The nicest guy in the room

The nicest guy in the room

They appear to be the nicest, most trustworthy individuals, but at the end of the day they are only in it for themselves

As a leader in forensic accounting and auditing, Dave Oswald was hired to look into suspected financial malfeasance when a privately owned company in North America was being considered for purchase by a private equity firm. Dave’s unique approach, years of experience and swift investigation ultimately led to the prosecution, sentencing and the payment of restitution with the judge commenting that Dave’s testimony was both credible and conservative. While this is not an unusual scenario this case provides a perfect study in how easily corporate fraud can take place in the workplace, and very often the culprit is the very last person you would expect.

The CFO of the company, let’s call him ‘Joshua’, was often referred to as “the nicest guy in the room”. He had grown up in a home with an alcoholic gambling mother and a work-obsessed father but had excelled in school. He had completed his CPA gaining outstanding marks and moved from company to company consistently climbing up the corporate ladder until he achieved this position as CFO. Under his stewardship, the companies financials were sound, receiving unqualified reports from the auditors, and achieving substantial growth. Joshua’s only blemish in an otherwise successful track record was a brush with the law when he was treasurer for a fraternity house, and some funds went missing.

Joshua became a person of interest when two weeks before closing the deal between the PE firm and the company, he was fired. The PE firm, worried about material misstatement of the financials tasked us to see if there were any errors in the financial statements that may affect the purchase decision.

We immediately attended the site where Joshua had his office and imaged the available computers. We also obtained a copy of his company credit card statements, emails, general ledger entries, and other relevant documentation. Unfortunately, Joshua had taken his work computer home with him when he was dismissed. Prior to appointing us, the company contacted Joshua to let him know that someone would be sent to collect it. He informed them that he would leave the computer outside his front door for the company to collect, as he would not be home at the time. When the company collected the computer they did not obtain a chain of custody sign-off from Joshua.

We earnestly began our investigation, and started by imaging the computers using EnCase software. The laptop used by Joshua contained a surprising lack of information. It appeared that he had removed the hard drive and inserted a new one in the computer. We checked the original purchase invoice for the computer, but the invoice was silent as to the serial number of the hard drive. As the hard drive was blank, apart from some random data, we concluded that he had not used commercial wiping software to erase the hard drive.

This was obviously a major cause for alert and as we suspected when the case went to trial, the defence used the argument that there was no chain of custody documents and that anyone could have replaced the hard drive. This argument placed doubt on the validity of the evidence. Fortunately, the replacement of the hard drive was not a critical part of our investigation as by this stage we had uncovered further damning evidence.

The trial judge concluded that it would have been unlikely for anyone to have replaced the hard drive on the porch, as he or she would have been more likely to remove the whole computer, but it could well have affected the admission of the evidence. This close shave to having evidence ruled inadmissible shows the critical importance of maintaining a chain of custody from receiving equipment from a suspect through to the court date.

When we began reviewing the evidence we found numerous discrepancies:

1) Duplicate fuel fills – up to three fuel purchases in a single day

2) Multiple purchases of food outside of company policy

3) The booking of hotels in the same city as Joshua lived

4) The purchase of non-work related furniture

5) The purchase of a Cadillac golf cart

6) The purchase of multiple cars that were not in use by the company

7) The purchase of regular home groceries

8) Payment of personal medical expenses

We also interviewed a number of the staff working for the company. Unfortunately, Joshua refused to comply with a request for an interview.

In addition to the above, Joshua had made some further interesting choices.

He had altered a cheque after the signing of the cheque. The cheque was originally cut for four thousand dollars, and signed by both signatories. Joshua then altered the cheque to read fourteen thousand by adding a ‘1’ to the number area, and informed the accounts payable clerk of the change, but never informed the other cheque signatory (Cheques above $10,000 would have required a different, higher second signatory at the firm). In the subsequent year, emboldened by his previous success he asked for another cheque of four thousand dollars, but this time changed the cheque to fourty (SIC) thousand dollars.

Joshua also paid himself a bonus. The company operated a share buyback scheme aimed at junior employees of the company. Joshua utilised the scheme to cash in some of his shares. It became apparent during the trial that Joshua had never qualified for this share scheme. In order to cover his tracks, when he presented the schedule at a board meeting, he included his payment ninth from the top of the document and thirteenth from the bottom of the document (just above the middle of the document). The placement of the amount is precisely the same tactic that is used by Nigerian 419 scammers when presenting documents, as people tend to scrutinise the top and bottom of a schedule but pay less attention to documents in the centre.

To try and remove himself from blame the defendant testified at trial that he did not know how his name ended up on there, although the origination of the list was from his own email. He stated "I don't know what happened. I kept the money. I didn't say anything about it."” The Judge did not accept this argument and stated that “He knew it wasn’t approved”.

Having successfully paid himself his bonus, he decided to pay himself a second bonus. He managed to convince his assistant that he had been short paid, and should have been paid out at the majority company valuation and not the minority company valuation. The difference between the two amounts increased his bonus from two hundred to four hundred thousand dollars, a significant increase. To justify the amount to the payroll department, he sent himself a letter signed by himself stating that he was due that bonus.

The Judge stated that “we believe that the trial record certainly supports by a preponderance not only the total that was testified to by Dave Oswald, but also the November 2012 bonus,”

This “nicest guy in the room” dark side even stretched to his co -workers. Joshua asked the board for a bonus of $50,000 for the head of insurance, Steven, based on the great work he had done in reducing the insurance costs to the company. The board approved the bonus but left it up to Joshua to inform him. Joshua encouraged Steven to share the bonus between his staff but informed him that the bonus was only $40,000. Steven, being the nice man he is, gave $10,000 of his bonus to his staff. Joshua then issued an instruction to the payroll department to pay $30,000 to Steven, $10,000 to his staff, and $10,000 to himself.

Following the success of this bonus skimming scheme, Joshua decided to apply for the same bonus ($50,000) for Steven, in the following year. Again the company agreed, and Joshua told Steven that he had arranged for him to receive a $30,000 bonus. Once again Steven chose to split the amount with his staff, and this time Joshua took $20,000 but split $3,000 to give to his staff. (the trial judge was so incensed by the fact that Joshua had stolen from his coworkers that she ordered that the first amount of restitution be paid directly to Steven).

During the trial, the defence entered various documents and emails into evidence. One of these documents purported to be a conversation between Joshua and his assistant, relating to an email sent by the CEO to Joshua, authorising the second bonus. We immediately investigated the document and found that it was neither in Joshuas or his assistant's email. The company employed Baracuda software as their email archiving system. As the Baracuda website states; “Barracuda uses journal capture to secure an accurate and unmodified copy of each message at the time it is sent or received. These immutable copies are stored securely in a tamper-proof repository for as long as needed, without risk of corruption or deletion.”

The fact that this document was missing on the Joshuas local computer emails, on the Barracuda backup system and the computer of the assistant led us to believe that Joshua had created the email himself. Following testimony about the creation of the email, which included an inconsistency with the fonts used in the email, and that the fact that the email was not in the archiving system, Joshua was cross examined on the document and eventually admitted to manufacturing the email. The trial judge was particularly harsh in her summary of this set of events. She stated “There are also aspects of me that are just furious with what happened here, irritated that you so blatantly sat in this courtroom and lied to a jury, that you produced, it was clear from your lawyer's face that he did not know until the moment it came out that you had produced, you had created this fake document that he had introduced. Moreover, the look on his face when he realised he had been used that way was a look of horror, and I felt bad.”

She went on to say: “I felt bad for your lawyer at that moment because I thought he has this reputation, and it's a good one, and good lawyers don't introduce fake evidence, and here he was all of a sudden with this very complicated problem on his hands because it sure looked to the rest of us like, uh-oh, you had dummied up some stuff and given it to your lawyer. And it certainly looked good on the outside, good enough that your lawyer would have believed you and trusted you this is what it was. I felt bad for him in that moment because you put him in a real tight ethics spot.”

At sentencing the trial judge stated “I did find credible the trial testimony of David Oswald, who was the forensic accounting expert” In ordering restitution from Joshua, the judge stated “So we believe that the trial record certainly supports by a preponderance not only the total that was testified to by Dave Oswald in his report but including the first bonus paid”

The Judge was disappointed in Joshua for not pleading guilty “I wish very much that you had pled guilty because we would have many more options available to us had you made that choice.” She continued “I

mean, you committed fraud, basically, in every way you could commit fraud at this company.”she finally stated “I am going to impose here a sentence of 48 months' imprisonment on each of Counts 1 through 5, with those sentences to run concurrently.” He was also ordered to repay $1.4 million in restitution.

So, how did Joshua get away with his fraud for so long? Firstly he was a nice guy, constantly providing his staff with positive feedback. He regularly took the staff to long lunches, ball games and other entertainment. As the firm operated 60 kilometres from the nearest large town, he helped staff with fuel, and even went as far as selling a car to one of the employees for $500, and another lucky employee received a car for the princely sum of $1. He purchased state of the art gymnasium equipment and created a staff gym at the firm. He also used fear to ensure that no one went against him. The financial centre was in a different state, miles away from the head office and there were always rumours that the office would close. In this respect, Joshua acted as the “saviour of their employment”, constantly reminding staff how he had their backs from the nasty people at head office. Also, if any discrepancies were picked up by the accounting staff they had no one else to report the matter to. The controllers were all seen as close friends of Joshua, and the portrayal of head office as “big bad ogres” that would shut the financial centre at the smallest sign of problems meant the staff overlooked the problems and just did as Joshua told them to do.

This case highlights how many avenues there are for internal fraud and how easily they can infiltrate into a company, often via “the nicest guy in the room”. If you suspect fraud in your organization give us a call, we can help identify, eliminate and help prosecute fraudsters.

Fraud Hurts, we make it better