Practice Areas

Thomas A. French recently participated as part of a panel for the CPBJ Roundtable "Investigating Internal Fraud"

October 2017
Central Penn Business Journal

Investigating internal fraud: A sponsored roundtable

By CPBJ Staff, September 29, 2017 at 3:00 AM

"They're always very shocked. And when you gather all the information, they're even more shocked." Bill Dean, Thomas A. French and Lisa A. Myers, three professionals with experience in forensic and internal investigations, join CPBJ Editor Joel Berg for a roundtable discussion. - (Photo / Amy Spangler)

Business owners place a great deal of trust in their employees. And for the most part, that trust is rewarded with hard work and dedication.

But it can sometimes be exploited by employees who may secretly divert a company’s resources into their own pockets.

The Central Penn Business Journal convened a panel of experts to discuss what to look for and what to do when you suspect your business is a target of theft and deception from the inside.

The discussion, moderated by CPBJ Editor Joel Berg, focused on the steps that business owners can take to protect their companies, both before and after a loss.

CPBJ: How do businesses perceive the risk of internal fraud?

Lisa A. Myers: Typically businesses believe they have really good controls in place, until something happens.

Bill Dean: We’ve never been involved in one that they weren’t surprised. They’re always very shocked. And when you gather all the information, they’re even more shocked.

Bill Dean is a senior manager at LBMC Information Security, a national IT security firm based in Tennessee. He is responsible for incident response, digital forensics, electronic discovery and overall litigation support. Bill Dean is a senior manager at LBMC Information Security, a national IT security firm based in Tennessee. He is responsible for incident response, digital forensics, electronic discovery and overall litigation support. - (Amy Spangler)

CPBJ: What factors influence those perceptions?

Thomas A. French: A lot of small-business people have personal relationships with their employees, particularly their financial employees, and they develop a sense of trust. In many of the internal fraud cases that I’ve been involved in, it’s that person that you’re working with for a long time who is secretly pilfering funds or cooking the books.

CPBJ: What kinds of red flags should business owners look for as indicators of potential misconduct or fraud?

Myers: Typically something has changed in somebody’s life. In one of the cases that drew me into this profession, the individual had his parents in different nursing homes, and that’s very expensive. And he was getting ready to retire.

French: Based on my experience, if you find someone who seems to be living a lifestyle that’s not consistent with their earnings, and there is no reasonable explanation. You also need to listen to your other employees, too. An owner might think, "Well, that’s just a disgruntled employee who is complaining." But you have to listen to those complaints. You need to at least take a look at that to make sure that there isn’t something behind it.

Dean: From a digital perspective, it’s when people’s behavior changes. They’re coming in early or they’re working late, logging in and out at night, logging in remotely.

French: We do a lot of work with theft of trade secrets. And one thing that would seem to spike is emails with attachments. You also start to see people printing documents that they otherwise wouldn’t necessarily be printing. You start to see them going into the document management system and making copies of documents.

CPBJ: What kind of information is most at risk?

Dean: You have market goals. You have customer information. You have "How do we make the secret sauce? What goes into our process? What are the markets that we’re going into?"

CPBJ: How do people benefit from taking that?

Dean: If they’re going to go to a competing company or start their own company, it’s an asset they can bring to the new job. If I have the customer list, and I know how I’m going to go into the market, I have a competitive advantage. I have the secret sauce as to what made my original employer a success.

Thomas A. French is a partner in the Harrisburg office of law firm Rhoads & Sinon. He is a member of the business litigation; e-discovery; fiduciary and trust litigation; financial institutions; insurance law; local counsel; special counsel; white collar criminal defense, internal investigations and corporate compliance groups. The firm also has an office in Exton. Thomas A. French is a partner in the Harrisburg office of law firm Rhoads & Sinon. He is a member of the business litigation; e-discovery; fiduciary and trust litigation; financial institutions; insurance law; local counsel; special counsel; white collar criminal defense, internal investigations and corporate compliance groups. The firm also has an office in Exton. - (Amy Spangler)

CPBJ: What are the first steps a company should take when somebody has suspicions or a whistle blower comes forward?

French: Once they’ve done their initial review, talked to a couple of people who are raising the issue or may be involved, our recommendation is that you engage outside counsel almost right away. They are the pivot point for conducting the rest of the investigation or helping determine whether you need an investigation. Counsel is important because you’re able to provide guidance from a legal standpoint as to what your risks might be. For example, companies need to protect whistle blowers from retaliation. But more importantly, it preserves attorney-client privilege. Everything that’s done during the investigation can be protected by privilege or attorney work product.

Myers: And it’s not always the business attorney. I call it a special counsel. It’s not the same as being a business attorney.

French: It is not, and you don’t necessarily want to use in-house counsel, because you could lose attorney-client privilege. Inside counsel will often have business roles as well as roles as legal advisers, and the courts will give heavy scrutiny to an inside counsel. So you try to find someone who’s independent and has experience in conducting investigations.

Dean: The client may want to talk to a digital forensic person first. But most of the time we want outside counsel, because we want to be sure they’re using their money wisely and sometimes maybe our services aren’t what they need.

Myers: We’re the same way. We want the litigator to quarterback this, specifically for the client-attorney, work-product privilege. We want to be able to talk to the attorney and to the client through the attorney.

French: If the company contacts their accountant or outside IT person directly and engages in communications, they may not be privileged. But if they communicate with counsel first and then counsel communicates with the consultants, then those communications are privileged, and there are many instances where you want to maintain that privilege, while there are others where you may want to waive it.

Dean: And sometimes clients may be spending time in an area that counsel may feel is just not valuable.

Myers: There could be statutes of limitation and the attorney is saying, "Why are you having them go that far back?" You want to go with the litigator first.

CPBJ: If I’m the owner of the business, why wouldn’t I do my own investigation and confront the person, especially if I think I know them well, or thought I knew them well?

French: That person will commence destroying evidence and covering up his or her tracks. And whatever you do, it’s not privileged. You’re going to have to disclose it. You may have to disclose that in a civil case where you’re sued. You may have to disclose that in a criminal case if the person has been conducting criminal activity. And so it would be very bad for you to begin the investigation yourself. You can destroy evidence, cause the destruction of evidence, and you can end up creating evidence for prosecutors or for plaintiffs to sue your company.

Dean: From a digital perspective, when the client is doing their own analysis, they’re stomping all over evidence. We may lose evidence that could have helped an attorney to win the case. Not that it would lose it, but it may be evidence that’s now gone.

Myers: It’s the same with the financial information: It can be altered.

Lisa A. Myers is a principal and CPA at accounting firm Boyer & Ritter LLC, which has offices in Camp Hill, Carlisle, Chambersburg and State College. She heads the firm’s forensic, litigation support and consulting group. Lisa A. Myers is a principal and CPA at accounting firm Boyer & Ritter LLC, which has offices in Camp Hill, Carlisle, Chambersburg and State College. She heads the firm’s forensic, litigation support and consulting group. - (Amy Spangler)

CPBJ: Is it tempting, though, for business owners to take that route?

Myers: It’s cheaper that way. At least they think it’s going to be cheaper. But on the back end it could be very costly.

French: Most business owners feel, "I’ve become a successful entrepreneur throughout my life, because I’m very competent and I can handle this." And generally they can handle things. But you don’t know what you don’t know sometimes.

Dean: They may not know everything to look at, where counsel knows more places to look and the digital forensics person definitely knows other things to look at.

CPBJ: What exactly is the definition of an internal investigation from a legal perspective and why does the distinction matter?

French: Business owners and companies, particularly public companies, need to understand that they have legal duties and obligations to conduct investigations under the appropriate circumstances. If there is a whistleblower who creates a complaint or they have learned that there has been some misconduct that could hurt shareholders or that caused financial statements to be inaccurate, they have legal duties to investigate and to correct those. And it’s not just an inquiry by a curious person.

When we’re talking about a legal investigation, you’re talking about a search for the facts. You would start with your lawyer. The lawyer will create a team, bring in a forensic accountant, bring in IT consultants, perhaps other private investigators. Then the next step in the investigation is to impose what’s called a legal hold. You have to prevent the destruction of any data, electronic or paper documents. And that’s very important, because the law will impose liability and perhaps criminal sanctions for obstruction of justice if you don’t curtail the destruction of documents. Many companies have routine document destruction policies. After so many months or years, you automatically delete or get rid of information. You’ve got to stop that right away, then you gather together documents. You do a forensic investigation of the accounting records. You find out everything you’ve got electronically. Emails and text messages are sometimes the very best evidence. Once you’ve digested all of that, you interview witnesses. And there are special techniques that are used, which make the information more valuable to the company, because the company can use it to perhaps prevent corporate criminal liability. It’s not just what people would understand as "Let’s go find out the facts."

Myers: It’s more complex than people typically think it is. It’s very structured.

CPBJ: What are the steps that you take to determine the facts, to find out what happened?

French: You put your team together and then you come up with your investigation plan. A big part of that plan may be the forensic accounting investigation. Another big part may be how we’re going to investigate the appropriate IT, the electronic documentation; determine who are what we call custodians, who are the potential witnesses, who are the persons who have normal access to the documentation involved. Then you create a plan of what documents, what evidence you want, and then what witnesses you want to interview.

Myers: From my perspective, the client reaches out to the attorney. The attorney calls a meeting. Often it’s with the accountant first and then IT at a different time. And they’ll tell us the story as they see it. And then as we’re going along, we’ll be asking, "What would you need to view from a financial perspective to be able to come up with a conclusion in this?" It’s not saying, "Here is what we want the conclusion to be."

Dean: We do the same thing, just with different terminology. We ask, ‘What questions are you trying to answer?’ And then counsel will typically rely on us to determine the best places to be able to answer those questions. They may not know all the artifacts that are available. And then we consult with counsel to say, "You have this artifact, this artifact, this information available. Which one of these would you like?" And we’ll pull that and figure out what is valuable and what is not.

CPBJ: By artifact, do you mean digital files?

Dean: Yes. Artifacts, activities, files, communications, those types of things.

CPBJ: At some point do you interview employees who are suspects?

French: Certainly. And this is where attorney-client privilege becomes very important. The first thing you do when you interview a witness, particularly in a situation where there may be criminal activity, is give them what’s called an Upjohn Warning. The Upjohn Warning is sort of the civil equivalent to the warning that police officers give, the Miranda Warning. Essentially what you’re telling them is, "I represent the company and our communications are subject to attorney-client privilege, which means they cannot be disclosed. However, I do not represent you personally. And in the event that the company decides they want to share this information with the authorities, they may do so and you can’t stop them."

And you’re not taking a sworn statement. It’s not a deposition. It’s an interview. And that’s important, because the witnesses are not under oath.

The other question that often comes up is, "Do I have to talk to you? I have Fifth Amendment rights." Well, I’m not the government. So you don’t have any Fifth Amendment rights with me, but you do with respect to government and prosecution. It’s up to you whether you want to cooperate. But if you don’t cooperate, your employer has the right to terminate your employment and impose discipline for not doing so.

CPBJ: Is that part of an employment contract?

French: That’s general law, unless it’s contrary to an employment contract. You have an obligation to reasonably follow the lawful directives of your employer as part of your job.

CPBJ: And the interview, is it once, twice? Is it ongoing?

French: The first thing you do is you have a sense for what they know already, because you’ve looked at the documents, you’ve looked at the electronic data. Your purpose is to let them tell you their version of the story and then you test-drive some of your theories as to what happened, or may have happened.

CPBJ: And do you double-check that with the IT professionals and the CPAs against the evidence in the financial statements and on the computers?

Dean: We’ve normally provided some sort of reports to help prepare the attorney for the interview. And if there is a discrepancy with the answer, they’ll typically come back and say, "Is this possible, could this really happen?" Sometimes we have to go back and do a little more digging to be sure.

Myers: And depending on what we’ve been able to discover, sometimes we’ll be there at the interviews just in case a question comes up. But we’re also going to go in ahead of time, say "Here is what we’ve seen, here is how this plays out." The attorney will digest it, and they’ll ask questions.

Dean: Sometimes if the expert is there listening to the testimony, the suspect is less likely to dispute that testimony or tell a tall tale.

CPBJ: Do businesses typically find what they expect to find? Do they find more loss, less loss, or are there things they never expected to find?

Myers: I don’t think there is a typical.

Dean: Most of the time from the digital side there is a lot more. A lot of people don’t realize how much information is really there. It may start out with financial fraud and they may find out the financial fraud is occurring, because they’re looking to get capital to start their own firm.

Myers: And they’re getting that out of emails sometimes. The emails are unbelievable.

CPBJ: Don’t people know by now to hide those things a little better?

Dean: They’re getting a little better with emails. But it just went from email to text messages. And people think, "Well, I believe my text message is gone." That’s not accurate. We’re going to get those text messages back, for the most part, and sometimes that’s even worse.

French: We’ve had cases where employees have tried to completely wipe their devices. There is always something that’s missed.

Dean: The device is a small component to the overall picture of where your data is. When you speak about cloud computing and social networking and text messages, those are all in a lot of different places other than just the computer itself. And one question I had: During the interview portion, there is no subpoena power that you can ask Microsoft or Gmail for that data, is there?

French: There is not. But once you get to a certain point, you may be able to bring action and gain subpoena power. It’s still not easy to get the documents from those services. But you can get a court order that requires them to give you their login records.

CPBJ: From your investigation before it goes to any kind of court, a government court?

French: You’d have to institute a suit, particularly in trade secrets cases where you’ve learned someone has stolen trade secrets.

CPBJ: Once you determine that there has been a loss, what do you recommend business owners do from there?

French: That depends on the type of investigation that you’re conducting. Certain investigations happen because the law requires you to have an audit committee. So in that instance, your client is the audit committee rather than the entire company, so you would report to the audit committee. In other cases, you may have a shareholder who has filed a class-action derivative lawsuit. The law says that you don’t have to allow that lawsuit to continue if you have created an independent committee and they have done an investigation and evaluation and determined that the claim is essentially frivolous. In that case, the investigation reports to that special committee. And there are two options. You can give an in-person oral report or you can give a written report.

If you give an oral report, it’s less likely to be discoverable, less likely the plaintiff will be able to access the results of the report and use it against you, less likely that government authorities will be able to use that against you.

However, you may want to have a written report, particularly if you think crimes may have been committed. That’s because the federal government gives credit to companies that cooperate in providing the results of their investigations and turning over the bad guys for prosecution. And you want to have a written report in that case.

CPBJ: What happens in a privately held company? Is it the same as in a publicly held firm?

French: If it’s a privately held company and there is some form of embezzlement, you create a report. You basically package up the prosecution’s case. Because, honestly, our local county district attorneys don’t have time to investigate and document financial fraud. It’s very difficult and time consuming. They don’t have the resources. They’re prosecuting violent crimes and thefts. So you package it up in a way that you can take to the prosecutor and the prosecutor can take it from there. But usually you’re not going to recover those funds directly from the wrongdoer. They’ve been spent on gifts and cars and vacations and stuff like that.

CPBJ: Is there insurance and the possibility of recovery that way?

Myers: Yes. There is employee dishonesty insurance.

CPBJ: And do you need that investigation in order to make any claim on that policy?

Myers: Yes. And when the corporation contacts the attorney, they’re going to reach out to the insurance company and put them on notice, saying, "Hey, we’re looking at this, we’re investigating this, we’ll come back to you with what we find." Ultimately what I’ve seen happen is the insurance company tries to go after the individual.

Dean: There also is a cyber insurance component. During the financial fraud, there may have been exportation of what we call disclosable data; they may have to pay to notify the public that there has been some type of disclosure.

French: The company has a legal obligation to notify persons whose data has been taken and then take steps to help to rectify that and provide them with credit and identity theft monitoring.

CPBJ: Do companies, public or private, generally disclose information to law enforcement? Do they have to?

French: It depends on the situation. If it is an embezzlement situation at small, closely held company, a lot of times they just fire the employee. They may try to get the money back, but they’re not willing to go so far as to prosecute. But when you’re dealing with substantial sums of money, I think, you owe it to the public to have these people prosecuted, because otherwise they’re going to do it to the next company.

But there is a real practical reason why you want to have the prosecutor step in and gain a conviction. When they are sentenced, they will be sentenced to make restitution. That restitution sentence can be turned into a civil judgment, which will travel with them. If they own real estate, it will be a lien on their real estate. And it will eventually lead, in some cases, to repayment in part or in full, if they sell their real estate, if they develop equity, if they come into some money somehow. And that is not very costly. You don’t have to pay a lawyer to get the judgement. You just have to pay them to take what the judge has already ordered in a criminal case and turn that into a civil judgment.

CPBJ: Are there other cases where you might want to keep a lid on the results and not tell anybody?

French: Where serious crimes have been committed, the management of the company has to make a determination: "Do I turn in the wrongdoer and gain cooperation credit so that we’re not prosecuted ourselves? Or is what they’ve done so bad and has it permeated the company so much that we’re not going to get any cooperation credit? We’re dead ducks either way." In that case, you just have to remain silent and wait for the prosecutor to do his or her job. But in most instances, you’ll at least have a chance of gaining cooperation credit at some level. In either case, the company can use the results of the investigation to take immediate steps to prevent further illegal activity and protect the company’s interest moving forward.

CPBJ: How long do investigations usually take?

French: It doesn’t take a year in most instances, but they’re all over the place depending on how sophisticated the criminal activity was.

Myers: My first one was a year and a half. But I learned a lot in that year and a half. Since then, a couple of months is the worst case.

Dean: Is there a benefit to doing an investigation if you plan to release that employee or if you were to fire the employee for a suspected fraud? Is it worth doing an investigation to avoid the lawsuit for a wrongful dismissal?

French: Yes, absolutely, although you can still get sued for firing somebody after you’ve conducted an investigation. However, the investigation should produce results that will help you make better decisions and provide evidence to help you win the case