A federal fraud statute known as the “honest services” statute, enacted in 1988, establishes that it is a crime for officers of a corporation to cause losses for shareholders by depriving them of their right to honest services by those officers.  Defense attorneys have argued that prosecutors have obtained convictions under this statute because it is too vague and, therefore, easy to charge and hard to defend. 

In August 2009, the SEC sued Bank of America, claiming that Bank management had lied to its shareholders in order to complete a $50 billion acquisition of Merrill Lynch, an investment company that was nearly bankrupt, while secretly paying several billion dollars in bonuses to Merrill Lynch executives.  In short, the Commission contended that the shareholders of Bank of America were the victims of fraud. The SEC action appeared to be an effort to enforce the law and bring justice to the shareholders of Bank of America who had been wronged by management.  When the SEC and Bank of America reached an agreement to settle the suit through payment of a $33 million fine by the Bank, federal Judge Jed Rakoff shocked both sides by rejecting the settlement and advising them to be ready for trial by February.

Even though Al Capone was known to have perpetrated many heinous, violent crimes, in addition to what we today would consider white collar crimes, he was finally nabbed by a forensic accountant , and sent to prison (for years, but not for the rest of his life).  But in some parts of the world, those in power who bilk others out of their money may be incarcerated for life, or even executed. 

Elliot Ness.  J. Edgar Hoover.  Al Capone.  Frank Wilson.  Wait, Frank who?  Frank Wilson – likely the first and most famous forensic accountant ever known.

It’s hard to picture the dramatic closing court scene of Law & Order being centered around an accountant, but as their stories are ripped from the headlines, this is more likely to appear in an episode a la Bernie Madoff's Ponzi scheme or the like. The specialty area of forensic accounting has opened up the scope of accounting, and features more intriguing services and characteristics beyond accounting and auditing; requiring skills and tools utilizing quantitative methods, finance, law and research – like investigative accounting detective work.

Those who question the value of independent audits and investigations by certified public accountants and certified fraud examiners may wish to consider a court case recently initiated by the SEC.  On July 6, 2009, the SEC filed a complaint in United States District Court alleging that the former CFO of UCI Medical Affiliates, Inc., a public company based in South Carolina, had embezzled nearly $3 million from the Company.  The Complaint alleges that the embezzlement was conducted utilizing company credit cards, fraudulent expense reports and altered invoices and resulted in fraudulent financial statements and SEC filings.  An internal investigation began in December 2008 when the Company’s independent auditor reported to the Company’s audit committee and raised concerns about certain financial transactions.  The audit committee authorized an investigation by the auditor and that investigation revealed additional irregularities.  As a result, the Company terminated the CFO and reported the internal investigation to the SEC which is now pursuing the matter in the United States District Court.
http://www.sec.gov/litigation/complaints/2009/comp21119.pdf

On July 10, 2009, Irving Picard, the court-appointed trustee who is overseeing the liquidation of Bernard Madoff’s assets and repayment of funds to those he defrauded, has officially reported what many have suspected since news of the fraud first broke.  Picard reports that it is unlikely that investors can be made whole on their losses because there simply are not enough assets to satisfy all of the claims.  Picard further reports that unraveling the mess will be a monumental task as Madoff has scattered assets throughout the world.  From the beginning, it has been suspected that the extent of the fraud and the whereabouts of all of the stolen assets may never be fully determined.
http://www.abcnews.go.com/Blotter/Madoff/story?id=8052999&page=1

As we discussed in Part 1 of this series of articles, when management of an organization relies solely on an annual audit of its financial statements by an independent CPA firm as its protection against occupational fraud, the organization is probably not nearly as well protected as management believes.  While an annual audit is a good idea, it must be supplemented by other fraud prevention policies and procedures.  One of the best steps management can take is to create, implement and maintain a strong system of internal controls.

What exactly is a system of internal controls?  Simply defined, a system of internal controls is the policies and procedures adopted by an organization to achieve two basic goals – safeguarding the assets (resources) of the organization and promoting accuracy and reliability in the accounting records.  Management of an organization that safeguards its assets and makes decisions based on reliable accounting information is much more likely to maintain a healthy and effective entity than the management of an organization that downplays the value of internal controls.  And, a potential benefit of good internal controls is the detection and prevention of occupational fraud that can drain an organization of its resources.

According to a survey conducted by the Association of Certified Fraud Examiners (ACFE) in 2008, 23% of documented occupational frauds were initially detected by the system of internal controls.  As mentioned earlier, only about 9% of documented occupational frauds were detected by independent auditors.  Does this mean that a strong system of internal controls is more effective in preventing fraud than an independent audit?  Perhaps it does.  After all, as stated above, one of the basic objectives of the system of internal controls is the safeguarding of assets.  But, that statistic may also demonstrate that organizations with strong internal controls detected fraudulent activity and dealt with the situation before the independent auditors ever arrived.  If this is the case, then there is probably no better justification for a strong system of internal controls than the potential to detect and eliminate fraud in its early stages.  Common sense will tell you, as will any Certified Fraud Examiner (CFE), that the earlier a fraud is detected and stopped, the lower the ultimate cost to the organization.

So, what does it take to have a strong system of internal controls?  There are two basic requirements to achieve that end.  First, the system for any organization must be appropriately designed to be effective for that organization.  Many times as we perform services as CPAs or as CFEs we study the system of internal controls of an organization and find that it is so poorly designed and has so many shortcomings that the chances of it being effective are minimal.  And, conversely, the chances of theft or misappropriation of assets are optimal. There is no such thing as a generic system of controls.  Every system must be tailored to meet the needs of the individual organization and when management of an organization designs its system by copying the system of another organization, they may well be setting themselves up for disaster.

The second requirement for a strong system of internal controls is that it must be properly implemented and maintained.  Obviously, no matter how well designed the system is, it will not be effective if it is not followed.  Sometimes members of management take great pride in the design of their system of controls and operate with great confidence in its effectiveness.  They are often appalled to learn later, sometimes after the discovery of fraud, that their brilliantly designed system was never actually implemented or has not been followed by their staff.  Perhaps the staff did not understand what they were required to do, or perhaps they did not see the point and decided that the required procedures were not worth the effort.  Whatever the reason, a system of controls, no matter how well designed, will not be effective if it is never implemented or if it is not maintained as designed

Next Topic: Specific Misconceptions about Internal Control