Forensic Investigations and the Art of Investigative Interviewing

By Kevin Sweeney

This book combines practical experience with academic knowledge to build an effective fraud or corruption investigation technique. The author uses his operational background and experience as well as academic research to explain what is necessary in these type of investigations. It provides the necessary skills to all types of investigators or a

• Language: English
• Publisher: Kevin Sweeney
• Release date: Oct 27, 2017
• ISBN: 9781999793708

Book preview

Preface

Fraud, especially when publicly exposed, can do irretrievable damage to a company’s reputation, as well as being a potentially expensive oversight. What makes a crime such as fraud unusual is that all too often, the most serious risks of fraud do not come from external actors but from within the organization itself. These insiders have the potential to do enormous damage as they are implicitly trusted, which they use to their advantage. This book presents a technique to investigate potential fraud offenses and to facilitate auditors or regulators in performing this role.

The technique is titled The Forensic Investigation and Investigative Interview Technique. It recognizes that there are two distinct elements to an investigation—the gathering of tangible evidence and the creation of evidence through interviewing witnesses and persons suspected of committing the offenses. It also recognizes the importance of careful evaluation or analysis of whatever evidence is gathered to enable the investigation to proceed in the correct direction. It examines the evidence custody chain to ensure the integrity of evidence. Finally, all evidence gathered or created must be compiled and the results must be communicated. The technique aims to bridge the gap between auditing in the private sector and police investigations, thereby ensuring that, if necessary, the audit investigation can continue relatively seamlessly into the public criminal justice system.

The technique is built on my almost 30 years of policing experience in the Irish police service, An Gárda Síochana, most of which was in the detective branch. The Irish State currently has no separate intelligence service and the Gardaí fulfill this role. So among other roles, I worked in anti-terrorism, including as a covert intelligence operative. Combining both the intelligence and policing role in one organization has certain disadvantages as a methodology but one advantage it confers is an understanding of the separate functions of intelligence operative and policeman. Police focus on prosecuting a case before a law court, so must perform certain legal functions in accordance with the relevant legislation.

Obtaining information in the role of policeman was done differently than in the covert role. However, interviewing people to obtain information is one skill essential to both functions. Throughout my career, I have always tried to research solutions to problems I encountered in my career, but in the case of investigative interviewing, the published material that was available, was unhelpful. Indeed, very often, little attention was given to the skill. interviewing was all too often assumed to be a skill that everybody was good at. Indeed, the skill or ability to discuss an issue with somebody who disagrees with your point of view, the ability to argue, use logic, to persuade, are abilities that appear to have been discarded for technical prowess. Sadly, in our ever increasingly polarized societies, we can now avoid engaging with anyone who doesn’t agree with us. The internet allows a virtual community of like-minded people to exist, even consuming their own personalized and partisan news and current affairs programs, if desired.

Interviewing is a skill, an often overlooked skill, but one that is essential nonetheless. Interviewing is not just about the ability to talk to someone, to pass the time in idle conversation, it is about obtaining information that another person has. It is only in recent years that police departments are discovering how vital a skill it actually is. Through experience, I found a friendly approach to interviewing led to better outcomes than aggression. Colleagues in the United Kingdom had similar experiences. Consequently, I undertook my doctoral research into the legality and effectiveness of police interviewing techniques, discovering that the necessary skills are not difficult, but are, nevertheless, poorly delivered by many police forces to investigators. Knowledge must be capable of being translated into action. Giving information is not sufficient, it merely sits somewhere in the mind but is rarely consciously available. To be useful, it is necessary that knowledge has been translated into a simple, usable and systematic form that is instantly available when required. In addition, understanding the importance of maintaining the integrity of the custody chain of evidence is a skill that even police officers often struggle with. Altogether, this book seeks to address these skills to allow auditors and regulators, who are highly trained in their own specific areas, to avoid making the basic errors that can jeopardize months of diligent work. It also seeks to cover the relevant underlying legal principles of interviewing, which apply to many jurisdictions. As a result, this book attempts to develop a system that produces repeatable and consistent results. Rather than focus on facts and knowledge in disconnected isolation, the guide conceptualizes the process and introduces an investigative interview technique that focus on execution. Nevertheless, individual investigators can adapt the technique to suit their own personalities and it is not a tick box framework.

Other books available cover some of these subjects in isolation and, indeed, there are many books available on interrogation techniques. Unfortunately, most are based on aggressive questioning techniques or deceptive practices and directed at serious criminals only. The interviewing model used in the Forensic Investigation and Investigative Interview Technique, on the other hand, is one that is suitable for both witnesses and suspects and focuses on collaboration. It is built on social intelligence and human psychology, which is discussed in the second part of the book to give an in-depth understanding of the model’s origins and the importance of prosocial behavior. Even more vital than this technical knowledge, however, is the ability to engage with an open mind and use critical thinking skills. All the technical expertise means little if this fundamental ability is absent.

Auditors provide an essential function in many industries, ensuring regulations, policies, and current best practice are followed. Regulators similarly serve a vital function. In recent years, following major financial irregularities being exposed, it has become apparent that merely having auditors is not the same as conducting effective auditing. Auditors sometimes need an understanding of the functioning of the criminal investigation process to equip them to successfully conclude any investigation. I hope that this book helps provide some guidance and direction to those who honestly want to perform their auditing roles with integrity, professionalism, and pride.

Dr. Kevin Sweeney

October 2017

Forensic Investigations & the Art of Investigative Interviewing

1.          Introduction

The purpose of this book is to provide information and develop skills for the fraud investigative process in the commercial sector. The technique used can be applied to an investigation of any type of allegation but it is explained here in the fraud and corruption context as that is frequently the type of offense to be examined. It may be used by industry regulators or auditors. It strives to leverage current investigative and audit practices in some industries, such as the pharmaceutical and financial industry, into the fraud investigative process. For instance, the pharmaceutical industry is committed to Good Manufacturing Practices (GMP) and Good Distribution Practices (GDP). Data integrity ensures documentation is correctly and properly completed thereby providing a framework to ensure compliance with GMP and GDP. Failure to abide by these practices may result in the involvement of regulatory bodies with powers to cease all manufacturing operations, if deemed necessary. The financial sector is similarly heavily regulated and subject to regular oversight and governance.

Throughout, this book treats falsification of company documentation or records as deliberate acts designed to either enrich or cause loss to the organization. Therefore, the book treats workplace breaches as always deliberate, even though in reality, many are or will be, minor and unintentional. However, once prepared for the worst-case scenario, an auditor or investigator should be able to tackle any assignment and scale up as appropriate and necessary. The book assumes some background knowledge of industry-specific auditing or regulatory processes and it aims to bridge the knowledge gap between auditing and criminal investigation. The book will also provide an understanding of criminal activity from different perspectives, examine common misconceptions, as well as laying out the investigative process.

The book will briefly consider how evidence is used in court and legal principles to provide the necessary understanding of how important gathering and preparing evidence can potentially be. The main focus is on the interviewing process and maximizing the information flow from different persons. First I will discuss what fraud is and why the effort to eliminate it is so important and can be essential for the survival of a private company.

2.          Fraud Defined

Normally fraud comprises three elements: Pressure or incentive, opportunity, and concealment together with rationalization. Pressure may be experienced through personal circumstances or outside coercion, subtle or not, from somebody else. Incentive is the ability to seize an opportunity that presents itself. Opportunity is created when there are ineffective controls or where controls are absent. New opportunities may be created where there is a change of circumstances in the workplace environment that now provides the ability to override the controls designed to counter fraud. Concealment is normally an essential part of the fraud, both to prevent possible sanctions and discovery that ends the activity and resultant benefit. Rationalization is a common feature of the human psych, nobody wants a negative self-image so frequently the autobiographical narrative is changed to one that avoids personal responsibility, holding someone or something else responsible.

What is fraud? A fraud may be perpetrated by or against the company being audited. It may be carried out by customers, suppliers or other third parties, or by employees, management, or directors—individually or acting together. It may be directed at altered financial statements or the misappropriation of assets of the company or others, or to obtain an unfair or improper advantage for the company itself. In general, it will be accompanied by attempts to conceal it, and may be achieved in very sophisticated ways. Directors and senior management, in particular, may be able to conceal fraudulent acts by their ability to override controls, or require employees to act so as to conceal the true nature of activities.[1] Fraud also concerns issues such as bribery or other forms of corruption where improper payments are made to gain an advantage for the company. Fraud is, therefore, a major concern in a business where credibility and public perception are critical to business survival.

2.1.         Working Definition:

In order to properly understand fraud, it is essential to define it. A definition of fraud could be:

The theft or misuse of Company funds or other resources, or causing a loss, by an employee or a third party, which may or may not also involve misstatement of financial documents or other records to conceal the theft or misuse or loss.

For example, fraudulent activity may include but is not limited to the following:

Willfully destroying, defacing, concealing or falsifying any account or any record or document made or required for any accounting or business purpose; or

Willful alteration, destruction, concealing or other manipulation of data or record that results from the manufacturing process, including that which may be gathered in furtherance of Good Manufacturing Practice and/or Good Distribution Practice; or

Misrepresentation or furnishing any account, or any such record or document, which to his or her knowledge is or may be misleading, false or deceptive in a material manner; or

Deliberate introduction of falsified or counterfeit products into the supply chain; or

Misappropriation or theft of money, equipment, supplies, materials or property of the Company; or

Falsification of expense claims, and falsification of invoices for payment; or

Commercial bribery or bribery of a government official or other violation of anti-corruption laws; or

Improper payment schemes such as employees or directors seeking or accepting from, paying or offering to, suppliers or business partners, kickbacks or gifts intended to or which may appear to influence business judgment; or

Attempts of such behavior.

Such behavior may also be considered breaches of criminal law and as such might involve investigatory bodies such as the police or industry regulators. Fraud is a criminal offense normally contained in legislation to counter theft (also known by its older name as larceny). As such, forgery may only be considered a crime in some countries if it is done in an effort both to deceive and to gain a benefit for the forger, or in some cases, cause a loss to another. Although more recent legislation tends to be broader to include instances where the forged article causes some person to do some act, or to make some omission, to the prejudice of that person or any other person. False accounting and dishonestly using a computer, to make a gain or cause a loss, are generally also considered criminal offenses in the more recent legislation currently being produced. A person need not be aware that the behavior is a criminal offense as ignorance of the law is no defense to criminal behavior. There are two parts to a criminal offense; the intention and the action. The person must have intended the behavior, even if not aware of its illegality. However, outside of criminal offenses, other behavior prescribed by company policies should be clearly set out as a person is entitled to know what is prohibited behavior from the organization’s standpoint. Consequently, an action that a company may consider damaging to its business and would wish to prevent should be clearly specified in an inhouse ethics guide or policy, as it may not necessarily be a criminal act, per se.

A police investigation normally requires an initial statement of complaint before they become involved. However, it may often be considered desirable to decline to involve a police investigation, at least initially. The reasons to make such a decision may vary but information potentially leaking to the public may be one reason to delay police involvement. It may also be decided to establish the extent of the issue first before notifying the police. Such an approach may also be taken with regulatory agencies, in certain instances. It should be understood that the police and prosecution authorities are responsible to the public as opposed to any one individual or company and must act in the public good. On occasions, the public good may not align with the individual company’s. For instance, a company may prefer an outcome of restitution of lost property or funds while a police investigation may be more directed at the prosecution and possible incarceration of the perpetrator.

2.2.         Role of Investigators:

Throughout different industries, auditors may be regularly and routinely active in monitoring work practices and being cognizant of suspected fraudulent activity. Auditing practice should be based on an anti-fraud policy document, a code of ethics and commensurate training in these areas. Where the auditor reasonably suspects instances of fraudulent activity, then a more forensic-type approach should be adopted. The situation, at this point, moves from being an audit to an investigation. For the purpose of this book, it will be referred to as a forensic investigation. If the auditor has not received sufficient training in this area, other auditors, internal or external, should be tasked with this function. Forensic investigators should have the necessary qualifications and training to apply the relevant expertise and determination to the investigation.

It is vital that where instances of activity of potentially fraudulent activity are uncovered, suspected or disclosed, that a full and proper investigation is undertaken. Unfortunately, understanding the risk that fraud presents is rarely given the full attention it merits. Too often such incidences are dealt with in a perfunctory fashion due to neglect, lack of awareness, or an unwillingness to create a fuss with senior management. Even where regular audits are often performed, these are frequently approached from a routine exercise mindset with auditors failing to appreciate the potential risks. In the financial industry, for example, the Financial Reporting Council has noted:

"The consideration of fraud risks and relevant laws and regulations, and the performance of related audit procedures, tends to be viewed as a compliance exercise rather than as an important and integral part of the audit… We saw evidence of a presumption by audit teams that issues in these areas were unlikely to occur at the entity they were auditing. This suggests a lack of appropriate professional skepticism."[2]

This lack of skepticism and awareness of risks among auditors or regulators can potentially be as damaging as having no audit process. This lack of awareness or even naiveté in some instances as to the correct course of action necessary wastes the audit opportunity. It may arise from the hope that if no action is taken, it will all turn out all right. This Pollyanna mindset is not uncommon in both public and private sectors. Indeed, it not just fraudulent offenses that are improperly investigated; when over a billion Yahoo users had their account details hacked in 2014, the company failed to investigate the incident properly, leading to the later censure of some of the senior management. An inquiry into the matter particularly chastised the Yahoo legal department for failing to examine the breaches in greater depth and thereby failing to properly investigate or analyze the incident.[3] Auditors, therefore, need to understand that if fraud exists, efforts will be made to keep it concealed. Without a questioning attitude and skeptical approach to all information, the effort to keep it concealed will be successful.

Auditors need to have fraud at the forefront of their thinking during an audit and be alert for both instances of suspicious activity and areas where the risk of fraud is identified, even if no signs of actual fraud exists. In particular, the auditor is required to consider the presence of fraud risk factors; these are not just risks of fraud, as such, but events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to do so. In reality, small indications of fraudulent activity uncovered might lead to an uncovering of much more fraud. This is better for any organization in the long run, certainly preferable to a delayed but major public exposure.

2.2.1.        Investigator traits:

The auditor or investigator should be able to scale up any investigation as appropriate. The skills necessary for a good auditor will be the same skillset that will be required to scale up the matter to a full investigation. Good auditors should consistently strive to deliver good audits that detect issues, identify failures, and challenge the audited organization to correct, improve, and prevent issues from becoming a systematic problem. The first and most essential requirement of any auditor is a sound ethical base from which all decisions originate. Honesty and a strong moral compass are essential prerequisites. This needs to be coupled with a strong ethical resilience as many decisions may be challenged and the ethical course may not always be the easiest route of action. An auditor must also be both open-minded and intellectually curious. The role should be stimulating and interesting or otherwise auditing should not be a career option. This curiosity must be maintained throughout a career, as must the desire to deliver high-quality results. Professionally, auditors must be technically capable and proficient in performing the role.

An auditor must have the ability to communicate, both the process and the results. The most important trait necessary is interpersonal ability through well-developed people skills and emotional intelligence. Potential informants and witnesses will not disclose information unless rapport is built with them. These are the people who have the knowledge that you need. Therefore, understand what factors encourage disclosure. It is essential that the outcomes of any investigation are correctly and carefully communicated, both as a process of natural justice and to enable lessons to be learned. Therefore, taking time and effort completing written reports is a critical factor. It is also how the auditor is judged by the organization. The auditor must also be capable of inspiring any necessary directional changes that are necessary as a consequence of these lessons learned.

When investigating, critical thinking is essential. There is a process to follow that involves gathering evidence and interviewing relevant personnel. Some people will be deceptive and will strive to keep the matter concealed. The fundamental personal traits of a successful investigator must, include, therefore, skepticism or a suspicious nature. This can require both dedication and courage, as one must often be prepared to be a contrarian at times and unwilling to accept the agenda others may want you to follow. An investigator may also be delivering bad news to management, which they may not want to hear. The former United Nations weapons inspector in Iraq, Hans Blix, listed other desirable traits as:

Driving and dynamic but not angry and aggressive.

Firm but correct.

Ingenious but not deceptive.

Somewhat flexible but not to be pushed around.

Calm but somewhat impatient.

Keeping some distance but not arrogant or pompous.

Friendly but not cozy.

Show respect for those you deal with and demand respect for yourself.

The above list is surely aspirational as we are all continually learning. Investigating is similar to any other skill, once the fundamentals are learned and some practice obtained, then every engagement should be used as a learning opportunity. Prior preparation ahead of any assignment is essential and saves valuable time on site. This includes reviewing documents that were requested ahead of time, information available on the Internet, historical data from previous audits performed, any updates on rules and regulations, and information available on comparable companies, processes, or issues.

Furthermore, an investigator may begin a process that ultimately ends in enforcement. The ultimate purpose of enforcement is to change behaviors and attitudes, and improve compliance by holding individuals and firms to account where their behavior falls below expected standards. These may involve local sanctions by management but some could also ultimately result in criminal prosecutions with potential incarceration. An investigator must understand this and be willing to assist in this process if the investigation uncovers sufficiently serious issues.

3.          The Forensic Investigation and Investigative Interviewing Technique

What is an investigation? The diagram in Fig.1 describes the fraud investigative process as a circular process, which I have called the forensic investigation and investigative interviewing technique (FIIIT), or shortened to the FIT cycle. The initial action results from a problem or issue coming to light. This may arise as a result of a routine audit or through a management audit, but the most likely way an issue will come to attention is through information from an employee. Once there is awareness of an issue, the investigators function is to begin the investigation by beginning to gather the facts, information, and evidence. At this point, there is little to distinguish information from evidence.

Every action taken, everything taken possession of, and every person spoken to about the matter under investigation, must be recorded contemporaneously. At this stage, items will be taken possession of that may potentially not be used. At later stages, evidence is information that is strong enough to be presented in a court of law. If the court of law is a civil court, there is generally greater latitude towards the rules of evidence than a criminal court would tolerate. In a civil law case, one person or entity sues another, usually to receive financial compensation for damages done. In a criminal court, the State itself is the prosecuting entity, through its agencies, and penalties include imprisonment as well as financial fines. The standard of proof required is higher in a criminal court being beyond a reasonable doubt where civil courts operate on the balance of probabilities. Consequently, it is good practice to always audit and investigate suspected fraud offenses as potential criminal activity as the higher standard can be used in either type of court, or indeed any other forum.

3.1.         Forensic Investigation Cycle

The information that is gathered by