Litigation and Enterprise Case Study

Internal Corporate Fraud

A large accounting firm was hired to audit certain activities by officers of a medium size, publicly traded bank (the “Bank”). During the investigation, the auditors needed to examine several computer systems used by certain Bank employees. GDF’s digital forensic examiners were immediately dispatched and sent in to arrange for the formal examination of those systems to search for corroborating evidence in support of the audit team’s suspicions and findings.

Corporate Examination

Bagged hard drive beside a forensic write blocker.
Matter type
Corporate Examination
Evidence involved
computers; network and access logs; financial and transaction records
Deliverables
forensic examination report

Matter Background and Technical Dispute

In the previous two years, the Bank had gone through a series of transitions, culminating in a new Board of Directors and, because of new regulations in the financial industry, an independent Auditing Committee. The Auditing Committee charged certain officers of the Bank with engaging in suspect activities related to particular Bank expenses that were either hidden or “lost” from the purview of the normal Bank’s accounting practices. In order to stay compliant and to remedy what may have been “bad apples” in the organization, the Bank’s Auditing Committee required the Board to hire an independent accounting firm to review those issues and present a formal report to the Bank. The accounting firm knew that one of the best ways to get to the true facts at the root of those issues was by performing a thorough examination of the Bank’s digital assets.

Since the Bank had in place a host of disparate and complicated IT systems, and because of the immense time pressure to solve those issues before the Bank was to release its next mandatory financial statement, a concise but thorough plan for reviewing those digital assets was needed. Complicating matters further was the fact that certain systems run by the Bank’s IT department had been recently changed and many logs and historical records regarding pertinent information were non existent.

There was an enormous volume of paper documents that the accounting firm was reviewing and needed to validate and review those documents against information gleaned from the digital examination as well. Because of the Bank’s size and market capitalization, it did not allocate surplus funds for this type of situation and cost factors were in the forefront, but could not guide the investigation on any substantive level for fear of bias and a lack of diligence.

The accounting firm retained GDF to perform examinations of the Bank’s digital assets as necessary to uncover information that potentially would help the Bank make an ultimate decision regarding how it should proceed with the employees and Bank officers suspected in the wrongdoing.

Resolution and Courtroom Outcome

GDF examined selected desktop and network systems and data supplied by the Bank's IT department. Examiners catalogued documents, fragments and Internet related activity relevant to the accounting team's questions. The collected records supported corroboration of aspects of the expense audit while missing logs limited the historical record.

The Bank's audit committee, counsel and accounting team were responsible for employment, settlement and filing decisions. The useful technical output was an organized record with the gaps identified.

This account describes expense records and gaps caused by system changes. See the related banking loan account for its loan approval focus.

Related

Complementary Forensic and Security Services

Confidentiality

Client identities and sensitive details are omitted. The organization is described generically, and no client mark appears on this site. Details are preserved from the original case record.

Talk with an examiner

Consult a Senior Examiner on An Internal Expense Forensic Analysis

Outline the expense questions, systems involved and known gaps in historical logs. We arrange a secure way to share evidence after we speak.

Since 1992 · 24/7 dispatch · Court tested experts

Or call (800) 868-8189

Email or phone is required. For an active incident, please call. Read what we send with the request.

Talk with an examiner

Request a Confidential Case Assessment

Call to discuss timing, scope and the safest way to share information.

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .

Privacy center

Choose your site settings

Optional technology stays off until you choose otherwise. You can change these browser settings at any time. Access to the core site does not depend on optional technologies.

Technology preferences
Sale or cross-context sharing: not used GDF does not sell or share website personal information for cross-context behavioral advertising.