Reseller News

The role of the forensic accountant

The Green Party recently called on the government to sign up to an accord that ensures financial transactions between the government and oil, gas and mineral companies are made public.

Green Party energy spokesman Gareth Hughes says there are "a number of mechanisms and instruments to promote openness and transparency in the energy sector", and "officials make publicly available information on all currently held".

"At the moment it's pretty hard to find that information if you're not a forensic accountant or tax expert."

This raises questions of what is the forensic accountant, what do they do, and how does that differ from computer forensic and the whole cyber crime specialist?

Wayne Kedzlie is a rare individual who covers both disciplines. He is a seasoned IT professional (programming, databases, BI, ERP) who has graduate and postgraduate qualifications in finance and accounting, and corporate and chartered accounting tenures on his CV.

“With the uttermost respect to the accounting profession, technical IT skills (databases, IT security, data mining, architecture, etc) are well outside the domain expertise of your classic accountant,” he says. “ And so for firms that offer forensic services, the forensic IT component is serviced by IT specialists, and the forensic accounting component by forensic accounting specialists. The required skills sets could not be more different.”

Kedzlie says the computer forensic specialist is all about the preservation and cataloguing of IT assets in the interests of a fraud investigation. This will invariably canvass emails, files and documents, images, and databases storing financial, billing and intellectual assets. Where computer forensic is about data preservation, collection and assembly, forensic accounting is about analysis and reporting.

“I had a lawyer in Court ask me whether my forensic work ‘would be described as basically straight copying the data onto hard drives’. Aside from trying not to laugh at the proposition, it indeed showed the knowledge gap between the lay-person and the sophisticated technologies and techniques that make up the arsenal available to the computer forensic specialist.

“The computer forensic specialist preserves the IT assets in a forensically sound way. This needs to occur as soon as fraud is suspected or, better still, as a planned programme of continuous testing for fraud through testing of physical and IT controls and the running of test investigations.”

He says there are very few organisations he has come across that take a proactive approach to fraud prevention. “Invariably we adopt the ambulance at the bottom of the hill approach, and at that stage, while a culprit might be held to account, the damage is well and truly done.

“Spinning hard drives overwrite data. The sooner those drives are preserved, the more likely data can be recovered. Put simply, nothing on a hard drive is ever deleted: the process of preservation and then the use of specialised forensic tools to identify and catalogue key data or chains of data is the key responsibility of the computer forensic specialist.

“First, we boot evidential computers direct from a USB drive, or we remove the drive from the machine, as it is important that the preservation process itself does not disturb the evidence. We then image the drive using industry approved technologies which delivers a forensically sound evidence that will stand up to the rigours of investigation and the Court processes.

“The second step in the process is building the case, reconstructing the paper trail, validating and or reconstructing the financials, reviewing the contractual and non-contractual elements around key transactions, identifying side letters and agreements, investigating conflicts of interest in the entity’s dealings, to determine whether fraud has occurred. This function falls squarely in the hands of the forensic accountant, who might not necessarily have or require a technical IT background, as the data cataloguing and data mining in the forensic exercise is already complete – the forensic accountant role is akin to investigative audit.”

Wayne Kedzlie's company, HardData, is a specialist, Wellington-based consultancy that has worked on a number of significant engagements, providing a range of computer and accounting forensic skills to individuals, corporates and government departments and providing expert testimony.