Forensic Accounting in Cross-border Investigations

Introduction

The current economic climate is extremely challenging across almost all geographies and a wide range of industries. According to World Bank forecasts, the coronavirus will result in the global economy contracting by 5.2 per cent in 2020, the deepest global recession in decades. Growth in the Asia-Pacific region is forecast to slow to 0.5 per cent.^[1]

At present, economic stimulus is mitigating some of the economic impact of the virus. Despite this, we have already seen a number of high-profile corporate failures. In this environment, accounting issues are likely to be a key compliance risk for the foreseeable future.

The economic environment creates additional pressure on businesses to hit performance targets and meet the requirements of their investors and creditors. Pressure to hit numbers in struggling companies with weak cultures of compliance will almost inevitably result in accounting irregularities, which, left unchecked, could escalate into material misstatements. Lessons from past economic crises tell us that, in times of severe economic stress, fraud is both more prevalent and more likely to be uncovered.

Fraud in a downturn

Looking at preceding economic slowdowns around the world, major fraudulent activities have consistently been exposed shortly after stock market lows have been reached. As depicted in Figure 1 below, a number of significant fraudulent matters were revealed during economic downturns in the United States, Greater China and Japan.

Figure 1: Uncovering Fraud Amid Stock Market Drops

Source: AlixPartners

In certain notable instances, the value of the stock market or asset values more generally can be identified as the key factor in uncovering fraudulent activities or accounting irregularities. The Madoff case came to light after investors began withdrawing their funds following the stock market correction in 2008 in the wake of the global financial crisis. More recently, the extraordinary dip in oil prices in early 2020 placed unsustainable pressure on Hin Leong with huge ramifications. Hin Leong’s founder Lim Oon Kuin admitted in a court document to directing the company not to disclose hundreds of millions of dollars in losses. The investigation identified that the company had hidden over US$800 million of losses in derivatives trading over a period of 10 years.^[2] If oil had been trading at US$100 a barrel, it is possible the fraud would not have been uncovered.

In other cases, the stock market drop is a bellwether for economic contraction and the fraud is uncovered as businesses that were struggling are tipped over the edge by reduced liquidity. Accounting fraud typically starts small to plug a hole in an underperforming business with some ‘creative’ accounting. This can arise in many forms, but most commonly involves ‘borrowing’ some revenue from the next quarter. Analysis of public companies in the United States shows that improper revenue recognition is considered as the most commonly utilised fraud technique, followed by the overstatement of assets or capitalisation of expenses.^[3] If business performance improves and the gaps can be filled then this may never come to light. On the other hand, if the business continues to struggle and the holes in the accounts get larger, the pressure to meet targets and conceal past indiscretions means the scheme escalates to the point where a company is materially misstating its financial situation. In a downturn, more companies are exposed as liquidity dries up and the fraud often comes to light.

In this regard, as economic pressure mounts, we are already seeing accounting issues as a key area of focus and we can expect to see further high-profile cases. Managed earnings as well as aggressive and fraudulent accounting practices are likely to be an increasing reality.

How is it done and how does it surface?

Accounting fraud involves the manipulation of revenues and profits. Aggressive revenue recognition practices, while extremely serious and may result in the requirement to restate prior results, can be considered the thin end of the wedge. In the most egregious cases, revenues and profits are completely fictitious. Such ‘profits’ create corresponding assets that result in the secondary fraud to cover up the impact of the falsified profits. This can manifest in a number of ways, such as falsification of cash balances, inflation of asset values or falsified acquisitions.

A frequently used tactic of short sellers to question the financial statements of target companies is to contrast levels of debt with the amount of reported cash. Inflated cash balances can be disguised with more involved schemes, such as round-tripping involving undisclosed related parties. In this way, a small pool of cash can be used to support the much higher falsified balances.

Inflation or falsification of other asset balances can be more difficult to detect if well disguised. This is complicated by the fact that certain asset balances may be a matter of subjective accounting judgment. The valuation of property, an acquired business, collectability of receivables are all areas that can be manipulated or falsified. These risks are also heightened in times of economic uncertainty.

Asset valuations in a pandemic

Regulators’ and accounting bodies’ recent publications provide insight into likely areas of concern relating to accounting fraud and related issues.

On 3 March 2020, the Hong Kong Institute of Certified Public Accountant issued a guidance in relation to the financial reporting implications of coronavirus. In particular, the guidance asks entities to pay careful attention to any areas where estimates need to be made, including accounting for the measurement of net realisable value of inventories, the remaining useful life and residual value of assets and assessing whether an indication of impairment exists for non-financial assets.^[4]

Similarly, the SEC’s Office of the Chief Accountant issued a statement on financial reporting in light of covid-19, which lists accounting issues involving significant discretion and estimation due to the virus. The list of accounting issues includes fair value and impairment considerations, revenue recognition, going concern and subsequent events.^[5] The timing of the pandemic is particularly challenging when assessing asset values; the World Health Organization declared a pandemic in March 2020, which is precisely the time a large number of companies would be going through year-end audits.

A perfect storm for corruption

The Asia-Pacific region continues to see high levels of activity relating to familiar issues involving anti-corruption compliance. A prolonged slowdown and continued focus on China by international regulators mean this is likely to continue for the foreseeable future.

China has long been the focus of investigations and enforcement activity. There are several key factors that have combined to make the perfect storm for corruption in China: the importance of China for global business, China’s long-standing corruption problems, increased enforcement by regulatory authorities and, in recent years, China’s slowing growth. While China continues to see a large number of cases, the volume of investigations elsewhere in the Asia-Pacific is also significant. Increasingly, operations in South East Asia and India are attracting attention. It is no secret that China has been a priority market for multinationals and global private equity firms for many years. With the sheer volume of foreign investment, China’s chronic corruption problems have resulted in continuous and significant exposure as multinationals have entered and tried to navigate the Chinese market.

As corruption cases became more frequent and visible, multinationals started to require anti-corruption due diligence as part of any prospective deal. Concurrently, compliance programmes evolved from a simple ethics statement to a fully fledged package of detailed policies and supporting procedures. This evolution resulted in a growing awareness of anti-corruption issues among employees. As awareness of bribery and corruption issues increased, the methods for making and disguising corrupt payments evolved as well.

There has been a general shift in corruption-related schemes from relatively higher-volume and lower-dollar value schemes (excessive meals, gifts and travel), to relatively lower-volume and higher-dollar value schemes involving more creative, opaque approaches (such as increased use of third parties and schemes similar to those seen in embezzlement cases). One example of this involves the creative use of third-party consultants in response to greater scrutiny of fictitious supporting documentation, whereby a series of different third-party consultants are utilised over short periods for the same scope of work. A typical scenario may involve a consultant being hired by a company for a high-risk scope of work, such as interfacing with government officials. The consultant would issue valid, officially registered invoices, so an initial examination of the company’s books and records would present no red flags. However, the consultant would then depart after a brief duration (less than a year) and be replaced by another consultant with the same function and scope. In addition, these consultants would essentially be start-ups with no history, track record or recognisable presence in the market, highlighting the need for substantive due diligence on intermediaries and third parties. In these cases, companies have effectively attempted to outsource their bribery. As a result, investigations and compliance programmes have had to expand in scope to ensure third-party risk is being adequately addressed.

Foreign companies in China have put considerable effort and investment into building compliance and fraud-prevention programmes, but as the external pressures increase, more will need to be done to stay ahead of a rapidly evolving risk and threat environment. Companies need to reassess the effectiveness of their programmes to weather the coming storm. As political tensions between the United States and China continue to mount, much of the media coverage has focused on global supply chains and multinationals seeking to relocate operations outside China or accelerating the adoption of a ‘China plus one strategy’ where companies set up a new location in low cost countries, to diversify their supply chain and manufacturing operations. In recent years there has been a marked increase in the need for investigations in less developed jurisdictions, where economic conditions and compliance programmes lag behind China. This has led to an increase of investigative activities in India and Indonesia, in particular.

Heightened regulatory risks due to political tension

In recent years, Chinese firms in the technology sector have been subject to high profile regulatory actions in the United States. This trend is likely to continue for the foreseeable future. One interesting observation is the use of different levers. In the case of ZTE, the Department of Commerce put in place a monitor for an unprecedented period of 10 years in response to the company allegedly providing false information relating to disciplinary actions taken against employees as part of its original settlement agreement for sanctions violations. In contrast, Huawei is subject to the US Commerce Department’s Entity List, which prohibits suppliers from providing certain technology or software to Huawei. In July 2020, the UK government announced that it would ban Huawei’s equipment from the country’s high-speed wireless network.

With the passing of the Hong Kong Autonomy Act in July 2020 and sanctions against political leaders in Hong Kong, it is clear that the United States is willing to use sanctions as and when relations between the United States and China deteriorate. The scale and scope of the sanctions against corporate entities remains to be seen but companies operating in the region will need to conduct a thorough risk assessment of their potential exposure.

Remote data collections and investigations

At a time when financial and regulatory risk is at its most acute, investigations have been forced online as lockdowns, social distancing, quarantine policies and teleworking have become the new normal. Investigators need to adapt to the changing environment and adopt innovative approaches for data collection. It is now possible to conduct investigations entirely remotely, including gaining access to accounting and other company systems, imaging of laptops and mobile devices and conducting witness interviews by video call.

Data imaging of laptops and desktops can be coordinated logistically whereby investigators ship an encrypted hard drive containing the imaging tools to the custodian or clients’ IT department and arrange for an online video meeting to request remote access and control over that system for imaging. Likewise, the custodian can also ship the PC directly to the investigators for imaging with consent from the client and counsel.

Before undertaking any collection effort, it is important to understand how the email system platform is deployed. Emails can be directly downloaded from cloud-based email systems such as Microsoft O365 that eliminate transfer time and physical media shipment. Email systems deployed on premises generally will require assistance from client IT technicians as remote access is impossible for investigators.

As for mobile devices, the process of data collection is more complicated, so remote mobile device collections are not recommended. Under special circumstances, such as social distancing and border closures, the assistance of custodians may be requested to have remote control of the computer that is connected to the mobile device. In the worst case scenario, such as failure on remote imaging, the device may be shipped to the investigators for imaging under the advice of the legal counsel and with the consent of the custodian.

Technology-assisted review

With practical limits on the ability of for investigators to conduct on-site work, the importance of using technology to the efficient conduct of an investigation is more important than ever.

Technology-assisted review (TAR) – using machine learning as part of the document review process – has been accepted by courts in the United States and Europe for some time. The take-up in Asia-Pacific countries has been slower but has been gaining popularity owing to increases in data volumes and wider acceptance of the technology by forward-thinking law firms.

The latest TAR software has a number of different functions that can aid the review process. Typically, the process involves taking a set of reviewed seed documents from which the software will look for common factors and apply predictive coding to the remaining review population. This is then refined and validated through an iterative process until the software determines that the remaining documents do not need to be reviewed or, technically speaking, that the probability that the relevance of any document that has not been reviewed (by a human) is outside predetermined statistical parameters.

Critically, for investigations, in the Asia-Pacific region, the technology has demonstrated its efficacy when dealing with Asian languages. Yet, the concern around this technology is the perception that machine learning is a black box process. Investigators who are not familiar with the technology can be reluctant to move away from tried and trusted methodologies, as the technology used for traditional linear review has been in use for some time and is widely understood. A set of search terms can be agreed at the outset based on known issues and a review population is identified. From that point the progress of the review is relatively predictable. The review plan is straightforward and easy to communicate to stakeholders, including regulators.

Because of the challenges outlined above, a hybrid approach can be an effective way to defensibly accelerate the progress of an investigation. Firstly, the TAR software can be used as part of an early case assessment. The data visualisation functions quickly help investigators get an overall understanding of the data set and identify if there are any gaps in the data. For the review phase, the search terms can then be applied to the review population as in a linear review. TAR is then used not to predictively code, but to prioritise the review based on the results of an initial review of the seed set of documents. The advantage of this approach is that the machine learning will help to identify potentially relevant documents and push them up the review queue, meaning earlier identification of key documents. Compared with a linear review there is no downside, as the prioritisation can be managed at minimal incremental cost and is likely to lead to efficiency savings overall. This is particularly helpful when there are parallel workstreams such as witness interviews and analysis of structured data. Early identification can allow the investigation to quickly home in on the key issues.

Combining insights from multiple sources of data

One of the most time-consuming and, therefore, expensive aspects of an investigation is identifying links and analysis between different data sets, particularly between unstructured data (eg, invoices, bank statements, emails, chat messages, etc) and structured data (usually transactional data). An email might refer to the payment of an invoice, and the investigator then has to identify the payment in the structured data in a different system (or systems) by reference to the date or the invoice number. This can be particularly time-consuming, especially in the context of investigations where the list of suspect transactions could be voluminous, such as AML, corruption or accounting fraud investigations.

New tools are now available that can not only house structured and unstructured data in the same review platform, but also automatically make links between the two data sets. In practice, this means a reviewer can look at the contents of an email discussing a transaction and the actual associated transaction details with a few clicks. This can help to quickly validate findings as well as root out false positives, namely by filtering out emails that on first review might appear to contain issues, but are actually benign. The increasing complexity and sophistication of the issues faced by forensic investigators means investigators must equip themselves with the best available tools to uncover the issues in an efficient and cost-effective manner.

Capturing communications

The evolution of channels of communication and blurring of the lines between business and personal communications means relevant data can sit on multiple devices with multiple applications on each device. Capturing, processing and hosting email and other electronic data has been standard practice for a number of years but is no longer sufficient. The use of messaging applications for business as well as social interaction is now commonplace. For instance, the annual WeChat report issued by Tencent reported that 87.7 per cent of surveyed respondents use WeChat for work in 2017^[6] and the active accounts of WeChat amounted to 1.2 billion as of 2020 Q1,^[7] all of which equates to a significant amount of business conversations happening off email. Crucially these work-related conversations occur regardless of whether the device is issued by the company or is owned by the employee.

Conversations on messaging applications can be extremely valuable evidence precisely because bad actors are often now well aware that their corporate emails can be easily accessed and reviewed. In most cases, custodians tend to be less cautious when communicating over messaging applications, and such communications can be key to corroborating findings and insights from investigation into the financial records.

Conclusion

Covid-19 is first and foremost a humanitarian crisis. We are now starting to see some of the economic impact of the measures put in place to control the spread of the virus. Looking at preceding downturns, fraudulent activity was exposed shortly after the stock market’s low points. We can expect to see more major cases surface as economic and regulatory pressure build and frauds and corruption schemes are exposed.

Investigations are more challenging in a remote working environment with travel currently largely impractical. With these restrictions, having the right technology to access and derive insights from ever increasing volumes of data is more critical than ever to the successful and efficient resolution of the investigation.

Notes

^[1] The World Bank’s feature on the global economic outlook during the covid-19 pandemic.

^[2] Financial Times, ‘Hin Leong founder says $800m of losses not recorded’, 19 April 2020.

^[3] The Committee of Sponsoring Organizations of the Treadway Commission, Fraudulent Financial Reporting.

^[4] Hong Kong Institute of Certified Public Accounting, Alert 33 on Financial Reporting Implications of coronavirus, March 2020.

^[5] US SEC: ‘Statement on the Importance of High-Quality Financial Reporting in Light of the Significant Impacts of COVID-19’.

^[6] South China Morning Post, ‘WeChat is top workplace communications app for 90 per cent of Chinese professionals’, 25 April 2017.

^[7] Statista, ‘Number of monthly active WeChat users from 2nd quarter 2011 to 1st quarter 2020 (in millions)’, 20 May 2020.