By Maria F. Boodoo, CPA
When something in a company is amiss financially, CPAs may be part of the team responsible for tracking down the problem. If an illegal act or wrongdoing within a company is suspected, an internal investigation is usually the first step so management can get an idea of what they are dealing with. Whether you are a CPA on the internal audit group, a hired forensic accountant, a part of the audit committee, or a member of management, this column outlines some basic principles of internal investigations that all CPAs should understand.
Team Work
Internal investigations often involve in-house general counsel, regular outside counsel, independent legal counsel, and forensic accountants. The company’s audit committee, depending on the extent of the investigation, will often oversee the investigation. The company’s external auditor also may be involved, approving the selection of the forensic accountants and their work plan as well as conducting a shadow investigation.
A shadow investigation refers to the external audit team’s review or "shadow" of the investigation performed by independent forensic accountants. The external auditor will assess the adequacy of the nature, extent, and timing of the forensic procedures performed. Oftentimes, larger public accounting firms have personnel with specialized forensic skills to conduct this review.
The Investigation
Companies must be cognizant of the fact that the net of an internal investigation must be cast wide enough to determine the extent of the illegal act or wrongdoing. Through this good-faith effort, companies may possibly mitigate harsh penalties meted out by regulatory authorities. Multiple factors will be considered, including, but not limited to, all the issues that may be affected by the suspected wrongdoing, such as accounting and financial disclosure issues. Possible examples include a freeze on all documents subject to the investigation to prevent destruction, a potential list of suspects or conspirators, a schedule of interviews of employees who may have information pertaining to the investigation, and an evaluation of the size of the investigation, including the number of departments or locations.
Once an investigation is under way, the steps may not always be linear. However, there are usually key processes that exist in any investigation. A forensic accountant, member of an audit committee, or an external auditor all need to know what these steps are and what they entail.
Follow a workplan - A workplan that addresses the scope of the issues must be developed. This plan should address the techniques to be used to gather the information, the sources of data to be collected, and the methods used to manage the investigative process, people, and documents. The plan may change over time as new information becomes available.
Define the extent of internal audit’s involvement - Those leading the investigation will decide to what extent the internal audit function will be involved in the investigation. Internal audit’s involvement could potentially impair the independence of the investigation. If internal audit resources are used, the audit committee will detail its relationship with the external forensic accountants, if applicable, and the degree of reliance that will be placed on internal audit’s work.
Communicate with employees - Communication with employees and those outside of the organization must be considered and carefully planned, especially if it involves a public company. Information contained in such communications must not be rushed. Oftentimes there is a rush to tell people the extent of problems before the problems are completely understood and quantified.
Gather relevant documents - Preventing the destruction of useful and relevant documents to the investigation is vital. The investigation should involve the technology department to preserve electronic documentation found on desktop and portable technology, such as handheld devices and laptops. Additionally, as backups and archives are sometimes retained for only 90 days, management should consider extending the document retention policy at the start of the investigation to prevent files from being auto-archived, sent to a backup facility, shredded, or recycled.
Conduct interviews - Those performing the investigation should follow key principles to conducting sound interviews. These include preparing discussion points prior to the interview, having at least two interviewers in the room, choosing the right location and setting to avoid distractions, and monitoring the interviewee’s body language.
Document the investigation and its conclusion - The format and content of the report, and the parties who will view the report, should be established during the investigation’s planning stages. Reports may be oral (to preserve legal privileges) or written. Reports should detail the investigative methodology, the technologies employed, a summary of the documents gathered, a list of persons interviewed and third parties used, results of the analysis of evidence, and a conclusion. Recommended remediation actions may also be included.
An internal investigation is one that involves a collection of basic, but important, procedures. The successful investigation will be one where the right procedures are used and followed in the proper order to create a clear set of data that can be used for the conclusion of the investigation. CPAs, no matter what their role within, or in relation to, a company, need to know what these procedures are in case they are called upon to participate in an internal investigation.
Maria F. Boodoo, CPA, is an auditor with FTI Consulting in King of Prussia, and is a member of the Pennsylvania CPA Journal Editorial Board. She can be reached at mariaboodoo@yahoo.com.
Copyright 1998-2008 PICPA. All rights reserved. Contact journal@picpa.org for reprint permission