Remote but engaged

How do fraud examiners conduct fraud examinations when they often can’t meet their team members and subjects in person? These experts — during pandemic constraints — discuss their biggest investigation hurdles, maintaining professional skepticism, best practices, eDiscovery challenges, chain of custody, interviewing constraints and more.

You’ve organized an interview with a subject whom you suspect has been embezzling from your company. But he and you won’t be in the same room. His lawyer and all your team members also will be in separate rooms. All in front of computer screens. Sound familiar? Is this any way to conduct a fraud examination?

That’s just one of the questions the speakers pondered during the recent ACFE “Fraud in the Wake of COVID-19” webinar. They later elaborated for Fraud Magazine on their webinar comments and discussed other aspects of remote investigations.

Here we give you some of the insights of Anthony Campanelli, CPA, CFF, partner at Deloitte Financial Advisory Services LLP; Leah Lane, CFE, director of Texas Instruments global investigations; and Steven Merrill, chief of the FBI Financial Crimes Section, to further help you in your investigations.

Biggest hurdles

“The inability to meet face-to-face with witnesses, subjects, and custodians of records are difficult hurdles for investigators that they must overcome while investigating fraud remotely,” Merrill says. “Focus is a vital factor necessary to develop rapport and a personal connection. When meeting in person, the investigator creates a private environment and minimizes interruptions so both the investigator and the witness can focus on the interview or other tasks at hand,” he says. “Unfortunately, the investigator cannot ensure or even control the environment during remote interactions, hindering productive developments.”

Lane concurs. “I think interviews are definitely the most challenging to execute remotely because we are not able to travel and perform those interviews in person like we’ve done in the past,” she says. “In-person or face-to-face interviews allow us to observe the interviewee and their behavior a great deal more than interviews through technology.” (See more on the aspects of remote interviewing in the sidebar, Crucial parts of the interview process.)

Campanelli says as the COVID-19 pandemic continues, virtual work and social-distancing orders have made investigating fraud in a remote environment more complex.

“But many of the challenging hurdles can be overcome with proper planning and the deployment of technology designed to identify and analyze relevant unstructured data — such as email and text messages — and structured data — such as accounting and financial information,” he says.

Campanelli says hurdles can include:

• Discerning the matters that require immediate investigation.
• Accessing personnel across different time zones when the investigation team would’ve been onsite.
• Identifying signs of verbal or non-verbal deception in interviews.
• Exchanging key documents during an interview.
• Executing certain forensic collections of laptops and mobile devices without warning.
• Obtaining relevant accounting and financial data relevant to the investigation.
• Relying on scanned documents instead of original.
• Waiting on court re-openings to view residing physical files.
• Working without the ability to “walk the halls” and have impromptu conversations with company personnel.

Lane says one of the biggest hurdles to investigating in a remote environment is technology. “I think we all have to rely on technology in a way that we’ve not had to do in the past,” she says. “We have to not only utilize technology to do interviews but we also have to use it to collect evidence that we might have collected in person prior to COVID-19, and to have meetings with executives, subject matter experts and HR."

Merrill says distracting external stimuli during online interviews and conversations — gadgets, family members, pets, noises — interrupt the connections and rapport investigators need to maximize the results.

“It is also more difficult during a remote interview for an investigator to detect truthful and untruthful non-verbal behaviors,” Merrill says. “Moreover, interviewers in private face-to-face settings have the luxury of time to let relationships organically develop.

“They are not concerned that technology issues will interrupt, or even prevent the meeting if the witnesses aren’t tech-savvy, experience connection issues or spontaneously terminate internet calls, which leaves investigators little or no ability to return focus to critical interactions,” he says.

Merrill says investigators have to contend with the risk that witnesses will record interviews. “As such, each interviewer should be appropriately cautious,” he says. “The interviewer’s strategic decision regarding when to conduct the interview within the scope of the overall investigation becomes perhaps even more important, knowing any comment may become public thereafter.”

The inability to meet face-to-face with clients, coworkers and subjects can affect key investigative procedures, Campanelli says. “For instance, conducting interviews with key personnel, exchanging of confidential documents, and device/data collection may be impacted,” he says. “However, the current environment does not mean that these procedures cannot be executed efficiently. Give careful consideration when planning an investigation to ensure you execute impacted investigative procedures in a manner that does not impair the legitimacy of an investigation.”

Campanelli says the inability to interact face-to-face with clients poses additional challenges for cross-border investigations. “Cross-border investigations already pose several distinct considerations, including language barriers, cultural differences and resource limitations,” he says. “Such challenges further the need for companies to adapt their cross-border investigative strategies so they can productively and proactively investigate allegations of potential misconduct outside the U.S.”

Lane agrees. “One of the most important challenges in performing electronic collection is cross-border captures,” she says. “I think we all need to stop and remind ourselves that just because you can capture something in another country, is it legal to actually do so and then transport it back to your home country?”

Increased professional skepticism

Fraud examiners, by nature, are skeptics when it comes to discovering evidence. Pandemic conditions have necessitated increased professional skepticism.

“When people feel like they have no choice or they have a great financial need, they may commit fraud for the first time,” Lane says. “That’s why I think red flags are more important than ever and need to be scrutinized more heavily in today’s environment. I think as investigators, we really need to follow up every suspicious item that we can."

Campanelli says that while we expect the number of fraud cases will continue to increase as a result of the pandemic and the new remote-work environment, it’s more important than ever for investigators to apply increased levels of professional skepticism throughout investigations’ lifecycles.

“Investigators can carefully analyze electronic documents to identify red flags or indications of manipulation, such as fabrication of invoices, differences in invoice templates etc. For example, conducting a forensic analysis of PDF file metadata can help determine if documents were recently manipulated — and, often, by whom,” Campanelli says. “If discrepancies are found, investigators can discuss them with appropriate personnel — ideally on videoconferencing — to assess verbal and non-verbal cues.”

Best practices

“The FBI has successfully investigated even our most sophisticated cases throughout the pandemic,” Merrill says. “To the extent possible, the FBI has continued to conduct field operations while taking the utmost precautions to ensure everyone has proper personal protective equipment (PPE), and that our personnel have enough PPE for our witnesses and subjects.”

Lane says that best practices for getting the most out of remote interviews are, of course, evolving. “The first best practice is preparation,” she says. “You have to almost be over-prepared for remote interviews. You have to prepare how you are going to present evidence virtually and still be able to observe the interviewee.

“Ensure the interviewee has video and audio capabilities. Have a backup plan in place in case that technology fails,” Lane says. “Review the backup plan with the interviewee at the beginning of your interview in case any disconnections or interruptions occur. If it is possible arrange to have someone sit with your interviewee during the interview.”

Campanelli agrees that over-planning is paramount. He provides these best practices:

• Ensure the interviewee is on-camera.
• Utilize the best video technology available.
• Organize key documents for use during interviews and reduce the need to share screens.
• Rehearse the interview flow to ensure technology and document sharing works properly.
• Provide sufficient time for interviews and be cognizant of time differences.
• Consider the number of individuals who’ll be interviewed and determine whether any special language skills are needed.
• Assess what could go wrong and how you’d react.
• Prepare your steps if your subject confesses during a guilt-confession or admission-seeking interview.

eDiscovery collections’ challenges

In normal times, discovering and gathering electronic evidence can be daunting. Lay a pandemic on top of that process, and your challenges grow exponentially.

“Data collection should run in a near-normal state since enterprise collections, such as email, are typically done remotely,” Campanelli says. “Custodian devices — which can be imaged remotely or physically shipped in — present a larger, yet solvable logistical challenge. After identifying relevant data sources, discovery specialists can coordinate with IT teams to access and download enterprise or cloud data sources.

“When custodian devices with enterprise collection capability for PCs are in place, there should be little to no impact to collections beyond internet upload speeds,” Campanelli says.

“In the absence of enterprise collection capability, collections will likely require custodian notification, increasing the risk that information may be deleted or destroyed,” Campanelli says.

“Such an approach might involve mailing an encrypted hard drive preloaded with scripts directly to custodians to connect to their devices. Devices can then be accessed and controlled remotely, or even automatically, to securely extract and collect the data,” he says.

“Server eDiscovery software solutions further enable for the digital production, review, and tagging of documents,” Campanelli says.

(For more information on remote data collection see the July/August 2020 Fraud Magazine “Innovation Update” column by Vincent M. Walden, CFE, CPA, Forensically preserving electronic evidence during a lockdown.)

Merrill says reviewing records is best done collaboratively in person with all parties so they can exchange information and ask probing questions. “This critical process is severely impacted without the ability to personally verify comprehension of the materials and verify the records are exactly what is sought."

Chain of custody

If evidence is subject to change over time or susceptible to alteration, the offering party might need to establish that the evidence hasn’t been altered or changed from the time it was collected through its production in court. Fraud examiners do this by establishing a chain of custody to establish authenticity.

The chain of custody is both a process and a document that memorializes (1) who has had possession of an object and (2) what they’ve done with it. It’s simply a means of establishing no material change of alteration to evidence. (See the ACFE Fraud Examiners Manual.)

Obviously, keeping chain of custody of evidence has become more difficult during the pandemic.

“An in-country evidence custodian can help when evidence is collected abroad while you are working remotely in another part of the world,” Lane says. “When you need to store or transport the evidence, attach a chain-of-custody form. Some key points of information that form should have is a description of all evidence or property collected during the investigation, who initially collected it and when, who it was collected from and who has controlled access to it.”

Campanelli says investigations might require collection of hard-copy and electronic documentation. The investigation manager typically controls a chain-of-custody register of the persons and/or locations from which documentation or evidence can be obtained. The register, he says, typically contains:

• Type of document: e-mail, internal memorandum, written note, etc.
• Dates and times related to the document collection.
• Document numbering.
• Details of the persons involved in the collection.
• Retention period, if any.
• Physical storage and security considerations, especially for hard-copy documentation.

“To maintain an accurate and complete chain of custody, it’s critical to limit the number of individuals handling evidence and any transfer involves properly sealed packaging and signed receipts,” Campanelli says.

Data secured and privacy maintained

Lane believes confidentiality of internal investigations is the cornerstone for your employees to place trust in your office. “This is accomplished by securing investigative data and maintaining privacy on case-related documents,” she says. “This is really difficult when you have to go outside your company’s firewalls to use technology for interviews.

“You should have your IT security department research and approve whatever technology you use in your investigations. You should also mention in your interviews that all documents presented today belong to the company and are protected under company policy,” Lane says.

Campanelli says investigators are often confronted with the challenges of balancing document preservation with confidentiality and privacy concerns. “There are potentially severe consequences for missteps,” he says.

He says those involved should:

• Institutionalize the journey of information governance (IG) in your organization’s culture. The IG governance structure will need to approve policies and standards. Your organization will need to provide resources to test adherence and measure quality.
• Give adequate consideration to local data privacy laws (e.g., General Data Protection Regulation, California Consumer Privacy Act) because of implications for handing organizational, employee and third-party (such as vendors) data to those outside the organization.
• Consider necessary communication channels to implement and enable effective remote information-sharing among investigative teams.
• Consider whether online sites are secure enough to exchange electronic documents.
• Establish additional security measures (e.g., remote desktop access, multi-factor authentication) to safeguard against unauthorized access to sensitive data.

Together apart

We’ve scratched the surface. This, of course, is an ongoing story. Agree, disagree and add to this information below. Begin a thread in the online ACFE Community.

Despite the odds, you’ve persevered in your job regardless of pandemic conditions. Charge on — remote but engaged.

Dick Carozza, CFE, is editor-in-chief of Fraud Magazine. Contact him at dcarozza@ACFE.com.