FAFP Backgroud PDF

Certificate Course on Forensic
Accounting and Fraud Detection
The Institute of Chartered Accountants of India

Committee for Information Technology
Notice and Disclaimer
Without the prior consent of the author, no part of this compilation may be copied, reproduced,
stored or transmitted in any form or by any means including without limitation by means of
electronic, mechanical, photocopying, recording or otherwise. The opinions and views expressed
in this compilation are without prejudice and are based on experience of the authors, research or
based on empirical studies. The material is purely for academic consumption and should not be
construed as professional advice. The author does not warrant that the views stated shall be
effective in each and every case or may give predictable consequences. The author shall not be
responsible for the result of any action taken on the basis of this work whether directly or indirectly
and for any errors or omissions in the work
iii
The instituteof CharteredaccountantsofIndiaCertificate Course
onforensicaccountingand frauddetection
Contents
1. Introduction to Fraud investigation and Forensic Accounting
2. Fraud and Audit: modern day scenario
3. Areas of opportunities for ICAI members and those involved
in fighting fraud
4. Types of Frauds and financial crimes
5. Familiarization with Red flags in Detection of Frauds.
6. Steps in conducting an investigation
7. Tools and techniques used in fraud detection and
investigation
8. Computer Aided Audit Techniques and Tools (CAATTs)
9. Overview
Appendices
Appendix A:Internal Factors that reduce the probability of fraud

Appendix B:Internal factors that enhance the probability of fraud
Appendix C:Sample Report on Investigation
Appendix D:Model Docket - Confrontational Interview
Appendix E:MS Excel - a CAAT
Introduction to Fraud Investigation and
Forensic Accounting
1.1. What is Fraud?

There are many definitions for fraud, depending on the point of
view considering. According to The American Heritage
Dictionary, Second College Edition, fraud is defined as a
deception deliberately practiced in order to secure unfair of
unlawful gain. Davia et al. (2000) paraphrase this in a number of
items that must be identified, when articulating a case of fraud:
a victim
details of the deceptive act thought to be fraudulent
the victims loss
a perpetrator (i.e., a suspect)
evidence that the perpetrator acted with intent
evidence that the perpetrator profited by the act(s)
In a nutshell, fraud always involves one or more persons who,
with intent, act secretly to deprive another of something of value,
for their own enrichment (Davia et al., 2000). Wells (2005)
stresses deception as the linchpin to fraud. To exclude kinds of
fraud we dont wish to examine, the delineation of fraud to
occupational fraud and abuse, as referred to by the Association
of Certified Fraud Examiners, is of interest. Occupational fraud
and abuse may be defined as: The use of ones occupation for
personal enrichment through the deliberate misuse or
misapplication of the employing organizations resources or
assets. (ACFE, 2006) This definition encompasses a wide
variety of conduct by executives, employees, managers, and
principals of organizations. Violations can range from asset
misappropriation, fraudulent statements and corruption over
pilferage and petty theft, false overtime and using company
property for personal benefit to payroll and sick time abuses.
(Wells, 2005)
2 Forensic Accounting and Fraud Detection
In criminal law, fraud is the crime or offense of deliberately

deceiving another in order to damage them - usually, to obtain
property or services unjustly. Fraud can be accomplished through
the aid of forged objects. In the criminal law of common law
jurisdictions it may be called theft by deception, larceny by
trick, larceny by fraud and deception or something similar.
1.2 Classifying Fraud

The delineation of fraud to occupational fraud and abuse is a
good start to study the desired scope of fraud. Yet still, a further
classification is convenient. There are numerous ways of
classifying occupational fraud. The classification most used is the
one where two types of fraud are distinguished:
Financial statement balance fraud and asset-theft fraud. The
main difference between the former and the latter is that there is
no theft of assets involved in the former. (Davia et al., 2000)
Bologna and Lindquist (1995) classify fraud on many ways,
amongst them fraud for versus against the company, internal
versus external fraud, management versus non-management
fraud and transaction versus statement fraud. Some of them
overlap the above mentioned classification into financial
statement balance fraud and asset-theft fraud. For example,
asset-theft fraud will be fraud against the company and
transaction fraud, without being classified as internal, external,
management or non-management fraud. Various combinations
can be made in this manner.
1.3 Some Numbers...

Two elaborate surveys, one in the United States (ACFE, 2006)1
and one worldwide (PWC, 2005)2, yield the following information:
45% of companies worldwide have fallen victim to economic
crime in the years 2004 and 2005. No industry seems to be safe
and bigger companies seem to be more vulnerable to fraud than
smaller ones. Small businesses however suffer disproportionate
fraud losses. The average financial damage to companies
subjected to the PWC survey, was US$ 1.7 million per company.
Introduction to Fraud Investigation andForensic Accounting 3
Participants of the ACFE study estimate a loss of 5% of a

companys annual revenues to fraud. Applied to the estimated
2006 United States Gross
Domestic Product, this would translate to approximately US$ 652
billion in fraud losses for the United States only.
Regarding to the types of fraud, asset misappropriation was
number one in both studies. In the PWC survey, this was
followed by financial misrepresentation and corruption, false
pretenses, insider trading, counterfeiting and money laundering.
The ACFE report handles a different classification, where asset
misappropriation takes 91% of the reported cases for its account,
corruption 31% and fraudulent statements 11%. About the way
fraud is detected, both studies stress the importance of tips and
chance in detecting fraud. According to the ACFE report, an
anonymous fraud hotline anticipates a lot of fraud damage. In the
cases reviewed, organizations that had such hotlines, suffered a
median loss of US$ 100.000,
Whereas organizations without hotlines had a median loss of
US$ 200.000. At the PWC study, no less than 34% of the fraud
cases were detected by means of tips and other chance means.
Internal audit and internal control systems can have a
measurable impact on detecting fraud after chance related
means. The more control measures a company puts in place, the
more incidents of fraud it will uncovered.
1.4 What is Forensic Accounting?

Accountants look at the numbers. Forensic accountants
look behind the numbers
Thrill seeking and accountancy are not, whatever you may think,
mutually exclusive. Forensic accountancy can be a high profile
and fascinating blend of legal and numerical problem solving
where you are key to beating the bad guys. Theres nothing
better than that thrill of getting the final bit of evidence that pieces
the jigsaw together
Mark Alden.
In the backdrop of highly competitive business environment,

there has been a surge in commercial litigations. The complex
nature of financial and accounting issues make the scenario
more complicated. This has resulted in the greater demand of
specialist financial skills in detecting and investigating fraudulent
actions. In cases where an investigation concerns embezzlement
by a corporate officer, environmental mishaps, or allegations of
tax fraud, counsel may not always possess the investigative
resources needed to gather all the relevant facts. In the course of
conducting internal corporate investigations, counsel may require
specialized assistance in the fact gathering process. In such
situations, the services of a forensic accountant are of paramount
importance.
The term Forensic Accounting encompasses a wide range of
activities including:
The Expert Witness - preparation of formal Reports for filing
in Court and giving evidence as an Expert
Litigation Consultancy - working with lawyers and their
clients engaged in litigation and assisting with evidence,
strategy and case preparation.
Fraud Detection - assisting clients in detecting financial fraud
by employees and others and tracing misappropriated funds.
Computer Forensics - assisting in electronic data recovery
and enforcement of IP rights etc.
1.5 General Nature of Forensic Accountancy Work

Forensic accounting (or at least, accounting expert witnessing)
can be traced as far back as 1817 to a court decision. According
to The Accountants Handbook on Fraud & Commercial Crime,
forensic accounting is defined as: the application of financial skills
and an investigative mentality to unresolved issues, conducted
within the context of the rules of evidence. Forensic Accounting
broadly is a mixture of Accounting, Finance, Law,
Computerization, Ethics, and Criminology, with focus on
prevention and detection of financial frauds and conduct of
investigation to undertake and assist in litigation support to book
the wrong doers. Forensic accounting looks at the accounting in

a wider perspective rather than in different segments such as
data entry, record keeping, preparation, and finalization of
accounts. Forensic accounting is not limited to the correctness of
accounts; it encompasses accounting, investigative accounting,
investigative audit, and litigation support.
Forensic accounting focuses on detection of financial frauds by
linking the data knowledge and insight together and prevention of
fraud by establishment and placing the accounting system on
right track, it also creates deterrence (as it promotes fear in the
mind of wrong doers that there is likelihood of their being caught
and punished).
Forensic accounting is the specialty practice area of
accountancy that describes engagements that result from actual
or anticipated disputes or litigation. Forensic means suitable for
use in a court of law, and it is to that standard and potential
outcome that forensic accountants generally have to work.
Forensic accountants, also referred to as forensic auditors or
investigative auditors, often have to give expert evidence at the
eventual trial. All of the larger accounting firms, as well as many
medium-sized and boutique firms, have specialist forensic
accounting departments. Within these groups, there may be
further sub-specializations: some forensic accountants may, for
example, just specialize in insurance claims, personal injury
claims, frauds, construction, or royalty audits
Simply put, forensic accounting is accounting that is suitable for
legal review, offering the highest level of assurance, and
including the now generally accepted connotation of having been
arrived at in a scientific fashion. That is, forensic accounting is
sufficiently thorough and complete so that an accountant, in
his/her considered independent professional judgment, can
deliver a finding as to accounts, inventories, or the presentation
thereof that is of such quality that it would be sustainable in some
adversarial legal proceeding, or within some judicial or
administrative review. Findings are based upon the scientific
detection and interpretation of the evidences of phenomena
introduced into the books and records of an accounting system

(expansively defined) and the effects of such phenomena upon
the accounts, inventories, or the presentation thereof.
(Alternatively, if there is no impact on an accounting system,
there is no accounting evidence, nor is there any effect upon the
accounts, inventories, or the presentation thereof; and such
situations are not within the realm of forensic accounting.) The
primary orientation of forensic accounting is explanatory analysis
(cause & effect) of phenomena - including the discovery of
deception (if any), and its effects - introduced into an accounting
system domain. The primary methodology employed by forensic
accountants is objective verification.
Engagements relating to civil disputes may fall into several
categories: calculating and quantifying losses and economic
damages, whether suffered through tort or breach of contract;
disagreements relating to company acquisitionsperhaps earn
outs or breaches of warranties; and business valuation. Forensic
accountants often assist in professional negligence claims where
they are assessing and commenting on the work of other
professionals.
Engagements relating to criminal matters typically arise in the
aftermath of fraud. They frequently involve the assessment of
accounting systems and accounts presentationin essence
assessing if the numbers reflect reality.
Since all professional accountants operate within a commercial
legal environment, all professional accountants are, in a sense,
forensic accountants. What distinguishes forensic accounting in
common parlance, however, are the engagements. That is, when
a professional accountant accepts an engagement where they
anticipate that their finding or analysis may be subject to
adversarial or judicial scrutiny or administrative review, the
professional accountant seeks a level of evidentiary detail and
analytical precision which will be sustainable within the legal
framework of such scrutiny or review. This approach is based on
no more than the realistic appreciation that, while there is some
evolutionary dialogue, in the end, the courts or appropriate
administrative bodies are the ultimate arbiters of what accounting

facts are.
Forensic accounting is focused, therefore, upon both the
evidence of economic transactions and reporting as contained
within an accounting system, and the legal framework which
allows such evidence to be suitable to the purpose(s) of
establishing accountability and/or valuation. Forensic
accountants are typically CPA/CAs that specializes in those types
of engagements where there is a need for such evidence.
Engagements are wide-ranging, and include transaction
reconstruction and measurement; bankruptcy, matrimonial
divorce, and probate asset identification and valuation;
falsifications and manipulations of accounts or inventories or in
the presentation thereof; and accountability within the statutory
audit and other environments; among many others. Increasingly,
as various parties perceive the value of such evidence, grounded
as it is in accounting facts, forensic accountants are called upon
to play important preemptive roles (as of right, without cause),
offering independent assurance in such diverse areas as audit
committee advisory services, merger and underwriting due
diligence, investment analyst research, and enterprise risk
management.
1.6 Forensic Accounting Cases

Although the basic strategy is the same, the types of
assignments that require the services of a forensic accountant
vary. An independent consultant may assist the owner of a small
company who suspects his bookkeeper of embezzling funds; or
an accountant working for the government may attempt to prove
that a corporation has been laundering profits. It can be difficult to
find case studies of forensic accounting at work because most
companies dont publicize details of financial misconduct. In this
section, well look at some notable examples of forensic
accounting in action.
In 1996, a city manager in Californias Contra Costa County
became suspicious when a local disposal service company asked
for help keeping itself afloat. Orinda-Moraga Disposal Services
wanted to raise rates on its customers and needed the Contra

Costa Sanitation Districts approval. However, the company had
recently stated its desire to lower rates. The wary city manager
hired forensic accountant Dan Ray to uncover the truth.
After examining Orinda-Moragas records, Ray discovered that
the company sent checks to nonexistent people at several
companies that had fake addresses. The disposal companys
owner deposited the checks into an account. He had created
these companies to illegally siphon money from Orinda-Moraga,
and inflated its business costs to justify the rate increase.
Ultimately, Orinda-Moragas owner and his partner were found
guilty in civil and criminal suits.
Forensic accountants are also retained to assist in uncovering
potentially hidden assets during divorce proceedings. The recent
high-profile divorce of Sir Paul McCartney and Heather Mills
included a dispute over how much McCartney was actually worth.
He claimed to be worth about $785 million (400 million pounds),
but Mills said that McCartney was worth about $1.6 billion (800
million pounds). She retained a team of forensic accountants to
delve into his assets. Mills hoped that if accountants proved that
she was correct, the divorce ruling would be overturned and she
could receive a larger settlement. As of June 2008, the initial
ruling hadnt been overturned.
Enron and other companies brought some aspects of forensic
accounting to prominence in recent years. In 1997, Sunbeam, a
company that manufactures small appliances, followed a practice
called bill and hold. This is when a company records sales of its
products as profits for the current quarter, while waiting to deliver
the product (typically they wouldnt be recorded as sales until
they were actually shipped). Sunbeam sold huge amounts of its
products to other companies at a discount, but kept the items in
warehouses. On paper, the company appeared to have had high
sales; however, Sunbeams warehouses were full of unsold
product. This practice was uncovered by a financial analyst at
investment firm Paine Webber, who downgraded the value of
Sunbeams stock.
Bill and hold isnt illegal, but Sunbeams shareholders felt

deceived and filed lawsuits. Sunbeams accounting firm, Arthur
Andersen (later ruined by its involvement with Enron), performed
an audit and reported that Sunbeams books were accurate and
in accordance with federal guidelines. However, the board was
unsatisfied and hired Deloitte & Touche to review Arthur
Andersens audit. This follow-up uncovered proof that the
numbers had been manipulated. The Securities and Exchange
Commission investigated Sunbeam, and its CEO, Alfred Dunlap,
was fired and forced to pay millions of dollars to settle investment
lawsuits. He paid $500,000 in fines and was banned from serving
as an officer in a public company.
Fraud and Forensic accounting

Considering all the foregoing, what then, are the terms fraud and
forensic accounting? Fraud, or, white collar crime encompasses
a wide range of intentional acts leading to any kind of damage to
an organisation. It may be noted that the damage need not be
financial. Frauds pose greater difficulties in detection than errors,
since there is a significant difference between frauds and errors;
errors are a result of inefficiency or oversight, whereas frauds are
the result of shrewd and efficient planning. Errors are
inadvertently committed without any intention of concealment.
Consequently, camouflaging of errors is rare and if at all, purely
accidental while camouflaging of frauds would be deliberate,
adroit and intelligent. For instance, certain frauds may be in the
form of calculated acts directed to affect the good image of a
company which in turn could be sponsored by competitors, or
disgruntled employees.
On the other hand forensic accounting has been defined by the
Websters Dictionary as belonging to, used in, or suitable to
courts of judicature or to public discussions and debate. It uses
the analogy of forensic medicine as a science that deals with the
relation and application of medical facts to legal problems.
Accordingly, the term forensic in the accounting profession deals
with the relation and application of financial facts to legal
problems. Gathering of hard core evidence proof information
which strengthens financial assertions and disclosures would be

entering the domain of forensic accounting. The term forensic
means suitable for courts of justice or for public discussion and
debate. Forensic auditing provides an investigation methodology
and accounting analysis that is suitable to the court which will
form the basis for discussion, debate and ultimately dispute
resolution.
This course concentrates on practical advice for all those
involved in the fight against fraud, with focus sessions on
deterrence, data mining and interviewing in a stressed
environment. It provides an incisive analysis of how fraud occurs
within an organisation and explains the latest techniques for
fighting it.
How is a forensic accounting analysis different from an

audit?
The difference between the publics expectation of the purposes
and objectives of an audit and the CPAs responsibilities under
Generally Accepted Auditing Standards has been referred to as
the expectation gap. Forensic accounting can help to bridge the
expectation gap.
In comparison, forensic accounting and audit differ in specific
ways, as shown below: Forensic Accounting
In response to an event
Financial investigation
Findings used as evidence in court or to resolve disputes
Audit
Mandatory
Measures compliance with reporting standards
Obtain reasonable assurance that financial statements are
free of material misstatement
In practice, there are differences in mindset between forensic
accounting and audit:
Investigative mentality vs. professional skepticism. A

forensic accountant will often require more extensive
corroboration.
A forensic accountant may focus more on seemingly
immaterial transactions.
A forensic accountant will often look for indications of fraud
that are not subject to the scope of a financial statement
audit.
Fraud and Audit:

Modern Day Scenario
Preamble: After the Enron debacle, auditing all over the world
has come under the scanner. The age old saying that an auditor
is a watchdog and not a blood hound is being re-examined, if not
questioned. Legislation which seeks to lay a greater emphasis on
detection and reporting of fraud by auditors has been introduced
all over the globe. In this context, the article examines an
auditors duty as regards detection and reporting of fraud. It
examines the causative factors that led to Enrons bankruptcy
and some of the subsequent legislation in India and ICAIs
pronouncements affecting an auditors duty and responsibility
towards the issue of fraud. For this purpose, the relevant clauses
in the Companies (Auditors Report) Order, 2003 (CARO), the
Standards of Auditing (SA), and certain observations made in a
recent high court judgment in Maharashtra (Note 3) have been
considered. To get an international flavor, the article also
examines the findings of the OMalley Report (Note 1) on audit
effectiveness. To make this study more interesting, the new
enhanced role of the auditor is examined with the help of a case
study.
Comparison of auditing scenarios before and after the turn
of the millennium.
In the last decade, two things have impacted the auditors role a
great deal: a) The rapidly evolving IT environment and b) the
Enron debacle in 2001. E-commerce and computerization in all
walks of life, for all the conveniences offered, have made
business practices and business models more and more
complex. New business models have sprung up where
commerce transcends not only huge distances, but also time
zones, currencies and countries. Data volumes are huge and
products with incredible technical specifications are introduced
every other day.
Consequently, the audit scenarios in this rapidly changing IT

environment have become more and more challenging. Amidst
this, the Enron bankruptcy (as well as the fall of several other
corporate giants during the 2001-02 period), brought the
Auditors role under the scanner. Panic buttons were pressed all
over the world and new legislation and statutory pronouncements
enhancing the role of auditors were announced. The Sarbanes
Oxley Act came into force in 2002 with revolutionary reporting
and disclosure requirements in audited accounts. For the first
time the CEO and CFO were obligatorily required to attest the
financial statements and also comment on existence of fraud.
World over, questions were raised about the performance of the
auditors. Undoubtedly, the auditors image was severely
impaired. Auditing practices, and auditing standards were all
revisited to make auditors address the issue of fraud and
emphasizing the need for greater audit effectiveness. In order to
understand the auditors role from the point of view of detection
and reporting of fraud, it would be useful to conduct a simple
case study.
Case Study of a Van Sales -business model.
Consider a business model applying the Van Sales method of
selling Fast Moving Consumer Goods (FMCG). This model was
conceived by a company with a view to reach out to
geographically far-flung untapped areas of potential demand. The
model required deployment of a fleet of multiple trailer vans
stacked with FMCGs like soaps, toothpastes, gels, creams,
biscuits, etc. The van crew would consist of a driver and a sales
representative given a specific route, (which could be hundreds
of kilometers long in the country), to find retailers, shops and
other buying entities to sell the products. Both cash and credit
sales were permissible within policy norms. These sales
operations were monitored through palmtop computers and small
portable printers provided to salesmen in the vans. Each palmtop
was linked to the main central server at the head office. The
salesmen made efforts to maximize their sales by approaching
retailers/ shops and buying outlets spotted on along the route.
The sales deliveries, invoices and collection receipts were raised
at the remote locations by the salesmen using the palm top
computers and printers provided. The palmtop sales system had
well designed controls built in to monitor credit limits, sales
Fraud And Audit:Modern Day Scenario 15
returns, discounts, and promotion/ festival/season offers. Each

van would return to the main warehouse to replenish its stocks
and deposit the collections after a tour was completed. In addition
all the vans were required to report, all together, once in a year at
one central place to facilitate stock verification, which was carried
out by the management. In such a business model, how does the
auditor perceive his role and what kind of audit procedures does
he apply?
Conventionally, an auditor would apply the following procedures:
a) Review and vouchsafe sales, receivables and inventory
data furnished to him at the head office, through the central
server.
b) Carry out tests of the sales application software for
evaluation of controls
c) Apply substantive tests to ensure compliance with rates,
discounts, etc., and terms and conditions in sales policies,
d) Apply substantive tests to ensure that collections deposited
at the warehouse by the van crew were deposited into the
bank,
e) Observe the annual stock verification procedure of stocks in
vans, and,
f) Debtors scrutiny and call for confirmations from debtors.
Would the foregoing tests be enough for him to express an
opinion on the correctness of the sales, collections, and debtors?
A couple of decades ago, the foregoing audit plan would have
been considered adequate. Unless some serious indication or
sign of fraud came up in his routine audit, or was brought to his
notice, the thought of a possible fraud or misuse would not even
have crossed an auditors mind. In other words, he would not be
specifically hunting for such a sign or indicator of fraud, nor would
he even consider discussing with his team the possibility that any
process or control could be exposed or circumvented to commit
fraud. However in the current auditing scenario, the above
procedures would not be adequate. An auditor has a duty to
consider the overall business model with professional skepticism

to understand its vulnerability and then apply appropriate audit
procedures to maximize his chances that any sign or indicator will
be spotted. For example, in the above case study, the auditor
would have to consider the business model and its control
systems with professional skepticism. If he does this, he will
immediately realize that the business with this kind of is fraught
with several significant risks of revenue loss in myriad ways.
Huge geographical distances within which the van stocks move,
virtually unmonitored and unchecked, along with sales to parties
with unknown credentials exposes the business model to risks of
stock shortages, pilferage of cash or stocks, fictitious sales,
unaccounted sales returns, teeming and lading of collections,
abuse or misuse of vans for personal purposes or parallel
business etc. Countless other kinds of misuse could take place.
While drafting his audit plan, the auditor cannot be completely
impervious to these possibilities and merely carry out the tests
stated above, on data given to him. He has to think of and apply
various customized tests to address all the business risks
envisaged. If he does not do this, fraud will occur and devastate a
business as happened in Enrons case. The failure of the auditors
of Enron to detect irregularities and/or their apparent willingness
to support some questionable transactions, permitted wrongful
accounting practices and diluted or misleading disclosures and
eventually brought Enron to bankruptcy. Corporate governance
was at its nadir and exposed that audit effectiveness was very
low. It would be immensely useful to study some of the findings in
the Enron investigation.
Insights from Enron bankruptcy:
There is a very comprehensive report tabled on February 1, 2002
by Enrons Special Investigative Committee (note 2), which had a
mandate to examine in detail certain transactions as regards their
nature, what went wrong, why they took place and who was
responsible. This report provided not only valuable information
about the possible causative factors which led to Enrons
bankruptcy, but also insights of immense value to auditors such
as issues relating to accounting practices, corporate governance,

audit effectiveness, management oversight and public
disclosures. Much of the subsequent legislation such as
Sarbanes Oxley Act, 2002, and other acts and auditing standards
around the world were based on the revelations in this report.
Some of the major revelations are summarized below as they are
relevant to the subject matter of this article:
1. The auditors and legal advisors role. The report
revealed that the legal advisors of Enron and their auditors
had actually reviewed these transactions and had even
cleared them. The report did not actually go to the extent of
stating that the auditors had participated in the wrongdoing.
However a reader can draw his own conclusions about this
aspect from the meaningful disclosures about the enormous
fees paid to them during the relevant period. Auditors billed
US$5.7 million for advice for these transactions alone,
above and beyond the regular audit fees. At the minimum,
there was gross negligence on the part of the auditors.
2. Corporate Governance failure. The report clearly indicated
that the Board failed to stop or deter transactions of
conflicting interest to Enron. The Chief Financial Officer
(CFO) and the Chief Accounting Officer (CAO) had dual and
conflicting interests in the suspected transactions. The
Board was aware, at least about the CFOs interest, yet it
failed to exercise sufficient checks and controls to ensure
that all dealings were above board, fair and equitable to
Enron interests.
3. Ineffectiveness of audit procedures to spot malicious
off-balance sheet transactions. Auditors ignored the
implications of transactions with entities referred to as
Special Purpose Vehicles (SPVs) which were created to
enable Enron to camouflage its losses and debts and
remove them from Enrons balance sheet. SPVs with whom
such transactions were effected were adroitly portrayed as
external independent entities, (which they were not), so that
it was possible to conceal Enrons losses and debts, without
the necessity of disclosing these in Enrons own financial

statements. These SPVs were, in fact, entities owned and
controlled by Enrons own employees.
4. Ineffectiveness of audit procedures to spot book
entries. The report pointed out that the management
resorted to, complex structuring of transactions that lacked
fundamental economic substance. In simple words -books
entries were created without basis and in contravention of
accounting principles, possibly like heal entries commonly
referred to in India.
5. Misleading Disclosures. The disclosures in the reports
were obtuse, and did not communicate the essence of the
transactions. The disclosures were made to downplay the
significance of related-party transactions, and in some
respects, to disguise their substance and import.
If one considers the possible business risks in the above case
study and the Enron fraud there are a lot of similarities. In the
above case study, the overall business risk could be quite high.
The SPVs in the above case study, could be fictitious retailers
and creative book entries could be fictitious sales, the creative
accounting treatment could be use of teeming and lading
practices and perpetrating other sales, collection and inventory
accounting manipulations. The conventional audit plan would not
necessarily expose these frauds.
Thus, concerns of audit effectiveness, were raised in India too
and the auditors role and CARO and ICAIs auditing standards
have been revised. The relevant clauses of these
pronouncements have been examined below:
1. Standard of Auditing 240 -

This is a specific auditing and assurance standard pronounced by
the ICAI (effective from April 1, 2009), relating to an auditors duty
as regards fraud and error in financial statements. This standard
states that the primary responsibility for the prevention and
detection of fraud and error rests, with both: 1) those charged
with governance and 2) the management of an entity. The

standard also spelt out the auditors enhanced responsibility and
laid down expectations of a far more penetrative audit than ever
before in the past. The salient features of this SA 240 are:
a) An attitude of professional skepticism. No longer can an
auditor rely merely on any management representation. In
effect, he must obtain evidence that either agrees with, or,
brings into question the reliability of management
representations. An auditor must adopt, necessarily, an
attitude of professional skepticism that will enable him to
identify and properly evaluate matters that increase the risk
of a material misstatement in the financial statements
resulting from fraud or error. He now has to examine and
question managements influence over the control
environment, industry conditions, and operating
characteristics and financial stability.
b) Importance of teamwork in conducting an audit. The
standard also expresses the importance of teamwork. In
planning the audit, the auditor should discuss with other
members of the audit team, the susceptibility of the entity to
material misstatements in the financial statements resulting
from fraud or error.
c) Perform additional, extended or commensurate audit
procedures where fraud is suspected. When the auditor
encounters circumstances that may indicate that there is a
material misstatement in the financial statements resulting
from fraud or error, the auditor should perform procedures to
determine whether the financial statements are materially
misstated.
d) Reporting obligations. When the auditor identifies a
misstatement resulting from fraud, or a suspected fraud, or
error, the auditor should consider the auditors responsibility
to communicate that information to management, those
charged with governance and, in some circumstances,
when so required by the laws and regulations, to regulatory

and enforcement authorities also.
e) Where an auditor has obtained evidence that fraud exists,
even materiality is not a point for consideration for
communicating this matter to the appropriate level of the
management timely.
Thus as per SA 240 an auditor has to virtually move heaven and
earth to satisfy himself while carrying out an audit, that no serious
red flags exist. If they do exist, he has to necessarily apply
appropriate procedures to confirm his suspicions or dispel his
doubts, about the existence fraud. In case there is evidence of
fraud, then, even materiality is not a factor for consideration- the
matter of fraud has to be communicated to the appropriate level
of management on a timely basis and he has to even consider
reporting it to those charged with corporate governance.
CARO also casts a significant responsibility on the auditor which
has been considered next.
2. Clauses of CARO relating to reporting of fraud by

auditors
Clauses 4 (iv) and 4 (xxi) of CARO are very important for
auditors, especially with regard to their duty towards fraud. 4 (iv)
requires an auditor to report whether there are adequate internal
control procedures commensurate with the size of the company
and the nature of its business, for the purchase of inventory and
fixed assets and for the sale of goods. What is significant is that
the auditor is expected to report whether there is a continuing
failure to correct major weaknesses in internal control. The key
phrase is continuing failure. The continuing failure could stem
from incompetence or fraud, but either way the auditor cannot
ignore the possibility of existence of fraud. If he reports such a
continuing failure but not a fraud, and if fraud is discovered later,
the auditor may find himself in a very difficult situation to escape
the responsibility for not carrying out appropriate audit
procedures and also perhaps for not reporting the fraud. Clause 4
(xxi) is even more serious, in that, it actually casts a direct

responsibility on the auditor to report whether any fraud on or by
the company has been noticed or reported during the year; if the
answer is affirmative, the nature of the fraud and the amount
involved is to be indicated. Here too, it is pertinent to note that
materiality is not a factor for consideration by the auditor. If a
fraud has been noticed or even reported, he has no choice but to
report its nature and the amount involved. Furthermore, by virtue
of being an auditor, and the very definition of audit as explained
later, his duty does not end merely in mentioning that a fraud was
noticed or reported; as an auditor his role automatically requires
him to carry out an investigation and apply such other checks and
verifications so as to enable him to be satisfied that the fraud is
not isolated and that it does not have any other implications on
the financial information he is expressing an opinion on.
Thus CARO clearly spells out the duty of fraud towards fraud
detection and reporting. In the recent past, an auditors duty
towards fraud detection was further accentuated by the High
Court in a recent judgment given below.
3. Sales Tax Practitioners Association (STPA) of

Maharashtra v/s the State of Maharashtra (Note 3).
This case is also very relevant to this article because it examines
the definition of audit and concludes that detection of fraud is of
primary importance in an audit. While considering the petition of
the STP (refer note 3 for details) the High Court examined the
very definition of audit. After considering certain definitions, it
concluded that the word audit has a specific connotation in the
matter of examination, investigation and auditing of accounts,
where detection of fraud is of primary importance. One of the
definitions of audit referred to is that of R A Irish in his book
Practical Auditing. It says that an audit may be said to be a
skilled examination of such books, accounts and vouchers as will
enable the auditor to verify the balance sheet. The main objects
of an audit are: a) to certify the correctness of the financial
position as shown in the balance sheet and the
accompanying revenue statements, b) the detection of

errors and c) the detection of fraud- the detection of fraud is
generally regarded as being of primary importance. The High
Court also observed The object and purpose of compulsory audit
is to facilitate the prevention of evasion of taxes, administrative
convenience .. It is a specialized job which can be undertaken
only by a person professionally competent and trained to audit.
Thus, auditors are expected to possess skills which could act as
even a deterrent for tax evasion fraud. However, the High Court,
also accentuated the risks accompanying the privileges: The
Chartered Accountant, by his very privileged status exposes
himself to the consequences of civil liability for negligence,
liability for professional misconduct in disciplinary proceedings
under the Chartered Accountants Act 1949, and sometimes to
criminal liability under the Penal Code.
Thus the above judgment clearly emphasizes that an
auditors role includes fraud and error detection and
detection of fraud is of primary importance and that the
auditor is exposed to severe penal consequences for non-
performance of his duty.
4. Insights from the OMalley Report

Thus far, this article has reviewed the auditors role within the
domain of the Indian legislation and the ICAIs pronouncements.
It would be useful to examine some views from the international
arena too. In this regard, there can be nothing better than the
OMalley Panel Report (Note 1). The Panel made some important
revelations about the auditors role towards fraud. The Panel
recommended that auditors should perform some forensic-type
procedures on every audit to enhance the prospects of detecting
material financial statement fraud. Audit work would be based
and directed to detect and find the possibility of dishonesty and
collusion, overriding of controls and falsification of documents.
Auditors would be required, during this phase, in some cases on
a surprise basis, to perform substantive tests directed at the
possibility of fraud. The Panel recommendation also calls for
auditors to examine nonstandard entries, and to analyze certain

opening financial statement balances to assess, with the benefit
of hindsight, how certain accounting estimates and judgments or
other matters were resolved. The intent of this recommendation
is twofold: to enhance the likelihood that auditors will be able to
detect material fraud, and to establish implicitly a deterrent to
fraud. This can be achieved by greater audit effectiveness which
would pose a threat to perpetrators in successful concealment of
fraud. The Panel also advocated stronger standard setting for
auditors. It observed that the Auditing Standards Board should
make auditing and quality control standards more specific and
definitive to help auditors enhance their professional judgment.
The Panel recommended that audit firms should review, and
where appropriate, enhance their audit methodologies, guidance,
and training materials; and peer reviewers should close the loop
by reviewing those materials and their implementation on audit
engagements and then reporting their findings.
Audit firms should put more emphasis on the performance of high
quality audits in communications from top management,
performance evaluations, training, and compensation and
promotion decisions.
The auditors enhanced role towards fraud.

In the past, the issue of fraud was a once in a blue moon
phenomenon for auditors. There was no compulsion for an
auditor to keep an eye open for red flags or warning bells, or
even to undertake extended audit procedures in areas where
potential red flags were noticed. Therefore, the actual reporting of
fraud in any report was rare. Furthermore, auditors had limited
digital tools and techniques, nor any specialized training to be
able to conduct interviews, mathematical data pattern analysis,
nor did they have trained investigators to carry out field inquiries.
The scenario changed completely after the Enron debacle and
the advances in IT. Societys expectations increased and auditors
have started using sophisticated software, digital tools and have
done further research and training to address the issue of fraud.
Risk based auditing plans and fraud risk detection is now a

component of all audit plans.
Considering all the foregoing, consider the case study of the van
sales business once again. Is the auditor concerned about all the
business risks envisaged- stock shortages, pilferage of cash or
stocks, fictitious sales, unaccounted sales returns, teeming and
lading of collections, abuse or misuse of vans for personal
purposes or parallel business etc.? Yes, the auditor must
necessarily recognize these risks, and based on the issues
brought out in SA 240, CARO, OMalley Report and the High
Court judgment, an auditor cannot complete his audit of this
business merely on the conventional audit plan detailed earlier. In
order to really provide a meaningful opinion on the van sales
operating results, an auditor would have to supplement the
conventional audit plan with at least the following:
1. Process study and Gap Assessment. The control
environment of the entire business model has to be studied
and examined by the auditor. Complete process
walkthrough study of the van sales process has to be
carried out by the auditor to identify vulnerabilities and gaps
in the controls. An overall gap assessment of un-addressed
risks must be conducted. In the case study illustrated an
auditor would have to study all the built in controls in each of
the processes on a typical route of a sales van. For
example, he must study the all the processes such as
loading the van, scheduling the route, visiting the retailers,
raising invoices, and issuing collection receipts, accepting
sales returns and submitting an account, at the end of the
day.
2. Teamwork. Have a brainstorm session, for designing
appropriate audit tests and procedures, with all the
members of the team to address the risks, corresponding
controls in place and gaps identified in step 1 earlier.
3. Testing of controls Based on steps 1 and 2 above, and other
appropriate audit tests to address the risks would have to be
applied including surprise tests at warehouse, visits to some

retailers, and covert observation of van sales operations by
having observers on the route.
4. Additional IT tests of palmtop computer/ printer controls for
sales invoicing and issuance of cash receipts to address the
issue of fictitious documents.
The above is not an exhaustive list- it is merely an indication of
the penetrative approach which an auditor must adopt.
Depending upon his findings, he may need to report errors/fraud
or control weaknesses in CARO. As per the CARO reporting
requirement if these weaknesses have been continuing
persistently without being addressed by the management, it may
stem from fraud and therefore needs appropriate tests and
verifications. The auditor needs to decide at what level of
management he needs to report the issue of fraud to, and
perhaps to the audit committee as well. In such a case, as per
the OMalley Panel, forensic-type procedures may also be
necessary which may include multi-dimensional trend analysis of
sales and collections, examination of palm top logs for changes,
deletions, alterations, warehouse stock discrepancies etc.
Conclusion. While the duty of detecting and preventing fraud lies
primarily with the management, the auditors role is not insulated
from this issue. Auditors cannot be a substitute for the
enforcement of high standards of conduct by management, but,
auditors can be an important factor in promoting high standards.
Auditors must possess the discipline, fortitude and ability to stand
up to management or to an audit committee or board of directors.
They need to be able to say, No, thats not right! where deemed
essential. The OMalley Panel called on all individual professional
auditors to heed this message: Only quality audits serve the
public interest, and the public is the auditors most important
client
Note 1. The Public Oversight Board (POB) appointed the
OMalley Panel on Audit Effectiveness in October 1998 to assess
whether independent audits of the financial statements of public
companies adequately served and protected the interests of
investors. The eight-member panel and its staff, headed by

Shaun F. OMalley, former chairman of Price Waterhouse LLP,
conducted a comprehensive review and evaluation of the way
independent audits are performed, and assessed the effects of
recent trends in auditing on the public interest. The Report and
Recommendations of The Panel on Audit Effectiveness (now
commonly referred to as the OMalley Panel or the Panel) was
released by the POB in late August 2000. The Panel members
and their staff completed the most thorough examination of the
audit process ever undertaken in the long history of the
accounting profession. Their work had the common and noble
goal of improving the reliability and credibility of financial
statements.
Note 2. Special Investigative Committee of the Board of Directors
of Enron Corporation was set up in October 28, 2001 to carry out
an investigation into certain specified related party transactions
and other transactions which had led to the restatement of
Enrons accounts and depletion of earnings
Note 3. Sales Tax Practitioners Association v/s the Government
of Maharashtra (170 TAXMAN 371 BOM on section 61
Maharashtra VAT ACT, 170 TAXMAN 371 BOM,
HIGH COURT MUMBAI.) The subject matter of this case was the
constitutional validity of section 61 of the Maharashtra Value
Added Tax Act, which requires that accounts are to be audited by
chartered accountants only. The STPA challenged this and it
wanted to put advocates and sales tax practitioners at par with
chartered accountants in this regard.
Areas of Opportunities for ICAI Members
and Those Involved in Fighting Fraud
Frauds are of such vicissitude and far reaching effects that it
would be unthinkable to include every type or even all major
types of frauds. However certain common situations in which
members are likely to find themselves in have been envisaged
and briefly described below:
1. Conventional Investigation assignments as a

continuation of audits. These are typical SAP 4 situations
where the audit findings have revealed certain anomalies
and there is a suspicion of fraud or error. The management
may ask the auditors to extend their audit to apply such
extended or modified procedures as may be necessary to
assess, evaluate and determine the nature and extent of
fraud. This kind of assignment is a regular investigation and
needs no elaboration. Such investigations could cover cash
embezzlements, asset losses, revenue leakages through
inflated or replicated invoices, suppression of income,
inflation of liabilities, deflation of receivables and the list
could go on and on.
2. Investigations by Statutory authorities. Investigations in
respect of violations under any provision under the Income
Tax Act, Companies Act, could be required by any of the
respective authorities. Even Police, CBI, CID and the
Economic Offences wing could need the services of
chartered accountants. Such services could include
determination of claims from investors of all kinds,
assessment of funds lost or misappropriated, non-
compliance of prescribed procedures, bank frauds and any
other economic offence where knowledge of accounting,
record-keeping and relevant applicable laws could be
useful. In the recent well published scams such as Harshad
Mehta scam, C R Bhansali, Neek Leeson, and Ketan
Parikh, large number of chartered accountants have been
asked to provide valuable insights as to the nature and
methodology of the frauds perpetrated.
Areas of Opportunities for ICAIMember sand Those Involved in Fighting
Fraud27
3. Bank frauds. This area has the highest potential of fraud.
The raw material is money itself. Frauds can be perpetrated
within a bank itself or by outsiders. Insiders may manipulate
funds, loans, and apply teeming and lading between favored
accounts. Outsiders could defraud a bank by furnishing
fabricated, duplicated or altered demand drafts, cheques,
bills of exchange, and other negotiable instruments. Apart
from these borrowers also often cheat banks in
hypothecation agreements by inflating inventories or even
providing substandard or spurious stocks with little or no
value. Chartered Accountants may find themselves as
auditors, investigators, or a part of the inspection team.
These days even pre facility audits are asked to be carried
out. These are audits in the garb of investigations to ensure
that funds are going into safe and reliable hands
4. Business risk evaluation. This is another area of
professional opportunity for chartered accountants. Every
business venture is always fraught with risks. What varies is
the degree and extent of the risk. Take for example a case
where a company has to undertake a new project for which
it requires a large finance say Rs 100 crores. In the current
financial markets there are plenty of consultants offering a
plethora of services. Very often such means of financing are
obtained through consultants not very well known to the
borrowers and possibly of dubious credentials. They offer
new and untested financing schemes through banks or
financing institutions or IDBI, or RBI, etc. In such situations
sometimes upfront or advance payments are to be made
which run in substantial amounts. In such circumstances
either the financial officers of the company who could be
chartered accountants or audit firms may be asked to
inquire into the feasibility of the scheme as well as the
reliability of the consultant. Since the stakes involved are
generally high, such assignments offer a challenging
opportunity for chartered accountants to earn the
appreciation of the clients. Similar situations could arise
when a new vendor, or a new client or a new venture s to be
entered into and the company wants to ensure that there is
no risk. In
All such situations the bottom line is to ensure that the client
minimizes its chances of being duped.
5. Insurance claim frauds. Claims for loss of stocks and loss
of profits of large values, particularly exceeding Rs 5 crores
are usually surveyed in detail by most insurance companies.
More often than not these claims are inflated, with or without
intention. In such situations as well chartered accountants
could be called upon to review, inquire and investigate into
frauds.
6. Compliance verifications. There are so many situations
where specific guidelines or directives have been laid down
for use of funds. For example a large trust may be given a
donation of Rs 10 crores for a project say providing for
orphans and widows. The donor may want an assurance
that the funds donated have been appropriately used. It is
possible that this could turn out to be a thriving ground for
frauds and misappropriation of funds. Similarly a hospital
may have been given funds for a specific ward with
conditions. There could be misrepresentations and false
reports. A business may have a remote site where certain
activities may be in progress. A possibility of misuse of
resources is also likely.
In all such situations, described above, it is not necessary that
chartered accountants could be auditors. They could be chief
financial officers, treasurers, and accountants, part of the
management or even consultants. Accordingly reference to the
member conducting an assignment has been generalized as an
examiner (short form of fraud examiner) unless that assignment
was specifically carried out as an auditor, CFO treasurer or
otherwise. This technical guide is intended to provide some
material for any role that a chartered accountant may find himself
in a situation of fraud detection. While it would not be obligatory
to apply SAP 4 or 5 in every situation, it is certainly advisable to
keep the provisions laid down therein to provide a consistent
quality of service. It is also very essential important to remember
that there are no standardized fraud detection methods. Each
assignment has to be carried out in a manner appropriate to the
Areas of Opportunities for ICAIMember sand Those Involved in
Fighting Fraud29
Specific needs. What this technical guide provides is a logical
and reasoned approach, information about certain methods and
techniques, certain theories which have been tried out and been
effective. They may or may not be effective in other situations.
However a member can draw upon this experience to refine,
improve or adapt these experiences in given situations. In this
context it would be relevant to quote the illustration of Eklavya
from our Puranas. When Dronachary expressed his inability to
teach him archery, he was not discouraged. He made a statue of
Dronacharya and learnt from it. The moral is that knowledge
dwells within ourselves. Whatever be the impediments in a given
situation one can find a solution from an infinite reservoir of
knowledge existing within. This analogy cannot be applicable
more than in the field of forensics and fraud detection. It is up to
the examiner to find the solution within himself, drawing upon his
skill, experience and judgment.
Types of Frauds and
Financial Crimes
In the context of the situation explained in chapter I, a chartered

accountant may be well advised to study and understand certain
types of frauds and manipulations which he is likely to come
across. The situation and technology applied might differ in each
assignment, but the core nature frauds will be the same. The
following are some of the typical frauds which a chartered
accountant needs to understand:
1. Trojan horse Frauds. These are frauds which are committed in
two parts or phases. Where systems laid down are reasonably
good and well defined, the fraudster is not certain whether an act of
fraud would be safe for him. In such situations, the fraud is done in
two phases. The first phase is that during which the resilience and
strength of a control is tested by the potential fraudster. If the act is
noticed or questioned, the fraudster offers a plausible explanation
of feigned ignorance or a simple lapse on his part. In such
instances, the fraud usually does not enter the second phase.
However, if the act is not noticed or questioned, the fraudster
musters up the strength to commit the fraud. The second phase is
then activated during which the actual act of damage is undertaken
after the fraudster is satisfied that the critical period has passed
and that he can go ahead with minimum of risk. A typical case is
where some collection of money is suppressed, but not pocketed
immediately. Suppose an accountant receives some money for
sale of junk or scrap. In a Trojan horse type of fraud, he will not
pocket the money immediately, neither will he prepare the cash
receipt. In the first phase, he would do something like this: He
would put the cash received in an envelope, mention proceeds of
scrap sale on it in bold letters, mark the date on the envelope and
initial it. He will keep it somewhere in one of the drawers in the
office. For a few days, perhaps weeks or even months, he would
say or do nothing about it. After a sufficiently long time has passed,
When he is reasonably certain that the scrap sale has been

forgotten, (referred to as the critical period) the envelope
with the money would be purloined. This act of stealing is
the second phase. The second phase is undertaken only if
the first phase has yielded satisfactory results, i.e. the
system or procedure has proved to be weak or fragile. This
is a typical Trojan horse fraud. The name is derived from the
Greek mythology of the Trojan horse where the Greeks
could not break through the Trojan defense and they
created an innocent looking wooden horse to test the
Trojans. The horse was intended to test the strength of
Trojans defense. If the Trojans destroyed the horse, the city
would have been impenetrable. However, throwing caution
to the winds, the Trojans took the horse inside the city and
at a convenient time at night, soldiers who were hidden
inside the horse came out and overwhelmed the Trojans.
The Trojan horse was successful. In principle, a fraudster
uses an object, act or some kind of a test as a Trojan horse
to evaluate the level of risk or safety in a given situation. He
evaluates the results of the act and then decides whether to
go ahead. These frauds are perpetrated with considerable
planning behind them and an astute mind masterminding
them. The most effective preventive steps that could be
taken are: a) identify key controls in every system and b) to
constantly test key controls. For the first part, assistance
from risk management specialists in this field may be
effective, in addition to the usual compliance and internal
audits. As regards the testing of key controls, using tiger
teams testing could be effective. These tiger teams test the
strength of a control by attempting to break it. Various
conditions are artificially created and the system is tested
practically. Conditions under which the controls do not work
or levels at which procedures wilt under pressure are then
examined for possible remedial and corrective measures.
Such tests enable the management to evaluate the
resilience of controls against possible threats and exposures
Types of Frauds andFinancial Crimes 33
and possibly take appropriate measures. Moreover this

throws a spanner in the plans of a potential fraudster
remarkably.
The tiger teams approach has a double effect in that, on the
one hand, it increases management preparedness and on
the other hand, it weakens the confidence and reduces the
safety level for perpetration of a fraud.
2. Disaster Frauds: These are frauds which thrive on
situations of disaster, chaos, anarchy, and disorder. The
fraudsters operate under the shield of the confusion created
in such situations. In the event of a calamity such as fire,
floods, earthquakes and other accidents, naturally the
organisation is reeling from the aftermath and shock. It
becomes impractical or impossible to comply with systems
and procedures and information and evidence can be easily
suppressed. Knowledge of asset location and whereabouts,
weaknesses and strengths of controls and access to other
sensitive information can be used or misused. Assets,
valuables and information can be stolen, sold, damaged or
destroyed for ulterior purposes. Just as a patient recovering
from an accident has to be extremely careful to avoid
catching a dangerous infection, so also an organisation has
to be very cautious while trying to stabilize itself after a
disaster. Take the case of a warehouse keeper who was in
a warehouse where there was a huge fire. There were
stocks of electronic items such as calculators, memory
chips, and other items which were lost by fire. By the time
the fire could engulf the entire warehouse, some stocks
could be salvaged. However the insured might not have
disclosed any or all of the stocks salvaged to the insurance
company. That is why every insurance claim has to be
carefully scrutinized and examined from several angles to
ensure that all clues fit in satisfactorily. It is dreadfully simple
for a claimant to inflate the claim and later explain it away as
an error if caught. The insured also has the convenience of
stating that all records are lost or in a disarray and cannot

be retrieved.
These kind of disaster frauds are the relatively simple ones, but
there can be more malicious ones also. The example of the
warehouse keeper is an example of a simple one, where at
worst, some of the stocks may be reduced from the
salvageable quantities. However the malicious frauds
Are those where a disaster is created as a shield to hide the
fraud already committed. Such a disaster can affect an
organisation in much greater dimensions and can take years
to recover from. There was a classic case of a loss making
hotel in a remote location where a new manager was able to
show profits. There was a sudden turnaround and the hotel
started making astronomical profits even though business
conditions were gloomy and room occupancy had not
perceivably gone up. Amazingly, the profits were evidenced
through full cash receipts; therefore there was no room for
doubt in the minds of the management. However what was
really happening was that the manager was selling off
expensive assets of the hotel such as chandeliers,
paintings, cut glass show pieces, etc. Elegant teakwood
furniture was replaced by commercial plywood furniture.
Part of the money was routed back to the hotel as sale
proceeds to show an upswing in the business and gain the
confidence of the management, and part of the money was
pocketed. When the hotel was fully stripped of all its
resources, the manager decided to set it on fire to escape
accountability and hide his fraud. Such a fraud is far more
serious and affects the organizations financial position,
goodwill and can attract even statutory liabilities. One of the
most effective methods is to evaluate the sheer logistics of a
situation. The theory of inverse logic explained in Chapter III
is one of the most effective ways to detect such frauds. It
advocates application tests of impossibility: Are any of the
events apparently incredible and impossible? In the case
above of the hotel, there were enormous cash receipts on
days of strike, bandhs, inauspicious occasions, whereas on

days when the manager was on leave or ill there were nil
sales. Detection of frauds in disaster situations in a direct
manner is otherwise very difficult.
3. Achilles Heel Frauds. The fraudster applies the principle
that no chain can ever be stronger than its weakest link.
These frauds are the perpetrated by those with a very sharp
mind. Those fraudsters have an eye for detail. They can
discern the smallest weakness or exposure in a system and
exploit it. Such frauds are appropriately referred to us the
Achilles Heel frauds, named after the legendary Achilles
who was invincible but for his heel. It was his heel which
was the only vulnerable part of his body which was attacked
and which eventually brought about his downfall. Some
systems are like that. They may be the most immaculately
designed systems with controls and procedures of the
highest order. But a small weakness can allow a fraud of
high dimension to take place. To illustrate this point, a
company had newly acquired an accounting system. As in
every accounting system, there were several input
documents, each of which had several fields for information.
The management had bought the software off the shelf, on
recommendation of a professional, and had not paid much
attention to its minute details. However the accountant did,
and found that the module for receipts had two fields for
dates: the date of receipt of a cheque and the actual date
of the cheque called the date of the instrument. For
example a cheque may be prepared by a debtor on say
November one (date of the instrument), but may reach the
creditor by post only on the fifth of November. The software
provided input of both dates to facilitate analysis of
collections and corresponding entries in the records. The
management was blissfully unaware that the accountant
was entering the instrument date in the system to clear a
favored debtors account. Accordingly the debtor was given
a credit retrospectively for a payment made even a month
late, merely by dating his cheque a month earlier than the

date of its delivery. This entitled the debtor to get all
bonuses and the early bird incentives which he shared with
the accountant. Such small little items often are
inconspicuous but could have incredible impact. In the
above case where the company had a panel of 1000
debtors, the fraud damaged the companys working capital
to an average of almost 20 lacs per month. What can be
done to understand the circumstances in which these
kind of frauds can occur? Each feature of the accounting
system must be comprehensively examined and understood
before audit. From the point of view of the management,
customized systems are much better than ready off-the-
shelf systems.
Each organisation has its own strengths and weaknesses,
its own culture, attitude and employee morale. Rarely does
an alien system adapt itself automatically. Unless
customization is done, a system can bring in inherent
weaknesses which can be exploited by sharp minded
people. System testing is essential not only at the beginning
but also for some time during actual implementation to
learn, understand and combat flaws which surface only on
practical usage. If in the auditors opinion, the management
has not taken these steps, the situation could then come
close to one where SAP 4 may be applicable.
4. Corporate Espionage: There was a simple fresh graduate
recruit junior level clerk in the purchase and procurements
department of an engineering company. His antecedents
showed that he was of a lower middle class background
drawing a salary of Rs 5,000 and generally meager means.
His father was in debt and had poor health. One fine day,
the clerk invited his colleagues to a party and announced
that he had recently purchased a new flat. When the
colleagues attended the party, they were stunned to see that
the flat was a huge four bedroom flat which had been
embellished with marble and granite fittings and expensive
furniture. The explanation given was that he had made a lot

of money on the stock exchange. However what did not
make sense was that he neither had the money to make the
initial investment nor the nerve, initiative nor the intelligence
to undertake speculation. He did not seem to have a known
broker and could not even clearly discuss which scrips he
had invested in and during which periods he had made
profits. It was clear that the stock exchange earnings were
merely a front for some other source. Since he had virtually
no decision making authority, it was unthinkable that he
would be able to make money through vendor frauds or
payroll frauds or expense frauds. Then how did he generate
the money? A field investigation was carried out and it was
found that he was selling company information. Information
about the companys research, products, technology and
methods, which he had easy access to was a saleable
product. Today, information carries the highest value and
frauds which sell information about a company to its
competitors are on the rise and considerable time and
money is being spent on this by large corporate houses.
Such frauds are almost impossible to prevent and deter.
For one thing, information is intangible and cannot be
missed such as a pilfered asset or money. Secondly,
facilities for transporting it through email, internet etc., are
easily available. This makes it even more impractical to
monitor misuse or theft of information. No amount of security
will completely prevent a fraud. The only thing that can be
done is to minimize damage. This can be partially achieved
by applying the red herring method. Use of decoy storage
is found very to be very effective. Keep sensitive information
in two or three places, of which only one has the full correct
information. The chances of the correct information leaking
out are that way reduced to one third. This must be
supplemented with constant patrolling of all priority systems
to see that there are no security breaches and violations,
however small insignificant or accidental they may seem to
be. In one EDP department, it was found that there were

computer breakdowns which had a pattern. They happened
only during duty hours of a particular EDP manager. It was
later learnt that under the guise of carrying out repairs, data
access restrictions had to be relaxed, and important data
files were copied, or damaged or downloaded for sale to
competitors. Thus even accidents must be examined for
causes and sinister possibilities. Noncompliance of security
rules must be viewed very seriously to enforce discipline.
Lastly, special training sessions must be held to educate
employees at all levels as to the dangers of such corporate
espionage activities, the company policies, and penal action.
5. Technical Frauds. These are frauds which can happen
right in front of the eyes of the management and it may not
even know that it has been defrauded. This is because
technical aspects are beyond the comprehension and frauds
using these as a cover, are difficult, if not impossible to
detect. A fraud of a high magnitude was observed in a case
in which a plastic component manufacturing company used
the services of external vendors possessing moulds for
manufacture of such components. The raw material was
sent to the vendors moulders) to process and return the
components on the basis of norms fixed in advance.
Apparently, the vendor was giving a good yield for the
material sent and the company had no reason to complain.
However in reality, the vendor was not utilizing the raw
material fully. About 90 % of the raw material received was
mixed with scrap and processed. The balance 10 % unused
raw material, was used for personal consumption or sold
outside and the proceeds pocketed. Since the volumes of
production were high, even a mere 10 % scrap mixed
amounted to a raw material saving equivalent to Rs 25 lacs
annually. The quality control division of the company did not
possess sufficiently sophisticated tools to evaluate the
quality of components produced. The norms for input output
ratios had not been revised for a long time. The vendors
also kept the quality control inspectors happy so as to

ensure a smooth approval and acceptance of processed
material. Such frauds can happen in any kind of
manufacturing activity where the controlling authorities have
little or no technical knowledge, or where there arent
sufficient tools to check such frauds. Here too such frauds
are difficult for anyone to detect. In the above illustration
of the plastic components, it was during the physical
verification of stocks which produced the first anomaly. A
huge pile, apparently of scrap, was observed at the vendors
site. This was unusual since the vendor was doing business
only for the above company, and as per insurance policies
taken out by the company, only stocks of raw material were
expected to be on the site. The company also confirmed that
this was not the usual production scrap accumulated over a
long time. It was something different. Further, the physical
raw material stocks showed some shortages on comparison
with records. On inquiring about both these above issues,
the vendor was visibly disturbed. As regards the shortage he
readily accepted the responsibility and was prepared to
make it up to the company. As regards the pile of scrap, he
stated that this was a pile belonging to one of the
neighbouring factories, allowed temporarily to be kept, to
help out with their storage problems. However the auditors
were not fully convinced. They took a round in the factory
and inquired about the pile of scrap with one of the workers.
The cat was out of the bag; that scrap was inferior raw
material to be mixed with the companys good raw material
received for processing in a certain proportion. The
clandestinely saved good raw material was disposed outside
and proceeds pocketed.
Familiarization with Red Flags in Detection of Frauds.
Familiarization with Red Flags in

Detection of Frauds.
Buddhism refers to three kinds of poisons anger, greed and

ignorance. If not checked they all eventually lead to wrongdoing.
A symptom or a red flag will surface in some form or the other
where any of these three evils are present
Red Flags
In fraud detection jargon the term red flag is commonly used. As
obvious red flags are nothing but symptoms or indicators of
situations of frauds. Sap 4 itself provides a few but the list is
endless. There is constant research being carried out across the
world. The following are some of the red flags which examiners
are likely to come across and understand.
1. Absence of rotation of duties or prolonged exposure in
the same area. For example in the above example of
technical frauds, where appropriate or sophisticated
technical tools for evaluation of quality are not available,
there was no system of constant rotation of duties,
rotation of suppliers and vendors. Further, if there was
complete dependence on external parties the red flag is
even more emphasized. Such rotation of duties should be
on a surprise basis, and if possible, with new recruits
wherever possible. Where identical factories or branches
are operating, rotating duties across the branches can
produce phenomenal results. Rotation of duties is a
preventive measure.
2. Close nexus with vendors, clients, or external parties.
There would be a conflict of interests if an employee,
particularly at a senior level, were to have close relations
with a client. For example if a loan officer were to go on a
Caribbean cruise with a borrower, it is quite likely that his
friendship might come in the way of his duties regarding the
loan monitoring obligations. The independence of a person
41
can be evident from the manner in which he behaves with
external parties
3. Sudden Losses. A company doing quite well suddenly
makes huge losses. While there could be genuine reasons,
mismanagement of funds and resources are more likely.
These losses are likely to have been there all along
simmering under window dressed accounts. Once the
bubble bursts, however the losses erupt and it appears as
though sudden losses have hit the business. These genesis
of the losses could have been siphoning of funds, inflation of
expense or suppression of income or a combination of all.
4. TGTBT syndrome. TGTBT stands for Too Good To Be
True. This indicates that lovely glossy report may be
furnished whereas in real terms there are gloomy
conditions. The illustration given earlier where a hotel
manager actually showed a turnaround of the losses into
fantastic profits were actually nothing but proceeds of
clandestinely sold fixed assets. Effectively the hotel was
rapidly watering down its capital and the manager was
helping himself in the bargain. What is learnt from this
example is that sudden profits need to be proved. There is
no shortcut to success. All the glitters is not gold. Another
illustration is a case where an EDP manager seemed a very
dedicated man. He would be the first to enter the office and
usually the last to leave. He was highly respected. But what
an investigation later revealed was that he was involved in
manipulating data and certain in-house applications for
receivables and payables to transfer credits to certain
favored parties. In fact he was manipulating his own loan
account to show nil overdue even though he had not paid
for several months. The point here is that what appears to
be good needs to be tested before accepting the truth value.
5. Generation of orphan funds. Funds which are held in a
fiduciary capacity and for which there is no accountability
are thriving places for frauds. Funds collected by trusts or
donations in cash collection boxes are typical examples
where there is no accountability on either side. Neither does
the donor concern himself about the usage of the funds nor
does the beneficiary have a direct claim or even awareness
in respect of such funds. However such funds can
Be substantial and invite perpetrators of fraud. Thus such
situations are the places where any investigator must look
into first.
6. Disaster situations. Accidents where books have been
lost, or damaged, or catastrophes such as fire, earthquake,
floods etc. are other places where fraudsters can feast. The
conditions offer ideal camouflaging conditions as explained
in paragraph 2 earlier in chapter II.
7. Missing Documentation. This is the surest sign of fraud
and practically every situation of missing records either has
been created to suppress a fraud or if such a situation
happens to emerge it is used to engineer a fraud. For
example some records have been stolen or lost during
shifting of an office. Deliberately the list of records shifted
could have missing items to provide for a future defense
against ulterior motives. The larger the organisation the
greater the chances of losing or misplacing records.
Opportunities to palm off frauds by mysteriously
disappearing records are easy and galore. Therefore
missing documentation is a very strong signal of possibilities
of fraud.
8. Chaotic conditions. As a corollary of disaster situations,
conditions where accounts are in arrears, messy state or
unreconciled, by and large are artificially created. The
reason given normally is shortage of staff or resources, but
this is more of an excuse. In several such situations it was
found that there was no assertive effort to increase or ration
the available resources. The shortage was artificial and an
optical illusion to allow this disorderly state of affairs which
in turn wonderfully camouflaged secret and evil designs
9. Irrational behavior.Behavior which is not becoming of the
employees position and which does not keep in mind the
decorum of an office often stems from deep rooted
43
insecurity which could be symptomatic of fraudulent
intentions. For example a person who is always rude and
inconsiderate, or overly secretive, is likely to be behaving in
that way to suppress fraud or some kind of deceitful act. The
intention is keep others at bay so as to avoid inadvertently
revealing guilt or to cover some malafide act.
How a check list can include certain questions to
indicate possible red flags
As explained above, red flags are anomalies or Clues dont fit
situations. As stated earlier there cannot be and should not ever
be a standardized fraud detection checklist. Yes what can be
used is a common checklist which must be adapted and
customized to a given situation depending using his skill and
judgment, and in consonance with the existing set of controls and
deficiencies noticed. When one reviews a system whether as an
auditor or investigator or a chartered accountant in any role to
detect fraud, the usual audit checklist can always be the starting
point. A few additional focused questions need to be added at the
right place so as to reveal fraudulent motives. To illustrate, take
the case of the technical frauds described earlier in Chapter II.
There were several aspects of concern such as extremely high
volumes to one vendor, absence of sophisticated tools, close
relations between vendor and the quality control managers. The
checklist could have been made more comprehensive so as to
include:
a) Are the supplier and the Quality control manager too
friendly? If so, how can one find out? Check statistical data
for a reasonably long period for granting approvals; how
many times have queries been raised? What are the kind of
queries and what has been the suppliers response. This
data will provide some evidence of the close ties, if any,
between the two.
b) How many times the supplier actually issued credit has
notes for rejections and what is the percentage in
comparison it with the volume of business?
c) Is there any resistance from any quarters for empanelling
new vendors? The resistance could be covert or indirect;
such as vague inquiries with unrefuted parties so as to put
the existing supplier in a good light. The existing supplier will
always be depicted as the best choice by highlighting all
His strengths and all the weaknesses of the proposed new
vendors.
d) Does the existing supplier appear to be charging very
reasonable rates, particularly in comparison with other
suppliers? If so, this is one of the surest signs of something
afoot. Most such cases are those where quality
considerations are compromised. Nobody is a
GoodSamaritan and there is no charity in business. If a
vendor is supplying, apparently at a rate which appears to
be amazingly low, 9 out of 10 chances are that he is taking
advantage in some other way.
e) Lastly, the auditor also needs to verify stocks at vendors
and reconcile balances of material with them regularly, and
if possible, even on a surprise basis.
f) Observation of a production cycle could also furnish
incredible results particularly in respect of rejection
percentages. Very often companies have a norm for
rejections and wastages and scrap. These can change on
account of environmental changes, technology
improvements etc. Vendors can make tremendous profits by
suppressing the actual rejection percentages
Thus what is shown above is a typical investigation or fraud
detection checklist. There is no limit to imagination and the best
guidance in compiling a check list is experience.
Steps in Conducting an
Investigation
There are no standardized series of steps nor is there any

standardized sequence of applying tests and checks in
45
procedures for fraud detection as one can have in situations of
audit or accounting or finalization of accounts. For example one
can apply and use standard audit checklists in consonance with
the provisions of standard auditing practices or prepare final
accounts with reference to disclosure requirements specified in
various Acts and prescribed accounting standards. In fraud
detection, each situation is unique and demands a customized
approach. The variables factors such as availability or non-
availability of data, information, explanations, etc. fluctuate widely
from case to case. Fraud detection also differs from audit
assignments in a very important aspect: audit offers an opinion
on truth and fairness of in a financial assertion while financial
investigation or fraud detection attempts seek out evidence to
prove or disprove a financial hypothesis. In this context, where a
situation appears to show conditions of fraud or error, SAP 4
obligatorily requires an auditor to confirm his suspicions, if any, or
dispel them by using additional, extended or modified
procedures. However even SAP 4 does not provide a specific
method of conducting an investigation. However SAP 5 provides
a guidance on the method of obtaining audit evidence. Audit
evidence can be obtained by one or more of the following:
inspection, observation, inquiry and confirmation, computation,
and analytical review. Considering the foregoing an examiner can
take the following important steps to the extent relevant and
appropriate under the circumstances of a given situation. He can
approach an assignment of fraud detection, by preparing a
programmercustomized to suit a given situation. The programmer
is conceptually similar to an audit programmer; a series of steps
for each assignment fine-tuned to meet and achieve the
objectives spelt out in the terms of reference.
These steps have been explained at an elementary level to

facilitate chartered accountants to tackle situations of fraud
irrespective of the role they have been assigned, i.e. whether
they are auditors, financial officers, treasurers, investigators or
business partners in a project. These are not exhaustive, but
illustrative. Fraud detection assignments are unique and peculiar
to the environment and the organisation culture. Therefore these
steps should best be viewed as various options which may be
applied individually or collectively. All of them may or may not be
necessary in every case. What is important to remember is that
fraud auditing should never be reduced to a simple standardized
checklist. It is a creative science. It is an awareness in the
broadest sense of many components such as the human
element, organizationalbehavior, knowledge of fraud, evidence
and standards of proof, an awareness of the potentiality for fraud,
and an appreciation of the so-called red flags. The important
thing is to clearly establish the objective of the assignment and
the kind of information or feedback required by the appointing
authority. Utmost clarity on these two issues is essential. Time
spent in these aspects will be rewarding and most fruitful in terms
of the final results both for the fraud examiner and the
management or the authority appoint him. Once this aspect is
clear, the actual exercise for fraud detection becomes very
simple to understand and implement. Depending upon the nature
each assignment, the exercise of fraud detection is usually
carried out through any, some or all of the following steps:
I. Defining the specific objective of the fraud detection
assignment. Generally the starting point could arise from
an audit report issued under a SAP 4 situation of a suspicion
of a fraud, or allegations received, or any theft or pilferage of
assets or any other reason. Some illustrations of an
objective:
Determination of a reason for a drop in profits in a particular
branch where several allegations of corruption and
mismanagement have been received
Steps in Conductingan Investigation 47
An investigation into shortage of inventory or cash, pointed

out in an
audit report as to the extent of shortage, the procedural
control deficiency, and the perpetrators involved
A general risk management exercise in a company initiated
by an audit committee with a specific emphasis on fraud
detection
An investigation into a borrowers slow-moving loan
repayment coupled
With a negative inspection report highlighting substandard or
spurious hypothecated stocks at his go down.
A covert inquiry into the activities of a purchase manager
who had
Suddenly acquired substantial wealth from apparently limited
sources. A suspicion of vendor corruption and unhealthy
activities to be confirmed or dispelled.
II. Vital considerations in finalizing the terms of reference with
the appointing authority. It is vital to clarify and remove all
doubts as to the real motive, purpose and utility of the
assignment. This is in contrast to a statutory audit
assignment where the terms of reference are spelt out by
the relevant provisions such as tax audit under section 44AB
of the Income Tax Act, 1961 or an audit under section 224
of the Companies Act, 1956. The auditor has more of a
compliance obligation there.
Motive and Utility. In fraud detection, unless it is initiated
under some statutory provision, needs absolute clarity of
thought, motive and its utility. What is the report going to be
used for? Is to assess risk merely or to find out whether a
particular kind of wrongdoing exists or whether an allegation
is true? This understanding will facilitate the examiner to
undertake and conduct the assignment meaningfully. In order
to leverage its utility to the maximum, it would be desirable to
understand the nature and background of the authority to
whom it is reported.
Materiality levels. Determine also what is the level of

materiality in consultation of the management. This is
essential because some degree of fraud is present in every
organisation. Some organizations even have a philosophy of
allowing and accepting some leakage as a necessary
business expediency cost. That level should be clearly
understood so that the investigator does not cut a sorry
figure in the end by detecting something which is immaterial.
Authority vested in the examiner. The examiner must also
clarify the extent of his authority in gathering evidence,
examining documents, interviewing internal or external
people, consent to use recording devices or other methods
for gathering evidence. Thus these assignments are
muchcustomized and require tremendous contemplation at
the initial stages. Ideally the terms of reference must identify
the scope of work, extent of authority presumed in gathering
evidence, and,
Confidentiality and reporting obligations. The levels at which
matters need to be discussed and represented must be
known so that the examiner does not inadvertently reveal
any management strategy or information about the
assignment. It would be very useful to obtain a list of
employees who can be approached for assistance. Similarly,
the authority to whom the report has to be issued should be
identified and spelt out. This will avoid embarrassment if
someone at a lower level asks for a report. This is important
so that there is no ambiguity as regards the issue and usage
of the report. For example an appointment for an
investigation may have to be reported to a parent company
and not to a local company in India. This must be known at
the beginning.
Spelling out constraints or impediments expected basedon
the above or the experience in the past. If there are any
constraints of time, resources, non-availability of records they
must be spelt out in advance. The constraints could also be
in the role of the examiner. Seven out of ten cases, where
fraud is suspected, will specify that the examiner carries out
his assignment covertly. To illustrate, the examiner will be

asked to pose as a system consultant, or an internal auditor,
or an accountant or someone other than an investigator. If
such conditions are laid down, the terms of reference must
specify that findings will be subject to such constraints which
will impede access to information and evidence due to the
covert nature of the assignment.
Various steps which can be considered in a situation of
fraud detection
Defining the objective
&
Crystallization of the terms of reference
Evidence collected directly: Documentary tests and
Interviews
Evidence collected indirectly: Field Audit and physical
checks
Digital Analysis of relationships and trends
Sting operations or Decoy traps or investigators bluffs
Confrontation Interviews
Evaluation of evidence
Reporting
Note: the sequence of the steps may change in a given situation.
Further a particular step could be attempted more than once also.
III. Direct evidence collection: Documents and Interviews:
Once the most important aspects explained earlier have
been finalized, the actual work commences by searching for
information or evidence through direct channels. Direct
channels would be those which are directly available in
terms of records, documents and information from the
organizations internal sources itself. The examiner also has
to understand and appreciate the internal environment to
ascertain whether there are factors which reduce or
enhance the possibilities for perpetration of fraud. (Attention
is invited to Appendices A and B in this regard respectively).
This requires appraisal of control systems, procedures and
level of documentation. This is done through appropriate

documentary checks and tests. As regards examination of
records and documents, much of what is done at this stage
is similar to the systems and procedural check done during
audit function. The difference is in the focus and the depth of
the inquiry, the method or gathering information, the tools
and techniques applied, and the maintenance of working
papers. Auditors would generally accept records and
documents at face value, unless something unusual is
noticed. For example, if there is a signature according
approval on a document, an auditor would accept it.
However in fraud detection an auditor would keep specimen
signatures of the sanctioning authorities so as to enable him
to spot possibly forged signatures. Fraud detection may
even use services of experts much more than an auditor
would. In fact several fraud examiners have a team which
include handwriting experts, interviewers, field investigators
surveillance experts and others who would be useful. The
exercise would embody even the conventional audit
procedures but in a much more detailed manner. This would
be a focused and concentrated audit with a sample
substantially larger and more comprehensive and fine-tuned
to meet the requirements of the situation. For example, if it
is suspected that the purchase manager is favoring a
particular vendor, then all inward challahs, purchase
invoices, purchase orders relating to that vendor may be
examined. Perhaps all transactions initiated by that
purchase manager may be scrutinized also. This is done
with the simple objective of gathering relevant and
meaningful information with reference to the objective. The
documentary tests are supplemented with information and
explanations obtained through preliminary interviews of all
those employees who are deployed in the area being
examined. Documentation of this is of paramount
importance. Cases of people changing statements at a later
stage on account of new evidence being revealed are not
uncommon. Therefore it may be worthwhile using tools such
as recorders, explained in a subsequent chapter, to have

submissions on record at every stage.
IV. Indirect evidence collection: Field audit and physical
steps. Every fraud detection exercise usually encapsulates
certain field verifications. What are field audits? These are
verifications external to the organisation, in addition to and
supplementary to the book keeping and documentation
checks and tests carried out internally. Field checks are
carried out to ascertain, or corroborate, or supplement
information or evidence obtained from the earlier
documentary checks or to ensure that anything represented,
say an asset, in a record or document exists. The
conventional audit procedures of physical verifications of
cash and inventory are a typical example. However this is
merely one of the categories of field checks. There can be
an unimaginable variety of field checks peculiar to a
situation. Some of the examples are given below:
Field audit of payroll disbursements to unearth phantom or
ghost workers. Verification of existence of all employees or a
workers with reference to names appearing in a payroll.
There have been cases detected where nonexistent workers
have come to light by auditors or investigators being present
and observing actual disbursement of wages.
Field verification of vendors offices to detect nonexistent
suppliers at the places or addresses given on bills. If they do
not exist the chances are that the relevant bills are fictitious.
For example purchase of stationery from a supplier who does
not have an office at the address mentioned could mean that
fictitious bills for stationery supplies have been inserted into
the system.
Physical verification of cash, stocks, fixed assets,
investments as represented in the books of account. This
principle may need to be extended to such assets lying with
third parties also. Verification could also be for expenses
incurred. For example construction or even repair costs of a
boundary wall could also be physically verified for falsification

of any kind.
Technical evaluation of assets or stocks. Physical verification
is one aspect which merely proves existence of something
stated in the records. A technical evaluation provides
assurance or reasonable support in terms of the nature and
value of the asset as represented in the records. For
example, purchase of a computer with a specific
configuration can be confirmed by someone technically
qualified to ensure that the configuration paid for exists
physically on the system.
Verification of accounts, with third parties at their offices or
sites. There was a very interesting case where the balance
confirmations with a party were matched perfectly. Therefore
the auditors did not see anything dubious. However an
exercise of reconciliation of the statement at the partys office
revealed that the partys ledger had lesser number of
transactions. An investigation revealed that since this was a
very old and trusted party, and since there was a
phenomenally large volume of bills received from him,
usually his bills were not scrutinized nor questioned in detail.
Fictitious bills were presented and paid but those cheques
were encased clandestinely in a bank account specially
opened with an identical name. These transactions were
easily camouflaged in the large volume of this partys
transactions.
V. Digital Analysis of relationships and trends. Further, an
analytical review of percentage checks for comparison of
transactions with other similar vendors may also be done.
These provide additional shape and direction to the
observations made so far. Analysis has to be done to
establish existence of relationships or to throw out
anomalies which could further provide evidence of wrong
doings. Digital analysis may be done for financial or non-
financial data. Financial data analysis is an area of expertise
of every chartered accountant and needs no elaboration.
Management ratios, debtors and creditors ages, marginal
costing and budgetary variances are all barometers of

financial discipline. However non-financial data can also
provide a wealth of information. For example:
comparison of the average number of days taken to approve
a particular vendors bills or to issue his cheques with the
average number of days for the same approval or issue of
cheques to similar other vendor/s could substantiate vendor
kickbacks nexus between the vendor and someone in the
purchase or accounts department
A trend examination of orders placed with a particular vendor
over a period could indicate results which could confirm
suspicions about over friendly relations with a specific
vendor.
Analysis of in and out time in a company could throw up
entry or exit at non respectable hours. For example an
analysis of a swipe card system in a company showed entry
of a certain manager at 5.00 am in the morning. It was found
that he had come on that day early to upload a virus into the
system to damage data. This was done with a view to help
certain competitors who were bidding for a job which that
company was also interested in. By damaging certain data
files the company was not able to submit a quotation.
Eventually the employee joined that competitor and other
latent frauds perpetrated by that employee came to light as
well.
It would be advisable for any fraud examiner to archive all
relationships of such non-financial data into a kind of a checklist
for future assignments. This will facilitate making evaluations of a
phenomenal kind with incredible results.
VI. Sting operations, investigators bluffs or decoy traps.
A sting operation or an investigators bluff or a decoy trap is a
procedure of trapping a suspected perpetrator of any wrongdoing
in the act. In common terms, it means laying a trap to catch a
crook or thief red handed, a kind of a mouse trap. This also forms
a part of some fraud detection assignments because certain
frauds are otherwise difficult to prove. The following illustration

proves this point.
In a trading concern dealing in chocolates and sweets having a
chain of stores in all the metro cities, the management decided to
have an incentive scheme to induce shoppers to visit their shops
again. The scheme required shoppers to make a purchase of
more than Rs. 1,000 to entitle them to get a 10 % discount
coupon for their next visit. A placard was to be prominently
displayed at each of the shops to bring about awareness of the
scheme. Appropriate internal controls in the form of serial control
over receipt books, and discount coupons were introduced also.
The auditor carried out a usual audit plan covering, sales
purchases, cash and bank transactions, salaries, and journal
entries, using appropriate statistical samples. He did not notice
anything untoward and the financial statements and the books of
account seemed to be in order. The serial controls, cash totals,
cash registers all tied up satisfactorily. However, there was one
small anomaly. In one of the metro cities, consequent to the
introduction of the scheme, the sales had not increased, though
large value of discounts had been availed of! All the other metros
showed an upswing in consonance with the budgets. Even the
management was intrigued by this result. The auditor was asked
to investigate. The auditor decided to apply a field check by
visiting that metro. On a personal visit, the first thing he noticed
was that the placard regarding the scheme was not displayed.
Obviously, shoppers could have had no other way of knowing
whether such a scheme was in force unless the cashier was, as a
matter of routine, informing shoppers purchasing chocolates
worth Rs.1, 000 or more, of the discount entitlement and
furnishing discount coupons. He went through all the past
discount coupons encashed by customers and found that most of
the shoppers who had purchased chocolates and sweets over
Rs.1, 000/- had purchased chocolates or sweets worth much
more on the next visit. Even more intriguing was the fact that a lot
of shoppers had visited the shop again on the same or the very
next day to purchase chocolates. This was unusual because
normally chocolates are not stocked and a shopper would
generally buy his required quantity on the first visit itself. This led
the auditor to believe that the discounts were not genuine.
However, since the names and addresses of the shoppers were
not available proving any foul play was difficult. This was an ideal
place to try the sting operation or an investigators bluff
technique. He decided to test out the scheme, by planting a
shopper who purchased chocolates worth Rs.2, 500. As
expected, the shopper did not get the discount coupon. He was
given a receipt of Rs.2, 500, numbered 20026. The receipt had
left the spaces relating to information of discount coupon, as well
as the net payment amount blank. At the end of the day, the
cashier reported his total cash sales for the day and a statement
of discount coupons issued, which showed that discount coupon
no 2113 had been issued against the receipt 20026. The auditor
immediately confronted the cashier who confessed that he had
fraudulently retained the discount coupon himself. He explained
how he was cashing such discount coupons as follows:
Step 1: Receipt 20026 was issued to A for Rs. 2,500/-
Step 2: Daily Cash Receipt and Discount coupons statement
would disclose: Coupon 2113 against Receipt 20026 Discount
Coupon 2113 was actually in possession of the cashier.
Step 3: The cashier awaits another customer purchasing
chocolates who does not ask for a receipt. The cashier would
make out a receipt for the value of purchase which was say
Rs.1,500/- and append the discount coupon 2113 for 10 %,
indicating a deduction of Rs.150/- in the discount column.
Step 4: The cashier would pocket Rs.150/- and place Rs. 1,350/-
in the cash box.
In this manner he had siphoned off almost Rs.20,000 per week.
This would never have come to light if the auditor had not applied
a field check, and followed it up with the sting operation. Very
often the audit procedures applied by the auditors do disclose
weakness in controls and anomalies in findings. However, the
audit stops short of discovering or bringing to light the actual
damage done and the nature of deceit or trickery. It is therefore
essential for him to recommend to the management to use such

fact finding techniques to determine whether control procedures
are being implemented. That is also why personal inspection,
visits and walk through tests are very meaningful where
situations so demand an investigators bluff as shown above can
be effective.
VII. Exit interviews or confrontation interviews.
Where doubts and suspicions regarding existence of fraud are
dispelled, a list of reasons for so concluding are prepared and the
management may be reassured that there is no cause for
concern. If unfortunately, based upon the findings through
various other steps undertaken, the examiner is of the opinion
that fraud appears to exist, then a list of suspects indicating the
kind of wrongdoings possibly committed, is compiled. Each of
these suspects may need to be interviewed, individually or jointly.
These interviews are those which are used for two purposes.
One purpose is to provide a fair chance of explaining and an
opportunity of being heard. The other purpose is to confront
evidence to the suspects, or confront at one suspect with another
where their submissions/statements are contradictory. This stage
is very critical in the final evaluation because the suspects are
likely to be antagonized and may offer considerable resistance.
Interviewing skills are a science in themselves. One of the best
ways to go about an interview at the exit stage or in interrogation
or confrontation is to make a questionnaire docket in advance
incorporating all possible questions to trap a potential wrongdoer
or to establish the innocence of any other suspect. Appendix
provides a sample docket which may be used for such interviews.
VIII. Evaluation of facts
When the fraud examiner reaches a stage where he has
exhausted all possible means of corroboration, substantiation, or
collection of information, it is essential for him to review all facts
and evidence in totality without losing focus on the objective.
Issuing a report is likely to have serious ramifications and could
have a serious impact on the future and careers of a person or
the organisation. Therefore considerable deliberation and micro-
macro evaluation is vital. All clues must fit and all facts must be in
harmony. In those assignments where a fraud appears to exist, a
wonderful approach can be adapted from the Mimamsa doctrine
from our sacred vedic scriptures. In simple words this doctrine
launches an inquiry to test the truth of various vedic assertions. It
provides a structured, balanced and equitable method of
conducting an inquiry and reaching a conclusion. It expounds a
logical process of analysis. Mimamsa examines the truth value of
each vedic assertion as follows:
1. Definition of Vishaya Vakya or the subject matter
2. Enumerating doubts of the Vishaya called Samsaya
3. The third step is placing forward arguments against the
doubts called Poorva Paksha
4. The fourth step is to furnish rebuttals to the arguments in 3
above called Uttara Paksha
5. The fifth and final step is to come to the conclusion or the
Nirnaya
A parallelism can be drawn to issues in fraud detection and
forensics. This spiritual philosophy fits into the study of forensics
and assignments of fraud detection like a hand in a glove These
five steps are the most appropriate steps in fraud detection in
situations where fraud is suspected and innocence or guilt has to
be established. The final conclusion should be drawn only after
reviewing all the steps in detail, by applying the science of
reasoning, assessing the strengths and reliability of the evidence
as well as the shortcomings and information available and also
considering information not available. The final conclusion then
reached, would be just and unassailable. The Mimamsa doctrine
thus facilitates structuring an approach for making an inquiry. If
all these above mentioned steps are followed, then, the final
report would certainly be equitable, fair and balanced.
An illustration of how this doctrine could be applied in a case of
an assignment inquiring into allegations of vendor bias against a
purchase manager could be briefly explained as follows: After all
the steps prior to the evaluation of evidence stage are carried
out, the tenets of the Mimamsa doctrine could envisage the

examiner over-viewing the entire assignment as follows:
1. The Vishaya Vakya is the subject matter of the objective:
Whether the purchase manager is guilty of favouring a
vendor which is detrimental to the interests of his employer
(the authority to whom the examiner is reporting to).
2. Samsaya establishes the chinks in the allegations.
All allegations were anonymous.
The purchase manager was good in his work
otherwise.
Several other vendors did have a were happy with him
and had a good opinion also.
Past record or the purchase manager from earlier
employments did not reveal any negative aspect.
3. Poorva Paksha juxtaposes all facts and submissions
favouring the Vishaya Vakya, the truth of the allegations.
There were several red flags noticed such as phenomenal
growth of 150 % in business volumes offered to favoured
vendors after arrival of the purchase manager. The vendors
credentials were not comparable to some other vendors
whose business volumes had dwindled in the relevant
period. Direct evidence of corruption through audio
recordings and video recordings of the purchase manager
and the vendor at external places where such business
deals for mutual favours were struck, were available.
Submissions from other employees about the managers
policies for the favoured vendors also supported the
allegations.
4. Uttara paksha. The purchase manager had been given a
chance to view all evidence and to provide contrary
evidence or a defence for rebuttal of the above. The
arguments provided were as follows. Growth in business
was on account of the exceptional performance of the
vendor. The vendor credentials may not be good on record,
but he was known to the purchase manager and was better
than others available. Submissions from other employees
were rebutted by submissions from certain employees who

were close to him.
5. Nirnaya. The purchase manager had no answer to the audio
and video recordings. He also could not explain why he had
disregarded other vendors, whose credentials were better
than the favoured vendors. All the rebuttals were capable of
being proved coincidental. There was nothing minuted in the
records to prove the exceptional performance of the vendor.
On the contrary several submissions from other sources
showed that there were complaints for materials delivered
from him several times. Direct evidence in the form of video
recordings clearly indicated the corrupt intentions. There
was no way in which the allegations could be proved
baseless. Thus the purchase manager was deemed to be
dealing with fraudulent intentions and had favoured the
vendors specified.
Thus the Mimamsa doctrine can be applied to ensure that any
red flag or information need not be converted into a sign of
wrongdoing or guilt unless corroboration is received from all
sides. In a jigsaw puzzle all clues must fit else the picture will be
distorted and incomplete.
VIII. Reporting
The report may then be presented in a manner which explains
the conclusion reached pursuant to the objective. The report
must be fine tuned to be comprehensible to the person
addressed to and using it. For example if an investigation report
is to be given to the CEO of a company who has, say, an
advertising background and little or no knowledge of accounts
and bookkeeping, furnishing a detailed report on how accounting
manipulations were carried out is not effective however precise,
serious and profound the findings may be. In each case, the work
must be carried out in a way where the nature of wrongdoings,
and their impact to the organisation examined are explained in a
simple manner easy to understand even for a layman and should
facilitate taking appropriate action. However if he is reporting
something to a chief financial officer his work may be more
focused even on technical aspects like lacunae in the accounting

systems etc. which would be appreciated and understood by him.
The conclusion may reveal innocence, guilt or a non-committal
evaluation.
1. The report may be drafted and structured appropriately for
each case. While each case may have a different set of
requirements, usually the following aspects are important:
1. Definition of the objective and terms of reference.
2. Executive Summary (which must summaries all aspects
given below)
3. Conclusion: Where applicable, a list of suspects and
wrongdoings would be specified.
4. Findings in detail:
5. Investigation Methodology and programmer
6. Constraints and limitations
7. Recommendations
8. Appendices ( statements or illustrations or quantifications of
findings)
9. Exhibits (Technical opinions, Photographs, confessions,
recordings etc.)
B. Types of evidence and concepts, principles, and

theories used in fraud detection.
While one aspect of any fraud detection is a
customizedprogrammer, the real value lies in the relevance and
reliability of the evidence and information gathered. Data,
information or evidence of any kind by itself has no value. It is
only when, logic, sense and reasoning are applied does it gain
value. In this context, SA 505 on audit evidence and the tenets of
another vedic scripture called the Nyaya Shastra offer
considerable insights to an examiner.
Some of the relevant provisions of Audit Evidence given by SA
505 provide some insight into the procedure of weighing and
judging evidence. The relevant provisions are:
External evidence is usually more reliable than internal

evidence
Internal evidence is more reliable when internal controls are
satisfactory
Written or documented evidence is more reliable than oral
representations
Evidence obtained by the auditor is more reliable than that
obtained through the Auditee
SA 505 further clarifies that documentary evidence originating
from third parties as most reliable and rates evidence originating
from the Auditee as the least reliable. These guidelines provide a
valuable tool even in non-audit but fraud related assignments.
It also explains briefly procedures such as inspection, observation
and computation which are related to collection of audit evidence.
Similarly the tenets of Nyaya Shastra, also a part of the Vedic
Scriptures, authored by Sage Gautama offer considerable help.
The relevance in fraud detection is that this teaches one as to
possible means and aids for collection of information and
evidence as in SA 505, to reach the truth. While Mimamsa
doctrine, explained earlier, believes in reaching a conclusion
which should be unshakeable and firmly embedded in truth,
Nyaya Shastra facilitates application of methods or aids to obtain
information and evidence which will be used in reaching the
eventual conclusion. According to the Nyaya Shastra there are
several aids called pramanas or types of proofs which can
facilitate reaching the truth.
Pratyaksha: Anything physically verifiable.
Anumana: Inference
Upamana: Description
Shabda: Axioms or undisputed theories
Arthapat: Conclusion through the principle of Reductio Ad
Absurdum
Anupalabdhi: Conclusion through absence of truth A brief
explanation of each is given below:
Pratyaksha: This pramana states that truth can be

determined by anything physically verifiable. This is the same
as field audit and physical verifications explained earlier and
therefore needs no further explanation
Anumana: Inference. In simple words this means determining
the truth by using the power of logic or deduction. If there is
smoke it is presumed that there is fire. Logic used here is
direct logic. A hypothesis is supported by proof, direct or
circumstantial and it is presumed be correct by inference. For
example a case of cash suppression of a cashier can be
proved by getting a customers copy of the receipt issued. If
the receipt shows a certain sum of money paid to the cashier
and is signed by him it is presumed that the cashier has
either deliberately or erroneously suppressed the money
received if it is not shown as received in the books of
account. If several such receipts are found then there is
circumstantial proof of suppression of income. A similar
hypothesis that a particular godown keeper is dishonest
could be circumstantially inferred by unexplained inventory
shortages. If the discount policy states that discounts could
be given from 1 % to 4%, and the total discount figure in the
general ledger is Rs 4 lacs, sales cannot be logically less
than Rs 1 crore, because even if each of the discounted
sales are at 4 %, all discounted sales must necessarily
aggregate to 1 crore even if no other sales are effected
Upamana: Description. Sometimes descriptions may be the
only way effective in substantiating facts. There was a case
of suspected siphoning of funds through expenses being
replicated in a remote plant at Bhavnagar. It was an offshore
drilling project where one-time costs of erecting specific
equipment were heavy. At the end of the project these items
were dismantled and scrapped. During the investigation
almost three years later, there was no possibility of physical
verification for ascertaining the whether all the equipment
which was paid for was in fact in existence. There were
plenty of invoices for identical equipment purchased. In
particular, there was an expenditure of Rs 16 lacs made for
erection of four tanks of Rs 4 lacs each through four bills

identical in all respects except for their numbers and dates.
There were several red flags about the bills common to all.
The tanks had a common purchase order, they were ordered
without competitive quotations, the rates were extraordinarily
high and there was no inspection report after they had been
commissioned. Since there were other bills which were
proved to have been paid twice, it was suspected that this
was one of the many replications. However a detailed inquiry
which included submissions independently of present and
past employees. Each employee was asked to describe the
tanks, their colour, their approximate size, their location, their
utility, the vendor from whom they were manufactured and
the circumstances under which they were received. Inspire of
all the other fictitious bills, the descriptions obtained
independently matched and proved that the tanks were
indeed there though they had been commissioned in a hurry
and through a common purchase order. This made a
difference since the concerned vendor for these tanks was
eventually not classified as a dishonest one as in case of the
other vendors who had been favored by the plant manager.
Thus evidence collected through descriptions corroborated
through several sources can be of immeasurable value.
Shabda: These refer to cosmic truths prescribed by sages of
the past. In fraud detection these symbolize mathematical
axioms or other undisputed theories. In the next chapter on
use of tools and techniques, the amazing Benfords Law is
one such tool which has been described to facilitate fraud
detection. There is also a case study on Vedic Mathematics
used in an insurance fraud given in Appendix. This law in
particular is revolutionary and offers incredible assistance in
detection of fraud or error in vast data populations.
Arthapat: Conclusion through Reductio Ad Absurdum. In
geometry certain theorems are proved by the method of
reductio ad absurdum. This solution is based upon the
assumption that there are certain identified solutions to a
theorem or a problem, and only that which is realistic and not
absurd can be the correct solution. It identifies that solution

which is possible and it is presumed that that is the correct
solution. This is also immensely useful in fraud detection
situations by identifying absurdity in reports and examining
them for elements of fraud. There was an entertainment
centre where there were bowling games, pool, fast food
cafes, etc. Access and entry to any entertainment activity
was controlled through a digital swipe card software. A
customer had to buy a card called a debit card and utilise it
by swiping it at various access points in the centre. This was
done with the obvious intention of eliminating cash handling
and ensuring greater discipline.
A major fraud was located by identifying a major absurdity in
one of the debit card consumption reports. The consumption
reports indicated about 30 customers who bought debit cards
of Rs 500 each and returned the cards at closing time
without using them at all. This peculiar observation
happened almost daily with the number of such inert
customers ranging from 25-35. It was absurd to think that so
many customers would each buy a debit card worth Rs 500
spend the whole day at the entertainment centre, play
nothing, eat nothing (outside food was not allowed), do
nothing and claim refund at 12 pm at night. It was even more
absurd to think that this was happening every day for
approximately the same number of customers. An inquiry
was made and eventually it was found that the floor manager
in collusion with the cashiers was misappropriating bowling
game collections through manipulation of debit card
software. This fraud was perpetrated by canceling or
reversing genuine sales and pocketing such collections. The
only clue left behind was the absurd report that so many
customers went without doing anything in the centre for 12
hours. A fraud of almost Rs 30 lacs was revealed. Thus one
of the most important traits of a fraud examiner is to look for
anything that seems absurd or illogical. More often than not
this could be a sign of foul play. This illustration also amply
illustrates how data or information by itself has no value until

there is application of sense and reasoning.
Anupalabdhi: Conclusion through absence of truth. This is a
corollary of the earlier pramana arthpat. While arthapat
states that all absurd findings or solutions have to be
eliminated to get to the correct solution, anuplabdhi states
that in absence of truth, eliminate all that is not true to come
closer to the truth. This is a paradoxical axiom which may be
called the theory of inverse logic. It has been explained in
detail in theories and concepts applied in fraud detection
later in this chapter.
There comes a stage when the examiner has a whole lot of
information, evidence and information with him. All the above
pramanas or recommendations of SAP 5 are illustrative and to
enable an examiner or auditor to tackle various situations. It is
necessary for one to be mindful of the fact that the evidence of
each type must be in consonance with the factors and situation
surrounding it. Each pramana could have a limitation and
therefore merely the presence of one of them usually is not
sufficient to arrive at a conclusion. For example if one were to
see alum it is possible that it may be mistaken for a lump of
sugar. In such a case both the pramanas Pratyaksha and
Upamana would have resulted in a wrong conclusion. One would
have to apply other tests to come to the truth for example
anumana, for example, by seeing if ants are attracted to that
lump of sugar. If not, then it cannot be sugar. By arthapat or
reductio ad absurdum, there is only one other possibility, it is
alum.
From the foregoing it is now evident that fraud detection is a
different field altogether as compare to tax, audit, consultancy
etc. for chartered accountants. In order to understand this
subject, a few theories have been explained with illustrations so
as to bring chartered accountants closer to the subject. These
theories have been selected because they have an audit
background which they are familiar with.
There are various concepts and principles which have been

successfully applied in fraud detection and perhaps could be
used effectively in similar or closely resembling situations. Some
of these concepts and principles are:
1. The theory of Inverse Logic
2. The concept of Distrust the Obvious
3. The Birbal tips and tricks
4. The principle of mirror imaging
5. The three dimensional vision
1. The theory of inverse logic

This is a technique which would be useful to detect some frauds
at the early stages. Often, it is not possible to ascertain whether
any assertion is reliable for want of information. For example, in
an insurance claim, in absence of all supporting records, which
may have been destroyed or lost, it may be difficult to accept the
claim made by the insured, which could be inflated. In such
situations, the theory of inverse logic could prove to be invaluable
and very effective. In simple words, if you cannot find out what
the truth of the matter is, find out what it cannot be and eliminate
all such possibilities. This process of elimination is application of
inverse logic which sometimes is the only method left to ascertain
the truth or fact in a given case. This principle is wonderfully
exemplified by the doctrine of the Neti Neti Vaada spiritually
elucidated in our Upanishads. This doctrine explains that the
whole world as we see it is an optical illusion, and consequently it
is not possible to reach or access the Truth (Parmatman) directly.
There is another way to reach it indirectly, by the process of
renunciation. By renouncing the world, the body, the mind, the
ego and everything in this unreal world, what shall remain is the
real truth. This has been explained in the Brihadaranyaka
Upanishad by sage Yagnavalkya. In simpler words, in order to
achieve salvation or moksha or nirvana, use the process of
elimination. Fraud detection is exactly the same thing: a quest for
the truth in a given situation. Because of alterations and
deceptions, which can be compared with optical illusions in the

above theory, it is possible that the truth is distorted, hidden or
suppressed. By eliminating what is not true, the investigator will
come much closer to the truth. How this can be applied is
explained below in a few examples.
Take the case of inventories in an organisation. While the
sophisticated software and inventory control systems do provide
a high level of comfort in the reliability of the reports generated,
there have been cases found where inventories had been
conveniently inflated for bankers hypothecation or insurance
claims. There is a famous Salad Oil Scandal fraud case which
features in practically every audit or fraud related publication. In
this case, the intelligent fraudster took loans from several banks
against hypothecated salad oil stocks in warehouses to such an
absurd extent that, the aggregate quantity of all salad oil stock
pledged with the banks exceeded even the stock of salad oil in
that whole country. None of the banks had bothered to ascertain
whether the total stock so hypothecated was reasonable and
acceptable. They failed to recognise the reality and practicality of
the situation. In the same manner, the reliability of production
figures can be greatly enhanced by ensuring that they are within
the installed capacities Production can never be greater than the
machine capacities. Similarly sales or closing stocks cannot be
greater than produced or manufactured quantities plus opening
and bought quantities. The auditor must seek to identify and
provide for all such absurdities, impossibilities or improbabilities.
In a situation of disorder, chaos and disaster such healthy checks
and balances must be constantly applied to ensure a smooth
recovery till proper systems are redesigned and implemented
In another case a steamer agents fraud of raising fictitious bills
Rs 40 lacs on the client was easily caught due to a simple clue:
The fictitious bills raised by the steamer agent were for terminal
handling charges which were well supported with full details of
tonnage, number of packets in break bulk cargo, the reference of
the bill of entry, the vessel name, the date of arrival, customs
duty paid etc. However, the fraudster made one small mistake.
He did not know that Terminal HandlingCharges were levied by

port authorities only in respect of container cargo and were not
applicable to packages in break bulk cargo!
In exceptional circumstances, where the information is missing,
incomplete or deliberately modified, fraud detection becomes
very difficult. How then, does the examiner determine and prove
the existence of fraud, particularly if he does not have full details
and correct facts and information? The following is one such case
study where all facts were not available and the examiner found
that certain clues did not fit, and he applied Inverse Logic using
his investigation software to prove the impossibility of an
insurance claim for stocks by fire.
FACTS OF THE CASE:
ABC was a partnership firm trading in Pressure Cookers. It
stocked several brands and sizes of cookers of various
companies. The stocks were kept at a warehouse in the vicinity
of the office. After an outbreak of fire in the warehouse ABC
lodged its claim with the Insurance Company. The claim was of a
very high value of Rs.2 million for about 15,500 cookers. Stock
records which were maintained at the warehouse included the
following:
1. Goods Inward Notes
2. Delivery Notes
3. No Charge Invoices for free replacements
4. Stock Ledger (ledger account for each brand and size of
cooker) A parallel stock ledger was maintained at the office
also.
The Insurance Company sent an auditor to assess the claim of
ABC. Since all records a warehouse were completely reduced to
cinders, the only quantitative record available to the auditor was
the parallel stock ledger at the office. First, he gathered all the
routine information: List of books of account, purchase and sales
procedures, levels of authorities in force, and list of suppliers and
customers. He also documented in brief, the nature of business
and the background of the owners. Since his focus was on the
insurance claim, he concentrated his efforts on the audit of stock

ledger, purchases and sales.
He conducted the audit with two broad objectives in mind:
a. To assess the correctness of the quantities of the stock on
hand as on the date of fire
b. To satisfy himself that the valuation was fair and reasonable.
As regards a), he had adopted the following audit procedures
using information available in the office:-
i. Stock Opening Balances: He traced the opening balances
from the last physical
Verification conducted by the auditors.
ii. Quantification of purchase: He traced quantities of goods
received from the Purchase Register and suppliers delivery
notes (since GRNs were lost)
iii. Quantification of sales: He traced quantities of goods
dispatched through Sales Register and Delivery Notes.
iv. Adjustments for other movements: He traced the free
replacements from the Claims Register and obtained
confirmations in writing from the partners that barring those
shown in the register, there were no other free
replacements.
v. He traced quantities of sales returns and purchase returns
from both credit notes and debit notes into the stock
register.
vi. Closing balances: He checked the castings of all quantities
received and sold.
As regards b), the audit procedure was fairly simple since the firm
had traded stocks only. The firm had adopted the FIFO basis of
valuation and therefore the purchase cost was derived from the
latest purchase bill. He listed out damaged or defective stocks on
the basis of the Claims Register to bring in the necessary
correction factor to the claim for such stocks. The Insurance
Company was satisfied with this because, as per the policy they
had to reimburse the claimant at the replacement value.
All the checks stated above were a part of the direct audit
approach, the Assessment of clues approach. This involved an
overview of the entire case which included determination and
establishment of relevant facts, confirmation of chronology of
events and interrelationship of data. Though he did not have any
direct query, there were several anomalies which needed to be
explained or reasoned out. The following observations led him to
believe that the claim was overstated and required an
investigation.
Extraordinary Increase of total Inventory value: The past
physical verification statement of the auditors as well as the
earlier balance sheets of the firm disclosed stocks less than
50% of the value as on the date of fire.
No evidence or documentary support in terms of orders
from customers for abnormal increase: Orders on hand
as on the date of fire did not even add up to 15% of the total
stock.
Deviation from normal purchase procedures: Some of the
purchases during the last few days before the fire were made
without any advance being paid. The payments were made
after the date of fire. By and large purchases were paid f o r
with 50% advance to suppliers in the past.
Suppliers Delivery Notes for the purchases stated above did
not bear the usual godownkeepers signature.
However, none of these observations really were sufficient
enough for him to conclusively prove that stocks were
overstated. He asked the Auditee for explanations to each of
the above anomalies, which were given in respect of each of
the above observations as follows:
The increase in the quantum and value of the stocks was
due to major sales drive which the firm was proposing to
launch shortly.
The firm had been negotiating a bulk order with a new client
which was in the process of finalization. Besides, a lot of
verbal and telephonic orders were on received as on the date
of fire.
Due to growing competition, some of the suppliers were

willing to favor the firm by not insisting advance payments.
Lastly, due to heavy traffic, a large consignment of stocks
came at late night when the usual warehouse keeper was not
in and one of the partners had himself come and accepted
the stocks.
Thus, the normal direct audit approach did aise doubts and
highlighted anomalies, but did not bring the auditor any closer to
the truth. Obviously, some concrete evidence was required to
disprove the claim. How could the auditor do this? This was the
stage where all the aspects of the direct audit had been tried out.
Now was the time to apply the inverse logic approach! The
auditor shifted his focus to the negative aspects. What was the
value of the stocks which could not possibly be true? Since the
value was a function of rate and quantity, an inquiry into each
was done. Manipulation of the rate seemed unlikely because it
was unchanged for most of the large sizes and models for almost
one and half years. That left the question of correctness of
quantities. Since the correct quantities as on the date of fire could
not be known, the auditor decided to find out what the quantities
could not be. It was here that he hit upon the solution to the
problem of proving the absurdity of the claim. The physical
dimensions of the warehouse posed a limit to the number of
cookers which could be stored there. Further restrictions were
imposed by stacking norms which permitted only 9 cooker boxes
in a column and vacant space needed for human movement
within the warehouse. The audit software used by the auditor was
capable of data interrogation and processing by applying queries
and mathematical operations on a given set of data. The auditor
keyed in quantities of stocks as on the date of fire as per the
claim statements and using the following constants worked out
the total Occupied Volume:
a. Storage Volume for each size and model of cooker
b. Maximum storage volume assuming stacking norms were
correctly applied
c. Space required for human movement correlated with each

size and type of cooker as per explanations received from
the management in this regard.
d. The results gave him the desired results as follows:
Dimensional Summary for each brand of cooker for quantities as
on the date of fire as per claim submitted:
Type, Company or Quantity Volume in Actual volume in the
brand name cubic feet warehouse for 5000
sq. feet and height of
20 feet.
Hawkins 4,650 40,345
Marlex 2,229 24,323
Prestige 1,900 21,002
Butterfly 4,709 43,987
PCA Cookers 2,015 23,456
Total Cookers 15,503 153,113 100,000 cubic feet

The total physical volume storage space was limited to 100,000
cubic feet; it was impossible to store 15,503 cookers as stated in
the claim in the warehouse! The above summary was supported
by a detailed working schedule software report for each brand /
company wise. For example, Hawkins cookers volume was
worked by the software as follows:
Hawkins Cookers Quantity Volume Space provided for Total Volume
stacking norms and in Cubic feet
- Models
human movement
5 Litre with 1,490 8,940 894 9,834

separator
5 Litre without 987 5,922 592 6,514

separator
11 Litre with 565 4,520 542 5,062

Separator
Stainless Steel 11 556 4,448 534 4,982

Litre
18 Litre with 498 4,980 996 5,976

separator
22 Litre with 554 6,648 1330 7,978

separator
Total 4,650 35,458 4,887 40,345

To further prove his point, the auditor calculated the occupied
volume for the previous three years where audited reports were
also available and it was found that the occupied volumes were
well within the overall physical limits of the warehouse as follows:
T y p e , Volume as on Volume as on Volume as on Volume as on
Company or the date of 31 March 31 March 31 March
brand name fire 1998 1997 1996
Hawkins 40,345 31,900 29,876 27,654
Marlex 24,323 12,090 16,098 12,435
Prestige 21,002 11,980 10,980 10,901
Butterfly 43,987 26,198 20,439 23,109
PCA Cookers 23,456 8,900 10,981 12,096
Total Cookers 153,113 91,068 88,374 86,195

When these queries were put up the firm accepted that there
seemed to be an error and agreed to reduce the claim
unconditionally.
In the same manner, to check the correctness of quantities of
inventories every management, auditor, investigator must
compute, within reason, the dimensional space occupied by the
quantities of inventories represented in any financial report, and
compare that with the physical dimensions of the warehouses
and godowns in which they are stored. There have been
instances of stocks claimed to have been lost by fire have been
proved to be impossible by determining physical limits of storage
capacity by measurement of volume determined by the length,
breadth and height of the warehouse..
The point that this case study highlights is that fraud detection is
a creative process and is effective only if all the examination and
review procedures are adopted in harmony and objectively
towards the purpose of the assignment. This theory of inverse
logic is an invaluable aid in situations of this sort. In order to
implement this theory dynamically, a special checklist can be
developed and updated from time to time and used anytime for
future reference.
2. The concept of Distrust the Obvious.

Mans actions are governed not by what he actually sees, but
what he thinks he sees is a well-known maxim. It means that
mans perception is a result of not only his vision but also his
mindset, preconceived notions, deep-rooted beliefs and past
experience. In such circumstances sometimes his judgment is
clouded and possibly he could become a victim of an incorrect
interpretation. Therefore, in fraud detection it is prudent to distrust
what is too obvious unless and until it is proved, preferably by
hardcore evidence. On the one side all submissions and facts of
the hypothesis must be understood correctly so as carry out a
focused investigation. For example consider the question Why
are 1990 Indian rupee coins worth more than 1989 Indian rupee
coins? Most people would obviously jump to the conclusion that
the answer has something to do with the quality of the coins
minted in 1990 or 1989. However the answer is quite simple: One
thousand nine hundred and ninety rupees are greater than one
thousand nine hundred and eighty nine rupees. What happens is
that the neurons in the brain are so used to seeing such a
number as 1990 as a calendar year that it does not consider the
other possibility of 1990 as a pure and simple number one
thousand nine hundred and ninety. An imperfect understanding of
the question is reached and consequently the simple answer is
missed. What is important to note here is that at times the brain
subconsciously adds its own deep rooted beliefs and
presumptions to a message received by it and its intellect judges
data or information in the light of such presumptions? The said
example could be better understood by having a look at the

picture given overleaf.
Are the horizontal lines in the picture bent or straight?
The picture has absolutely straight linear lines which in fact are
parallel. However an optical illusion is created in the brain which
makes it seem as if the lines are bent at certain places. Similarly
perception errors can occur in any situation where the human
brain weighs information with past experience, beliefs and
presumptions. Chartered accountants are no exceptions and like
anybody else, they could also be victims of such a phenomenon.
In one particular case, two joint auditors were in the process of
finalizing the audit of the accounts of a factory of a large
company in June 2001. One of the auditors was scrutinizing the
bank reconciliation statement as at 31 March 2001, and an entry
of Rs 12 lacs, paid to Gujarat Earthquake Relief Fund had caught
his attention. What caught the auditors eye was that this cheque
of Rs 12 lacs issued to the Gujarat Earthquake Relief Fund
(GERF) was not presented even 2 months after the date of issue
on 30th January 2001. The accountant explained that since the
cheque had been sent by post, it may have taken time to reach
the GERF authorities and because of the state of disorder and
confusion, it may have been presented late. The explanation
seemed reasonable and normal. The other joint auditor found
nothing to cause concern. To him the transaction appeared a no
risk transaction. This was because he was viewing this in the
context of the organisation culture, the nature of the fund and
controls in operation. Primarily, the entire transaction was
embedded in a noble cause, and a charitable sentiment. Since
this fund was collected from the factory employees, it was merely
a transitory entry so was no revenue risk to the company. Other
comforting factors were proper documentation of the employees
approval and sanction, known and established payee such as
GERF, and above all a system control of effecting payments
through account payee crossed cheques only. That auditor was
left with no doubt as to the bona fide nature of such a transaction
in the light of all these beliefs and convictions and even if there
was a delay in presenting the cheque it was not unusual.
However the other auditor felt there was something unusual in

the above entry in the bank reconciliation statement. Among fifty
odd such cheques appearing in the bank reconciliation
statement, this cheque was the only one where the cheque
number was not written on the bank reconciliation statement.
While it was nothing grave, it was unusual. On further inquiring
about the decision to make such a huge payment, it was learnt
that the factory employees usually rallied around whenever such
tragedies took place, and in this case, had contributed a sum of
Rs 100 which was deducted from each employees pay for
January 2001. Accordingly the factory had collected a sum of Rs
12 lacs from the 1200 employees which in turn had been donated
to the GERF. Though all this ancillary information seemed to
substantiate the other auditors evaluation, he felt that the
sufficiency in the controls and the truth value was perceived and
had to be proved in order to accept the truth value and bona fide
nature of the payment.
Application of SA 505 and SA 240.

In this context his attention was drawn to SA 505 which lays
down provisions relating to audit evidence and SA 240 which lays
down auditors duties and responsibilities in situations of fraud
and error. Audit evidence must be sufficient and appropriate in
terms of reliability and relevance. What would have been
sufficient in the context of the above case was a valid receipt
from GERF for the money donated to it by the factory staff. The
accountant explained to the auditor that the receipt had not yet
been received, probably since the cheque was cleared only in the
last week of May 2001. He expected it to be received within a few
days. However the auditor derived a sense of discomfort from the
fact that the cheque was presented so late. Why he felt that this
could be a situation where fraud was also likely was because this
was a situation of absence of accountability on either side,
which was a key issue. These funds could very well be termed
as orphan funds. Neither the payers, (the employees) nor the
payee (GERF) had any control over the funds and neither of
them were even likely to ask for an account of the money
collected. Such funds which are in a no mans land, so to speak,

and are always in the danger of being misused and would not be
even missed by either side. Therefore he decided to ensure that
all aspects of SA 240 and SA 505, to the extent possible, were
applied. As he did so, more procedural lapses were revealed. A
photocopy of the cheque had not been preserved, as was
required under the companys policy in respect of all cheques of
Rs. 5 lacs or more. The auditor then asked for the bank
statement for May 2001 to satisfy himself about the presentation
of the cheque. There he was astonished to find that the amount
was presented in two cheques of Rs 9 lacs and Rs 3 lacs. The
accountant now apprehensive, explained that there were two
categories of employees and a separate cheque for each had
been prepared so as to agree with the individual payrolls for each
category. He asked the accountant to obtain the cancelled
cheques from the bank and also insisted that a copy of the
receipt from the GERF be obtained on fax. He spoke to the
factory manager for doing the needful.
The Fraud and how it was masterminded

This relentless pursuit of the auditor was rewarded and the
factory manager then admitted to the auditor that the payment
had never been made to GERF at all. The auditor was not
surprised at all since he had been suspecting this all along but
insisted upon getting the cancelled cheques of Rs 9 lacs and
Rs.3 lacs from the bank. Left with no choice, the manager further
admitted that he and the accountant in collusion, had collected
the fund from the employees by making an appeal to them for a
humanitarian cause and collected a large fund through the
payroll. The fund was now available but could be paid only
through account payee cheques. The factory manager had
authority to issue a cheque only upto Rs 10 lacs and therefore
had asked the accountant to split the cheque into two categories
so as to bring them below the Rs 10 lac limit. They had issued
the cheques to a vendor who was friendly with them and he in
turn had paid them back Rs 10 lacs of the total amount of Rs 12
lacs The accountant also knew exactly how the auditors checked
the bank reconciliation statement and therefore clubbed the two

cheques in the bank statement as if it was a single cheque. He
knew that once the audit was over, the non-presented cheque
would be forgotten particularly when it was knocked out of the
bank statement. He did not go so far as to falsify the cheque
number in the bank statement, in which case perhaps this fraud
would have not been noticed. However this was merely a tip of
an iceberg. The factory manager and the accountant had a
regular devious scheme of collecting and misappropriating such
funds. It was learnt that several times in the past whenever there
were other catastrophes or similar occasions, an appeal was
made and funds were collected and so donated. The objective
was to create orphan funds which never reached the intended
payees but filled the coffers of the manager and the accountant.
In one case, funds were collected for an employee who had met
with a terrible accident and required a large sum of money for
surgery and treatment (over and above the medical
reimbursement given by the company). A fund of Rs 7 lacs was
similarly collected and paid to the friendly doctor who paid a
large part of the money back to the manager. Thus what was
projected was a bona fide charitable activity which was intended
to invite appreciation and compassion and create an optical
illusion halo of charitable and noble activity. This preempted
anyone from having a negative thought and the perpetrators got
away with almost Rs 1 crore in 3 years.
In any hypothesis, shave of all assumption and presumptions,
beliefs and unproved submissions and you will surely come
closer to the truth. Do not believe what you see without verifying
all the facts. Sometimes something might seem too obvious. In
the above case it was seen that the veil of a noble cause, a
corporate controlled environment, excellent control procedure for
cheques issued all optical illusions, fundamentally unproved
submissions. If they were true, then to provide proof should not
have been difficult. It was imperative that they had to be proved
to be true and not be taken at face value.
3. Application of Birbal tips, tricks and traps in detecting the

guilty mind
The wisdom and strategy applied by the legendary Birbal can be
effective in fraud detection even today. The legendary Birbal
could guess what the thief had in mind and plan a situation so as
to trap him. One of the most useful anecdote is the one wherein
he had to identify the guilty servant from among four, who had
stolen the queens jewels. He provided each of the servants with
a straw stating that it was a magic straw. They were told that,
the next day, the straw in possession of the guilty servant would
grow an inch longer. The guilt in the servant who had stolen
thejewels made him cut the straw by an inch to avoid getting
caught. But that was precisely what gave him away, since his
was the only straw which was an inch shorter.
This strategy is perhaps also effective in modern day fraud
detection. There was a charitable trust set up for assisting the
poor, providing medical relief, and other noble causes. The trust
had amassed tremendous goodwill during the last fifty years and
therefore attracted substantial donations. It collected large sums,
exceeding crores of rupees through cash collection (donation)
boxes kept at various public places such as department stores,
airports, shops, supermarkets and other locations. Collections
were retrieved at least twice a week by sending collection
cashiers to the locations and boxes were opened at the trusts
office.
The managing trustee had received some disturbing reports. In
addition to several anonymous complaints, even the auditors had
reported that the collection procedure was weak. Tampering of
the boxes and pilferage of some part of the collections was
suspected. The managing trustee was referred to a fraud
examiner, who studied the trends and the collection system. He
came to a conclusion which confirmed the worst fears of the
managing trustee. Someone at a very senior level of the
management, or, perhaps even one of the main trustees was
likely to be involved in a cash collection fraud.
The fraud examiner suggested laying a trap which would at least

deter the perpetrator even if it did not reveal his identity.
Accordingly, it was announced in the next trustees meeting, that
the fraud examiner would test the collection system. He would
arrange to drop, five hundred rupee notes bearing a red cross
mark in one corner, in all the cash collection boxes at the various
locations during the following week. If the five hundred note was
missing in any of the cash collection boxes, then that box would
have been tampered with and would automatically identify the
cashier involved. The trustees agreed and the fraud examiner
was asked to go ahead. A week later, the fraud examiner sent
word that the five hundred notes had been dropped in the cash
boxes at all locations and the cash boxes could now be opened
to determine whether any of them were missing. The fraud
examiner was also invited to be present when the cash boxes
were opened. Amazingly, of all the cash boxes only one of them
had the five hundred rupee note with a red cross in the corner.
Did it mean that all the other collection boxes were tampered?
No answered the fraud examiner. In fact the cash box where
the five hundred rupee note was found was the one where
the pilferage was now confirmed. He now announced that he
had not dropped any five hundred note in any of the boxes. In
fact instead of five hundred notes in the cash box, he had actually
dropped in each of the cash boxes, a foreign currency note of
20 GB pounds with a small red dot in one corner. The only
cash box which did not have such 20 pound notes was the one
where this five hundred pound note was found. This meant that
the collection cashier for that particular cash box had emptied a
part of the cash proceeds, retained the 20 pound note and
inserted a five hundred rupee note with a red cross on one of its
corners to proclaim his innocence. The fingerprints on the five
hundred note with the red cross were examined and compared
with those of the cashier and the store manager where the box
was kept. They matched and the two were turned over to the
police for further questioning. The Store manager turned out to
be a relative of one of the trustees and an estimated Rs. 2.5
crores in the last four period was removed from such cash boxes.
The cashier confessed that the involved trustee had provided him
with a duplicate set of keys and with the store managers help, a
part of the box was emptied before it was taken to the trusts
office. The instructions given were to cream the large value notes
and foreign currencies and leave behind the smaller
denominations.
Such methods provide not only a trap but also a moral check and
can reduce the probability of fraud.
4. The principle of mirror imaging applied in detection of

a major project expense fraud.
The laws of physics tell us that every image of an object in a
mirror is identical to the object. A normal glass mirror reflects
whatever is placed before it without distortion. This simple
phenomenon can have an effective and meaningful application in
fraud investigation. The mirror imaging principle states that
procedures and controls, in a given situation, applied at one
place should be possible to apply at another, if the set of
circumstances are the same. Results should be same or similar
and deviations could mean that some something is amiss. What
is emphasized here is that an examiner must include in his
repertoire, certain techniques and methods which will alert him to
such possibilities if they exist. Sometimes the doctrine of mirror
imaging is one such tool which can enable an auditor to take a
comprehensive view of similar activities and weed out symptoms
of inconsistencies. For example a company having depots in
each state in the country having the same accounting software
must have similar results or problems. If it has a specific problem
at one place, logically it should occur at other depots as well. This
imaging theory can be very effective in such situations. Similarly,
consider identical factories, units, branches, sales offices retail
chain stores, supermarkets and malls where the products are the
same and the same systems, procedures, and controls are
replicated. Each may be considered a mirror reflection of the
other and if at one place a system can work efficiently there
should be no reason why it would show different results at
another place. An examiner would therefore considerably benefit

from application of such theories as and when the need arises.
The following is an illustrative case study where an auditor
applied this mirror imaging technique in fraud detection
Facts of the case

BEL was an engineering company with global presence, having
several large project sites in India. In one of its large projects at
Haldia, a special crane had to be temporarily imported from a
Singapore multinational company. The crane was shipped from
Singapore to Calcutta which was at a distance of about 90 kms.
from the actual site where it was needed. The crane was to be
used for about three months and returned back to Singapore.
However, it was actually returned after more than 5 months.
Consequently there was a huge overrun in the budget, for costs
relating to import and use of the crane. Originally budgeted at Rs.
3.5 crores, the actual expenditure was 7.1 crores! The major
relevant costs debited to this project were as follows :
Hire Charges Rs.1.2 crores
Customs Duty Rs.0.6 crores
Transportation, Loading & Unloading Rs.4.2 crores
Others Rs. 1.1 crores
The crane was shipped along with 180 different packets of
various accessories, consumables, extra weights, spare parts
and tools for erection and making it operational. The company
had entered into a contract with M/s Couriers and Carriers
(CNC), for ensuring safe transportation of the crane from Calcutta
to the site, for a specific fee and reimbursement of incidental
expenses at actuals. As explained, on reaching Calcutta, the
crane had to be dismantled to be unloaded. The unloading of the
180 accompanying packets was no easy task and a lot of time
and effort was involved in their transportation to the site. The
unloading operation had required several cranes and taken about
14 days (4 for the main crane and 10 days for the 180 packets).
The crane and some heavy packets were transported over
hydraulic axles and the rest were carried in trucks to the site, on
rough terrain, narrow roads and unsafe conditions. The entire

transportation and reloading procedure had to be repeated
conversely while shipping back the crane to Singapore.
The internal review by the management had not yielded any
adverse finding; in fact the explanations, for variances in the
budgets, seemed reasonable and quite probable. In brief the
following justifications for the unforeseen costs were given:
a) Collective impact on costs on account of pressing deadlines
for work completion, depletion in dollar rate, and substantial
increase in the hire time of labour and equipment.
b) Practical difficulties in budgeting and estimating
transportation, and unforeseen loading and unloading costs
c) Factors such as poor roads, transport facilities, and
unskilled labour had created considerable difficulties in the
movement of the crane to and from the site and had led to
high costs of repairs
d) Heavy costs for disassembling the crane while unloading at
Calcutta port, and again while loading it on the barge for the
return journey back to Singapore, entailing similar costs
which had not been foreseen earlier.
The management had been convinced that the cost overrun was
inevitable and ratified it.
Audit Procedure:
The auditor applied all routine tests including:
1) Vouching all expenses incurred on the crane
hire activity using standard audit procedures of
document examination, and obtaining and
recording explanations.
2) Scrutinised budgets and actual costs in detail.
3) Examination of vendor selection procedures
and 4) Study of documentation.
General audit review of authorisation procedures, control
procedures review and documentation was also conducted.
Barring a few routine queries, no adverse finding was noted. The

hire charges of the crane were payable in foreign exchange and
approved at highest level and were further ratified by the board of
directors and therefore there appeared to be little scope for any
manipulation or wrongdoing. The other main chunk of cost was
customs duty paid to exchequer for which there were prescribed
rates and well supported by official receipts. Transportation,
loading and unloading costs were paid to a third party (CNC).
The auditor had verified CNCs bills for adherence to the terms of
the agreement and documentary evidence in terms of bills,
supportings and detailed expense statements. Other expenses
were not material and for which proper supportings were
available. After going through the available documentation, and
applying all routine and appropriate audit tests, and obtaining
explanations as warranted the auditor did not have any direct
evidence of any wrongdoing. Even then the auditor felt that the
provisions of SAP 4 were attracted.
Why was SA 240 required to be invoked?
The auditor had been unable to understand or satisfy himself as
regards the following:
a) Though CNC had been selected after compliance with
vendor selection procedures, they had very little experience.
The company had been recently set up and did not have
any major assignments on hand.
b) How could such a large cost overrun could be explained
away on account of unforeseen factors. He was not
convinced that budgeting the crane activity was so difficult
so as to lead to such a massive overrun
c) Almost the entire variance in cost was in the costs billed by
CNC relating to loading, unloading, and transportation.
d) A lot of transportation costs for vehicles and other cranes
deployed by CNC could have been inflated, particularly
because the bills had been submitted from M/s CNC post
facto; and accepted at face value. Log sheets of vehicles
were not signed in all bills. (The explanation given was that
the crane and the accompanying packets had arrived on

different vehicles at different times and odd hours, therefore
some signatures may have been missed out by oversight.)
e) Why wasnt consent taken from the senior management in
Mumbai for disassembling the crane at Calcutta, an
unforeseen cost? Even granting the urgency, there was not
even a fax on record and this decision had been taken
unilaterally by the local manager.
f) Almost all throughout the journey of the crane from the
Calcutta port to the site and back, the crane was in complete
control of CNC. This gave it sufficient freedom to bill
anything to the company without recourse by way of
verification. All these issues and other minor inconsistencies
in various explanations obtained, gave the auditor a high
level of discomfort. Therefore, he discussed these matters
with the senior management. They were concerned and his
queries seemed reasonable. They consented to his
investigating further.
Application of the mirror image doctrine.
Till now the auditor had applied all the correct audit checks and
tests which could have been applied by any reasonable person in
such a situation. But he realized that his view was a micro view,
i.e. a view of the variables from close range. What he still needed
to apply was a macro view or a birds eye view as against a
micro view or an ants view of the crane hire activity. The
dismantling of the crane at Calcutta while unloading and then
again while reloading on the return trip reminded him of a mirror
image. The mirror gave him a new direction of thought and drew
his attention to the crane on the other side, i.e., Singapore.
Applying the same logic of mirror image, he thought that if the
crane had to be dismantled at Calcutta Port for unloading, then
how was it that the crane was in an assembled state on the
barge, particularly if it had to be dismantled for
loading/unloading? There was no sense in dismantling it at
Singapore port for loading and then assembling it back on the
barge and then re-dismantling it again at Calcutta port.
Extended Audit procedures, based on new clues.

The auditor then once again re-examined the entire crane
delivery operation. The forwarding and clearing (F&C) expenses,
he observed, were supported by several third party bills which
were available with vehicle numbers and time-logs. However he
found that when all the bills were examined together they were in
continuous serial numbers, implying that during that period all
those parties had no other client except CNC.
He felt that some more information and evidence was required to
satisfy himself that the overrun was not on account of any
wrongdoing. He requested the management to allow him to
conduct an investigation to determine the facts.
On getting the management consent, the auditor then contacted
the imported crane owners office at Singapore to gather the
information on loading operations of the crane at Singapore and
got the necessary data to answer the question he had posed to
himself. He was surprised to learn that the crane was loaded on
the barge, in an assembled state. It was shipped in a semi
working condition such that it had sufficient maneuvering
capability to lift all the 180 packets shipped alongside. Thus there
was no need for any dismantling at Calcutta and certainly not for
hire of all those cranes to lift the accompanying packets billed by
CNC. Realizing that his inquiries were yielding new results he
extended his investigation further. His further investigation
revealed that the crane-vehicle numbers billed were registered
with the Motor Registration Department as private cars and were
not commercial vehicles as billed by CNC. Thus the crane bills
were fictitious This was further evidenced by the denials of the
third parties on whose letter heads some of these bills were
made.
Final results of the investigation after due interviewing and
confrontation of this new evidence showed that, the site manager
confessed that along with the help of CNC, he was able to
astutely insert false third party bills to defraud BEL. He had ideal
conditions for such a fraud because, on the one hand, deadlines
for project completion were the topmost priority for the senior
management. He had been given a blanket clearance by the

senior management in Mumbai for getting the project completed
in time. Consequently many high value bills were getting passed
without queries from the senior project directors. On the other
hand, the accounts and finance department was already under
tremendous pressure on account of a major internal audit by the
parent company, new software and manpower constraints.
Moreover, they did not possess any technical expertise or even
knowledge to realize that a particular expense was not required.
The fraud was a cakewalk and was not noticed till about six
months later when that project was taken up for audit.
5. The three dimensional vision used in detection of

material rejection frauds:
Scientifically speaking, the two eyes of a human being see the
same object from slightly different angles. Therefore, although
the object is the same, the brain receives two slightly different
images, which are infused. The viewer thus perceives solidity and
depth of the object studied. In much the same manner, an
examiner may have access to a multitude of reports, information
and evidence. For example he may receive information from
several sources such as documentation checks, internal reviews,
field audits, reports from internal auditors, external auditors,
consultants, staff, etc. In spite of such abundance of information,
time and resource constraints they remain nothing but a mass of
clutter. Unless relevant issues are linked the seriousness and
gravity of certain issues do not get accentuated. The intrinsic
wealth of any such information remains unreachable till all this is
viewed on one platform and a collective meaningful evaluation is
done. This process is applying a three dimensional vision. The
following is one case where an auditor applied a 3D vision to
detect a fraud.
FACTS OF THE CASE
A cookware and ancillary consumer products manufacturing
company had insufficient capacity for certain products and it
depended upon an outhouse vendor to make up for its total
production requirement. The outhouse material processing

procedure, was as follows: A material process plan was compiled
each month by its Works Manager (WM) and a relevant extract
relating to quantities of material to be sent for outhouse
processing was given to its stores manager (SM). The SM
prepared delivery challans (DC) for materials dispatched through
a local transporter to the vendor (VN). The vendor would process
the materials and the companys quality control (QC) manager at
VNs site would inspect and certify the quantity of approved
processed material after weeding out rejections. VN would return
the approved material through the same transporter to the
company. On receipt of the processed material, SM would
prepare a Goods Receipt Note (GRN) for the quantity actually
received. As per the companys own manufacturing norms, it
would allow a shortage of a maximum of 3 % on account of
wastage and rejections was permissible. Accordingly, shortages
upto 3 % of the original quantity dispatched were allowed and the
GRN was accepted in full settlement of return of material
delivered through the original DC. (If the shortage was greater
than 3 %, a debit memo for the shortage exceeding 3 % would be
prepared; however this was a rare event) A certified copy of the
GRN with a copy of the corresponding settled DC was then sent
to the WM for approval of payment. The WM would then prepare
a Process Charges Approved Memo which would be sent to the
vendor as well as the accounts department for credit to the
Vendors running account with the company. This seemed to be a
reasonable system prima facie. However this system embodied a
major fraud discovered by the auditor.
APPROACH OF THE AUDITOR
Keeping in mind the various auditing standards pronounced, the
auditor went about his task cautiously. He wanted to collect all
the evidence and the relevant information and explanations to
support his eventual conclusion. The company was professionally
managed and had a vast information base since it received
information from various sources such as internal review reports
from its senior managers, internal audit reports, financing banks
auditors review reports periodically. The management took a one
for-one routine follow up or corrective action regarding the

findings wherever possible while in case of certain issues the
management approach was casual and indifferent depending
upon the apparent seriousness. However, it never occurred to the
management to take a birds eye view or a macro view of the
information. The auditor meticulously studied all the observations
and taking a macro view prepared a summarized table, given
below, of all observations and corresponding actions taken. On
studying the table, he felt that point 4 of the internal review report
was closely related to point 4 of the bank auditors report and
point 3 of the internal auditors report
Observations and Findings Justification or Corrective
Action
Summary of internal auditors reports Management response
1. Stale cheques reversals not Since done

carried out
2. Non-compliance with certain Recovered from all parties except

statutory provisions relating tax one
deductions at source
3. Vendors challans for materials GRNs furnished the necessary

sent for outhouse processing not information
available
4. Sales discounts in Delhi branch Staff pulled up and new controls

excessive and in contravention of enforced
policies
5. Several unsupported cash expense Tighter controls on cash

vouchers disbursements by having higher level
of sanctioning authorities
Summarised observations of the Management response

Internal review reports
1. Unreasonably high salary, A salary review exercise was in

overtime and allowance payments to process to address this issue
Information Systems (IS)
department:
2. Procedural lapses in acquisition of Since ratified

certain fixed assets
3. Use of unlicensed software in Unlicensed Software deleted

certain specified departments
4. Transportation charges for sending Would be reviewed by WM at the

material to outhouse vendors needed time of renewal of annual contract
to be controlled
Summarised observations in the Management response

financing bank's auditor's review
reports on stocks and book debts:
1. Collection procedures for book A procedure review was carried out

debts needed to be strengthened and recommendations were being
implemented
2. Certain credit sales made in Since ratified

contravention of policy guidelines
3. Value of certain spares purchased Since Corrected

overstated
4. No quantitative control over stock WMs explanation: Not necessary

of rejections lying at VNs site on account of immaterial value and
further VNs rate was negotiated
considered the expected salvage
value
Invoking Provisions of SA240:

The auditor felt that though individually these controls did not
appear to be serious, collectively indicated something unusual.
This was because each of these points were linked to outhouse
material processing where his current audit team also had a lot of
unresolved queries relating to dispatch reconciliations,
transporters bills etc . On an average, the outhouse processing
was to the tune of Rs 25 crores about one third the capacity of
the companys own manufacturing activity and a 3 % rejection
was 75 lacs which was materially significant. Thus on materiality
count as well as the unusual symptoms noticed by him as well as
other professionals, he felt that some kind of fraud was likely and
therefore provisions of SAP 4 would be applicable and
accordingly he decided to apply extended procedures. He
obtained the consent of the company to make such further

inquiries as were necessary.
FURTHER INQUIRIES MADE BY THE AUDITORS:
Pursuing the bank auditors comment regarding absence of
quantitative controls over rejections, he visited SM. SM
stated that rejections were never sent to the company. VN
always sent the good pieces. The auditor made an
independent statement of rejected pieces not returned back
for the last one year and he was stunned to see that the
actual cost of such material exceeded Rs 60 lacs! The
auditor showed it to WM who had explained to him that such
rejections were an inherent part of the manufacturing
process as evidenced in the companys own in-house
activity. Such material could not be reused or recycled and
would fetch miniscule salvage value. Therefore no effort had
been made to recover such rejections which were probably
lying at the vendors site.
With respect to point 4 of the internal review report regarding
excessive transportation charges he observed that the
outhouse factory was at a distance which was not
commensurate with the distances for which charges were
levied by the transporter. He also found that the company
used a different transporter for this activity. WM had never
obtained any quotation from other transporters. When asked
to explain, WM stated that the material had to be handled
very carefully and this transporter was experienced. Further,
a relationship had developed over a period of time which
could not be severed easily. The auditor noticed that WM
had not taken any follow up action (as he had been directed,
per the management response report) during the time of
renewal of contract which had been renewed just a few days
back. The auditor was now convinced some about some kind
of improper dealings on the part of WM.
More facts fell into place when the auditor pursued point 3 of
the internal auditors report regarding vendors challahs not
being preserved. He discussed the matter with SM who
certified quantity of materials received. The justification given

was that the company had a very large inventory and
considerable documents to monitor movement of stocks,
materials, tools and spares in and out of the company.
Further certain vendors were not well organized and did not
have documentary discipline and did not have formal
challahs. To ensure consistence and minimize loose
documentation the company relied upon its own DCs and
GRNs for materials sent and received for clearing the
vendors payments and therefore the vendors challahs were
not required. All that SM was expected to do was to correctly
certify the quantity received on the GRN, ensure that
shortages on account of rejections did not exceed 3 % of the
original DC and attach the relevant supporting GRN and
forward it to WM for processing the vendor payment. What
surprised the auditor was that WM himself monitored the
entire ledger account and ensured that there was no
outstanding or any cause of dispute. The auditor also learnt,
through general discussions with the company staff, that any
discussions or meetings with VN would always be done in his
presence.
Convinced that there was something amiss and suspecting

some kind of unhealthy relationship between WM and VN, he
made a personal visit to VN, the outhouse vendor to satisfy
himself. However, he came across an unexpected amazing
revelation. There were no stocks of rejections lying at the
vendors site... In fact in the previous year, VN had acquired
a new computerized machine which automated the process
of manufacturing almost entirely. As a result rejection rate
was less than 0.2 %. He was further explained hitherto the
processing activity was partly manual and therefore the
percentage of rejections was high. Further the processing
was much faster and cheaper. The earlier 3 percent rejection
percentage was not applicable, but this fact was not known
to anyone except the WM and the QC manager.
How was the fraud committed?

The fraud was not one which the auditor suspected: A cut back
relationship with VN. The modus operandi of the fraud was: WM
was in collusion with the QC manager. He would have the

dispatched quantity for outhouse processing sent to the vendor.
VN would process the material and offer it for inspection to the
QC manager who would approve and stamp the vendors challah
and accept the quantity processed which would have negligible
or no rejections. He would prepare his own QC memo and send it
back with the material back to the company to SM using the
same transporter. However on the way back, the transporter
would stop by at an accomplices place. The accomplice would
remove upto 3 % of the processed material and send the balance
to the company. He would appropriately fill in a figure of rejection
quantity on the QC memo and show the net quantity deliverable.
This detour of the transporter to the accomplices place explained
the excessive transportation charges. Since the quantity actually
delivered was modified clandestinely, it was dangerous for WM to
have the vendors challahs in the records of the company.
Therefore he had instructed SM to disregard, in general, vendor
challahs and maintain GRNs and not to preserve VNs challahs.
In the process the company suffered a damage to the extent of
the value of 3 percent rejections which did not exist in reality. To
make the rejection percentage realistic, he would keep fluctuating
it between 2-3 %. The vendor VN did suspect some sort of foul
play, but he turned a blind eye to it since he realized that the
management had given wide powers to WM and for him there
was no loss in the transaction. The processing charge payable to
him had been determined four years ago taking into considering
some salvage for rejections, but after acquiring the new machine
his overall processing costs had reduced and therefore he was
more than happy to continue with the old rate. On the other hand
WM and his accomplice would sell off the 3 % processed material
and pocket the sale proceeds.
Both the internal review and the auditors report did, in their own
way, point out control deficiencies, but did not reveal the depth of
the underlying fraud. Each report presented only a part of the
picture just like a part of an object visible through one eye.
Explanations given in respect of weaknesses seemed
satisfactory when viewed in the context of the individual
assignments. However evaluation of information and decision

making can be more effective when information from
different sources is viewed comprehensively. A few people
are gifted with a vision called three-dimensional vision (3-D
vision). They have the ability to comprehend the actual depth of
a picture. An average person normally is guided, not by what he
sees, but what he perceives or, what he thinks he sees.
Compared to such an average person, people, who have
developed a 3 D vision, see and understand much more than
what the picture apparently reveals. This three-dimensional
vision, in a certain sense, can be applied to audits and
investigations t with incredible results.
How can an examiner come to a conclusion that there could exist
frauds or errors which could materially impair the information in
the financial statements available? Well, developing a vigilant
approach using the principle of the 3 D vision explained above,
could be one of the tools which might be effective. By collecting
information from as many sources as is possible, and by applying
the 3-D vision, one can easily see the underlying features of the
information, which otherwise may not be comprehensible, This is
because, collusion between employees can lead to fraud even in
the best of systems. No amount of internal control, security, and
precautionary measures can eliminate fraud based on collusion.
Therefore, extremely powerful tools are required to detect,
combat, and tackle fraud arising out of collusion. The key point is
that information must be collated and digested from various
sources to be of value. This is the essence of the principle of 3 D
vision. It is evident in this case that such collusion would have
been very difficult to detect. However 3-D vision enabled the
auditor to focus on the information and results of the other
sources to unearth the fraud. Fraud by collusion can be
overcome to some extent by using this 3 D vision combination.
Tools and Techniques Used in Fraud

Detection and Investigation
There are several tools which can be used in fraud detection.

Some of the ones commonly used are:
1. Audit software
2. Mathematical Tools
3. Statistical Tools
4. Electronic or digital tools
Advanced Use of Audit Software in Audit and Fraud Detection
Audit Software: An Indispensable Tool in the New Millennium
With the advent of more and more sophisticated accounting
systems, and rapid improvements in technology, soon it will be
unthinkable to conduct an audit without using audit software.
Therefore, its essential that auditors sharpen their skills in the
use of such tools. Auditors must keep pace with the changing
environment because inevitably there will be occasions when a
mere working knowledge of these audit tools will be insufficient.
For better and more pervasive results in audits, auditors must
become experts in applying audit software.
Routine or elementary application of audit software in any audit
software, the use of simple commands such as sorting, statistical
analysis, totaling and subtotaling, grouping, indexing and filtering
certainly offer considerable support when applying audit tests and
evaluations. By using software, an auditor can carry out three
types of audit checks:
data input or validation checks through tests of sequential
control, and use of commands for scanning missing numbers
and record counts
data processing or report validation checks through simple
and standard re-performance tests; for example,
reprocessing the debtors aging report using software and
comparing it with the auditees aging report
output control checks through distribution and access tests

and verification of exception reports
Similarly, investigation software can help an auditor to apply

certain commands for detecting duplicate invoices/ checks /
payment vouchers. Even phantom vendors or employees can be
spotted and certain software can even detect suppliers with the
same addresses or telephone numbers, and can perform
interesting and effective tests for audit and fraud detection.
Most of these tests are usually not possible manually, especially
in sophisticated computerized accounting systems and where
audit populations have massive amounts of data. To reiterate,
without using sophisticated computer tools, auditors would not be
able to conduct such tests.
However, the actual creativity, imagination and expertise of the
auditor have not yet been used, or if used, only marginally;
auditors can scale greater heights and achieve much more
meaningful, penetrative and focused results if they build their
own experience, foresight, judgment and vision in the audit
software.
Advanced use of software in audit and investigation Auditing
has always been a creative process and the auditors
judgment, skills, and experience play an important role in the
audit process. While the elementary tests explained above
are essential, they are not always adequate to achieve the
desired objectives. Towards the end of any audit or
investigation, in order to achieve the audit objectives, the
auditor must also view the data both on a macro and micro
basis, and arrive at his/her own conclusions based on:
Control and substantive tests results Data trends consistency of
the data with the given facts in the audited and control
environment in the first two points, the elementary tests offer
considerable support and assist the auditor in his evaluation
process. However, its the last point in which the use of audit
software phenomenally increases the depth and extent of the
audit; this is where the advanced application of audit software
comes in. After all the routine control and substantive tests are
satisfactorily applied and results evaluated, the auditor takes a
macro look, in the context of the audit objectives, to satisfy
Tools and Techniques Used in Fraud Detection and Investigation 99
him/herself that all the clues or facts fit properly. This is the place
where the auditors expertise supported by the audit tool can
work miracles in terms of audit results and findings. What should
be done at this stage, is to compile Data Query Models (DQM) to
test the goodness of fit of all the earlier findings with the facts in
the auditee and control environment. Quite simply, such DQMs
are programs or macros built using audit software for specific
queries. These are possible even in simple spreadsheets, as well
as in advanced audit software.
The strategy for preparing DQMs always stems from the auditors
study of the auditees environment, the control environment, and
the regulatory statutes applicable to the auditee. The information
he/she collects provides various audit clues in the form of facts
and conditions that govern the various transactions, operations
and the activities under audit. Based on these clues, the auditor
can build up a DQM that can be applied to test the fulfillment of
conditions or facts that affect the activity. He/she may require the
aid of an IT manager to provide technical assistance, or achieve
the desired reports. This can be more easily understood from the
following examples.
An example
An auditor found that travelling expenses in a certain company
were high (as well as voluminous), and controls were weak.
Management had not insisted on air/train ticket receipts, and had
been remiss in monitoring travel expenditures. In this context, the
auditor wanted to ascertain whether there was a possibility of any
inflated or false travel claims. He made a list of all the metro
cities to which senior employees travel was high. He also
obtained from a travel agent the details of flight and train
connections, and the days on which such flight/train connection
were available from the city in which the company was situated.
He asked his IT manager to create a DQM which would filter the
clients travel expenses, and each of these were further filtered
by city, with details of days and dates of travel. The DQM was
required also to compare the dates of actual travel with the dates
of flight and train connections available, which were obtained
from the travel agent, and generated exception reports. These

exception reports were expected to spot instances where any
person had traveled to any city when the air/train connection was
not there. Sure enough, the report threw up four tours made by
the same person to a city on days when the air/train connection
was not available. On making further inquiries, the auditor found
that this persons expenditures were supported by fictitious bills
for hotel, food and conveyance during his four trips. Such a
comprehensive test was obviously impossible manually wherein,
at best, a sample test would have been applied. However the
DQM, compiled through audit software, made it possible to check
the travel of every employee for the entire period under audit with
accurate results.
Other similar examples are:
A DQM compared employee swipe cards attendance swipes with
dates in tour and travel reports. Since there should be no swipes
on dates of travel, inflated claims made by employees were
easily detected by comparing dates of travel with swipe card
entries. There were plenty of instances where employees
extended the dates beyond the actual travel in their reports in
order to claim extra travel allowances.
In another DQM, freight charges for railway freight were
compared with clearing agents charges for the same
consignments. The number of boxes for which railway freight
paid was compared with the number of boxes for which the
commission was paid to the clearing agent. It was found that the
agent had inflated his claim by almost four times the actual
amount.
For a company having several warehouses, a DQM computed
the actual dimensions of warehouses and compared the storage
volume available with the actual volume of inventory reported. In
one case, the computed area, as per the stock statement, was
found to be three times in excess of the physical possibility to
store such stocks. Conclusion
All these are relatively simple examples based on certain facts
and possibilities. In practice, DQMs can be quite comprehensive,
covering multiple activities and revealing mind-boggling results.

The important point to note is that the auditor actually tests or
verifies whether the facts and possibilities are misstated or
misrepresented. Whether or not a DQM is prepared depends on
the importance and materiality of the expected finding in the
overall audit objective, and the related cost in terms of time and
money.
Moreover, most audit software programs are so user-friendly and
flexible, and contain such advanced features that DQMs are not
overly complicated and difficult to create. Though there are
constraints in terms of incompatible hardware/software, or
impediments in data retrieval, high costs of staff training and
upgrading software, these will taper off in due course. A
reasonable degree of audit software training, a logical approach,
and a clear understanding of the audit objective are all it takes to
use DQMs properly. Audit software can be compared to a
musical instrument the more practice, the greater the
imagination and creativity, the better the audit.
The one such tool which perhaps may revolutionize auditing in
the current millennium is the application of the amazing first digit
theorem or Benfords Law using digital analysis tools.
II. BENFORDS LAW AND ITS PLACE IN FRAUD AND

ERROR DETECTION, IN INVESTGATION AND AUDITING
An astonishing mathematical theorem known as Benfords Law
is a powerful and relatively simple tool for exposing errors,
frauds, sloppy accountants, embezzlers, and even computer
bugs which has remained in archives and ignored for years,
since 1938. What exactly does this law mean? In simple words
any body of numbers contains numbers having digits 1 to 9
placed together differently for each observation. Intuitively, and
from common sense, most people assume each digit could be
any number from 1 through 9. All nine numbers would be
regarded as equally probable in any place. However, as Dr.
Benford discovered, this is not true. Each digit, in a umber, in a
body of data (natural number populations,) has an expected or
defined frequency of appearance in the population. For simplicity,

this article deals with the appearance frequency of only the left
most or the first digit in each number. Benford found that each of
the nine digits do not have an equal probability of appearing.
The chance that the first number in the string will be 1 is 30 % as
against common sense probability of 1/9 or 11.1 %. The
probability of digit 2 appearing is expected about 17.6 percent.
The following table indicates the expected frequencies as against
11.1% or equal frequencies as what one would reasonably
expect for all digits from 1-9 in the left most place in any number
in a population:
First Digit Benfords
Expectation %
1 30.1
2 17.6
3 12.4
4 9.6
5 7.9
6 6.6
7 5.7
8 5.1
9 4.6
This table was compiled after sheer hard work on widely
disparate populations such as a days stock quotations, a
tournaments tennis scores, the numbers on the front page of
The New York Times, the populations of towns, electricity bills in
the Solomon Islands, the molecular weights of compounds, the
half-lives of radioactive atoms and much more.
How does this help auditors? The one word answer for this is
phenomenally. The application of this law in auditing can lead to
amazing discoveries in terms of errors or frauds. Data validation

and analysis of a new dimension is now possible. Most
accountants or embezzlers would not know that any error or
fraud is very likely to be caught or trapped by digital analysis
using this amazing theorem. This is because a material error or a
fraud, influences a natural number population and consequently
the data set loses its digital properties as predicted by Benford
and a digital analysis would easily throw up the anomalies for an
auditor to concentrate upon. Thus this law facilitates an auditor to
virtually focus his attention directly on fraud or error prone areas.
Research studies have shown that a digital analyses are
successful about 68 % of the time with the limited knowledge that
humans possess as of date, as regards this law and its potential.
III. CASE STUDY USING BENFORDS LAW.

It would be relevant and important to mention here that the author
of this article was extremely skeptical of this law and did not
really expect such digital frequencies to appear in any audit data,
till he actually tested it. He tried out this test using audit software
in an engineering company on a population data comprising of
cheque payments for the entire company running into a volume
of about 3000 transactions for a quarter. This test was
independently conducted by someone different from the audit
team. The results were amazing. The actual frequencies
matched quite closely with the Benfords expected frequency
distribution as given in the table above. Further, the actual audit
results did not reveal any material discrepancy or fraud per the
independent audit teams audit findings. which seemed to agree
with Benfords Law.
However, the above is a positive test and may not be convincing
enough. What is really important is also to know whether this
works where there is an error or fraud. The following example is
one which illustrates the negative findings, which eventually
revealed a fraud cleverly perpetrated.
In a large and popular restaurant, there was a lunch buffet priced
at Rs 100 per person. Normally there would a waiting period to
get a place even though there were a large number of tables and
covers. An auditor applied the digital test on cash memo
collections. He was surprised to find that the cash memo
collection amounts for a period beginning with the digit 1, (for
single customers -value Rs 100, or 10 customers per cash
memo- value Rs1,000 or multiples thereof) were only 18%
whereas Benfords Law states that they should have been 30.1
%. The auditor discussed this observation with the manager who
was also surprised. This was because, a large part of their
patronage was from nearby corporate office executives who
came for lunch, mostly alone. They were quite regular and
therefore cash memos for single customer lunches should have
been substantial. Carrying out his analysis further, the auditor
filtered out data relating to single customer cash memos (Rs 100
cash memos) and averaged them for a month. He found that the
average single customer cash memo collection per day did not
exceed Rs 1500, i.e. not more than 15 such single customers
had lunch in a day. However the manager said that this was not
correct because at least 25 such single customers patronized the
restaurant each day. Even the auditor confirmed this when he
personally visited the restaurant the next day at lunch time.
Inspire of the fact that the cash memo system was computerized,
and, a system procedural control that no one was allotted a table
unless he had taken a cash memo printed from the counter cash
income suppression appeared possible. The auditor then decided
to apply a walk through test of the collection system and bought a
lunch cash memo. The cash memo which was issued to him
seemed quite normal. He asked one of his team members to try
out the same thing on a different day. Again, the cash memo
seemed normal. However he saw that the serial number (a six
digit number) was the same as his own cash memo of the earlier
day, though the date was different. This was strange and he felt
that something was wrong with the cash memo. He discussed
the matter with the vendor who had supplied the software and
explained to him this strange anomaly. The vendor took one look
at the cash memo and straight away stated that the cash memos
which the auditor had, were not generated by his software. The
serial number could not be repeated in the same month as a

measure of internal control in the software itself. The auditor then
asked him how could these cash memos be generated? Simple,
by using sophisticated software, almost any kind of bill invoice,
memo, and form could be replicated as many times as was
needed, the vendor informed him. Now the auditor began to see
light. On launching a full scale investigation it was revealed that
the cashier would have both the software loaded on his terminal,
and when he saw an opportunity, particularly of single customers
walking in, he would exit from the official the cash collection
software, and run the other software which had a replicated
version of the cash memo with the current date, and print it out.
The customer would pay him and take the memo to get a table
allotted and the money would be pocketed by the cashier, since
the official cash memo system would not have this transaction at
all. The cashier was smart enough to change dates to be online
with the current date, but he could not change the numbers.
However all such cash memos were issued to different
customers and no one ever bothered to compare numbers. He
would perpetrate this only for single customers who would not
attract too much attention and have minimum of disputes
regarding any cash memo. This fraud went unnoticed for almost
3 years and the damage exceeded Rs 20 lacs and the cashier in
this manner pocketed a large sum. This fraud was revealed so
simply by this digital analysis. Consider the flip side of not using
this audit approach. While the fraud may have been detected
using other audit procedures also, chances were slim.
CONCLUSION
This illustration does not in any way reduce the importance and
effectiveness of traditional audit procedures. However it
accentuates the need to treat investigation as a science as well
as an art. Nothing should be treated as standard and routine.
The very essence of a professional service is to provide
meaningful results. This is possible only when constant
refinement, improvement and betterment of services are sought.
Revolutionary changes must be brought where useful to
supplement and enhance results produced by the time tested old

procedures and techniques.
Use of Audit and Investigation software, analytical tests, and
Mathematical and Statistical tools such as Benfords Law,
Regression, and principle of Scale invariance with some case
studies can be considered if the length does not exceed the
budgeted pages.
Computer Aided Audit Techniques

and Tools (CAATTs)
Audit in general and fraud investigation in particular is getting

complex day by day primarily due to migration to non-paper
based systems. Processes and workflows are system driven and
generally the entire control revolves around the computerized
environment. Therefore, there is a clear trend that auditors would
have to churn voluminous digitalized data as auditable records.
Needless to say, auditors would therefore have to devise ways
and means of verification that is commensurate with the
changing times. The challenges are to examine various
databases generated from different systems which may or may
not be integrated.
Changing patterns of businesses, regulatory framework, scarcity
of resources at auditors disposal on one side and the ever
increasing mountainous data on other hand is making audit a
complex process. Use of CAATTs is, thus, indispensable to the
Auditors and forensic accountants.
Lets see how we can use CAATTs in its simplest form for routine
work.
CAATTs, as the name suggests, deals with two aspects -- the
CAT-Tool and CAT-Technique. While the CAT-Tool refers to use
of software tool, the CAT technique insinuates enhancing the
effectiveness and efficiency of audit to work with the CAT-Tool on
the auditable database. Thus both are integrated part of each
other like a sides of scissors and one will not be able to work
without the other. Needless to say both sides have to work in
tandem to be able to cut through the complex data. CAT-Tool is
all about learning the syntax of a software application and will
also entail a need to know about the database architecture. It
deals with How-to work on the database. Whereas the CAT-
technique is all about the auditors judgment to apply procedures
on the database knowing auditees environment viz-a-viz the
underlying audit objective. This part deals with What-to-do with

the database.
Computer Aided Audit Techniquesand Tools (CAATTs) 109
Computer Aided Audit Tools or CAATs can be broadly divided into

Generalized Audit Softwares (GAS) or
Common Software Tools (CST)
Generalized Audit Software (GAS)

These are specializedsoftwares designed for accountants
fostered with audit architecture in mind. The user interface is very
simple for users to follow and with that objective, GASs very often
have out-of-box-integration with leading accounting / other
systems. However simple it may sound, it needs some training
and experience to use them and some people do find it complex
to operate. Another reason for GASs unpopularity is due to its
high cost. Some examples of GASs are ACL, Idea, etc.
Common Software Tools (CST)

Due to shortcomings of GASs, CSTs have become popular over a
period. Spreadsheets (like MS Excel, Lotus, etc.), RDBMS (like
MS Access, etc.) and Report writers (like Crystal reports, etc.) are
few examples of CSTs. Their widespread acceptability is due to
its instant availability and lower costs. While spreadsheets may be
extremely easy to use due to its simplicity and versatility, other
CSTs may need some practice.
Whether one uses GAS or CST, it is imperative that the auditor is
aware about the manner and processes that have led to the data
generation, the control environment revolving around the data and
the source from where the data samples are imported into the
GAS/CST.
As a part of computer-aided audit, an auditor needs to do one or
more of the following.
A typical 8-point CAATT program:
1. Check Missings
2. Check Duplicates
3. Round Numbers
4. Repetitive Odd-Numbers
5. Classification
6. Stratification
7. Single Transactions
8. Isolated Outliers
1. Check Missing:
Here we basically try to identify the gaps in any workflow that has
serial control mechanism. For example, missing cheques
numbers, insurance policies numbers, and bank fixed deposit
receipts, good received notes, cash receipt numbers, etc.
Depending upon the availability of data viz-a-viz audit objectives,
an appropriate data attribute (data field) may be selected to run
this check. Missing gaps can be filtered for auditees
explanations.
Example:
In one of the Company there were a few missing cheque numbers
that could not be physically traced. Nor were proper explanations
available whether they were factually cancelled or missing. Later
it was revealed that the accountant had pilfered them and in fact
one of the adjacent cheque number was surreptitiously encased
too. In another case, a missing Bank Guarantee document was
misused to help an accomplice qualify for eligibility criteria in a
Government Tender.
Following are some of the examples of areas where controls are
exercise through serial sequence mechanism
Control Documentation : GRNs, Cash Receipts, Cheque
Nos., Gate pass, DCs, Pack-List, Invoice, Coupons, Tickets,
Sale Orders, Agreement Numbers, PO/WO, Trade Nos. -
stock markets, contracts_nos, etc.
Products: Machine-Sr-Nos, FA Tags, Inventory Nos, Token_

No(banks),Vehicle, Book_No (Library), CD-Nos (TVSerials),
patent_nos , batch_nos, etc.
Humans : employee_Ids, membership, Roll-Nos, loyalty prg.,
patient no, passenger PNRs, Mines, Jail_nos., etc.
Certification: passing certificates, ban guarantee certificates,
FDs, Share certificates, Insurance policies, licenses, etc.
Animals : livestock, insured animals, etc.
2. Check Duplicates :
This is converse of Check-Missings--- the serial control numbers
which ought not to be repeated are checked for duplicates. Thus
all the documents (that have serial control), mentioned in the
above paragraph can be checked for replication. Duplicated
numbers could throw up serious gaps in the sourcing of these
documents or in case they have been generated using some
computerized system could mean a software bug. All such
duplicated numbers need thorough detailed review to dispel any
wrong doing.
Here auditor can also check duplication of clustered-fields. That
is, say a cluster of vendor code + bill number can be checked for
duplication, presence of which could indicate excess/double
payments to same vendor. This is sometimes referred to as
Same-Same-Different check.
3. Round Numbers :
Basically there is nothing wrong with Round numbers and it is not
unusual to see many round number transactions in any
commercial deals. However, sometimes round numbers are
symptomatic of mysterious deals. Therefore the auditor should
use some judgement to eliminate possible round number cases.
For example, it is quite natural to generally spot round number
transactions in monthly rentals, professional fees, audit
remuneration, etc. - these transactions could be filtered out from
the list of transactions with round numbers.
Example:
Daily Times was a reputed newspaper publishing company that

was publishing an eveninger-tabloid. Several round numbers
payments were noticed to M/s. ABC Ltd., a news sprint supplier.
ABC had been dealing with Daily Times for last 3 years and ever
since payments to the vendors was always in round numbers. A
detailed review and visit to ABC, revealed that there were several
gaps in accounting of both the entities. Just to keep these gaps
under the carpet, on account payments in round numbers were
affected to the vendor. Daily Times would adjust the bills per its
own accounting system and ABC would follow theirs.
Investigations exposed large unaccounted transactions of unsold
newspapers returned back (for recycling).
4. Repetitive Odd-Numbers
This is converse of Round-numbers. Unlike the round numbers,
repetition of odd numbers (particularly repetitions at decimals
levels) are very rare coincident. Unless of course there is
apparent reasons say, like for Telco having promotional offer of
Rs 199/- prepaid packs - but in that case, the repetitions will be by
volumes and not a few stray incidences here and there. Repeated
oddnumber transactions can be filtered for detailed verification
and most often these will throw up some irregularities.
Example:
In one MIS report of a public company running a restaurant
business, the tobacco sale of Rs. 10,89,233/- was repeated
consequently for the month of June and July. This was too much
of coincident to catch the attention of the independent director
who was otherwise a reputed investigator in his professional life.
A few probing questions during the audit committee meeting
revealed that the Manager was faking the MIS numbers and the
amount was result of sloppy use of the spreadsheets copy-paste
command. The Manager had been manipulating MIS reports for
quite some time and over the period casual complacent attitude
had set-in. A detailed investigation launched subsequently
exposed other mismanagement.
Repetitive checks can be performed on a given sub-set or across

the entire set of population. For example, say in case of database
of purchase records -- this check can be applied separately for
each vendor or across all the vendors.
5. Classification
Classification is a process of arranging data into homogenous
group or classes according to some common characteristics
present in the data. This analysis aid the Auditor in getting a birds
eye view to see a panoramic whole of how the data is dispersed
or where the concentration lies. Classification can be combined
with other appropriate CAATT checks to enable more penetrative
tests.
Sr Party_Code Count Sum_Amount %Count %Amt
1 A-0001 3 7,375 0.09% 0.06%
2 A-0002 4 3,548 0.12% 0.03%
3 A-0003 107 46,430 3.26% 0.40%
4 A-0004 68 8,756 2.07% 0.07%
5 A-0005 1 188 0.03% 0.00%
321 Y-0006 1 17,329 0.03% 0.15%
322 Y-0007 1 2,696 0.03% 0.02%
323 Y-0008 1 447 0.03% 0.00%
324 Y-0009 3 26,989 0.09% 0.23%
325 Z-0001 21 5,940 0.64% 0.05%
326 Z-0002 13 9,496 0.40% 0.08%
327 Z-0003 2 165 0.06% 0.00%
328 Z-0004 1 56 0.03% 0.00%
Total Vendors 3283 1,16,83,516 100.00% 100.00%

=328
Classification could be done on various attributes (field) of data.

For example, classify the data vendor-wise, salesman/agent wise,
account wise, period wise, day-timing wise, etc. A typical
classification of Purchase Data can be done to get following result

he above list running into several pages can be further filtered for
say %Count<1%and %Count >0.5% to get a very small sample
size as follows :
Sr Party_Code Count Sum_Amount %Count %Amt
16 A-0016 20 4,26,636 0.61% 3.65%
23 A-0023 13 15,94,532 0.40% 13.65%
34 A-0034 28 88,301 0.85% 0.76%
73 A-0073 3 99,358 0.09% 0.85%
96 A-0096 7 61,264 0.21% 0.52%
145 D-0002 14 1,66,954 0.43% 1.43%
149 D-0006 7 1,36,835 0.21% 1.17%
155 E-0006 7 2,30,400 0.21% 1.97%
179 I-0001 4 1,47,862 0.12% 1.27%
185 I-0007 10 68,497 0.30% 0.59%
207 L-0001 8 3,41,660 0.24% 2.92%
227 M-0019 4 5,09,856 0.12% 4.36%
238 N-0004 6 67,089 0.18% 0.57%
257 P-0009 1 1,07,361 0.03% 0.92%
260 P-0012 1 59,967 0.03% 0.51%
290 T-0004 12 3,02,458 0.37% 2.59%
301 T-0015 28 4,27,933 0.85% 3.66%
306 U-0003 1 1,52,343 0.03% 1.30%
Total 174 49,89,306 5.30% 42.70%

Vendors
= 18
As can be seen above, the sample size has generated just 18
vendors accounts covering 5% in terms of volume and 42% in
terms of value.
6. Stratification
Stratification is a derivative of classification which involves
grouping of large data into strata. Strata means levels, bands or
groups. Thus it involves dividing or rearranging the data within the
Strata and then overviewing it to decipher the latent configuration
of the database.
For example the purchase data of the above example can be
stratified into various bands of bill values to obtain following
results :
Strata Bill Counts Bill
Value
Bill_Val_ Bill_Val_To Count Count% Cumm% Sum_Bill_Val % Cumm%

From
- 10,000 3081 93.85% 100.00% 34,49,671.74 30% 100%
10,001 20,000 77 2.35% 6.15% 11,14,929.05 10% 70%
20,001 30,000 45 1.37% 3.81% 11,35,250.64 10% 61%
30,001 40,000 37 1.13% 2.44% 13,47,267.34 12% 51%
40,001 50,000 13 0.40% 1.31% 6,01,560.32 5% 40%
50,001 1,00,000 14 0.43% 0.91% 9,17,721.94 8% 35%
1,00,001 1,50,000 7 0.21% 0.49% 8,68,979.09 7% 27%
1,50,001 3,00,000 7 0.21% 0.27% 14,40,783.65 12% 19%
3,00,001 4,00,000 1 0.03% 0.06% 3,19,000.00 3% 7%
4,00,001 5,00,000 1 0.03% 0.03% 4,88,352.19 4% 4%
3283 1,16,83,515.95
As can be seen, a sample size can be easily determined from

above to mark bill values over Rs 50,000/- (depicted by dotted
line in table above). This translates into a 0.91% in volume terms
and 35% in value terms.
Strata can be quantities, insurance-policy holder-age wise,
debtors ageing analysis, etc..
7. Single Transaction
This is self explanatory and may need little explanation. As the

name suggests, this check basically filters all the single
transactions in a database. These single records could be
bonafide cases or just a stray transaction inserted by opportunist
beneficiary. Generally vendor account, employee account,
customer account, etc. should have multiple transactions since
everyone wants regular business. Solitary transaction could be
vouchsafe to exonerate sketchiness if any.
Example :
In a database of a medical distribution arm of a pharmaceutical
company (Pharmaco), it was noticed that there were many stray
records of doctors who were reimbursed train fares as part of
promotional scheme. The promotional offer was to incentivize the
doctors by allowing them tourism along with their family. The
Pharmaco regularly had these schemes -- at lower end it was
distribution of some token, gifts, etc. whereas at higher end senior
doctors were allowed foreign travels, costly medical equipments,
etc. The database analysis of doctor-wise expense of last 3-
4years revealed these stray instances. While the individual
vouchers did not throw up any irregularities, collectively all these
single instances had a pattern of suspicious behavior. These
vouchers were otherwise vouchedsafe with proper supportings
(original train tickets), managers approvals, names and
particulars of the doctors, etc. However, collectively viewed the
skepticism was obvious; train tickets of many beneficiaries
pertained to journeys for same day with same coach numbers -
this breached the test of impossibility. ield verification exposed
fake names and addresses of many of these doctors, however the
tickets appeared genuine. On detailed investigation, it as revealed
that the accomplice would collect all the tickets from the Railway-
ticket-checker by tipping him a good amount. Suitable tickets
(family/groups) were later attached as supportings and monies
siphoned off on regular basis. The fraud was perpetrated into
small amounts on regular basis aggregating to large amount
eventually. Clearly there were many single instances of genuine
cases also but that actually facilitated in camouflaging the fraud.
8. Isolated Outliers
An Isolated outlier is an observation in a data set which is far
extreme in value from the others in the data set. It is an unusually
large or an unusually small value compared to the others. Any
database will be vitiated by incongruent records or contaminated
transactions which will stick out as outliers. That happens
because of its inherent nature that impedes its blending with the
others in the group and will be clearly isolated with the
remainders.
A word of caution -- there could outliers that would creep in any
database as deviations which happens in normal course and may
not always mean a fraud or an error. However, as an auditor s/he
will be concerned about these outliers and should review these
transactions as part of audit plan.
There are various ways to spot the Isolated Outliers as discussed
below.
Simple Charting Options : Using a popular spreadsheets, it is
not difficult to plot a chart of the entire database as shown
below. The database contains 3,283 records of 328 vendors.
The vendor codes are plotted against the x-axis and the
amount against the y-axis.
A simple visual review of the chart can enable the auditor to

immediately spot the isolated outliers. The above chart is
reproduced below with the dotted outline :
Thus all the transactions above Rs 1,00,000/- are isolated

outliers. Relative Size Factor :
RSF is the ratio of Largest Number to the Second Largest
Number of a relevant set.
RSF = Largest Number
Second Largest Number
For example, if we have following bank payment vouchers of
Vendor XYZ
Voucher No. Rs.
SB-211 50,000
SB-642 5,00,000
SB-547 5,00,000
SB-1864 20,000
SB-4755 23,000
SB-8347 8,500
The Largest value in above table = Rs 5,00,000/- and the second
largest value = Rs 50,000/-. Therefore the RSF in this case = 10
that is Rs 5,00,000 Lacs divided by Rs. 50,000/-. Per RSF theory
generally any transactions where RSF > 10 are the cases of
isolated outliers.
Relevance ofRSF:
Scrutiny of individual parties account is humanly ineffective and
now with most of the data available digitally how does one
scrutinize the ledgers? RSF theory comes in very handy here,
instantly one can calculate RSF and take sample for verification.
This tool finds focus and meaning to the scrutiny. It highlights all
unusual fluctuations which may be stemming from frauds or
errors.
Application of RSF theory in audit

Any set of transactions generally take place in certain range
or limits. Thus there is a certain pattern of financial limits
peculiar to each vendor, customer, employee, etc. These
limits may not be defined, but the data can be analyzed to
view a pattern. RSF captures this pattern as ratio.
For example in case of vendor X the normal invoicing range,
say is Rs. 20k to 50k per bill. If there is any stray instance of
single transaction which is way beyond the normal range than
that ought to be looked into. That is, in the instant case, if
there is bill of Rs. 5 lacs than it naturally concerns the auditor
to have a look at.
RSF is above case will give a ratio of 10. That is. ratio of
Rs. 5lacs (largest value) to Rs. 0.50 lacs (second largest value)
This single instance could be case where there is some foul
play or error in punching of the data (due to additional zero at
the end).
Case study on use of RSF

ICE, a large multinational white goods company had set up
operations in India in the year 2000 by acquiring a small local
manufacturing company and expanded its operations
countrywide. The investigators were called in the year 2003 /
2004 pursuant to allegations contained in an anonymous letter
against the Plant Manager. Initial engagement discussion
revealed that the ICEs outflows mainly comprised of labor
payments, power, Capex, raw materials, job-works, R&M, etc.
The investigator first ran a check of RSF on the vendor data and
got the following parties where the RSF exceeded 10.
Vendor Max_Val 2nd Max_ RSF >
Val 10
WAP Systems LLC 25,748,906 2,059,912 12.50
Indergoll Rand Ltd 206,788,550 13,586,007 15.22
Difel Inc. 96,574,432 3,094,148 31.21
Ajmera Constructions 45,659,440 1,551,753 29.42
A-Technologies Ltd 13,478,523 705,870 19.09

A drill-down on the voucher level details of the above vendors
revealed following information
Name Doc Ref Date Rs. Particulars No.
Of Cases
WAP Sys 17089343 31-Mar-01 25,748,906 WAP -ERP 14 Capitalised

System
WAP Sys 18088874 06-May-02 WAP-system-AMC 14 for 2 years

2,059,912
Indergoll 17089352 31-Mar-01 SW, PS, Asly-line 22 Capitalised

206,788,550
Indergoll 17089353 31-Mar-01 P&M Erection and 22 Comm.Chgs

13,586,007
Difel 17089355 31-Mar-01 Foaming System 16 Capitalised

96,574,432
Difel 18089983 05-Jun-01 3,094,148 Foaming cryst 16 capitalised

s/w
Ajmera 17069323 15-Jan-01 45,659,440 FacBldg., Admn
Ajmera 17070222 02-Feb-01 1,551,753 Wing, Stores, FGStore

Interiors-Office, 18
Mng.,Conf.,Canteen
A-Techn 37852344 25-Mar-03 13,478,523 Mould qty1 - 4,586 4011 Stellar

SKE
A-Techn 18088874 21-Jan-03 705,870 Mould Job wrk 4,586 HDL-5004 - 15000
nos.
Considering the information obtained, the RSF of M/s. WAP,

Indergoll, Difel, Ajmera were explainable since they had basically
supplied capital items which was one time large cost and
subsequent bills would be for supply of services/ spares etc. and
hence the cost would be much lower. However, A-Tech was a job
worker and had issued over 4,500 bills. So the pattern of his
general transactions were in range of 50,000 to 7,00,000/-, thus

the off-beat transaction of Rs 1.34 Crores needed a review.
The investigator made inquiries of the transaction for Rs. 1.34 Cr
and learnt that it was towards the cost of mould purchased from
A-Tech. General review of accounting documents and supporting
showed everything to be in order. He was explained that generally
moulds are procured from another vendor but this one was
purchased since ATech was L1. The investigator reviewed the
quotes received, bid comparison, etc and noted that indeed A-
tech was lowest. He also noted that the next bid value was about
Rs 3 Crs that is more than double then the quote of A-Tech. This
raised a red-flag that how was A-Tech able to supply the same
mould in less than half of its competitor. He decided to inspect the
asset. To cut the long story short, when he investigated into the
procurement, it was found that the mould actually belonged to the
ICE only which was not in use and had been discarded by the
previous management of ICE and later sold as scrap to A-tech.
The plant manager in connivance with the A-tech created the
need for a mould which was little bit modified and put to use. The
mould was however sold back to the company at much higher
profit.
How to calculate RSF in MS Excel

Given data of about 1000 records extracted from Account payable
system. The data consists of foll. relevant fields.
Voucher No.
Voucher Date
Vendor Name
Bill Amount
Bill Number
The objective is to find out the RSF for each vendor in
following format
Vendor Max_Val 2nd Max_Val RSF
Col _A Col_B Col_C Col_D
Summarised Steps
Step 1 : Extract the maximum value for each vendor and store in
a column of the work sheet - say col. B
Step 2 : Extract the second maximum value for each vendor and
store in another column say col. C
Step 3 : Divide Col. B by C to get RSF Ratio and store result in
Col. D
Step 4 :Filter Col. D for results where RSF is more than say 10.
Step 5 : Filter records from Database for the above results as
audit sample. Detailed Steps
Step 1 : To obtain the largest or maximum value from the data
Use Pivot Table Function to classify the bill-amount field of
data.
The classification criteria will be vendor name
Classification of Bill amount field will be for Max. Value
Step 2 : To obtain the 2nd maximum value from the data
To obtain the 2nd max value, it will be necessary to nullify the
max. values obtained in Step 1 above. This can be done as
follows.
Extract results obtain from the first step to append to the data
with the maximum value for the each respective vendor. This
can be done by using Vlookup Function.
Formula = Vlookup(CriteriaCellRef, DataSource, Offset)
Nullify the effect of the bill amount if the respective bill value
is equal to the Max. value. Using the If function.
Formula = If(BillValueCellRef = MaxValueCellRef, 0,
BillValueCellRef.)
[The above formula will add to the existing database, a field with
bill amount which is not a MAX.Value.]
Repeat The First Step again to obtain the max value from the
field created above. The max value now will be actually the
2nd Max. value.
Step 3 : Divide the Max Value with 2nd max Value

This is a simple divide function Formula = MaxValueCellRef
2nd MaxValueCellRef
The result obtained is RSF
Step 4 : Filter the RSF col. to extract where RSF is more than say
10
This can be done using the Auto Filter Command of excel
sheet by customizing the limits.
The result obtained are data where RSF is more than 10.
Step 5 : Filter records from Database for the above results.
This is same as filter command used in Step 4, except that
now the filter is set on the main database.
This data is records where the max value of bills exceeded
the 2nd max value over five times.
Benfords Law
This is revolutionary theorem profounded by Dr. Frank
Benford, as American Electrical Engineer and Physicists.
Benfords Law is also popularly known as the first digit law. The
law is about statistical statement regarding occurrence of
numerical digits. Dr. Benford observed that in any large database
generated through a ordinary process, the natural numbers
(numbers which are not limited by boundaries or non-serial nos.)
follow a count of its first-left-most digit which is not in consonance
with the law of probability. He asserted that the first-leftmost-digit
(e.g it is 1 in a number 1,23,456.78) follows a pattern of
appearance where the lower numbers have more chance of
appearing as compared to the higher numbers. According to him
the appearance of first left most digit has the following frequency.
Digit 1 2 3 4 5 6 7 8 9
3 0 . 1 1 7 . 6 1 2 . 5 9.7 % 7.9% 6.7% 5.8% 5.1% 4.6%

% % %
Thus numbers deviating from the above principle would be
transactions that could are isolated outliers.
Please refer to chapter 7 for detail discussion on Benfords Law.
Overview and Conclusion
All that has been covered hitherto in this course material has been
brilliantly postulated as the thirteen principles of fraud auditing by
G Jack and Bologna and Robert J Lindquist, in their book on
Fraud Auditing and Forensic Accounting, new tools and
techniques, second edition, page as follows:
1. Fraud auditing is unlike financial auditing. It is more a
mindset than a methodology.
2. Fraud auditors are unlike financial auditors. Fraud auditors
focus on exceptions, oddities, accounting irregularities, and
patterns of conduct, not on errors and omissions.
3. Fraud auditing is learned primarily from experience, not from
audit textbooks or last years working papers. Learning to be
a fraud auditor means learning to think like a thief - Where
are the weakest links in this chain of internal controls? 4.
From an audit perspective, fraud is intentionally
misrepresenting financial facts of a material nature. From a
fraud-audit perspective, fraud is an intentional
misrepresentation of financial facts.
5. Frauds are committed for economic, egocentric, ideological
and psychotic reasons. Of the four, the economic motive is
the most common.
6. Fraud tends to encompass a theory structured around
motive, opportunity andbenefit.
7. Fraud in a computerised accounting environment can be
committed at any state
of processing-input, throughput or output. Input frauds (entering
false and fraudulent data) are the most common.
8. The most common fraudulent schemes by lower-level
employees involve disbursements (payables, payroll, and
benefit and expense claims).
9. The most common fraudulent schemes by higher-level

managers involve profit smoothing (deferring expenses,
booking sales too early, over-stating inventory).
126
Overview andConclusion
10. Accounting type frauds are caused more often by absence
of controls than by loose controls.
11. Fraud incidents are not growing exponentially, but fraud
losses are.
12. Accounting frauds are discovered more often by accident
than by financial audit purposes or design. Over 90 percent
of financial frauds are discovered by accident.
13. Fraud prevention is a matter of adequate controls and a
work environment that places a high value on personal
honesty and fair dealing
Thus any assignment relating to fraud detection should be
conducted so as to include:
Identification of Financial Issues: When examiners are
presented with a situation
generated by a complaint, allegation, rumor, inquiry or
statement of claim, it is important that they clearly identify the
financial issues relating to the matter quickly.
Knowledge and application of Investigative Techniques:
When the issues have
been identified, it is imperative that further information and
documentation be acquired in order to obtain further
evidence to assist in either supporting or refuting the
allegation or claim.
Knowledge of Evidence: The examiners must understand
what constitutes
evidence, the degree of reliability, relevance, sufficiency and
completeness to ensure that the truth is unassailable from all
sides.
Interpretation of Financial Information: As a chartered
accountant in any case
this is his expertise. He can ensure that there is a fair and
equitable evaluation in the interpretation process.
Presentation of Findings: The examiner must have the ability
to clearly communicate the findings resulting from the
investigation in a fashion understandable to a layperson as
well.
APPENDICES 127
Exhibits and Appendices with extracts of reports, photographs etc
will be provided.
APPENDICES
APPENDIX A:
The probability of fraud, theft or embezzlement in any work
environment is a product of the personality of the executive and
employees, the working conditions, the controls and the level of
honesty therein
Internal Factors that reduce the probability of fraud, theft and
embezzlement include:
I. Prevention measures
A. Internal accounting controls
1. Separation of duties
2. Rotation of duties
3. Periodic internal audits and surprise inspections
4. Development and documentation of
policies,
procedures, systems, programmes and programme
modifications
B. Computer access control
1. Identification defences
2. Authentication defences
3. Establishment of authorisation by levels of
security
II. Detection measures
A. Logging of exceptions
1. Out of sequence, out of priority and aborted runs and
entries
2. Transactions that are too high, too low, too many, too
unusual (odd times, odd places, odd people)
3. Attempted access beyond authorisation level
4. Repeated improper attempts to gain access (wrong
identification, wrong password)
B. Variance reporting
1. Monitoring operational performance levels for
APPENDICES 129
a) Variations from plans and standards
b) D eviations from accepted or mandated
policies, procedures and practices
c) Deviations from past quantitative relationships,
for
example, industry trends, past performance levels,
normal profit and loss (P&L) and balance sheet ratios
C. Intelligence gathering
Monitoring employee attitudes, values, and job satisfaction
levels
Soliciting feed back from customers, vendors and suppliers for
evidence of employee dissatisfaction, inefficiency,
inconsistency of policies,corruption or dishonesty
APPENDIX B
Internal factors that enhance the probability of fraud, theft and
embezzlement include:
Inadequate rewards
Pay, fringe benefits, recognition, job security, job
responsibilities
II. Inadequate management controls
A. Failure to articulate and communicate minimum
standards of performance and personal conduct
B. Ambiguity in job rules, duties, responsibilities and
areas of accountability
III. Lack of inadequate reinforcement and performance
feedback mechanisms
A. Failure to counsel and take administrative action when
performance levels or personal behaviour falls below
acceptable standards
IV. Inadequate support
A. Lack of adequate resources to meet mandated
standards
V. Inadequate operational reviews
A. Lack of timely or periodic audits, inspections, and
followthrough to ensure compliance with company
goals, priorities, policies, procedures and
governmental regulations
VI. Lax enforcement of disciplinary rules
A. Ambiguous corporate social values and ethical norms
VII. Fostering hostility
A. P romoting or permitting destructive interpersonal or
interdepartmental competitiveness
VIII. Other motivational issues
A. Inadequate orientation and training on legal, ethical
and security issues.
B. Inadequate company policies with respect to
sanctions for legal, ethical and security breaches
C. Failure to monitor and enforce policies on honesty,
loyalty and fairness
D. General job-related stress or anxiety.
APPENDIX C
A SAMPLE REPORT ON AN INVESTIGATION INTO
ALLEGATIONS OF MISMANAGEMENT BY A WORKS
MANAGER INVOLVING VENDOR CORRUPTION AND
MANIPULATION OF FUNDS.
Executive Summary:
1. Objective:
The objective of the investigation was to determine whether the
allegations made against Mr. xxxx in the various letters
addressed to the company were true or false and, whether we
could collect evidence which would support our findings. The
letters containing allegations that were brought to our notice had
the following allegations:
1. Bribery and corruption allegations made by Abhay
Construction in 1998 in writing
2. Inflation of costs in warehouse construction project
APPENDICES 131
3. Close nexus between the subject and certain vendors
apparent on account of favours in rates, business volumes,
and payments
4. Suppression of income from gate sales
5. Close ties and arrangements with the canteen contractor/bus
contractor
6. Surreptitious payments to union leaders
7. Inflated Horticulture expenses
2. Conclusion and Findings:
Several allegations against the subject appear to have merit.
In order to be fair to the accused the report divides all these
allegations into the following four categories:
Those which are supported by direct evidence
Those which are supported by inference or circumstantial
evidence
Those which are supported by verbal submissions
Those which are not supported
2.1 Those which are supported by direct evidence:
2.1.1. Bribery and corruption allegations made by Abhay
Construction in 1998 in writing. A detailed statement from the
vendor has been obtained which explains the modus operandi of
vendor appointments. The procedure required paying a bribe to
Mr xxxx, , at a specified hotel at a pre determined date and time
where the purchase order would be handed over. There was
similar price payable for getting the cheque later for the material
supplied. The vendor was continuously harassed. With the help
of the vendor a sting operation was set up where in the junior
officer was seen taking a bribe on 12 September 2001 at Marina
Hotel, Trscal room, at 4.15 pm and handing over a cheque of Rs
4,54,000 to Pradeep Construction.. A video recording and an
audio recording is available with us. A confession in writing from
Mr xxxx has been furnished, copy of which is annexed in Docket
A.
2.1.2 Inflated costs in waterproofing of warehouse etc. through
PCC Co and Inns (same owner Mr. Bhatti). We have
documentary evidence of inflated measurements stated in a bill
from Inns. This has been referred to in one of the objection
memos of the site engineer, Mr. R K Y. Significantly, this
measurement sheet (series 4211), was not available at the
factory. We have obtained this document from inquiries and
investigation made on our own. The measurement sheet proves
that there was indeed inflation in the measurement from 5574 sq.
metres to 7100 square metres and thereby an excess payment
was made.
Those which are strongly supported by circumstantial evidence
Unhealthy practices of corruption with other vendors.
The fact that there was this series 4211 of a measurement sheet,
implies that there could be other measurement sheets as well.
Other projects regarding boundary wall construction,
administration building would all have similar measurement
sheets. Therefore the other measurement sheets must be either
destroyed, missing or concealed. Unfortunately we could lay our
hands only on the one relating to INNs. The allegation is further
supported by other circumstantial evidence which infers that Mr
xxx had close links with several other vendors.
1. Poor credentials of the vendors to whom various job were
entrusted,
2. Revealing photographs of the office at the address stated on
the bills. This party ABC is supposed to have cranes,
equipment and a 3000 square feet office to whom business
worth Rs 2.3 crores has been given in 2000-2001 for
construction and crane hire charges. It is obvious that the
place has een unused for a long time. There is no name plate,
nor even a single office attendant, nor a post box nor any
evidence to indicate that a construction company ever existed
there. Neighbouring residents, (for which audio recordings are
available) also did not know of such a company and have
informed us that the office was locked for the past few years.
3. Further circumstantial evidence is in the form of 13 unsigned
bills paid by the plant, existence of a bill on a different
letterhead from the same party.
APPENDICES 133
4. Advance payments digressing from conventional practice of
paying only 20 % upfront.
All these facts collectively infer that these parties were either
dummy parties providing just a front for billing purposes and the
actual work was done by some one else. The fact that these
parties are fictitious is established and all these parties entered
the company only during the tenure of Mr xxxx. Since all powers
of introducing and approving rested with him and since there is
other direct evidence also against him, these circumstantial
factors seem to provide additional evidence against him in
support of allegations relating to unhealthy links with vendors.
2.2.1. Close nexus between the subject and certain job
workers viz. Alkali Thermoformers Limited (ATL) and Evergreen
Moulders Limited (EML) by way of favours in rates, business
volumes, and payments. (Dockets C and D). In particular we
wish to draw attention to:
Credit of Rs 50 lacs to EML for almost two years for sale of
scrap.
Mould repairs of Rs.4.7 lacs which seem to be unreasonable
and credited to EML almost four years later under dubious
circumstances.
Unexplained methodology of costing of components
processed by EML and ATL, the impact of which may be
detrimental to the company substantially. We also
understand, from verbal submissions, that customized cost
sheets were provided for our audit; and that the original cost
sheets were possibly quite different. Since a response has not
been received to our queries relating to these costs, the onus
of proving the truth and fairness of these customized costs
lies with the subject. Colour cost element in the cost sheet is
worked out in a manner apparently favorable to the party.
The additional burden to EKL on account of this cost
computation, if our contention is correct, could run into lacs of
rupees.
2.2.2. Close nexus between the subject and the new
architect, M/s Artec (Docket A regarding Premier.)
2.2.3. Favouring M/s Om Construction Ltd. for the warehouse
construction Rs 210 lacs in the bidding and selection
process
(Docket E)
2.2.4. Financial leakage through inflated or double payments,
cheque manipulations and other accounting manipulations
(Docket F)
2.2.5. Loose monitoring of scrap sales by permitting
dispatch of material without insisting upon timely or
advance payments, depositing cheques late etc.
2.3 Those allegations which are supported by verbal
submissions
2.3.1 Gate Sales : Misuse of companys policies of selling B
grade refrigerators to employees, and free sales to statutory
authorities
2.3.2 Autocratic method of dealing with people and
employees. Abuse of authority and power.
2.4 Those allegations which have not been examined, or, for
which there is no documentary evidence
2.4.1. Close ties and arrangements with the canteen
contractor/ bus contractor
2.4.2. Unfair suspension of workers and termination of
employment of certain workers on alleged charges
2.4.3. Payments to union leaders
2.4.4. Horticulture expenses
3. Other issues affecting allegations:
This report also furnishes other findings, which may support the
allegations indirectly, and which in our opinion cannot be
altogether overlooked by the company.
4. Significant data missing.
Missing records are to be expected in every organisation, but
some of the records that are missing here are significant in the
light of the allegations against the subject.
4.1 The subjects own personal (HR) file. Possibly, there
could be some evidence of relationships with any of the
APPENDICES 135
vendors or some reference from the earlier employers
or some other information which might be adverse to
him in the current scenario when an inquiry is in
progress. Ordinarily, a missing record can be replicated
or information can be provided from alternative
sources. However the subject has made no effort
inspite of requests from us, the HR head and perhaps
other senior executives in the company as well.
Similarly, details of telephone bills only of the subject
were missing.
4.2 Mr. R K Yadavs personal (HR) file. Significant because
the site engineers objection memos feature in the
allegation letters. All his objections had been overruled
and huge payments had been cleared to tainted
vendors such as Premier Construction, and
Innovations. He was dismissed on being accused of
having accepted a bribe. Strangely, his resignation
letter that admits accepting a bribe, has been
preserved, but his entire H R file is missing.
4.3 Mr. R K Yadavs boss, Anil Apurvas resignation letter
is missing but his file is available. This is astonishing
because we understand from Anik Raja that three
copies had been given and all three copies are
missing. Strangely, the subject has preserved certain
letters of Anik Raja complaining to the management
about Mr. R K Yadavs inefficiency. (Anik Raja has
since admitted to us that those letters were given under
pressure from the subject). It is possible that some bills
may have been passed after Anil Apurvas departure,
using his approval, and therefore the resignation letters
have been removed.
4.4 Documents and vouchers which are missing are
related to some kind of financial damage to the
company:
4.4.1 Credits given to EML
In April 2001, for Rs 10.68 lacs relating
to missing vouchers of
FY 1996-97
O riginal debit notes are missing for
credit worth Rs. 4.70 lacs given for
mould repairs. Therefore if they have
also been paid some separately in some
other financial year, to EML, we do not
know.
4.4.2 Write offs of non moving suppliers and
creditors running well over Rs.66 lacs in the
past three years, are not supported
by notes, correspondence or any other documentary trail
to satisfy us that these were genuine and essential
4.4.3 A large number of vouchers and
documents (which are photocopies, where
the original documents are missing) gives
us considerable discomfort.
5. Relatives and other employees who have a close
relationship with the subject.
The report also furnishes a list of other close employees who are
suspect and need to be relocated or kept under close scrutiny.
The subject has also manned his relatives in important
departments such as quality assurance. The relatives have not
disclosed their relationship in the application form for employment
with the company. Even these employees need to be similarly
kept under scrutiny or relocated. [As per information available
with us, Mr. Pajeet Gupta is Mr. xxxxs nephew (son of his wifes
sister Kamla , whose house we visited). The application form
submitted by Rajeev Gupta does not disclose his relationship
with Mr. xxxx even though it is so required to be disclosed.
Moreover the increment letter issued by Mr. xxxxalso proves that
he was aware of Rajeevs appointment and he should have
disclosed this. We have been told that there are 3 other relatives,
(1) kailash Gupta, (2) Ram Vilas Gupta and (3) Mohian Goel]
6. Constraints:
The investigation was to be done under the guise of internal audit
covertly. Therefore we had to depend upon the documents,
APPENDICES 137
papers, details and information given to us. Possibilities of
suppression, concealment, destruction or removal of data and
other evidence are quite high. We have also noted missing files,
papers, records, documents which are significant. Lastly, the
subject was given an opportunity to respond to our queries,
doubts and observations based on the allegations made and
appropriate checks applied by us. Sufficient time has been given
to him to respond to them and the importance of giving a
response has been emphatically communicated by the CEO of
the company as well.
The fact that we have not received a response is itself a
major form of evidence as to the possible truth of various
allegations against him.
APPENDIX D
MODEL DOCKET PREPARED FOR A CONFRONTATION
INTERVIEW
CDIMS
MR.X, DRILLING SUPERINTENDENT
Contents
1. Employee Details
2. Role And Relevance In The Current Investigation
3. Objectives Of The Interview
4. Act(S) Of Default / Non-Compliance(S)
5. Interview Level - 1 (Collection Of Information)
6. Interview Level - 2 (Confrontation Of Evidence)
Exhibits
1. EMPLOYEE DETAILS
Docket No. 01 (One)
Name of The Employee Mr. X
Employee Code (If Any) A-1254
Located At Vishakhapatnam
Designation Drilling Superintendent
Reporting To Mr. A
Reported By Mr.Y (Drilling Op. Advisor)
Date Of Joining 12.05.84
No. Of Years In Service 17
Level(S) Of Authority
APPENDICES 139
2. ROLE & RELEVANCE IN THE CURRENT

INVESTIGATION:
Mr.X alongwith Mr.W / Mr.A (rotating pair) were looking after the
drilling operations and as such, were concerned with the offshore
activities. They were co-ordinators between the Drilling
department, Materials and the Vizag Shore base for offshore
requirements.
This employee has approved certain invoices raised by some of
the suspected parties, on the basis of which payments were
released. Since his work involves direct verification of the
services rendered by the contractors and dealing with the shore
base employees, he plays an important role to reveal the actual
facts of the various situations.
He has been identified by Mr. M, the current Shore base manager
to be one of the group of three (Mr.W, Mr.P and Mr.A) who took
all dubious decisions on vendor dealings, to such an extent that
Mr.C once sent an email asking Mr.A to be removed from Vizag
Shore Base!
In the opinion of Mr.J, since the requirements were not planned
well in advance and the scope of work was not properly pre-
defined there were so called rush situations at Vizag Shore
Base. In the process, vendors saw an opportunity in such chaotic
situations and could have taken advantage of the same whereby
premium payments could have been effected.
Other pertinent facts relating to Vizag Shore Base in the

earlier days
Mr.S had initially made some rough sketch plan of the Vizag
Shore Base facility. However, later it was decided that the other
service providing agencies (like Weather Services, MJ Services,
Maurya Offshore, etc.) were also required to be accommodated
at the Vizag Shore Base facility. Thus it was a situation where on
one side the materials had started pouring in and on the other
side it was a onset of monsoon, besides sharing of the port
premises with those stated agencies. This exploded the situation
whereby the conditions went out of control.
Under the circumstances, it was not possible for the Shore base
manager / Materials department to procure the material after
following proper bidding procedure. Jobs were always carried out
on an urgent basis with uncertain scope of work and there was a
constant change in plan of action. Thus, purchase orders were
issued subsequent to the work for regularizing the bill payment.
APPENDICES 141
3. OBJECTIVE(s) FOR INTERVIEWING:

To obtain confirmation / clarification on information furnished
by Mr. P and Mr. D.
To determine vendor relations with M/s ABC s employees.
To ascertain whether the jobs executed by the vendors (viz.
Vijay Construction Co., Sanju Engineering Services and N F
Patil) were of good quality.
To clarify important issues regarding agreements, selection
of vendors, empanelment and major purchase and bill
payment procedure.
To disclose more facts about operations right from the early
days.
To ascertain whether any further evidence or reasons exist to
indicate involvement of Mr. P, Mr. R, Mr.A, Mr.D and/or Mr.T
4. ACT(s) OF DEFAULT / NON-COMPLIANCE(s):
The said employee has signed in the slot for Approvals
Signature in few of the bills pertaining to the 6 suspected parties
which, as mentioned above were either dubious or contained
various discrepancies.
5. QUESTIONNAIRE: Interview Level 1: Information
Collection, (if required)
A. GENERAL INFORMATION :
QUESTION Y/N REMARK
1. Recruitment and background

D id you know someone or did you approach the
Company through advertisement or otherwise?
Since how long have you been with the company?
2. Work Experience
D id you have any previous work experience for the
post applied? If yes, where.
D o you have a job profile and a job description

drafted by the Company? If so, please furnish
W hom did you first report to and whom do you report

to now?
W ere you recruited as Drilling Superintendent and

continued to be till the current investigation? If not,
then what other work have you done? Details of other
departments with whom worked and the nature of
work done.
H ow many promotions and increments have you

received? Which years you have not received any
promotion/increment, if any?
H ave you been admonished or penalized at any time

for any act whatsoever?
3. Daily Operations
E xplain in brief what is the nature of work done by
you. A detailed note may be given to us.
W hat were the actual documents / registers required
to be maintained by you?
W hat were the various documents required to be
authorized by you?
What was your level of authority?
O n what basis (documents) you used to sign as
Approval Signature? Please give detailed explanation.
D o you receive a copy of the PO before the work has
to be commenced? Or do you rely on the copy
enclosed along with the bill/invoice?
QUESTION Y/N REMARK

APPENDICES 143
B efore signing a bill/invoice as approved for payment did
you ever try to match/compare it with its PO?
If yes, then did you ever notice any discrepancies?
W hat was your reaction in case some major discrepancies
were noticed by you?
I n your tenure did you notice any discrepancies in parties
bill?
I f yes have you ever reported this to your seniors? What
action was taken by him/her?
P lease tell us the type of anomalies noticed by you during
your tenure? Any major anomalies noticed by you?
T o your knowledge were any bills dated before
corresponding PO dates? If so, how were you verifying
such bills?
I f yes then in what circumstances? Please give instances?
Were they ever reported to your senior? What action was
taken?
D id you ever receive a bill to be approved which had no
PO?
I s yes, What did you do with it? How did you approve it, if
so?
H ave you ever signed a document which was forced upon
you / not in your purview? If yes, list down the documents
and also the reasons for signing at that point of time.
W ere you ever involved in making of PO / FPO? If yes,
please explain your exact role.
D id you ensure that adequate documentation has been
complied with?
I f at any point of time the documentation required was
incomplete / not done, what was your reaction to that?
Please state instances.
W ere you satisfied with the type of ongoing
documentation? If not, why not?
H ave you ever insisted to a particular party to furnish
proper documentation; yet it has been never done so? If
yes, which party.
D id you report any of the above instances to your seniors?
What were their reactions? Please elaborate.
D id you document all your correspondence to your seniors,
if any, as an act of safeguard?
QUESTION Y/N REMARK

4. Role of your boss:
H ave you been ever forced upon to sign a particular
document ? If yes, by whom and for what reasons?
D id you have any serious difference with him at any
time? If yes, please elaborate.
6. General:
W hether you have cordial relations with all superiors
and colleagues?
Did you come on holidays often or rarely?
D o you have any grievance against any of your
seniors / colleagues?
B. SPECIFIC INFORMATION :
QUESTION Y/N REMARK
Confirmation of Information given by Mr. J :

Were the activities and utilisation of Vizag Shore Base
facility not planned in advance ?
Was it not known earlier that the service providing agencies
(like Weather Services, MJ Services, Maurya Offshore, etc.)
will be sharing the Vizag Shore Base and that they were to
be accommodated at Vizag Shore Base?
Were the Material dept. / Shore base Manager kept
informed about the requirements well in advance?
If so, were they given enough time to understand the
requirement and follow a proper bidding procedure for
vendor selection ?
Were the jobs scope of work uncertain before or during the
execution of work ?
Were there was always a rush situations and jobs were
required on an urgent basis ?
Performance of vendors (viz. Vijay Construction Co., Sanju
Engineering Services and N F Patil) :
Were you satisfied with the jobs executed at the Vizag
Shore Base ?
Do you feel that the vendors were qualified in executing the
work allotted to them ?
Were you satisfied with the vendors understanding about
the job requirement (i.e. were they able to understand and
execute it accordingly, or were they required to be
monitored to such an extent that lot of time and energy of
M/s ABCs staff was spent in explaining them and getting
the work done)?
QUESTION Y/N REMARK

APPENDICES 145
Were the jobs executed required to be redone because of
faulty work or not upto the specifications?
Were the jobs required a lot of repairs and refurbishing at a
later date ?
Did you feel at any time that any other vendor could have
done the job much better?
How will you rate the performance of each of the above
vendor -
Excellent
Very Good
Good
Reasonable / Just OK
Bad
Worse
Relation of M/s ABCs employees with the Vendors :
Do you feel that any of the vendors relationship with M/s
ABCs employees were cordial ?
Do you feel that the relations extended beyond the limits
where an intimate friendship could have been developed
where favors were offered to vendors ?
If yes, name such employees.
Involvement of any of the M/s ABCs employee
Do you feel or have any reason to believe that any
unreasonable relations existed between any of the
employee and any of the vendor ?
Specific Questions Y/N Remark
Facts regarding bill of Vijay Construction Co. (PO date is
after the actual bill date):
Did you ever approve a bill whose PO was dated after the
actual bill?
If yes, instances?
Was the fact reported to the

was taken on the same?
What do you have to say to the bill no.1019900 Dt.08- 04-
99 of Vijay Construction Co. of Rs.2,28,674, its PO is dated
0705-99. You have approved of the same?
Why did you over look this fact?
Have you met any of these parties?
Have you met the partner of Sanju Engineering Services?
Whose work do you find better?
does it compare with Vijay?

Can you give a brief account of the bidding procedure with
respect of jobs awarded to Vijay?
Did you ever have any complaints about their work?
APPENDIX E
MS Excel - a CAAT
MS Excel software needs no introduction; its a simple application
which most of us use every day -time-in and out. The versatile
spreadsheet is available almost on all machines and seldomly
one will find an accountant / auditor not using it. While mostly it is
popular for making statements, charts, etc., it can conveniently
be also used as CAAT. This article is to facilitate to make best
use of whatever little is known by user about MSExcel.
Some of the important MSExcel-functions that are useful as
CAAT for audit / investigation are described below.
IF
IF in combination with AND
IF in Combination with AND & OR
CountIF and SUMIF
SUMIFS
VLOOKUP
Pivot Table Function
Formula Auditing
Note : The above list is not exhaustive but is only an illustrative
one. There are many other useful functions and the users may
develop skills once he/she starts practicing them. Also it needs to
be noted that there are several ways in MS Excel to achieve the
same results; therefore this article attempts to only explain a few
of them.
The above functions are explained in detail with its corresponding
application in audit / fraud investigations.
The IF Function
The IF Function along with its derivative usage with AND / OR
can be useful for:
Detecting Gaps
APPENDICES 147
Finding Duplicates
Locating Multiple Records
Flagging Records
Ageing Analysis or Advance Analysis
Extracting Records meeting certain criteria (Combination with
filter commands or with Pivot Table commands)
Example of IF Function :
The given data is list of cheques issued and the objective is to
determine gaps of missing cheque numbers.
For complex operations, another IF function can be used within
an IF function. This is known as Nested-IF function which is
explained as follows :
The Nested IF functions - that is using IF within IF Function.
Here we use multiple tests (queries/ questions) in serial order and
depending upon the response of preceding test another logical
test follows. The nested-IF function can be explained as follows:
Syntax of Nested IF
= IF (Test1,
if true IF [Test2, if true,if false], if
false IF [Test 3, if true, if false] )
There can be maximum of 64 nested IFs
Example of Nested-IF function

The given data is list of sales team with their date of joining,
years of experience and sales achieved during a period. A
salesman is entitled to promotion depending upon his/her
experience and sales achieved. If his experience in under 3
years, he/she is eligible if the sales are over $ 3mn and for others
APPENDICES 149
the eligibility sales criteria is $ 5mn. The objective is to flag
Eligible status in Col-F
The Eligible and Not-Eligible employees can be filtered
separately to check with the promotions given.
Using IF function in combination with AND/ OR

Sometimes we need to have two or more tests that needs
simultaneous confirmation for logical actions, this can be done by
using the AND or OR with the IF function. These results can
also be achieved using the Nested-IF functions, however
sometimes it may be easier to use AND/OR functions. The IF
in combination with AND/OR are explained below :
Syntax of IF function used in combination with AND

=IF(AND(Test1,Test2)=Result,If True,If False)
Example of IF function used in combination with AND

:
The given data is a list of payments stating details of cheque
nos., bills reference (against which the payments are made) and
the name of vendor with the amounts. Here is order to establish
multipayments, one need to compare the vendor names and the
bills numbers. When there is match for both criteria (Name and
Bill No.) then double payment flag is set.
Syntax of IF function used in combination with OR

=IF(OR(Test1,Test2)=Result,If EitherTrue,If BothFalse)
Example of IF function used in combination with AND

+ OR
Continuing with the same example as above, it can be seen that
we are able to flag only one of the two records of double
payments. On applying filters, though we have details of the
double payments, we cannot show both the records. It happens
because we are comparing the record on current line with a
below-line item (in above example Row27 is compared with
Row28).Therefore to flag both the records (or if there more than 2
than all the records), we need to compare the current line item
APPENDICES 151
with line-item above and line-item below. That is, say for record
at Row28, we need to check Row28-with-Row29 AND Row28-
with-Row27. If either combination matches then that record
needs to be flagged for Dbl Pymnt.
To simplify (at Record at Row28) we need to :
On filtering the Dbl Pymnt records, we are able to get all the
bills that are paid more than once.
The COUNTIF Function

This function counts the Tnumber of records satisfying user
criteria.
This function isextremely useful in analy esis of master databases
(vendors, customers, employees,hetc.) to determine whethaer
there is nexus between them. For example commontelephone
numbers, fax nos., contact person references, email_ids.,etc. can
give acclue of linkages. This function can be coupled with filter
command to give instant results.
cSyntax Of COUNTIF Function:
=COUNTIF(criteria_range, criteria,)
Example Of COUNTIF Function:
oThe given data is of vendors details -Vendor_name, city, fax-

nos. andtelephone nos.
cBy using the Countif function we can count (say for Row2) how
many times the faxnumber (in cell C2) is repeated in the entire
Col-C (the count is stored in Col-D).
nSimilarly we can also counrt how many times the tel_no. (in cell
E2) is repeated in the sentire Col-E (the count is stored in Col-F).
Thereafter set filters for :
fax-counts more than 2 and
tel-counts more than 2 following result is obtained.the
linakages bet the partys are highlighted.
APPENDICES 153
The filtered records can be copied on another sheet and sorted

on fax_no. / tel_no to get the proper result :
The SUMIF FunctioniThis is an extension of wiMdely used Sum

function but here the SUM is combinedwith IF. Thus
summationcan be obtained of selected records satisfying user
defined ecriteria. This function operates the same way as Pivot
Table Command. However,
oPivot Table function is not on real-time basis (one need to
refreshto get updated
nresults); SUMIF function con other hand works on real-time
basis (changes in data minstantly updates this formula) tSyntax
of the SumIF function is as follows :
Example of the SumIF function:

Given data is of quantities of fruits sale with summary of total
auntities (kgs.) sold. aTo check the summary calculation, the
SUMIF function can be easily used. Say for fruit-Dates, we take
sumof Col-D only for the records where Dates appear in Col-
C. Therefore criteria_range will be the Fruit-name (C19:C40),
Criteria = C45 (Dates) and sum_range is quantnities in Col D
(D19:D40). It needs to be noted that the tcriteria_range (19:40)
matches with sum_range (19:40). The calculated numbers can
ebe compared with the given quantities to show the differences.
The VLOOKUP Function

This function is extremely,useful in linking two databases. This
can be,however, only done if there is a commosn unique
reference (generally referred to asprimary key) between the two
databakses. All databases built-up on RDBMS workon this
primeprinciple and hence generally it is easy to generate a
APPENDICES 155
primary key. There can be several applications of VLookup
function. A few examples could be :
To verify the rates billed with standard rate-card prices,
To confirm proper napplication of interest rates charged for
bank advances.
To vouchsafe whether all dispatches are billed or vice-versa.
Similarly vendor-bills can be checked with the Inventory
receipts.
Quantities, rates, ehtc. in purchase orders can be compared
withthe vvendor_bills. Or evmen the rates charged can be
analysed by comparing multi- vendors or same vendor over
different period.
Multi-years Inventories records can be compared.
Employee payroll can be compared over the period or with
master records.
Tax rates for emploeyees (withholding tax) , invoices, etc.
can bechecked.
Production records can be checked to inventories and
viceversa.
The list can be endles ns and an effective use can be made
depending upon the bcircumstances and subject matter of
the audit / investigation.
Example of VLOOKUP
Given two databases (i) data of sales (marked with green frame)
and (ii) data of standard rate card prices (marked with yellow
frame). In practice usually the databases are in different
worksheets or workbooks, but here it is shown in same
worksheet for easy understanding. However the principle is
same. The objective is to check whether the correct rates are
invoiced to the customer. Using VLOOKUP function, the rates (in
Col.D) of rate card (B23:D36) is extracted in Col- Q. The formula
is explained in figure below. The difference between rates
invoiced (Col.M) and rates chargeable (Col-Q extracted as
aforesaid) can be compared.
The Col-R can be filtered for non-zero to list the differences which
is list where the rates are charged higher or lower for further
investigation.
This function quickly summarizes large data by :

Querying the data in many user-friendly ways.
Subtotaling and aggregating numeric data, summarizing data
by categories, and subcategories, uand creating custom
calculations and formulae. Beside ssumming (sum), it can
also find average, max, min, etc.
APPENDICES 157
Expanding and collapsing levels to focus on results,
drilldowns to details from the summary
Moving rows to columns or vice-versa; see different
summaries using various scenarios.
Filtering, sorting, grouping, etc.
Application of Pivot Table function:

There can be several uses of the Pivot table function, a few
examples can be as follows :
Stratification / Classification of Data - periodwise, party-wise,
assets-wise, etc.
Creating various scenarios with if-then categories, using with
filters it is possible to expand and collapse levels. For
example in data of vendor bills, a pivot can be created to see
Vendor_wise+Item_wise summary or Item_wise+Vendor_
wise summary.
Create Trial Balance of General Ledger, Accounts Payable,
Accounts Receivable, Bank Account balances, etc.
Inventory Summary, Slow Moving / Non-moving Stock, etc.
Digital Analysis e..g. Benfords Law, Relative Size Factor
(RSF), etc.
How to apply the Pivot Table:
Unlike many formulae, thge Pivot function does not begin with a
= sign. This is more eof a command and hence enot a formula.
Therefore this command needs to refresh afrom time to time to
obtauin correct results. If there is need for an update on real-
Utime basis, one can use SUMIF, COUNTIF, etc.
To apply the Pivot command, in the insert tab select nthe

PivotTable icon and one needs to navigate throughthe interactive
dialogue box. Select the appropriateodata range and where you
need to place the outputtable (the appropriate choice generally
should be in new sheet since that willnot conflict with your
data).Select the appropriatefields for the vertical andhorizontal
crosstabs as Row_labels and Col_labels. The data to be
summarised shbould be placed in the value section. Here by
selecting the value field settings, one can select the sum, count,
average, max, min, product, etc.Cosmetic touch can be givmen
to the table by selecting appropriate formats or charts.
Example of Pivot Table :

Given data is of sales du uring a period giving details of Bill_No.,
Customer_name, Product_Id, Quantity bil eled, etc. The objective
is to summarise the quantityproduct_code wise. Applying the
Pivot Table the pivot table / charts can be obtained as shown
below :
principle however complex queries and charts can be generated

for different scenarios to give much more insights into the data.
Formula Auditing
Very often some excel sheets are very complicatedly built-up --
there are many variables spread across multiple sheets and
complex formulae make it difficult to audit. Most often such
sheets are verified based on rebuild-and-compare method. This
can sometime take enormous effort and hence may not be viable.
This is where the Formula Auditing options come handy.
APPENDICES 159
This is an in-built tool in MSExcel to quickly spot errors /
omissions by locating inconsistencies in data having regard to
surrounding region. A check run is conducted for:
Cell containing formula that result in error
Inconsistent calculated column in tables
Cell containing years represented as two digits Numbers
formatted as text
Formulae inconsistent with other formulae in the region
Formulae which omitted cells in a region
Unlock cells containing formulae
Formulae referring to empty cells
Data entered in a table is invalid
How to use the Formula Auditing Options :

Click on the Formula tab and then select the Formual Audting
section as shown in figure below. There are different audit tools
available, a combination of which can throw up exceptions. Since
this does not change the data, there no fear for data modification.
Trace dependent and precedents diagrammatically show

various relationship between the cells. Repeatedly pressing
these commands shows a pattern of linkages (see the
linkages in blue arrows in the figure below); one can easily
spot variations (marked in red circle) if any.
As the name suggests, the Show Formula tab quickly

converts the entire sheet from value to the formula as shown
below so that one can spot any glaring errors, e.g. direct
numbers entered (see the yellow highlighted cell in fig.
below) as against expected formula or vice versa, some
extra numbers inserted
APPENDICES 161
in cell along with formulae, etc.
Error checking commands works like a spell-check

command. It basically checks all the possible errors and
shows the errors in a dialogue box (as shown below) giving
the cell numbers with possible error and explanation. The
user can then correct the errors as he deems fit.
Also one can use the green-corner sign (see adjacent screen
shot) to spot errors. This is similar to the error checking. In
error checking explanation is given, while in green-corner is
just flagged (this is like the red line shown from wrong
spelling in word file). This can be done by enabling the
configuration settings in the as shown below.

FAFP Backgroud PDF

Uploaded by

Document Informationclick to expand document information

Copyright:

Available Formats

FAFP Backgroud PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FAFP Backgroud PDF

Uploaded by

Copyright:

Available Formats

Certificate Course on Forensic

Accounting and Fraud Detection

The Institute of Chartered Accountants of India

Appendix A:Internal Factors that reduce the probability of fraud

1.1. What is Fraud?

In criminal law, fraud is the crime or offense of deliberately

1.2 Classifying Fraud

1.3 Some Numbers...

Participants of the ACFE study estimate a loss of 5% of a

1.4 What is Forensic Accounting?

In the backdrop of highly competitive business environment,

1.5 General Nature of Forensic Accountancy Work

the wrong doers. Forensic accounting looks at the accounting in

introduced into the books and records of an accounting system

administrative bodies are the ultimate arbiters of what accounting

1.6 Forensic Accounting Cases

wanted to raise rates on its customers and needed the Contra

Bill and hold isnt illegal, but Sunbeams shareholders felt

Fraud and Forensic accounting

which strengthens financial assertions and disclosures would be

How is a forensic accounting analysis different from an

Investigative mentality vs. professional skepticism. A

Fraud and Audit:

Consequently, the audit scenarios in this rapidly changing IT

returns, discounts, and promotion/ festival/season offers. Each

consider the overall business model with professional skepticism

as issues relating to accounting practices, corporate governance,

the necessity of disclosing these in Enrons own financial

1. Standard of Auditing 240 -

with governance and 2) the management of an entity. The

when so required by the laws and regulations, to regulatory

2. Clauses of CARO relating to reporting of fraud by

(xxi) is even more serious, in that, it actually casts a direct

3. Sales Tax Practitioners Association (STPA) of

accompanying revenue statements, b) the detection of

4. Insights from the OMalley Report

auditors to examine nonstandard entries, and to analyze certain

The auditors enhanced role towards fraud.

Risk based auditing plans and fraud risk detection is now a

applied including surprise tests at warehouse, visits to some

investors. The eight-member panel and its staff, headed by

1. Conventional Investigation assignments as a

In the context of the situation explained in chapter I, a chartered

When he is reasonably certain that the scrap sale has been

and possibly take appropriate measures. Moreover this

stating that all records are lost or in a disarray and cannot

days of strike, bandhs, inauspicious occasions, whereas on

late, merely by dating his cheque a month earlier than the

furniture. The explanation given was that he had made a lot

be. In one EDP department, it was found that there were

also kept the quality control inspectors happy so as to

Familiarization with Red Flags in

Buddhism refers to three kinds of poisons anger, greed and

There are no standardized series of steps nor is there any

These steps have been explained at an elementary level to

An investigation into shortage of inventory or cash, pointed

Materiality levels. Determine also what is the level of

his assignment covertly. To illustrate, the examiner will be