Banking Industry: Executive-Level Financial Fraud

A large accounting firm was hired to audit certain activities related to loans to individuals on the Board of Directors of a medium size, publicly traded bank (the “Bank”). During the Audit, the auditors needed to examine several computer systems used by certain Bank employees as well as by certain Board Members. GDF’s digital forensic examiners were immediately dispatched and sent in to arrange for the forensic analysis of the computer systems and to search for corroborating evidence in support of the audit team’s suspicions and findings. The systems GDF analysts forensically analyzed included laptop computers issued to managers in the loan origination department, desktop systems used by managers and board members. Email (Exchange) servers as well as Voicemail Systems were examined.

In the previous two years, the Bank had gone through a series of transitions, culminating in a new Board of Directors and, because of new regulations in the financial industry, an independent Auditing Committee was appointed. The Auditing Committee charged certain officers of the Bank with engaging in suspect activities related to particular Bank expenses and loans that were either hidden or “lost” from the purview of the normal Bank’s accounting practices. In order to stay compliant and to remedy what may have been “bad apples” in the organization, the Bank’s Auditing Committee required the Board to hire an independent accounting firm to review those issues and present a formal report to the Bank. Because of the immense time pressure to solve those issues before the Bank was to release its next mandatory financial statement, a concise but thorough plan for reviewing expense and loan records as well as applications, approval processes and a multitude of other financial data stored in electronic as well as paper form. There was also an enormous volume of paper documents that the accounting firm was reviewing and needed to validate and review those documents against information gleaned from the digital examination as well. Because of the Bank’s size and market capitalization, it did not allocate surplus funds for this type of situation and cost factors were in the forefront, but could not guide the investigation on any substantive level for fear of bias and a lack of diligence.

Immediately upon being retained GDF analysts reviewed the computer systems with the bank's IT department. After meeting with the audit committee and determining the focus of the audit and what was available in paper versus electronic GDF analysts worked with the auditors to design a methodology that allowed for an in-depth forensic analysis of the electronic data and documents that virtually eliminated duplication of efforts by the forensic accountants by providing them with data and reports in electronic format that could be easily reviewed and audited.

GDF analysts were also able to utilize Computer Forensic Techniques to recover digital artifacts from the laptops and desktops of the suspect bank employees and board members. These forensic artifacts included email and documents exchanged through various free web based email accounts. These accounts were used to send and receive information on several mortgages and loans that were approved for “friends of the bank” that would normally have been denied or issued at substantially higher interest rates.

GDF correlated computer artifacts, deleted messages and documents with records supplied by the Bank's IT department. The review included SunGard systems, internally developed and commercial banking applications, database logs and a Unisys mainframe. Non-standard reports helped the accounting team examine loan applications, approval criteria and user activity that standard reports did not show.

The accounting team and Bank decision-makers used the technical reports in their review of suspected policy violations. Employment, loan, settlement and regulatory decisions belonged to those parties. Technical reports do not themselves determine legal compliance, quantify every saving or guarantee a filing outcome.

This account describes the loan and approval records. The related internal corporate fraud account emphasizes expense review and missing historical logs. Their shared details should not be counted as independent proof of two additional client results.