Investigating Theft Acts and

Concealment
[2016/2017] 1st Semester Topic 6
Tunku Puteri Intan Safinaz School of Accountancy (TISSAUUM),
College of Business, Universiti Utara Malaysia
Dr. Oluwatoyin Muse Johnson Popoola, PhD, MBA, FCTI, FCA, CFA, RPA
Coordinator & Lecturer: A161 BKAB 3013 Forensic Accounting
Email: popoola@uum.edu.my
Tel: +6016 435 4874
11/13/16

Topics to Be Covered

11/13/16

When to
Investigate

Theft Acts
Investigative
Methods

Investigating
Concealment

When to Investigate

When to
investigate and
factors to
consider

11/13/16

Investigate when there is a

predication
Decision to investigate lies with
auditors, security personnel,
human resource personnel,
attorneys or even law
enforcement officials.
Factors to consider whether to
investigate or not include:
Perceived strength of the Predication
Perceived cost of the investigation
Exposure or amount that could have
been taken
The signal that investigation or noninvestigation will send to others in the
organisation.
3

When to Investigate

Factors to consider contd

Risks of investigating and not

investigating
Public exposure or loss of reputation
from investigating and not
investigating
Nature of the possible fraud

When to
investigate and
factors to
consider

11/13/16

Note: As you investigate, remember to

remain objective. Do not miss
potential indicators. Look at people
and evidence with professional
skepticism.

Theft Acts Investigative Methods

Theft acts are those activities that

directly investigate the fraud act.
These are
Surveillance and covert
operations
Invigilation
Obtaining physical evidence
Gathering electronic evidence

Note: Investigation should begin by

Theft Acts
Investigative
Methods

using techniques devoid of arousing

suspicion and most importantly will
not incriminate innocent people.

11/13/16

Theft Acts Investigative Methods

Theft Acts
Investigative
Methods

Steps to investigate Theft acts

include but not limited to:

Check personnel records or company

records for evidence of liens, or other
financial difficulties
Perform a special audit of the function
Search suspect(s) email and other
electronic records for communication
with external parties
Search public records and other
sources to gather evidence about the
suspect(s) lifestyle
Perform surveillance or other covert
operations
Interview former buyers and
unsuccessful vendors.

11/13/16

Theft Acts Investigative Methods

Theft Acts
Investigative
Methods

Steps to investigate Theft acts

include but not limited to:

Interview current buyers and if no

collusion with management is
suspected, interview the suspect(s)
manager(s).
Simultaneiously, interview the
suspected buyer and the suspected
vendor.

11/13/16

Note: Surveillance when properly

conducted is done without the suspect
or perpetrator(s) knowledge.

Theft Acts Investigative Methods

Develop
Vulnerability
Chart

11/13/16

It is important and useful to

develop theories about what type of
fraud could have occurred, the
possible perpetrators, their
motivations, and the extent of
fraud.
A vulnerability chart is a tool for
explicitly considering all aspects of
fraud and for establishing fraud
theories. A vulnerability chart
coordinates the various possible
elements of fraud, including:
Assets that were taken or are missing
Individuals who have theft opportunities
Theft investigative methods

Theft Acts Investigative Methods

Develop
Vulnerability
Chart

11/13/16

Concealment possibilities
Conversion possibilities
Symptoms observed
Pressures of possible perpetrators
Rationalization of perpetrators, and
Key internal controls that had to be
compromised for the theft to occur.

See Albrecht et al., 2012, p.213.

Theft Acts Investigative Methods

This type of investigative method

relies on senses, especially
hearing and seeing.
Surveillance or observation
means watching and recording
(on paper, film or magnetic tape)
the physical facts, acts, and
movements which form part of a
fraud.
Three types of surveillance are:

Stationary or fixed point

Moving or tailing
Electronic surveillance

Surveillance and
covert operations

11/13/16

10

Theft Acts Investigative Methods

Surveillance and
covert operations
Stationary or
fixed point

11/13/16

Stationary or fixed point

observations. This can be conducted
by anyone. The investigator should

Locate the scene that should be observed

Anticipate the action that is most likely to
occur at the scene
Keep detailed notes on all the activities
involving the suspect or record them on
film or tape. E.g. date and day of
observations, te name of the observer, the
names of corroborating witnesses, the
position from which the observation was
made, its distance from the scene, and the
time and observation began and ended,
along with the detailed time log of all the
movements, and activities of the suspect.

11

Theft Acts Investigative Methods

Moving or tailing

Mobile or tailing observation is more risky

than stationary surveillance.
Potential reward is high and may include
identifying the receiver of stolen goods or
the payer of bribes or kickbacks, the
chance of failure is high.
Tailing should be done by the
professionals.

Surveillance and
covert operations
Moving or
tailing

11/13/16

12

Theft Acts Investigative Methods

Electronic surveillance

Electronic surveillance of employees ,

using video cameras, is frequently used.
Wiretapping is only available to law
enforcement officers.
Electronic surveillance is useful in
kickback type schemes
Surveillance and covert operations are
normally legal as long as they do not
invade a persons reasonable expectation
of privacy under the Constitution.
Undercover operations are both legal and
valid provided they are not used as fishing
expeditions, though costly and time
consuming, it should be used with extreme
care and caution.
Requires training.

Surveillance and
covert operations
Electronic
surveillance

11/13/16

13

Theft Acts Investigative Methods

Invigilation
technique

Invigilation

It is a technique that imposes significant

controls to make fraud impossible to
commit for a period of time. This is a theft
act investigative technique that involves
close supervision of suspects during an
examination period.
During a fraud investigation, changes seen
between the control periods highlight
where fraud may be occurring.
The use of detail record keeping before,
during and after invigilation is significant
to this method of investigating theft acts.

11/13/16

14

Theft Acts Investigative Methods

Physical Evidence

This technique is useful especially in

inventory where physical stock can be
counted and missing inventory can be
searched for.
Gathering physical evidence entails
analyzing the objects such as inventory,
assets, broken locks, grease and fluids,
paints and stains; cutting marks, tire
tracks, and finger prints.
Searching computers

Physical
Evidence

11/13/16

15

Theft Acts Investigative Methods

Electronic Evidence

This technique, though a physical evidence is

usually termed Computer forensics.
The process for gathering electronic evidence
may vary from device to device.
It is necessary to work with IT personnel and
legal counsel because of the amount of
technical knowledge require to perform the
tasks correctly.
Process for gathering electronic evidence:
Secure the device and perform initial tasks
Clone the device and calculate a CRC
Checksum Adopt a Cyclic Redundancy
Check (CRC)
Search the Device manually
Search the device using automated
procedures. Albrecht et al. (2012, p.220-221)

Electronic
Evidence

11/13/16

16

Theft Acts Investigative Methods

Forensic
Software
Packages

11/13/16

Electronic Evidence

Forensic software packages are available for

investigative purposes. Examples include
Guidance Softwares EnCase Forensic
Edition, AccessDatas The forensic Toolkit
(FTK). These software support the task of
cloning, CRC calculations and searching using
a variety of methods.
Other open source packages are: e-fense Inc.s
Helix or Remote-Exploit.orgs BackTrack.
These software come with bootable CDS that
support the investigation and searching of
computers.

17

Theft Acts Investigative Methods

Electronic Evidence

Email systems prove to be an incredible

repository of communications between
suspects and other people.
A single email can become a smoking gun on
which an entire case is based.
Other sources include: Text messages, Chat,
Skype, Facebook, Instagram, etc.
Email is accorded special consideration
because copies often exist in many places: on
the sending computer, on the two or more
email servers involved in transmission, and
on the receiving computer.
Web-based email within a users browser is
especially difficult to search. E.g. Yahoo!,
Hotmail, Gmail. Once needs a warrant to
access.

E-mail Systems

11/13/16

18

Question & Answer

Invite questions from students

11/13/16

19

Summary
Discuss topics covered in Topic 6
Investigating Fraud
When to investigate
Theft act investigative methods

Reiterate welcome
Wrap-up

11/13/16

20

End of Class
Should you require further clarifications,
please feel free to see me on
CONSULTATION DAY at TISSA-UUM
Room 3.58, 04289 7303; or Email:
popoola@uum.edu.my; or WhatsApp:
+6016 435 4874.
Thank you. Terima Kasih.
Dr. Oluwatoyin Muse Johnson Popoola, PhD

11/13/16

21