Episode 81: Best Evidence: Accounting Records with Leah Wietholter

At the heart of all successful forensic accounting engagements or fraud investigations is the reliance and analysis of evidence. Best circumstantial evidence in a financial investigation are sources of information or data that are furthest removed from the influence of a subject. If you want to ensure that you uncover facts resulting in defensible investigative analyses in your cases, you are in the right place. In this six-part series, Leah Wietholter reviews the most common best evidence data sources in order of reliability by exchanging seats from host to guest to thoroughly discuss this topic with guest host, Bethany Pigott.

Leah Wietholter, MBA, CFE, PI, CPA is the CEO and founder of Workman Forensics headquartered in Tulsa, Oklahoma. With career aspirations at 12 years old of becoming an investigator, Leah worked for the FBI while completing her accounting undergraduate degree and masters in business administration. After working in public accounting for over two years as a staff tax accountant and forensic accountant, Leah opened Workman Forensics - a firm dedicated to forensic accounting and fraud investigations. Since starting the firm in 2010, Leah has worked over 150 cases providing data-focused solutions resulting in settlements and testifying in both state and federal courts. Read her full bio on the Workman Forensics team page.

The information in today's podcast is just a glimpse of what's inside Leah's book—Data Sleuth: Using Data in Forensic Accounting Engagements and Fraud Investigations. Available on Amazon!

RESOURCES MENTIONED IN TODAY’S EPISODE

Order Leah’s book to learn more about best evidence in forensic accounting and financial investigations Data Sleuth on Amazon.

To schedule a discovery call for your group or team to play The Investigation Game Interactive Case Studies visit investigationgame.com.

Connect with Workman Forensics
Youtube: @WorkmanForensics
Facebook: @wforensics
Twitter: @wforensics
Instagram: @wforensics
LinkedIn: @workmanforensics
Subscribe and listen to this and more episodes of Workman Forensics Podcast on Apple Podcasts, Android, or anywhere you listen.

Transcript:

Leah Wietholter:

Hi, I'm Leah Wietholter, CEO and founder of Workman Forensics in Tulsa, Oklahoma. And this is the Data Sleuth podcast. At the heart of all successful forensic accounting engagements or fraud investigations is the analysis of evidence. Best circumstantial evidence in a financial investigation are those sources of information or data that are furthest removed from the influence of a subject. In this six part series, I'm going to review the most common, best evidence data sources in order of reliability by exchanging seats. I'm going to go from host to guest, so we can thoroughly discuss this topic with our guest host, Bethany Piaget. If you want to ensure that you uncover facts resulting in defensible investigative analyses in your cases, you are in the right place.

Bethany Pigott:

Welcome to the Data Sleuth podcast. I'm your host, Bethany Piaget, and once again, we're with Leah to discuss best evidence. So Leah, today we're talking about accounting records. When you say accounting records, what are you talking about?

Leah Wietholter:

Yeah, the most common, I feel like I probably should kind of frame this conversation and our best evidence sources. There are plenty of cases where we're not going to use all of these evidence sources, and I'm talking about the most common investigation, which is, and we'll get into it a little bit more, but where you've got some sort of employee embezzlement. That's the type of case we're talking about. You've got this employee embezzlement, and this person has a lot of control over the account, over the accounting process. So when I'm talking about accounting records, I'm talking about the most common, I mean, I just really want to emphasize I'm addressing the most common uses of all these evidence sources, the last three episodes plus today and through the end of this series. So we're going to look at QuickBooks data, their reports or transactions. We could look at anything entered into any accounting system, billing system.

I've done it before where there was a concrete ready mix business where they mix the concrete and they had QuickBooks, but then they also had their proprietary software for mixing like an ordering system. And it was industry specific, not proprietary, but industry specific software. So any of that type of software. And then we could also have, this is pretty common too in a larger business would be purchasing or procurement data. We're not really going to focus on that today, but that's another source whenever we're talking about accounting records sometimes. And that happens a lot with state and government type of cases or larger businesses where you do have some internal controls.

Bethany Pigott:

Okay. So you did mention that we've talked about some other best evidence, and so listeners can go back and listen to those. And those have been about bank statements, credit card statements, and payroll reports. So can you differentiate how accounting records are different from those three sources that you've already discussed in previous episodes?

Leah Wietholter:

Sure. Yeah. So bank statements and credit card statements and the data that comes from those statements, that's the result of transactions that are being processed by a third party. No one is actually hand entering those transactions. So whatever is listed on that statement, especially if I get that statement directly from the bank or the credit card company, that represents what actually happened. That just happened and it's proof of what happened. Payroll reports, they've got a little bit more data entry involved because somebody in the company has to enter the number of hours, the salary, the hourly rate, somebody had to enter that from the company side. But if I'm obtaining these records from the payroll company, especially if it's a third party, and to some extent QuickBooks, I can pull that information from that third party source and rely on it because it's going to tell me what actually happened.

Now, some of the input may have been falsified or altered or have errors from the company representative perspective, but at least getting that record from the payroll company is going to tell me how much money was spent and who benefited from that money. Accounting records, the reason I've even placed them in the order number four in our series is that when we're on a cash basis of accounting, which is again, the most common, financial statements that are really used in a lot of small to mid-sized companies, all accounting records represent is that somebody has taken third party information, so bank credit card statement, payroll information, and then they've categorized it to be then summarized in financial statements. So your balance sheet and your income statement. So when it comes to reliability, we have to look at the reliability of accounting records. We have to look at a couple things, and I'm going to talk about both ends of the spectrum.

If there are internal controls, segregation of duties, which is the accounting terminology for, we have multiple people handling things within the financial processes of the company. And so the idea is that who inputs the information is not the same one that verifies that information. So your hope is that if there's an error, it gets fixed. If there's fraud, it gets caught. That's what you're trying to do with the segregation of duties. So if you have that type of setup, then your accounting records are probably going to be more reliable unless there's a risk of people colluding. So if people are teaming up, if the entry person is teaming up with the verifier, then those records aren't going to be reliable. That's why I typically just say, "Let's just look at the bank statements," unless we're dealing with a large company and that's not the focus today.

So the other side of the spectrum though, so one side of the spectrum is we have a pretty low risk of our accounting records being wrong because there's all these safeguards. The other end of this spectrum is there are absolutely no safeguards and this individual, one person controlled everything or there's collusion because that means there's no safeguards. Anytime people collude in a system, that's going to completely override your controls. So unless you've got other kind of backup controls, but we really just need, whenever we're at this other side of the spectrum, which is our focus today, when one person is controlling everything, you really just want to use accounting records for context or for evidence of intent. We don't need to perform a loss calculation based on accounting records that are subject controlled. That's not going to prove anything other than whatever the subject wants you to prove.

Bethany Pigott:

Okay. So talking about intent, what is the difference between evidence used to calculate the loss versus evidence used for intent, and why do those things matter?

Leah Wietholter:

So from the highest level, if you think you have fraud in your business or you're investigating fraud, you need two things to prove fraud, either civilly, criminally, it doesn't really matter. But high level, you need evidence that the individual benefited and you need evidence that the individual benefited because of intent. Their actions were intentional to hide how they were benefiting or to deceive in order to obtain benefit. So I need both. If you have a loss, or I'm going to call it the loss to the company is typically the benefit of your subject. So whenever I say loss or benefit, that's what I'm talking about, so a loss to a company may be an error and it could even benefit the subject if you don't have evidence of intent. So they could say, "Oh, yeah, this did benefit me. I accidentally fat-fingered my hours for this month," and so then they fixed it the next month or whatever. Maybe they don't realize till they're called out. If you don't have that intent piece, your case is really going to fall flat.

Bethany Pigott:

Yeah, that's so good to know. Do you have an example of this to put a picture around what this looks like?

Leah Wietholter:

So I had a client who, his friend had suffered a major loss. I think it was in excess of $10 million from his controller and bookkeeper. So he wanted his controller or bookkeeper, he wanted somebody to look into her activities because his setup was real similar to his friends. And this bookkeeper controller had full access to everything. I mean, definitely high risk when we're looking at this. So we go in, we perform what we call our source and use, our IDF. We do all of our steps. And we looked at one year of data since he didn't know if she was stealing or not. And then we identified some risk areas and whatnot. But we went through all the expenditures with him and he's like, "Yeah, I don't really see anything egregious." And he had a bunch of accounts. I mean, we were looking at millions of dollars, and he's like, "Yeah, there's just kind of some weird stuff in here."

And I said, "Well, before we spend more money going back further, why don't you just let me talk to her about these items?" Because it was really minor. I mean, it was some TurboTax charges on the credit card, but one I really wanted to talk to her about was a over $3,000 purchase of golf clubs. And he said that wasn't for him. So we go in and I had several things to ask her about that just kind of looked strange. And so I go in and actually I told the owner, I said, "I'm happy to interview this bookkeeper controller. We're not seeing what we would normally see in these areas." I said, "But I think if anybody is stealing from you, it's actually your foreman." And he was like, "Well, but he makes me a lot of money. It's fine." And I said, "Well, I'm just telling you the stuff I'm seeing in these expense reimbursements.

I think he's putting fake stuff in your expense reimbursements," and it's okay. He makes me a lot of money. Anyway, so I go in and I wanted to ask her about the expense reimbursements. I mean, this was not supposed to be super confrontational. She of course, was very upset that she was being reviewed anyway. And so we had to kind of talk through that. He just wants to make sure everything's fine. And this is really for your benefit too, because you do control a lot of things. So if there's nothing going on, we're good to go, but we're just going to talk through some stuff. So I get to the $3,000 golf club charge, and I said, "So what were these golf clubs for?" And she said, "Those were mine," and the owner is sitting or he was standing in the doorway, kind of awkward, but he was standing in the doorway.

And I said, "So what is this for?" And she looks at him and I mean, she's so mad, and because she had calmed down and then now she's real mad. And she said, "You told me I could put those golf clubs on the credit card, and now you're asking me about them?" And I said, "Okay, tell me what happened." So she tells me the story and she says, "This is what happened." And then she said, "And I have been deducting this from my payroll." I said, "Well, great, can you show me?" And she said, "I've been tracking it. Here's my Excel spreadsheet." I said, "Great, I'll compare it to your payroll. We'll be good to go. Let's move on to the next thing." And we talked about a $20 turbo tax thing. So the reason that I like to talk about this is that the accounting records are really to help us with, like I said, that intent piece.

And in this case, I think that it actually, things did look strange in the accounting records, but once we got down to the bottom of it, it was nothing. She wasn't stealing money, but I think this lady would've been fired had we not looked at both because we started with the bank statements, we started with the credit card statements. We saw weird things. We saw where they were classified. Then we went and we asked her about them, and then it turned out, so she says, "You told me I could do this." He's standing in the doorway. And he goes, "Oh, you're right. I did." And that was the largest purchase, but he didn't remember when we were going through everything. So that's just an example of there was a benefit to this subject, but there was no evidence of intent.

Bethany Pigott:

Yeah, that's super helpful. What evidence is most reliable for the benefit or loss calculation?

Leah Wietholter:

Yeah, that's when you want to look at those bank statements, credit card statements and payroll reports. So at Workman Forensics, we prepare every case as if it's going to trial and beyond that to take it up a notch, we're going to prepare everything as if it's going to criminal trial, which means that whatever evidence we're providing ultimately to the prosecutor, assistant US attorney, local law enforcement, whatever we want that to hold up against and help them prove their case beyond a reasonable doubt, that is the highest standard. So if I'm always preparing every case, whether it's criminal or not to that level, then I know it's going to be defensible and prove our case at civil court or an administrative proceeding arbitration. So that's why we're wanting to rely, if we're going to say how much somebody benefited, because that's a strong accusation.

I mean to go and sit in front of this lady and say, "What are these golf clubs for?" I mean, we need to know what that is. And I did a presentation at the global conference, and one of my slides, this was in Seattle a couple weeks ago, but one of my slides says, "As investigators, we have to get it right. We need to make sure that we've covered all of our bases." And so if I'm preparing as if it's going to go to criminal trial, and I'm making sure that I've quantified this benefit, I want to make sure I'm quantifying the benefit from the most reliable source, not necessarily from the accounting records that could have been altered by the person controlling them.

Bethany Pigott:

Yeah, I know that you've talked about how you really want to be thorough because of how it impacts people's life and their future. And so this is just so thorough in talking through these things, but there is this area of intent, and so what evidence is helpful for that?

Leah Wietholter:

That's where I like to use these accounting records. So what we're looking for is anything that indicates that the fraudulent transactions were trying to be hidden from the rifle owner. So in our example of the golf clubs, I'm probably going to reference that several times, but in that example, by her saying, "I talked to you about this. I have this Excel spreadsheet. I'm deducting this from my payroll." That tells us that nothing was hidden. So those accounting records or I don't have evidence of intent there. You signed off on it, that type of thing. I run every reimbursement through you and you sign off on it. The things we're looking for, so it could be that notes or memos are made in the entries. I had a controller that was actually colluding with a CEO, so we had internal controls, CEO and controller are colluding.

That's a lot of Cs there. But anyway, okay, so they're colluding and the controller, before he would send the financial statements to the owner of the company, he would make adjustments. We call them adjusting journal entries. And so he would take transactions that had been coded as business promotions by the accounting clerks, and he would reclassify it where it was hidden on the balance sheet in an asset. And so those transactions are really helpful in showing us that, "Oh, controller was hiding these transactions," but where it went a step further, because we knew CEO was getting the benefit, controller wasn't getting the benefit, but yet he's reclassifying these things. So what was really helpful was that he left notes or memos in his journal entries that would say, "Reclassify to CEO's special project, reclassify to whatever." And so then that helped us with that evidence of, "Okay, we've got collusion going on.

The controller's not personally benefiting, but he's perpetuating this scheme." The other thing we're looking for are deleted entries. That's a really good indication. I had a bookkeeper who was paying herself through a payroll check, but then she was also paying herself through direct deposit. So the owner was signing the checks. He knew about those payments. What he didn't know about were the extra direct deposit payments. So she would actually go in and after the direct deposit was made using QuickBooks, she'd go in and delete it. So we can use the audit trail and user log to show us, "Oh, this person logged in, this person was receiving the benefit, and then this person is deleting these extra payments." So that's that evidence of intent.

Bethany Pigott:

So many helpful things that we're all learning as we listen. Thank you so much, Leah. We're going to take a short break and just talk about on the other side of the break how you access the information that you've been talking about.

Speaker 3:

Ready to feel like Sherlock Holmes while earning CPE credit. The investigation game, interactive case studies are facilitator led group training events, utilizing case story videos and sample evidence to stimulate real fraud investigations. Participants complete various solo decision making and investigation activities to calculate the loss to the victim from the fraud scheme. The training concludes with a solution presentation and key findings from the actual case. The interactive case studies are recommended for two CPE credit hours. To schedule a discovery call, visit investigationgame.com.

Bethany Pigott:

All right, welcome back. So Leah, as we wrap up this episode, can you tell us how you access this information and what you're looking for when you're looking at the accounting records?

Leah Wietholter:

Whenever we're accessing the information, we really just need access to the accounting system, and I prefer that if we're dealing with QuickBooks that we get some sort of backup or we have our own access to QuickBooks online so that we can run the reports we want. But sometimes if the accounting system is more robust or we don't have a copy, maybe it's industry specific, then we'll have reports run. But I definitely want to look at journal entry reports, and I really want to look at are the adjustments being made, especially for the loss. We've already identified the transactions that weren't for the benefit of the business at this point in the process. So now I want to look at where were they coded in the system, and if I see that there's journal entries impacting or maybe impacting those accounts, I want to look at does the adjustment or the movement that this adjustment is making, is it moving the transaction or group of transactions to something that doesn't make sense that would hide it?

Does the entry have a note or a memo regarding the purpose of the adjustment? The other thing I want to look at, I want to look at audit trail reports and user logs depending on the system. So QuickBooks, if you have QuickBooks desktop, the audit trail report is so awesome. If you have QuickBooks online, it is not as awesome. It still has the same information, but it's just very difficult to access and it doesn't even really have all the information. It's just very difficult to access and put it into a way that you can analyze. So that's just kind of difficult. And I'm not a fan. However, on QuickBooks online for every transaction, especially whenever you download the general ledger, you can see who made the entry and it's got a little bit more detail there. But one of the things we're looking for, or a couple of things we're looking for in the audit trail reports is what was deleted or changed.

So for example, I had checks in a case that were printed and paid to a spouse, and after the checks were printed, then the CFO went back in, changed the name to a common vendor. And so whenever the bookkeeper came in to reconcile at the end of the month or at the end of the month, then they saw the check there, they could reconcile. But what they didn't see was that the check was being paid to the spouse. So we're looking for those kinds of changes. We're looking for any backdating. Why did that backdating happen? Is that important to our case? Really, we're looking for related to the transactions we've identified that we're pretty sure didn't benefit the business.

So then the last area I want to look at, and sometimes I'll even do this first, but I'm going to pull the general ledger so that I can see and run the general ledger report so that I can see where the transactions, where they're coded today, whether they've been changed to where they are, whatever, I want to see, where are they today, because I want to know does it make sense?

So taking the purchase of fancy suits, like this one guy was purchasing fancy suits out of the operating account. So if I take that information or if I see those transactions and they were originally coded even to ask my accountant, but if they're in some weird spot and they've been reclassified to an asset account, that's interesting to me. Why was it being hidden that way? But also, I've had somewhere they were just classified, the purchases of suits might have been classified to business promotions or it was classified to office expense, or it was classified to cost of goods sold. It just does not make sense at all. Then we want to ask about it or payments to LLCs that aren't normally vendors, and it's put to some random like janitorial account and we know that that is not our janitor, then that's what's going to help us look at, well, it was trying to be hidden.

Maybe office expense is a large expense account, and so nobody ever really looks at that. So we're really just wanting to use these accounting records to see, it kind of helps us sure up our loss sometimes, our loss calculation, but then also it's really helping us with the story, how did it happen and that it may even help prove who actually benefited from it, who was in on the scheme. There's just a lot of context. And then of course, what we've been talking about, the evidence of intent behind these transactions or behind the entries.

Bethany Pigott:

Thank you so much, Leah, for sharing with our listeners about using accounting records for best evidence. And thank you listeners for joining us. We hope you'll join us next time as we continue the conversation about uses of best evidence.

Leah Wietholter:

Thank you for listening to the Data Sleuth podcast. If you enjoyed this episode, please leave us a review wherever you listen. The Data Sleuth Podcast is a production of Workman Forensics in Tulsa, Oklahoma. To learn more about our investigation services and resources, please visit workmanforensics.com. You can purchase your copy of Data Sleuth using data in forensic accounting engagements and fraud investigations on Amazon, Goodreads, or wherever you like to purchase books.