R- rectify and replace
D-duplication check
..\collections\financialsA.xls

SPACE TIME DIMENSION

BOTH SPACE AND TIME OFFER TESTING
YARDSTICKS FOR AUDIT PURPOSES.

e.g. How much quantity can be stored in a

warehouse, container, truck, box can be very useful
for corroborative tests of inventory, sales,
purchases.

Time can be used in several ways, time of

transaction, time taken for the transaction, time
difference between two events etc.

Case Study

A robbery took place in a mall in

January 2006
Thieves broke in through

the door
They stole case worth

more than Rs. 40 lacs

Police complaint lodged
Police made inquiries with

staff, neighbourhood

Findings of the Police

They concluded that this was the work of a local gang

of thieves operating in the area and this mall was the

latest victim
They suspected that some employee may have
helped but could not get specific clues against
anyone
They recommended better locks and greater security.
Case virtually closed

Management appointed auditors who

were specialised investigators more for
studying controls and recommending
preventive measures

Auditors spot red flags

The time element indicated that the thieves had only 20
minutes to complete the robbery while the patrolling
guards were circling the mall.
How could they throw about all contents of all drawers?
Where did they have time to steal a few cell phone handsets
which were on a different floor?
The alarm had been switch off. Therefore it was certain that
someone had helped them
The door that was broken was done with crude tools- not
the work of a professional gang
Out of two safes only one was broken into and robbed. The
second was left untouched?

Findings good but inadequate to

point out any means of recovery

Auditors try a new approach

The use the space time dimension approach

IDEA_DATA.xls

Amazing findings- Late night sales

The log in id was traced the store manager.

On being questioned he confessed
There was no robbery- it was a stage managed robbery to

cover up stock shortages

The shortages were built up over a period of time. The
store manager panicked when he was told that a stock
taking was to take place
He converted the stock shortages into artificial sales by
entering sales at midnight along with his accomplice the
head cashier during the previous two nights. This
resulted into stock shortages being converted into cash
shortages.
This shortage was then palmed off as robbery by breaking
open the door and throwing papers and documents in the
cash room to make it look like a robbery

Use of mathematical tools

39

Relative Size Factor

(RSF)

Relevance
40

Scrutiny

of individual parties
account is humanly ineffective.
It
highlights
all
unusual
fluctuations
which
may
be
stemming from frauds or errors

What is RSF ?
41

RSF is the ratio of Largest Number to the Second

Largest Number of a relevant set.

RSF =
Largest Number
Second Largest Number

42

43

RSF- Relative Size Factor

RSF= highest value divided by the second highest

value in a ledger account of debtors, or creditors
Even a comparison of prices, quantities or values in
an inventory
If the RSF > 10, chances of error or fraud are great

How does RSF Work ?

45

Any set of transactions take place in certain range. E.g. A

vendor XYZ may have normal pattern of bill value range of

Rs. 13k to 50k.
If there is any stray instance of single transaction which is
way beyond the normal range than that ought to be looked
into. E.g. in above case, if there is bill of Rs. 5 lacs.
RSF is above case will give a ratio of 10 (I.e. ratio of Rs. 5lac
to Rs. 0.50 lacs)
These single instances could be cases where there is some
foul play.

Types of frauds
that RSF can unearth
Data entry mistakes
Alterations in decimals
Wrong coding with masters (vendors, customers,

employees, etc.)
Revenue items charged to capital accounts and
vice versa
Excess payments in payroll

Useful algorithm
Luhns algorithm
For verifying correctness of credit cards
and other cards which have been
generated using the check sum digit

Tiger Team Tests

Tests used to assess the
robustness of a system by actually
carrying out penetration tests or
walk through tests of processes as
in ethical hacking for IT process
testing

Surprise Repetitive Tests

Surprise tests lose their sting when an

auditee can predict an auditors plan

Timing is very effective: one way to throw a

suspected auditee completely off guard is to
repeat a test in quick succession.
Complacency, cover-ups and even frauds are
likely to be exposed in the repeat test.

Mirror Imaging tests

Tests of processes, operations and controls
across similar units
Anomalies should be explained, else
something is amiss:
Case of discounts in chocolate shops
Case of repairs to moulds in two identical
processing units

OPEN SESSION.
THANK YOU
www.chetandalal.com
cd1@chetandalal.com