As a leader in forensic accounting and auditing, Dave Oswald was hired to look into suspected financial malfeasance when a privately owned company in North America was being considered for purchase by a private equity firm. Dave’s unique approach, years of experience and swift investigation ultimately led to the prosecution, sentencing and the payment of restitution with the judge indicating that without Dave’s testimony and findings this would not have occurred. Whilst this is not an unusual scenario this case provides a perfect study in how easily corporate fraud can take place in the workplace, and very often the culprit is the very last person you’d expect.
The CFO of the company, let’s call him ‘Kelly’, was often referred to as “the nicest guy in the room”. He had grown up in a home with an alcoholic gambling mother and a work-obsessed father, but had excelled in school. He had completed his CPA gaining outstanding marks and moved from company to company consistently climbing up the corporate ladder until he achieved this position as CFO. Under his stewardship, the companies financials were sound, receiving unqualified reports from the auditors, and achieving substantial growth. Kelly’s only blemish in an otherwise successful track record was a brush with the law when he was treasurer for a fraternity house, and some funds went missing.
Kelly became a person of interest when two weeks before closing the deal between the PE firm and the company, he was fired. The PE firm, worried about material misstatement of the financials tasked us to see if there were any errors in the financial statements that may affect the purchase decision.
We immediately attended the site where Kelly had his office and imaged the available computers. We also obtained a copy of his company credit card statements, emails, general ledger entries, and other relevant documentation. Unfortunately, Kelly’s personal computer was not on site, so the company contacted Kelly to let him know that someone would be sent to collect it. He informed them that he would leave the computer outside his front door for the company to collect, as he would not be home at the time
We earnestly began our investigation, and started by imaging the computers using EnCase software. The laptop used by Kelly contained a surprising lack of information. It appeared that he had removed the hard drive and inserted a new one in the computer. We checked the original purchase invoice for the computer, but the invoice was silent as to the serial number of the hard drive. As the hard drive was blank, apart from some random data, we concluded that he had not used commercialwiping software to erase the hard drive.
This was obviously a major cause for alert and as we suspected when the case went to trial, the defence used the argument that there was no chain of custody documents and that anyone could have replaced the hard drive. This argument placed doubt on the validity of the evidence. Fortunately, the replacement of the hard drive was not a critical part of our investigation as by this stage we had uncovered further damning evidence.
The trial judge concluded that it would have been unlikely for anyone to have replaced the hard drive on the porch, as he or she would have been more likely to remove the whole computer, but it could well have affected the admission of the evidence. This close shave to having evidence ruled inadmissible shows the critical importance of maintaining a chain of custody from the time the equipment is received from a suspect through to the court case.
When we began reviewing the evidence, we found numerous discrepancies:
- Duplicate fuel fills – up to three fuel purchases in a single day
- Multiple purchases of food outside of company policy
- The booking of hotels in the same city as Kelly lived
- The purchase of non work-related furniture
- The purchase of a Cadillac golf cart
- The purchase of multiple cars that were not in use by the company
- The purchase of regular home groceries
- Payment of personal medical expenses
We also interviewed a number of the staff working for the company. Unfortunately, Kelly refused to comply with a request for an interview.
In addition to the above, Kelly had made some further interesting choices. He had altered a cheque after the signing of the cheque. The cheque was originally cut for four thousand dollars, and signed by both signatories. Kelly then altered the cheque to read fourteen thousand by adding a ‘1’ to the number area, and informed the accounts payable clerk of the change, but never informed the other cheque signatory (Cheques above $10,000 would have required a different, higher second signatory at the firm). In the subsequent year, emboldened by his previous success he asked for another cheque of four thousand dollars, but this time changed the cheque to fourty (SIC) thousand dollars.
Kelly also paid himself a bonus. The company operated a share buyback scheme aimed at junior employees of the company. Kelly utilised the scheme to cash in some of his shares. It became apparent during the trial that Kelly had never qualified for this share scheme. In order to cover his tracks, when he presented the schedule at a board meeting, he included his payment ninth from the top of the document and thirteenth from the bottom of the document (just above the middle of the document). The placement of the amount is precisely the same tactic that is used by Nigerian 419 scammers when presenting documents, as people tend to scrutinise the top and bottom of a schedule but pay less attention to documents in the centre.
In order to try and remove himself from blame the defendant testified at trial that he did not know how his name ended up on there, although it was an email from himself., He stated “I don’t know what happened. I kept the money. I didn’t say anything about it.”” The Judge did not accept this argument and stated that “He knew it wasn’t approved”.
Having successfully paid himself his bonus, he decided to pay himself a second bonus. He managed to convince his assistant that he had been short paid, and should have been paid out at the majority company valuation and not the minority company valuation. The difference between the two amounts increased his bonus from two hundred to four hundred thousand dollars, a significant increase. To justify the amount to the payroll department, he sent himself a letter signed by himself stating that he was due that bonus.
The Judge stated that “we believe that the trial record certainly supports by a preponderance not only the total that was testified to by Dave Oswald, but the November 2012 bonus,”
This “nicest guy in the room” dark side even stretched to his co -workers. Kelly asked the board for a bonus of $50,000 for the head of insurance, Bob, based on the great work he had done in reducing the insurance costs to the company. The board approved the bonus but left it up to Kelly to inform him. Kelly encouraged Bob to share the bonus between his staff but informed him that the bonus was only $40,000. Bob, being the nice man he is, gave $10,000 of his bonus to his staff. Kelly then issued an instruction to the payroll department to pay $30,000 to Bob, $10,000 to his staff, and $10,000 to himself.
Following the success of this bonus skimming scheme, Kelly decided to apply for the same bonus ($50,000) for Bob, in the following year. Again the company agreed and Kelly told Bob that he had arranged for him to receive a $30,000 bonus. Once again Bob chose to split the amount with his staff, and this time Kelly took $20,000 but split $3,000 to give to his staff. (the trial judge was so incensed by the fact that Kelly had stolen from his coworkers that she ordered that the first amount of restitution be paid directly to Bob).
During the trial, the defence entered various documents and emails into evidence. One of these documents purported to be a conversation between Kelly and his assistant, relating to an email sent by the CEO to Kelly, authorising the second bonus. We immediately investigated the document and found that it was not in neither Kellys email or the assistant’s. The company employed Baracuda software as their email archiving system. As the Baracuda website states “Barracuda uses journal capture to secure an accurate and unmodified copy of each message at the time it is sent or received. These immutable copies are stored securely in a tamper-proof repository for as long as needed, without risk of corruption or deletion. You can automatically import historical email data to the archive, along with instant-message and other non-email data (appointments, contacts, tasks, notes), to provide a comprehensive archive of all data.”
The fact that this document was missing on the emails on the Barracuda backup system and the computer of the assistant led us to believe that Kelly had created the email himself. Following testimony about the creation of the email, which included an inconsistency with the fonts used, and that the email was not on the archiving system, Kelly was cross examined on the document and eventually admitted to manufacturing the email. The trial judge was particularly harsh in her summary of this set of events. She stated “There are also aspects of me that are just furious with what happened here, irritated that you so blatantly sat in this courtroom and lied to a jury, that you produced, it was clear from your lawyer’s face that he did not know until the moment it came out that you had produced, you had created this fake document that he had introduced. Moreover, the look on his face when he realised he had been used that way was a look of horror, and I felt bad.”
She went on to say: “I felt bad for your lawyer at that moment because I thought he has this reputation, and it’s a good one, and good lawyers don’t introduce fake evidence, and here he was all of a sudden with this very complicated problem on his hands because it sure looked to the rest of us like, uh-oh, you had dummied up some stuff and given it to your lawyer. And it certainly looked good on the outside, good enough that your lawyer would have believed you and trusted you this is what it was. I felt bad for him in that moment because you put him in a real tight ethics spot.”
At sentencing the trail judge stated “I did find credible the trial testimony of David Oswald, who was the forensic accounting expert” In ordering restitution from Kelly, the judge stated “So we believe that the trial record certainly supports by a preponderance not only the total that was testified to by Dave Oswald in his report”
The Judge was disappointed in Kelly for not pleading guilty “I wish very much that you had pled guilty because we would have many more options available to us had you made that choice.” She continued “I
mean, you committed fraud, basically, in every way you could commit fraud at this company.”she finally stated “I am going to impose here a sentence of 48 months’ imprisonment on each of Counts 1 through 5, with those sentences to run concurrently.” He was also ordered to repay $1.4 million in restitution.
So, how did Kelly get away with his fraud for so long? Firstly he was a nice guy, constantly providing his staff with positive feedback. He regularly took the staff to long lunches, ball games and other entertainment. As the firm operated 60 kilometres from the nearest large town, he helped staff with fuel, and even went as far as selling a car to one of the employees for $500, and another lucky employee received a car for the princely sum of $1. He purchased state of the art gymnasium equipment and created a staff gym at the firm. He also used fear to ensure that no one went against him. The financial centre was in a different state, miles away from the head office and there were always rumours that the office would close.. In this respect, Kelly acted as the “saviour of their employment”, constantly reminding staff how he had their backs from the nasty people at head office. Also, if any discrepancies were picked up by the accounting staff they really had no one else to go to. The controllers were all seen as close friends of Kelly, and head office had been portrayed as “big bad ogres” that would shut the financial centre at the smallest sign of problems
This case highlights how many avenues there are for internal fraud and how easily they can infiltrate into a company, often via “the nicest guy in the room”. If you suspect fraud in your organization give us a call, we can help identify, eliminate and litigate possible fraud.