Forensics Training Masterclass Module - 2

All copy and transmission rights reserved by the IICFIP USA, Incorporation
MODULE NO. 2
This module covers Introduction to Forensic
Investigation & Step 1 to 3 of the forensic
investigation process.
Introduction
Forensic Investigation covers a broad spectrum of activities, with terminology not strictly
defined in regulatory guidance or law books. The term forensic investigation refers to any
inquiry that is aimed at gathering evidence for disciplinary either action or court proceedings.
Forensic investigation touches on many areas including forensic accounting, fraud/corruption
investigation. Generally, the term forensic accounting is used to describe the wide range of
investigative work which accountants in practice could be asked to perform to sort out disputes
of a financial nature. The work would normally involve an investigation into the financial affairs
of an entity, and it is often associated with investigations into an alleged fraudulent activity.
Forensic Investigations refers to the whole process of investigating a financial matter, including
potentially acting as an expert witness if the fraud comes to trial. Although this module focuses
on investigations into alleged frauds, it is important to be aware that forensic investigators/
accountants can be asked to look into non-fraud situations, such as the settling of monetary
disputes in relation to a business closure or matrimonial disputes under insurance claims.
The process of forensic accounting as described above includes the forensic investigation itself,
which refers to the practical steps that the forensic accountant takes in order to gather evidence
relevant to the alleged fraudulent activity. The investigation is likely to be similar in many ways
1
to an investigation of financial information, in that it will include a planning stage, a period when
evidence is gathered, a review process, and a report to the client. The purpose of the
investigation, in case of an alleged fraud, would be to discover if a fraud had actually taken
place, to identify those involved, to quantify the monetary amount of the fraud, and to ultimately
present findings to the client and possibly to the court.
Ultimately, it refers to the precise measures carried out to produce valid evidence. Various
investigations techniques are usually used to recognize and to put together evidence to establish,
for instance, the duration the fraud has taken place, alongside how the whole thing has been
conducted and concealed by the people involved. Evidence may also be gathered to support other
issues, which would be relevant in the event of a court case. Such issues could include:
The suspects motive and opening to commit fraud;
If the fraud involved collusion between several suspects, any physical evidence at the
scene of the crime or contained in documents;
Comments made by the suspect during interviews and/or at the time of arrest, and any
attempts to destroy evidence. Forensic investigations involve fraud investigating. Fraud
investigations is the examination of fraud allegations using documents collected from the
suspected fraud area or obtained externally via external confirmations.
Fraud investigating is narrower than forensic investigation since fraud investigating just
concentrates on fraud, whereas forensic investigating skills apply to all situations requiring
investigations.
Other definitions of forensic investigation are as follows:
Forensic investigation is a Systematic Inquiry or Examination to know what is

happening or what happened, with an aim to collect evidence for or against the
allegation. In financial management, an investigation will be referred to as a
2
forensic investigation. For example, they may conduct an investigation or

investigations into financial irregularities.
According to IICFIP Inc (www.iicfip.org), forensic investigations is the

systematic application of financial accounting, forensic accounting, digital
forensics and investigative skills to the gathering of evidence for use in court in
support of or against an allegation.
Forensic Investigations attempt to establish What actually went wrong, Why,

How, When, Where and Who was involved. If it is financial Investigations, a
further attempt would be to establish What Sum of Money, Where is the money,
and Who are involved and How are they involved. All supported with forensically
analysed evidence and proof beyond reasonable doubts. Charles Keshinro (FCA,
FCTI, CFA, CFE, AIPMN, MBA).
A forensic investigation is an allegation resolution technique or methodology. The

forensic investigator is hired to find out whether or not the information gathered
supports the allegation.
There are many types of forensic investigations, but I will restrict myself to forensic
investigation i.e. investigations of crimes like Fraud, Corruption, Money laundering and Cyber
Crimes.
The steps that I am discussing under this book are generalized for all white-collar crimes and
apply to other forms of forensic investigations.
Going by the definitions above, a forensic investigation must be carried out in a very systematic
manner in order to gather evidence to support or dispel an allegation. The 9 steps of forensic
investigations therefore sets out the systematic approach to investigations.
Types of Investigation
The forensic investigators may be asked to do investigations of many different types of fraud.
Thus, it is crucial that they arrange these types into three categories to avail an overview of a
wide range of investigations that could be done. These three categories of fraud include financial
statement fraud, corruption, and asset misappropriation. Forensic Investigators are also called
3
upon to investigate money laundering, terrorism and general crimes. Many have argued that
certified forensic investigators cannot investigate violent crime. This is a very narrow thinking
since any person who is well trained in the investigation process can investigate any crime given
the opportunity and legal backing.
Corruption
Corruption and fraud can be put in three categories: extortion, conflicts of interest, and bribery.
According to various researches, corruption is involved in around one third of all frauds cases.
Bribery; is when money is offered in order to influence a situation. Bribery also involves
the receiving of something of value to influence an official decision. Both the giver and
receiver are culpable in a bribery case that can be substantiated.
Extortion; this is the opposite of bribery. It happens when one demands money to secure
or influence a particular outcome. It usually involves some kind of threat to denial of
services or rights if the bribe is not given.
Conflict of Interest
While in conflict of interest fraud, the fraudster puts their influence to obtain a personal
gain that ultimately affects the company. In some cases, though the fraudster may not
benefit financially, he/ she may receive an undisclosed personal benefit. For instance, a
manager may approve the expenses of an employee who is also a friend in order to
maintain that friendship, even if the expenses are erroneous. Conflict of interest may also
involve sitting together in the tender committee to discuss tenders where one of them
belongs to a relative.
4
Asset misappropriation
This is the most common type of frauds. In this category, there are several types of fraud, which
can be listed as follows. The most known feature is the theft of cash or other assets from the
company, for example:
Cash theft; this is the stealing of physical cash, such as the petty cash, from the clients
company.
Fraudulent disbursements; this happens when the company cash is being used to make
fraudulent payments. Examples include billing schemes. This is where minor/ major
payments are done to fictitious suppliers. While payroll schemes are whereby payments
are done to fictitious employees.
Inventory frauds; this is the theft of inventory from the client company. This also
includes stock pilferages.
Misuse of assets; is committed when employees use company assets for their own
interest. Misuse of assets is the most subtle or all the types of assets misappropriation
since it does not necessarily involve taking the asset away.
Financial statement fraud
Also known as fraudulent financial reporting. It is a type of fraud which causes a material
misstatement in the financial statements. Fraudulent financial reporting includes deliberate
falsification of accounting records; balances or disclosures and omission of transactions from the
financial statements. It may also include the misapplication of financial reporting standards. It is
usually done with the intent of presenting the financial statements with a particular bias. For
instance, hiding liabilities to improve any analysis of gearing and liquidity.
5
Money laundering
What is money laundering?
Generally, each year large amounts of funds are earned from illegal activities like people
smuggling, arms trafficking, tax evasion, drug trafficking, corrupt practices, people smuggling,
and theft. In most cases, these funds are usually in the form of cash. The perpetrators who
generate these funds always want to bring them into the legitimate financial system without
raising any form of suspicion. To achieve this, they have to convert cash into other forms, which
makes it more useable therefore less suspicious. In addition, it also puts a distance in between the
perpetrators activities and the funds.
Money laundering is therefore a name given to the procedure by which illegally obtained funds
are made to appear legitimate.
General Crimes:
This refers to crimes like murder, robbery, theft of goods, rape and many others. Certified
Forensic Investigation Professionals (CFIPs) who understand the investigation steps well, do a
good job in investigating those crimes. In fact, the aim of this Module is to develop a strong
systematic inquiry approach that can apply to any type of investigation.
6
Preliminary Review
Introduction
What is a Preliminary review?
A preliminary review is any inquiry carried out before the actual investigation to enable the
investigator to make a decision whether to take the assignments or not. This is also referred to as
pre-engagement assessment. This is step number one in the forensic investigation process.
Nature and Purpose of a preliminary investigation
The preliminary review is a pre-investigation engagement exercise that seeks to find out facts
about the following:
1. Complexity of the clients operations.
2. The possibility of the perpetrators alleged wrongdoing on the alleged case, and ending up
in court.
3. The objectives of the client in the investigations.
4. The clients industry.
5. The regulations touching on the client.
6. The expectations of the client as to completion of the investigations.
7. The suspects of the alleged wrongdoing if any.
8. The witnesses of the suspected wrongdoing if any.
9. Knowing the client and the nature of his business.
7
When is a preliminary investigation required?
A preliminary investigation should be conducted before the signing of the contract so that the
investigator enters into an assignment agreement much aware of what is required of him and his
team. A preliminary review must be carried out every time a Certified Forensic Investigation
Professional (CFIP) is approached for forensic assignments so that he/she does not rush into
what he/she does not understand well.
This is the first stage of the investigation. I call this stage 'Preliminary Review. This comes
before formal engagement. If one considers himself not fully qualified to complete the
investigation, he can either exonerate himself or engage other qualified professionals to reinforce
his team. In conformity with Danny McLaughlin, 2013, I would also add that you should find
out the client's objectives for the investigation -
Do they want to prosecute?
Do they want to terminate someone's employment?
Is their focus on finding out exactly how and why the incident happened to
prevent a repetition?
Do they want to try to recover lost or stolen assets or cash?
Is it a combination of one or more of the above objectives?
Preliminary review can safely be considered as the initial stage of any investigation. In this step,
the investigators seek to get basic information which will guide them in coming up with a
defendable quote proposal to the client. It is done both prior and at the start of the actual
assignment.
8
This step mainly reviews the area(s), which have been affected by the fraud or the respective
white-collar crime thereby providing an opportunity for coming up with a rough estimate of the
time, and expertise needed to successfully execute the investigation. This step does not only
assists the investigator get an understanding of the nature of the investigation, but it also helps
them in understanding the scope or extent of the assignment.
During the preliminary step, the Certified Forensic Investigation Professional may seek all
information to enable him/her to develop better understanding of the clients operations and
nature of business.
According to Livingstone Ochan, (Director for Investigations, the South Sudan Anti-Corruption
Commission), the initial step in forensic investigations is to understand the client's business
environment, that is the information that should lead to the signing of an Engagement Contract
Letter. An Engagement Contract Letter is simply a letter showing a legal binding between two
contracting parties. However, in my view, the discussion and signing of an engagement letter is
the second step in any investigation. The process of conducting a forensic investigation is in
many ways similar to the process of conducting any investigation, but of course with some
additional considerations.
Important information about the allegation(s)
During a preliminary review, the Certified Investigation Professional (CFIP) will be in a
position to gather the following information:
Time or period of the alleged wrong doing perpetrations.
The types of alleged wrongdoing.
9
How the client got information about the alleged wrong doing i.e. how was the offense
detected and who reported it.
The crime scene i.e. the location of the alleged wrong doing
Does some evidence exist in the form of documents or tangible items indicating the
possibility of wrongdoing? If some evidence is available, it has to be collected and be
examined by the investigator to establish the probability of the existence or otherwise of
the alleged offence.
Considerations When Accepting the Engagement.

1. Is the investigator up to the assignment?
2. Does he/she have the capacity to have the nature of the investigation?
3. Does he/she have a team with the required skills and experience?
4. Does he/she have the time required to complete the job?
5. Does he/she have access to the special experts required for the perfect completion of the
assignment?
6. If the international /cross boarder operations are required, does he/she have the requisite
resources, experience and skills?
7. Past experience in similar assignments?
8. The objectives of the client
Accepting the investigation contract
The forensic investigators must initially consider whether their firm has the necessary skills and
experience to accept the assignment. All investigations in Forensics are specialist in nature. That
means, the work needs detailed knowledge of investigative skills alongside a legal framework.
Forensic Investigators should have received training in interrogation and interview techniques, as
well as maintaining the safe custody of evidence gathered/ collected.
10
Further considerations comprise whether or not an investigation client is requesting the
investigation. Should it be, this poses extra ethical inquiries, since the investigating firm would
be potentially exposed to advocacy management and self-review threats to objectivity. Except
robust safeguards are used, the client must not provide investigation and forensic investigation
services to the same client/ firm. In most cases, commercial considerations are crucial, and a high
fee level ought to be negotiated to compensate for the specialist nature of the duty, and the
likelihood of the involvement of senior and experienced members of the firm in the
investigation.
Factors to be considered in accepting a forensic assignment are;
1. Competence
This refers to relevant academic and professional training and qualifications. If the
investigator lacks the skills and qualifications required and cannot find professionals with
the right skills to employ, he or she has to decline from taking up the assignment and
recommend someone else.
2. Capacity
Does the investigator or his investigation team have capacity in terms of resources to
complete the assignment to the satisfaction of the client and within the time limits set by
the client? If not, then he or she does not have capacity to complete the assignment and
therefore must decline it. Capacity therefore refers to the equipment, finance, and
personnel required for the completion of the assignment to professional standards.
3. Experience
Relevant experience in similar assignments.
11
4. Availability
Is the investigator available for the assignment? If he or she cannot have the time
required to complete the assignment, he or she should let someone carry out the
assignment.
5. Independence.
Is there any semblance of conflict of interest? Is the investigator going to investigate
relatives or business associates or close friends? If so, then there exists conflict of interest
and therefore he or she must decline the assignment.
How to prepare and Conduct a Preliminary review
This is how to prepare for and conduct a preliminary review.
1. Book an appointment with the prospective client
2. Attend the meeting, and interview the illicit; seek for a detailed account of the
alleged offence(s). A Forensic Investigator must request the client to agree to
preliminary enquiries about his business before an engagement contract is arrived at.
3. Attend the meeting and interview the illicit, seek a detailed account of the alleged
offence(s). Forensic investigator must request the client to agree to preliminary
enquiries about his business before an engagement contract is arrived at.
4. Examine the financial statements of the client.
5. Examine the external Investigators reports
6. Ask for the organizational structure of the clients organization.
7. Review the clients business environment.
12
Based on my experience, step number one in a forensic investigation includes understanding the
client's business environment. The Client's business environment includes but not limited to the
following:
1. The structure of the organization;
2. Internal controls and security systems;
3. Nature of business;
4. ICT systems in use and the extent of reliance on those systems;
5. The complexity of the organization's operations;
6. The Client's industry within which it operates;
7. Number of total staff members in the area of investigation; and
8. The possibility of having the incident linking to the client's branches or subsidiaries or
suppliers and customers.
At this step, the investigator is mainly interested in knowing the extent of the incident. That is,
the complexity of the client's operations, which may have an impact on the effectiveness of the
investigation. In addition, the investigator seeks to know whether or not the organization is
working in a highly regulated industry.
The information gathered at this stage has a great bearing especially in planning and resource
allocation for the investigation. In fact, from my own experience, it is this information, which
determines the overall contracts quotation. Poor review of the client's environment would
culminate into under quoting and over estimation of the investigator(s) team's ability to deliver.
Certified Forensic Investigators like any other professionals are expected to engage specialized
experts to handle unique areas of the investigation. For instance, the gathering of computer and
digital evidence. The need of a special expert is determined at this first and most important stage.
13
Witnesses Interviewing
The need to consider a video-recorded interview will not always be immediately apparent, either
to the first police officer who has contact with the witness or to other professionals involved
prior to the police being informed. Even where it is apparent, the need to take immediate action
in terms of securing evidence and making initial decisions about the criminal investigation plan
might be such that some initial questioning is necessary.
Any initial questioning should be to elicit a brief account of what is alleged to have taken place;
a more detailed account should not be pursued at this stage but should be left until the formal
interview takes place. Such a brief account should include Where and When the alleged incident
took place and Who was involved or otherwise present. This is because this information is likely
to influence decisions made in respect of the following aspects of the criminal investigation plan:
Forensic and medical examination of the victim;
Scene of crime examination;
Interviewing of other witnesses;
Arresting of alleged offender(s);
Witness support.
In these circumstances, any early discussions with the witnesses should, as far as possible,
adhere to the following basic principles:
Listen to the witness.
Never stop the witness who is freely recalling significant events.
Should need be, ask questions as far as possible in the circumstances, and be open-ended.
Ask no more questions than are necessary in the circumstances to take immediate action.
14
Create a comprehensive note of the discussion, taking care to record the timing, setting
and people present as well as what was said by the witness and anybody else present.
Come up with a note of the demeanor of the witness and anything else that might be
relevant to any subsequent formal interview or the wider investigation.
Record exclusively any comments made by the witness or events that might be relevant
to the legal process up to the time of the interview.
Make a decision whether to take up the assignment or not. After all the considerations of a
Preliminary review, the Certified Forensic Investigation Professional should make a decision
whether to get started on the engagement or not. If he/she decides that the assignment is well
within his resources to complete it up to professional standards, he/she must then ask the client
to sign an engagement contract.
What if the decision is to decline the assignment?
Some of my students have argued that it would be money lost in terms of time wasted in carrying
out a pre-engagement assessment if the assignment is not accepted. They therefore suggested
that, one should enter into a pre-engagement agreement to carry out the preliminary review. This
cannot work with the majority of clients. I therefore recommend the following:
1. One should be prepared to incur the preliminary expenses. It after all protects his or her
integrity and professionalism, since it is more risk and can cost more if the assignment is
taken up in a hurry and then later on one discovers that he/she has undercharged the client
due to limited knowledge of his or her operations. The client would like you to complete
the job within the costs agreed to initially and within the timeline set. Anything like a
variation that was not foreseeable from the onset of the engagement will indicate that you
are either incompetent or dishonest.
15
2. Plan to carry out the assessment in a very cost effective manner like using questionnaires
so that you will only spend time analyzing them instead of interviewing the client and the
top officers one by one in person.
An Engagement Contract
Introduction
What is an Engagement Letter/Contract?
This is a written agreement promising to perform services in exchange for compensation. These
types of letters were traditionally made use of by certain professional service firms, chiefly in the
field of finance, and consulting to come up with the specifications of the business relationships.
Usually, the service firm sends an engagement letter to an officer of the engaging firm.
Immediately after the officer has signed the letter, it begins to serve as a valid contract.
In forensic investigations/ accounting, an engagement letter is the contract between the client and
the forensic investigator. In this letter, both parties agree upon the dispute resolution procedures.
The engagement contract drafting and signing is Step 2 of the forensic investigation process.
This involves the agreement on the following:
1. The engagement involves the stating of terms of reference which mainly refers to the extent
of an investigation or to which it is relevant.
2. Compensation terms and reporting timelines/ deadlines; this in most cases refers to the total
compensation received by the investigator, which includes not only the base compensation
but some expense reimbursements
3. The person hiring and therefore the authority to report to.
16
4. An agreement as to the procedure for reviewing a draft report with the client before the final
report is reached at.
5. An agreement as to the time and costs escalation at the request of the client.
6. Dispute resolution procedure(s). A dispute may arise from either party to the engagement.
The agreed dispute resolution mechanisms if follows quite well, settlements may be arrived
at professionally.
Engagement Letter Basics
See to it that you and the client are working towards the same goal. The application of
accurately drafted engagement letters is not only critical as a risk management tool; it also acts
as a form foundation upon which the client communication and trust are based. Whilst your
authority may require the use of an engagement letter, it should be a must in your practice/
guidelines. According to a recent article by the ABA Standing Committee on Lawyers
Professional Liability: at least 16 percent of all claims had been caused by poor client
communications/consultations., (Karagiozis, 2005). This can equally apply in forensic
investigations.
Amongst the things that should be included in an engagement letter include; the clients details,
subject matter, scope and objectives of the investigation. Reflection ought to be given to give a
requirement on what you will not do for the client in question, particularly in situations where
the similar facts give rise to recoveries on multiple theories/ explanations. Furthermore,
consideration must be given to setting forth any problems, or complications, or even the
weaknesses that have already been realized, and any special agreements concerning the inquiry.
17
However, the investigator must never guarantee specific results such as, in terms of currency in
the contract letter. Should the client require that one promise a specific outcome of the
investigation, then the investigator must resist such attempts discreetly since an investigation is
an inquiry that may lead to any result; recovery or not
Deadline for such investigations must be agreed upon by the client and he or she must commit
himself/herself to facilitate the investigation by providing all the required explanations,
documents and other items that may be required for the purposes of the investigation. All these
must be clearly recorded on the engagement letter.
The number of times in reviewing the draft report must be agreed with the client and all details
put in the engagement letter. Typically, the report drafted must be reviewed twice and then the
final report is submitted to the client.
Costs escalation clause; in the contract document, there should be a clause allowing the
escalation of costs. It must however be made very clear that the investigator(s) will try as much
as possible to make use of the available resources to accomplish the agreed tasks within the
allocated time and give a report, nevertheless, the client has a right to inflate the extent of the
tasks to be covered by the investigator(s) if new information received necessitate this move, and
then concur to amend the completion date and the related costs must be reviewed accordingly.
The engagement letter is a very important document. It serves as a contract for the assignment
and may be required during the dispute resolution process. It therefore goes, without saying, that
a dispute resolution clause must be included in the engagement letter.
18
Types of Forensic Audit Engagements
1. Short Term Engagement
2. Long Term Engagement
This may either be external or internal engagements.
A Forensic Audit is an investigative activity undertaken by an independent forensic practitioner,
a certified Forensic investigator, to provide opinion to a principal, the shareholders, over a
subject matter, financial statements, which is the primary responsibility of another person,
directors, against a given criteria or framework, whether any financial wrong doing occurred or
not.
Forensic Investigation or Audit
A Forensic Investigation combines the use of investigative skills to situations that may involve
legal end results. Forensic investigations are usually in instances like the ones below:
Deception investigations involving misappropriation of funds. Alongside, tax
evasion, money laundering and insider trading.
Quantification of loss in case of insurance claims.
Establishing the profit share of business partners in case of a dispute.
The Engagement Scope and the Acceptance Considerations
The objective of the investigator, in applying International Standards of Investigation in an
investigation of a single financial statement or of a specific aspect, report or item of a financial
statement, is to address appropriately the special considerations that are relevant to:
The acceptance of the engagement;
The planning and performance of that engagement.

19
Forming an opinion and reporting on the findings on the alleged wrongdoing.
Planning and Resource allocation

Forensic investigation engagements are agreed-upon as procedures engagements, not assurance
engagements. Forensic investigation will not provide a view, but an opinion whether fraud or any
financial wrongdoing occurred or not. Normally, this involves establishing a suitable value or
quantifying a loss as discussed here above. It is very distinct from an assurance engagement in
which the engagement team would review an amount determined by the client in question. In
forensic engagement, the certified Forensic Investigation Professional (CFIP) determines or
estimates the amount of loss. Planning and resource allocation is step 3 of the forensic
investigation.
As an agreed-upon procedures engagement, forensic investigator will normally prepare a report
for the client that sets out their conclusions, founded on the scope agreed in the engagement
contract. The report may be addressed to the Administration in most cases of a fraud, or to the
person insured. It may be that a witness report for submission to the court/arbitrator is required in
addition to or instead of a report to the client.
Nonetheless, planning for an investigation is almost similar to planning an investigation or any
other assurance engagement contact. It usually commences with preliminary review in which the
engagement team will develop an understanding of the events and actions taken by the client
since it occurred.
A major part of planning is to confirm exactly what format the output is required, and precise
matters required to be covered within it. During this step, any key documentation will be
obtained and scrutinized, for instance, insurance policies, partnership records, and the evidence
20
that led to the discovery of the fraud. The team will agree with the client in question, what access
to other information or personnel will be required and this will be arranged.
Based on the aforementioned, the team will design procedures that enable them to meet the
requirements of the client, as agreed in the engagement letter. In some instances, it may or may
not include test of controls, relying on the situations. There would be no need to test control
when valuing a business for a matrimonial dispute. Nonetheless, trying controls will be key to
establishing how a fraud occurred. The plan should not include sampling since sampling may
lead to the skipping of very important pieces of evidence. In this book, step three is chapter three.
The planning and resource allocation falls under step three of the forensic investigation process.
This is the most important step where the success or failure of the investigation is determined.
Failure to plan well here definitely leads to disastrous results and failure to complete the forensic
investigation satisfactorily.
Planning Information
Overview
The planning phase of an interview with a witness involves some consideration of three types of
information:
Information about the witness;
Information about the alleged offence(s); and
Information important to the investigation.
At this stage, interviewers need to have differing amounts of knowledge about each type of
information. In a general sense, they need to know as much as is possible in the circumstances
about the witness and a little about the alleged offence and information important to the
investigation.
21
The kind of information needed and the decision-making that surrounds it differs somewhat for
each category of witnesses considered in this guidance. For this reason, the information needed
in respect of each category of witness will be considered in turn before moving on to look at the
information that is needed about the offence and the information that may be important to the
investigation.
Use of Planning Information
The planning information should :
Set the objectives for the interview;
Determine the techniques used within the phased interview, and decide the means by
which the interview is to be recorded;
Find out who should conduct the interview, and if anybody else should be present.
Find out if anybody should monitor the interview, and who will operate the equipment;
Determine the location of the interview;
Set the timing of the interview;
Spell out the duration of the interview; and
Ascertain what might take place after the interview?
Objectives
Setting clear objectives is important because they give direction to the interview and contribute
to its structure. The interview objectives should focus on:
The alleged incident or event(s); and
Any case-specific information important to the investigation.
The aim of the interview should be to achieve all the objectives that are set for it while being as
concise as reasonably possible.

22
Planning an investigation
The lead investigator must carefully consider what he/she has been asked to achieve and plan the
work accordingly. The goals of the investigation will comprise the following:
Locating the type of fraud that has been going on, for how long it has been undertaken,
and how the fraud has been concealed;
Recognizing the fraudsters involved;
Finding the quantity of the financial loss suffered by the client;
Putting together the evidence to be used in court proceedings;
Availing advice to prevent the reoccurrence of the fraud;
The investigating team should also consider the best way to gather evidence; the application of
computer assisted investigation skills is very common in forensic investigations these days.
Assembling the Team
The greatest asset to the practitioner is the team he or she assembles to conduct the examination.
It is normal that, all of us may not be completely skilled in all areas of forensic investigations
and should rely on the competency of others to assist us when necessary. Think about the
following specialized areas for inclusion as part of the specialized areas requiring experts to
assist the investigation team.
Forensic Accountants
The forensic accountants will assist in control reviews, data mining, and root cause
analysis.
23
Legal Counsel
This should offer the investigation team advice on what are the privileges and rights of
suspects, witnesses, and victims. They will also advice on employees rights as to privacy
and how to go about them.
Computer and Digital Forensic Experts
These can assist in electronic evidence retrieval and review, hard drive imaging, and
internet activity logs.
Company Security Personnel
Security personnel will assist in physical access controls, records, and background reports
on employees.
Company Management
Company management assists in facilitating the investigation by authorising access to
books and other records.
Human Resources Personnel
These personnel provide employee files, motivation policies, background history, and
records of previous incidents of misconduct or disciplinary action.
The inclusion of specialists from each discipline provides significant benefits to the practitioner
throughout the investigation process. Introduction and conducting an investigation without a
competent team is like performing an operation without an anaesthesiologist, and nurses amongst
other medical staffs. Later, one could end up in a serious problem.
Assembling other resources
Equipment
Transport
Travelling and accommodation allowances;
24
Start and finish times of various tasks; and
Line of attack- how to approach the investigation.
Establishing a Crime Scene
The Location
Select an area with limited access to intruders, for instance, if its a school environment, students
has to be kept at bay, such as a storage area or an extra room at school; so that the crime scene
can remain set up for continued observations and examination.
Storyline
Establish the victim and suspect and their relationship to each other. Determine a scenario where
all suspects have the object, chance, and means to be involved in the deception, except if the
outcome is undetermined beforehand. It is hoped that the co-investigator will manage the
evidence.
Suspects
After establishing a group of suspects, make a decision whether to introduce them into the
interview process. The suspects identified will assist in the suspects interviewing process in step
7 or chapter 7. Every suspect must have the motive, opportunity, and means to be involved in the
crime. Sketch evidence may link a number of different suspects to the crime scene.
Motive. This is a reason for committing the evil activity. Potential motives could
include, revenge, passion, and greed. Such a motive is usually determined through
interviews and research.
25
Opportunity: This is a suspect who can be placed at the crime scene, or was capable
of getting into the crime scene within a particular timeline, can be counted to have
had opportunity to perpetrate the crime.
Means: A suspect considered by investigators to have been able to commit the
crime, can be counted to having had the means. As an extension, one may want to add
a witness or suspect who has been seen fleeing from the crime scene.
Alibi
Determine alibi for some or all of the suspect(s). These statements may be presented to clients/ a
firm/ organization in a written format. It is similar to the law enforcers interview with the
suspect. During the time when the investigation proceeds, the suspects may be subjected to
several interviews where they might add new information. The investigator might choose to
distribute information from the interviews at specific intervals. The investigator may avail the
suspects with a written script and allow the forensic investigative teams to interview the
suspect(s).
Suspect Files
The investigator may wish to establish suspect files within the clients premises, on which
information can be added during the investigation.
Evidence
Evidence can be defined as a statement or material object from which reasonable conclusions can
be made. In a criminal trial, evidence concerns the motive, intent, means, and opportunity to
26
commit a crime. Generally, it can be divided into two categories: these are circumstantial
evidence and physical evidence.
Circumstantial evidence consists of information gleaned from witnesses, the
computer/internet and documents that point to an individual as the perpetrator of a crime.
A good example of this is an e-mail indicating the intention to meet the victim at a place
and time of the crime scene.
Physical evidence consists of actual objects, bodies, weapons, written cheques, and
fingerprints associated with the crime, and may be linked to the perpetrator.
It is the responsibility of forensic experts to examine the physical evidence/ such as the cheques
by using an appropriate method of science in reconstructing the events that constituted the crime
at hand. The investigator must then combine this data with statements of witnesses and evidence
from documents, like the telephone records, correspondence, and credit card receipts, to develop
an overall theory of the crime that can be presented in court.
Collecting and Storing Evidence
A good plan must be in place to ensure that labelling, collecting, preserving of any evidence
connected with a crime activity is well done. The forensic investigators must be able to prove
that the evidence has always been in their possession from the time it was taken at the crime
scene until the time it appears in a court of law.
Anybody who has access to the material must be documented and presented to court. Certified
Forensic investigator must prove that the object shown in court is the same object that was tested
in the forensic laboratory or is the object that was collected from the crime scene. In case this
cannot be certified, the court may rule that the chain of custody has been broken and the object
may not be admitted into evidence/ confirmations. Once an object is found, it is placed in a
27
container, or a seal, then sealed, and labelled. In the seal, the officer who also initials the labelled
seal notes the places where the object was found and when it was found. Should the evidence go
to the police station or forensic lab, the evidence must be placed in a locked evidence room to
which only a few people have access to. On the same note, a similar record has to be maintained
pertaining everyone who has had the evidence in his or her custody. The chain of custody is
discussed in details in chapter 5.
The following must be laid out for the collection of evidence:
Purchase gloves for collecting evidence.
Purchase zippered plastic bags to store evidence gathered at the crime scene and from the
suspect(s). You must also Label bags with a code for which you maintain the key and/ or
with the suspects name and address.
Arrange a box labeled Evidence Locker. To ensure safety, the investigative teams must
sign out the evidence stored in this box before examining it.
Forensic Investigation Log Book
Plan to procure a Forensic Investigation Logbook for keeping the information collected by the
forensic investigative teams.. The investigator may wish to have the individual team members
initial their work to see to it that each member is contributing to the investigation process. The
investigator may choose to allow them access to this information at any time, even during the
final examination. Investigators are encouraged to keep their database or logbooks neat and to
organize the information in a manner that allows them to retrieve information speedily.
Crime Scene Kit
Criminal investigators apply a variety of materials and instruments in collecting evidence from a
crime location. Some of the materials could include the following
28
Crime scene tape String
Chalk Measuring tools
Hand-held magnifying glass Colored evidence flags
Flashlight Adhesive lint pick-up roller
Tweezers Portable alternative light source
Swabs (infrared, ultraviolet, laser)
Tape lifts Fingerprinting kit (powder, brushes,
Trace evidence vacuum Lifting tape, cards, stamp/ink pad)
Sketchpad, logbook, pen Casting kit (casting powder, mixing
Camera Bowl, fixative)for tire prints or
Video recorder Footprints
Evidence bags Laser trajectory kit
Seals Gunshot residue kit
Paper bags Blood-detection reagents
Envelopes Serology kit
Disposable clothing Insect specimen jars
Gloves hazmat kitto Assess composition
Masks of toxic materials
Table 1: Crime Scene Kit (Courtesy of Forensic investigation of stolen-recovered and other crime-related vehicles 2006)
Crime Lab Equipment
Crime labs may include equipment such as the following:
29
Beakers Spectrograph
Flasks Spectrometer
Burets Spectrophotometer
Pipets Electron microscope
Graduated cylinders Ultraviolet lighting
Test tubes Gas chromatograph
Watch glasses Mass spectrometer
Stereoscopic microscopes Electrophoresis chamber
Compound microscopes Nuclear reactor
Phase contrast microscopes Refract meter
Spectroscope Liquid chromatography apparatus
Table 2: Crime Lab Equipment ( Courtesy of Forensic investigation of stolen-recovered and other crime-related vehicles
2006)
Sketches and Investigative Notes
While there are controversies over whether Sketches are important, based on most investigators
opinions, properly prepared sketches and notes are useful to you as reference when questioning
witnesses, suspects, and victims; in preparing a report of investigation; and to refresh your
memory when appearing in court.
They are also valuable sources of information for both trial and defence counsel. Sketches are
frequently introduced in court as evidence and used to acquaint the court with crime scenes and
help witnesses orient themselves as they testify. Notes or sketches used to refresh your memory
during a court appearance maybe reviewed by the court. Appropriate attention is given to ensure
30
that all notes and sketches are legible and project clear, meaningful facts. Lack of organization in
notes or sketches could adversely influence the weight given to your testimony by a court.
Sketches
A sketch graphically portrays the scene of a crime and items within the crime scene that are of
interest to the investigation. The sketch, which includes the crime scene photographs, and the
investigative notes are complementary and are all-necessary to effectively process the crime
scene.
The sketch provides the best means of portraying distances between objects at the scene. There
are two basic kinds of sketches, the rough sketch and the finished sketch. Both types of sketches
contain the same general information, but differ according to the technique of presenting the
information.
Outline sketches, which generally indicate the dimensions and shape of crime scenes and which
are used as interview aids, will not be discussed here.
To cover items of interest to the investigation, crime scene sketches should, at a minimum, depict
the following:
1. Locations of approaches, such as roadways, paths, entrances, exits, windows, and
skylights.
2. Size of the area.
3. Exact locations and relative positions of all pertinent evidence found at the scene.
4. Camera locations
In depicting the foregoing, the sketch should do the following:
31
1. Reflect accurate measurements verified by another person.
2. Indicate compass direction of north.
3. Designate the scale. If no scale is used, state this fact.
4. Use a conventional system of measurement. (Paces or steps are not used.)
5. Contain a legend that explains all symbols or letters used to identify objects on
the sketch. Military symbols are used where practical.
List the report or incident number, offense alleged, name of victim, designation of scene,
location of the scene, date and hour the sketch was started, and the name of the persons who
made and verified the sketch.
Rough Sketch: The rough sketch is drawn at the scene of the crime and is not changed after
leaving the scene. It is not usually drawn to scale but depicts accurate distances, dimensions, and
proportions through use of one of the methods discussed below. The rough sketch is filed with
the copy of the report retained by the originating office.
More than one sketch can be made of a particular scene. One may reflect measurements; another
may show camera positions; and a third maybe required to show locations of items of physical
evidence at the scene. In some instances, separate sketches maybe the best way to record
multiple scenes contained within a larger area of investigative interest, or to provide detailed
depictions of isolated locations within a relatively small crime scene. It may be necessary, for
example, to sketch separate, limited areas within the scene. The following are items necessary to
prepare a rough sketch:
32
Figure 1: Rough sketch showing evidence measurement and triangulation (courtesy of tpub.com)
Soft lead pencil.
Unlined or graph paper.
Clipboard large enough to form a back for the paper.
Steel tape (at least 100 feet long).
Ruler.
Compass.
Finished Sketch
When possible, the finished sketch is drawn to scale from information on the rough sketch.
When drawn to scale, the sketch need not include figures to show distances. If it is not drawn to
33
scale, this fact should be indicated on the sketch and distances should be shown as on a rough
sketch. A copy of the finished sketch is appended to each copy of the report of investigation.
The investigator need not prepare the finished sketch, but must verify its accuracy. It is
recommended that personnel skilled in such work prepare the finished sketch. The Public Works
Officer of the command may be able to provide a qualified person for this task.
Figure 2: Finished sketch (courtesy of tpub.com)
The name of the person who prepared the sketch is indicated in the report and on the sketch. If
the finished sketch is prepared by personnel of the investigative unit, the following materials are
considered necessary:
1 Drawing board or table,

2 Draftsman's T-square,
3 Pencil and ink,
4 Drawing compass,
5 Ink ruling pen.,
6 Lettering and drawing pens 16-51,
7 Black India ink,
8 Drawing and tracing paper,
34
9 Architect scale,
10 Art gum and ink erasers,
11 Engineer or architect triangles
12 Drawing pencil,
13 French curve
A projection drawing may be used as the scaled drawing. The projection drawing adds another
dimension and in some cases is necessary to effectively portray the scene. The Figure above is a
sample of a projection drawing. All measurements to a point on a movable object are made from
at least two immovable reference points:
Indoor areas
The triangulation method is used for all indoor sketches. In this method, objects are located and
depicted by creating a triangle of measurements from two or more fixed points to a single
identifiable part of the object to be fixed ideally, each object is fixed by two separate triangles
related to two different points on the same object. If movable items are to be used as fixed
reference points, they must first be fixed themselves.
Outdoor areas
Outdoor areas are considered in two categories; that is inhabited and uninhabited or remote. The
reason for this separate consideration is that inhabited areas normally have easily defined fixed
reference points, and the triangulation method can be used for establishing the location of other
objects. Uninhabited or remote areas may not have easily defined fixed points within reasonable
proximity, and objects will have to be located through use of the intersection/resection method
taught in map reading.
35
Progress Test 2
1. The Client's business environment includes, but is not limited to the following EXCEPT:
A. The structure of the Organization
B. Internal controls and security systems
C. Nature of business
D. Chain Of Custody
2. The planning phase of an interview with a witness involves consideration of three types of
information. Which one is not?
A. Information about the witness.
B. Information about the alleged offence.
C. Information important to the investigation.
D. Information to be reported to the court.
3. The preliminary review is a pre-investigation engagement exercise that seeks to find out
facts about the following, EXCEPT:
A. Complexity of the clients operations
B. The objectives of the client in the investigations.
C. The clients industry.
D. The amount of Money in the suspects account
4. Which one is not a general objective of forensic investigation?
A. Assess activities for the recent twelve-month period.
B. Evaluation of the in-house controls and security systems of the client.
C. Advice the company on their financial stand.
D. Interview the employees.
5. The following are the factors to be considered in accepting or declining a forensic

assignment. Which one is not?
A. Availability.
36
B. Competence.
C. Fear.
D. Experience.
6. A sketch graphically portrays the scene of a crime and items within the crime scene that are
of interest to the investigation.
A. True
B. False
7. Crime scene sketches should, at a minimum, depicts the following except one.
A. Size of the area.
B. Exact locations and relative positions of all pertinent evidence found at the scene.
C. Camera locations.
D. Interview location.
8. In an investigation, motive is the reason for committing the evil activity.

A. Yes
B. No
9. An Engagement letter is a written agreement to carry out services in exchange for

compensation.
A. True.
B. False.
10. Engagement contract signing involves the following.

A. Terms of reference or scope of the investigation;
B. Remuneration terms and reporting timelines;
C. Setting the date of arresting the suspect.
D. Evaluating the costs escalation clause.
37

Forensics Training Masterclass Module - 2

Uploaded by

Copyright:

Available Formats

Forensics Training Masterclass Module - 2

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Forensics Training Masterclass Module - 2

Uploaded by

Copyright:

Available Formats

What are the steps involved in a forensic investigation?

What are the steps involved in a forensic investigation?

What is the difference between forensic investigation and fraud investigation?

What is the difference between forensic investigation and fraud investigation?

All copy and transmission rights reserved by the IICFIP USA, Incorporation

Forensic investigation touches on many areas including forensic accounting, fraud/corruption

on investigations into alleged frauds, it is important to be aware that forensic investigators/

disputes in relation to a business closure or matrimonial disputes under insurance claims.

present findings to the client and possibly to the court.

The suspects motive and opening to commit fraud;

scene of the crime or contained in documents;

attempts to destroy evidence. Forensic investigations involve fraud investigating. Fraud

suspected fraud area or obtained externally via external confirmations.

Other definitions of forensic investigation are as follows:

Forensic investigation is a Systematic Inquiry or Examination to know what is

forensic investigation. For example, they may conduct an investigation or

According to IICFIP Inc (www.iicfip.org), forensic investigations is the

Forensic Investigations attempt to establish What actually went wrong, Why,

A forensic investigation is an allegation resolution technique or methodology. The

investigations therefore sets out the systematic approach to investigations.

the opportunity and legal backing.

receiver are culpable in a bribery case that can be substantiated.

or influence a particular outcome. It usually involves some kind of threat to denial of

services or rights if the bribe is not given.

company, for example:

are done to fictitious employees.

includes stock pilferages.

since it does not necessarily involve taking the asset away.

Financial statement fraud

misstatement in the financial statements. Fraudulent financial reporting includes deliberate

instance, hiding liabilities to improve any analysis of gearing and liquidity.

perpetrators activities and the funds.

are made to appear legitimate.

systematic inquiry approach that can apply to any type of investigation.

What is a Preliminary review?

Nature and Purpose of a preliminary investigation

about the following:

1. Complexity of the clients operations.

3. The objectives of the client in the investigations.

4. The clients industry.

5. The regulations touching on the client.

6. The expectations of the client as to completion of the investigations.

7. The suspects of the alleged wrongdoing if any.

8. The witnesses of the suspected wrongdoing if any.

9. Knowing the client and the nature of his business.

When is a preliminary investigation required?

what he/she does not understand well.

out the client's objectives for the investigation -

Do they want to prosecute?

Do they want to terminate someone's employment?

Do they want to try to recover lost or stolen assets or cash?

Is it a combination of one or more of the above objectives?

them in understanding the scope or extent of the assignment.

Important information about the allegation(s)

During a preliminary review, the Certified Investigation Professional (CFIP) will be in a

position to gather the following information:

Time or period of the alleged wrong doing perpetrations.

The types of alleged wrongdoing.

detected and who reported it.