Forensic interviews: Plan to succeed

Is an interviewing strategy all talk? Not if you want to save time and money while conducting more effective investigations.

By Charles L. McGimsey, CPA/CFF, and Dan Whelan, CPA

August 1, 2015

From: http://www.journalofaccountancy.com/issues/2015/aug/forensic-interviews-fraud-investigations.html

Imagine someone taking an automobile to a mechanic for a repair. The mechanic asks, “What’s the problem?” The customer replies, “I’d rather not say. Just take it apart, and tell me what you find.”

Sound crazy? Of course it does, but it’s not that much different from what happens when forensic accountants always start fraud investigations by digging through the financials.

Consider this. What if someone would simply tell the investigator how a fraud was perpetrated—whether the incriminating information was provided by the interviewee intentionally or not? How valuable would that be? How much time would that save compared to a semi-blind search through a company’s books?

Some people are simply waiting to tell their story. They just need to be asked the right questions at the right time and in the right manner. Interviews can help form the scope of further analysis and identify areas to be investigated more thoroughly. This article looks at an approach to setting up a formal interviewing plan for a forensic engagement.

BENEFITS OF CONDUCTING EFFECTIVE INTERVIEWS

The main goal of an interviewing strategy is to gather and synthesize enough supporting evidence to provide a sound basis for questioning the suspected fraudster and to elicit an admission of guilt. A strategically planned interview program conducted by a skilled forensic interviewer also can:

• Decrease the time involved in determining how to conduct the investigation;
• Reduce the breadth of the investigative plan;
• Garner valuable information from interviewees, either wittingly or unwittingly; and
• Increase the likelihood of overall success in discovering and proving fraud or malfeasance.

ELEMENTS OF A FORENSIC INVESTIGATIVE PLAN

An investigative plan for a fraud engagement should incorporate both the interview strategy and the related analysis of financial information. Following are three best practices for plan development:

• The investigative team should develop and agree upon the plan before the first interview;
• The plan must be flexible enough to incorporate continual changes dictated by information unearthed at each stage of the engagement; and
• The team should meet regularly during the engagement to consider the possibility of changes in the interview program.

In terms of developing the interview strategy, an investigator should include the following:

• Whom to interview within the organization, considering both key and non-key personnel;
• Whom to interview outside the organization, considering both key and non-key third-party individuals;
• Timing of interviews, incorporating time to review documents and other information discussed and analyzed during interviews; and sequencing of interviews.

Additionally, as part of the interview strategy, an investigator should consider whether the fraud is either publicly known, or alleged or suspected internally; and also whether the perpetrator(s) is known or has confessed; is only suspected; or is unknown, and there are no suspects.

STATE A PURPOSE FOR THE INTERVIEWS

While the investigative team members may not want to reveal that they suspect fraud, they need to provide a reason for wanting to talk with potential interviewees. The reason cited should be honest but does not necessarily have to disclose concerns of fraudulent activity. Examples of reasons to undertake these types of interviews include:

• This is part of a special-purpose audit;
• This is part of a process or accounting system improvement study;
• This is connected with an internal control study;
• We need to understand further details about a specific financial transaction; or
• Certain accounting procedures have generated some concerns.

DIFFERENT APPROACHES TO INTERVIEWING

Four possible interview approaches may be considered in developing the plan. They include:

• Inside-out. Begin by interviewing internal personnel, moving later to outside third parties. Outside third parties may confirm or refute information gleaned from internal sources.
• Outside-in. Begin by interviewing outside third parties, moving later to internal personnel. Internal personnel may provide information that contradicts information obtained from outside third parties.
• Key to non-key internal personnel. Begin by interviewing key personnel, moving later to non-key personnel. Non-keypersonnel may confirm or rebut information gleaned from key personnel.
• Non-key to key personnel. Develop an understanding of the accounting and finance transactions first from non-keypersonnel. Contradictions and inconsistencies may be identified as key personnel are asked to describe accounting and finance transactions already understood from earlier interviews with non-key personnel.

An investigation may employ various parts of these approaches, as the forensic accountants deem appropriate. Professional judgment is key to developing and using the preferred interviewing approach. Remember that initial interviews often provide background information, allowing later interviews to be more illuminating and impactful. In some situations, for example, people inside the organization under investigation may be willing to talk. In others, it may be better to start with outside parties, such as:

• Bankers;
• Vendors;
• Professionals;
• Customers;
• Investors;
• Government agencies (where information is publicly accessible); and
• Any individuals who formerly had relationships with the organization (e.g., former employees, vendors, etc.). These parties may have no continuing reason to support individuals within the organization and may be more candid than other third parties with an ongoing relationship.

This article next looks at how to develop and implement a plan, followed by a case study on how an engagement mightproceed.

SET THE INTERVIEW’S TONE EARLY

A forensic accountant may have only one chance to engage someone in a candid interview. Take advantage of this “one-chance” opportunity.

The initial few minutes are important for setting the tone. Most interviewees are uncomfortable and stressed at the meeting’s onset. Regardless of whether they have anything to hide, interviewees often would rather be anywhere else than in a room answering difficult and sensitive questions.

The interviewer should introduce himself or herself, inform the interviewee of the nature of the interview (as previously discussed with the interview team), and express appreciation to the interviewee for his or her cooperation. Additionally, while maintaining a professional and businesslike atmosphere, the investigator may opt to briefly share some human-interestinformation about himself or herself and solicit the same from the interviewee. It’s a process similar to the start of a conversation with someone you’ve just met socially. You might ask where the person is from or whether he or she has any children. And you might share similar information about yourself.

The main objective of this process is to help the inteviewee to feel comfortable. You want the process to be as informal and relaxed as possible. The setup should seek to increase the interviewee’s willingness to cooperate—not only for the initial interview, but also for the remainder of the engagement.

Rapport and trust are crucial when an interviewee is unlikely to have been involved in any wrongdoing but may have information important to understanding a fraud. Rapport and trust are even more important when talking with the suspected fraudster. While rapport building does not require the interviewer to be unduly polite or kind, it does require him or her to be respectful of the interviewee, even when the interviewee is suspected of lying. In those cases, the interviewer should encourage the suspect to talk as much as possible. Someone telling the truth has far less trouble adding details than someone who is lying and reciting a memorized story. If you can lure a suspect into making up details on the fly, there’s a chance he or she will say something that doesn’t fit with details shared earlier.

ESTABLISH A BASELINE TO GAUGE THE INTERVIEWEE

During the interview’s initial phase, questions should be designed to elicit general information about the interviewee’s job description and typical duties. Questions should be posed with answers the interviewer already knows. This will give the interviewer an opportunity to carefully observe the interviewee, who should have little problem with the content of these questions, allowing the interviewer to establish a “baseline” for gauging the interviewee’s demeanor under low stress. Special attention should be paid to the interviewee’s behavior and manner—calmness versus nervousness, speech patterns and style (e.g., clear, stuttering, or halting), perspiration, etc.

The hope is that the baseline will allow the interviewer to notice changes in demeanor and voice as questions become progressively more difficult and steer closer to areas where a fraud may have been perpetrated.

A change in demeanor may be caused by increased stress. This often reveals that the interviewee is uncomfortable with specific questions. If a change is detected, the interviewer may want to expand this line of questioning, extending the time and deepening the focus on the area of the interviewee’s discomfort.

PAY ATTENTION TO BOTH VERBAL AND NONVERBAL CLUES

It is during the more intense portion of the interview that verbal and nonverbal clues may become apparent, although these clues can appear anytime.

Some common verbal indicators of possible deception by the interviewee include:

• Hesitation or stuttering when answering a question;
• Repeating the interviewer’s question (buying time);
• Not answering the question and attempting to move the conversation to a different topic; and
• Starting answers with phrases such as “to be honest,” “I swear,” or “I am not that kind of person.”

Some common nonverbal indicators of possible deception include:

• Avoiding eye contact; and
• Touching of the head, face, ears, nose, or covering of the mouth, when answering.

Verbal and nonverbal indicators are only possible signs of deception. Identifying deception is not an exact science. People react to stress and other stimuli differently. The human mind is too complex to allow the investigator to consider a one-size-fits-all approach. Therefore, it is extremely important to observe the interviewee from the onset of the interview process to determine his or her baseline reaction to low-intensity questions.

OTHER TACTICS TO CONSIDER

Simultaneous interviews in certain instances may be needed to curtail dissemination of sensitive information to other interviewees. For example, the CFO and controller could be interviewed at the same time regarding irregularities in accounting procedures.

A fruitful interview often allows time for the interviewee to do most of the talking. A common error of interviewing is for the interviewer to talk too much. Inexperienced interviewers may also speak over the interviewee’s responses, not allowing the interviewee to complete his or her statements. Allow the interviewee to answer completely before asking another question.

The interviewer should not be concerned with periods of silence and should not initiate speaking to interrupt these moments. Don’t be surprised if an interviewee volunteers beneficial information to end an awkwardly silent period.

While remaining professional and never showing disrespect, frustration, or anger, the interviewer may choose to increase the intensity of the interview whenever he or she deems appropriate. Increased intensity can be manifested with a change of inflection in the voice, or by silence with direct eye contact after an important question is asked.

‘LEAVE THE DOOR OPEN’ AT THE INTERVIEW’S CONCLUSION

At the interview’s conclusion, the interviewer should “leave the door open” for later contact with the interviewee. Contact information should be provided to the interviewee. Like the investigation itself, information may be obtained over a period of time. The rapport and trust created during the interview may eventually lead an interviewee to provide additional valuable information in the weeks or months following the interview.

HYPOTHETICAL: STEVENSON TIMBER

How does all this fit together? Consider the following hypothetical case:

The Stevenson family owns a 30,000-acre tract of timberland and hires Stribling, a timber harvesting company, to cut the timber and deliver it to be processed at the AAA Lumber Mill. Stribling will be paid a production fee for its service.

Stevenson family members overseeing the process suspect fraud because the daily tallies of logs being received at AAA are substantially lower than the number of logs estimated to have been removed from the property. The Stevenson family is concerned that cut timber may have been diverted and sold, with the proceeds stolen.

A fraud is suspected but not publicly known

Having no idea as to why the tallies and extraction estimates vary so widely, the Stevensons hire Wright & Co. CPAs (W&C), a firm experienced in accounting for the timber industry and in forensic investigations. In the initial meeting, the Stevensons tell W&C of their fraud suspicions. This is akin to a car owner telling the mechanic that he or she hears a noise. Now, the mechanic has to figure out the source of the noise—and correct it, if needed.

W&C assembles a team for the engagement and develops an investigative program, including a strategically designed interview plan. It also collaborates with the Stevenson family’s CPA firm and a forest-harvesting expert.

How to communicate the reason for the engagement

The Stevenson family and W&C agree to state the reason for the investigation—”to assess and improve accounting and internal controls over their timber operation.” This is an honest representation, notwithstanding their unstated purpose of investigating potential fraud.

Inside-out or outside-in?

Because W&C believes any of Stribling’s employees could be a part of a fraud, the firm decides to begin the investigation with a general overview of the financial records provided by the Stevensons, followed by an outside-in interview strategy. This approach is adopted based on W&C’s experience and professional judgment applied to this specific case.

After the interview questions are written, W&C’s interviewing team members work together to practice asking and answering questions. The team develops a combination of specific questions (i.e., those with yes-or-no answers) and open-ended questions.

The firm assigns two professionals for each interview. One interviewer asks questions while the other takes notes. The interviewer asking questions watches closely for nonverbal clues.

Outside parties interviewed include:

• Employees of the ferry company that transports Stribling logging trucks over a river from the area where the timber property is to the area where the AAA sawmill is.
• Employees of the company that makes metal tags for identifying logs and their owners. This company handles all of this type of work in that region.
• Clerical staff at the AAA mill.
• Accounting staff employed by AAA, though working at AAA’s home office.
• Other sawmills within 150 miles of the Stevenson property.
• Residents living near the timber property (they report suspicious hauling activity at night and on Sundays).

Each evening, the investigative team reviews the interview results and modifies upcoming interviews. Financial records are compared with information gleaned from the interviews. Questions are added and deleted, and changes are made to the structure of existing questions. Follow-up questions are compiled for later use with individuals interviewed previously. As information is obtained, the team applies professional judgment and continually modifies the sequence of interviews yet to beconducted.

Inside parties: Key vs. non-key personnel

A discovery resulting from the outside interviews reveals the existence of an unusually close relationship between Stribling’s controller and logging personnel. Typically, these individuals would have few reasons to communicate with one another. In this case, interviewee representations indicate frequent contact between the controller and logging personnel, who appear to have an unusually close social relationship. As a result, the investigative team opts to obtain information from Stribling’s non-key accounting and finance personnel before talking to key personnel—hoping to obtain additional intelligence before facing the controller and others suspected of fraud.

The engagement team develops questions for lower-level accounting staff, then simultaneously interviews three accounting clerks in separate offices, again using two-person interviewing teams. Holding the interviews at the same time stops potential collaboration among the three clerks.

The information derived from these interviews, together with comparisons of accounting data provided by the accounting clerks, provides a strong inference that Stribling’s controller has conspired with logging personnel to divert and sell some of the Stevensons’ timber. In addition, interviews with lower-level personnel revealed that the controller struggled with a gambling addiction for several years, often finding himself without enough money to support his family and his habit.

Now that it has this information in hand and all outside parties and non-key financial personnel have been thoroughly questioned, the W&C team develops a question list and finally interviews Stribling’s controller.

A clerical employee typically purchases metal ownership tags. In this case, the controller had bought them. When presented with information regarding his direct purchases (as revealed by the regional fabricator), the controller begins weaving various stories to explain the anomaly. The skilled interviewers point out the contradictions in his statements. Under intense stress and realizing he has been caught, he confesses to the fraud. He admits buying metal ownership tags from the regional fabricator and colluding with logging personnel to misidentify Stevenson logs, allowing him and his collaborators to divert and sell the logs to dishonest sawmill operators.

The engagement uncovered the fraud and helped stop the scheme before too much damage had been done, clearing the way for the Stevensons to recoup much of their losses. Essential to the success of W&C’s engagement were productive interviews with people at various stages of the process.

A good interviewing plan can help produce similar results.

Sample questions: Stevenson timber HYPOTHETICAL

In the Stevenson hypothetical, the interviewers used many questions to gather information and eventually elicit a confession. Though many more questions would have been asked during the engagement, the following are sample questions that could have been helpful. Based on answers to prepared questions, the interviewer might ask additional follow-up questions, composed on the fly. The time frame for questions was stated to have been “between June 1 and June 30.”

Outside: Ferry operator

1. How many logging trucks did you ferry during this time?
2. Of these, how many were owned by Stribling?
3. Do you have a schedule of the actual days and times trucks were being ferried during this period? If not, can you estimate these?

Outside: Metal tag fabricator

1. Whom do you deal with at Stribling when an order is placed for ownership tags?
2. Do you have records reflecting orders from Stribling for this year?
3. How do you control which owners the tags reflect; i.e., could someone order tags with any owner identified on them?

Outside: Clerical and accounting staff at AAA

1. Describe the accounting process used to account for loads of timber delivered to your mill.
2. How is this information transmitted to logging operators? To owners?
3. How are loads being hauled by Stribling for Stevenson tracked?
4. Did Stribling haul loads to your mill for other timber property owners during this time?

Outside: Other sawmills within 150 miles of the Stevenson property

1. Did Stribling trucks deliver logs to your mill during this time? If yes, who were the owners of these logs?
2. Do you have a record of their deliveries? (If applicable, follow-up interviews with other owners could be arranged to confirm or refute information provided by these sawmills.)

Outside: Neighbors near the property

1. How many times per day did you notice a Stribling logging truck coming by your home?
2. What days of the week and times of day did they typically come by your home?

Inside: Logging truck drivers

1. How are you compensated?
2. What’s an average number of loads per day you hauled from the Stevenson site during this time?
3. What is your work schedule?
4. Do you have mileage records for hauling during this time? Trip reports?
5. Were all Stevenson loads delivered to AAA? If not, what other mills did you deliver to?
6. Were all logs tagged? As Stevenson logs? How do you get tags? How are tags stored for safekeeping?
7. Did you have tags for any other owners? During this time frame? Do tags ever get mixed up? (This question is very important; the other questions build to this moment. If the driver has been involved in fraud and he suspects an investigation, he may answer this question in a way he thinks will later provide him with wiggle room.)
8. What times of day and days of the week did you work?
9. Did you haul loads from other properties during this time?

Inside (non-key): Stribling accounting personnel

1. How are drivers compensated?
2. What is an average number of loads per day you hauled from the Stevenson site during this time?
3. Do you have mileage records for hauling during this time frame? Trip reports?
4. How do drivers report hauling information?
5. Describe how you reconcile time and production reported by logging personnel to actual results of logging activity, extraction, etc.
6. Describe how you account for and invoice customers for timber cutting and delivery.
7. How are ownership tags obtained? How are they safeguarded? Do tags ever get mixed up?

Inside (key): Controller

1. How are drivers compensated?
2. What’s an average number of loads per day hauled from the Stevenson site during this time frame?
3. Do you have mileage records for hauling during this time? Trip reports?
4. How do drivers report hauling information?
5. Describe how time and production reported by logging personnel is reconciled to actual results of logging activity, extraction, etc.
6. Describe how you account for and invoice customers for timber cutting and delivery.
7. How are ownership tags obtained? How are they safeguarded? Do tags ever get mixed up?
8. In the course of performing your duties as controller, describe direct interaction you have with logging crew members. How about nonbusiness-related interaction?

Training in interview techniques

To become consistently effective in executing forensic investigation plans, CPAs should invest time training in interviewing techniques. Among other activities, CPAs should:

• Attend interview skills training;
• Assist experienced interviewers during actual interviews—learning from them and making adjustments to their own style and personality;
• Critique their own and others’ recorded interviews;
• Practice role-playing and rapport building; and
• Learn and understand verbal and nonverbal clues.