how to conduct an investigation · • certified information technology professional (citp) ......

How to Conduct an How to Conduct an InvestigationInvestigation

Hector Collazo Jr.Inspector General/Chief Audit Executive

727-464-8371727 464 [email protected]

Questions

2

It is important to point t th t thout that these

policies & procedurespolicies & procedureshave evolved over time and continue to evolve.

3

GET OVER THE FEAR

InvestigationInvestigation(Th W d)(The Word)( )

4

INVESTIGATIONS ARE SIMILAR TO AUDITS

step in step in establishing an establishing an

effective effective investigative investigative

processprocess

6

Inspectors GeneralProfessional Investigative StandardsgPrinciples and Standards for Offices of Inspector GeneralAssociation of Inspectors General

Florida Inspectors General Standards Commission for Florida Law Enforcement Accreditation (CFA)

9

Investigative Forms

11

Investigate allgcases as if they ycould develop p

into a

13

You Do Not W t T Want To

Jeopardize Jeopardize Potential Potential

Prosecution

14

U th i t h i f t d•Use the appropriate chain of custody P&Ps for evidence obtainedSt id i d•Store evidence in secured area (restricted access)V l t I t i F•Voluntary Interview Form

•Voluntary Statement FormN U G it F DO YOU KNOW•Never Use Garrity Form. DO YOU KNOW WHY?

All statements obtained afterAll statements obtained after issuing a Garrity to an g yemployee cannot be used against them in a criminalagainst them in a criminal investigation. g



processprocess

17

I ti ti P li i & P d•Investigative Policies & Procedures•Conducting Investigations•Investigative Interviews

•ACFE•FLETC

18

• Certified Public Accountant (CPA)• Certified Fraud Examiner (CFE)• Certified Internal Auditor (CIA)

C tifi d I f ti S t A dit (CISA)• Certified Information System Auditor (CISA)• Certified Government Finance Officer (CGFO)• Certified Inspector General Auditor (CIGA)• Certified Inspector General Investigator (CIGI)p g ( )• Certified Fraud Specialist (CFS)• Certified Inspector General (CIG)• Certified in Risk and Information Systems Control (CRISC)• Certified In Risk Management Assurance (CRMA)• Certified In Risk Management Assurance (CRMA)• Chartered Bank Auditor (CBA) • Certified Commercial Lender (CCL)• Certified Information Technology Professional (CITP)• Certified Anti-Money Laundering Specialist (CAMS)• Chartered Global Management Accountant (CGMA)• Certified Florida Law Enforcement Officer (CLE)

19



processprocess

20

N d T B P dNeed To Be PreparedBefore The Call Comes

InvestigativegGo Kit?

23

Investigative Go Kit

24

NOTARY LAPTOP

FORMS

PRINTER

CAMERA

INVENTORIED MONTHLY

FORMS

BATTERIESBATTERIES

25

Investigative Tools

26

Computer ForensicsInvestigative ToolsInvestigative Tools

27

Investigative Tools

IT Security Can Be Your Best Friend• Phone Logs (in coming and out going)• Phone Logs (in-coming and out-going)• Remote Imaging of Networked Computers’ Hard DrivesHard Drives

• Access to Databases

28

Investigative Tools

•Surveillance (The Word)•Surveillance is normally the planned observation of individuals, but may also include places.

29

Surveillance

30

Surveillance

IG WASTEIG WASTESYSTEMS,

INC.

31

Investigative Tools

InterrogationsInterrogations(Th W d)(The Word)( )

32

Be Prepared Prior ToBe Prepared Prior ToRespondent Interrogations

•Two per interview team•Gather evidence and background information before the interviews•Do not read a script•Limited note taking•Open ended questions•Let the Interviewee talk (limit interruptions)I t i i d•Interviewing order

1. Complainant (if known)2. Witnesses3 Respondent Last (at end of investigation) You3.Respondent Last (at end of investigation). You

Should Know The Answers To Your Questions

Be Prepared Prior ToBe Prepared Prior ToRespondent InterrogationsRespondent Last (at end of investigation).

You Should Know Their Answers To Your Questions

•Conduct Interviews at EE work locations;

S Q(Be Prepared).

however, you need to “OWN THE ROOM” (WHY?)

•Voluntary Interview Formsy•Voluntary Statement Form•Garrity Form (management standing by)

Interrogation



processprocess

37

B f b i i fi ld k i i i i

Preliminary Audit Investigative Planning Before beginning any fieldwork on any investigative assignment, it is important to begin the preliminary investigative planning process through:

•Obtaining knowledge about the nature of the operations, the respondent, and a general idea as to the scope of the investigationinvestigation.

•Although investigative planning is a continuous process, preliminary investigative planning is of high importance.p y g p g g p

•Preliminary investigative planning culminates in the investigative plan containing the overall investigative objectives and a time frame for doing the investigation as well as any special problems that will be encountered.



processprocess

40

Start The Paperwork (P&Ps)

stepstepin establishing an effective in establishing an effective

investigative process

START THE INVESTIGATION

44

Solid Waste Call (BCC)

47

Solid Waste Call (BCC)1. Scale house operator was short $140 in cash receipts and was

bl l i h h M i d hunable to explain the shortage. Management summarized the irregularity was a result of reprinting earlier completed cash transaction tickets instead of inputting a new transaction. Customers would sign the reprinted ticket unaware that it was notCustomers would sign the reprinted ticket unaware that it was not entered as a new transaction in the Autoscale system. Respondent would then destroy the reprinted tickets and steal the cash ($10 and/or $20 for each reprinted ticket) Confrontedcash ($10 and/or $20 for each reprinted ticket). Confronted Respondent who denied and resigned.

2. In this case, department management referred case; therefore, , p g ; ,you do not have to be concerned with them discovering you are conducting an investigation.

3. Requested management preserve all the records and summarize the events.

48


4. Immediately go onsite (first impressions are very important)•Dress in Suit/Pantsuit (dark) •Why you ask?• It establishes a professional and credible relationship b t t d th l !between you, management, and the employees!

49


Cash T tiTransaction

Tickets

50


5. Meet with management, review issue, and tour operations where theft occurred (informal risk assessment).

6 Since management was aware reported and6. Since management was aware, reported, and employee resigned, what is the next step?

7. Determine if other Solid Waste Scale House operators had exploited this internal control weakness (reprinting tickets).

51


8. Informal Risk Assessment resulted in request for:q• All original transaction tickets, customer data, weight of load, and cash

and check payments made by the customer (last two years)• All daily Scale House transaction reports• Copy of surveillance camera footagey g• Confiscated DVR (30 day capacity)• List of all Scale House EEs and their personnel files• EE work schedules• Scale House policies and procedures manual• Unannounced informational interviews of Scale House supervisors

and manager• Requested secured office space by Scale House

9. Conducted an analysis of transaction tickets to daily transaction reports.

10. Reviewed hundreds of hours of surveillance videos.

11. Conducted Unannounced informational interviews of EEs and supervisors.

12. Observed Scale House operations.

52


Confiscated the DVR

Remember To Secure Secure

Evidence

53


54


13 Tentatively identified potential EEs that may have exploited13. Tentatively identified potential EEs that may have exploited this internal control weakness.

14 Conducted Unannounced first soft interrogation of suspected14. Conducted Unannounced first soft interrogation of suspected employees.

15. Regrouped and identified one additional suspect.g p p

16. Informed management we had an additional suspect.

17. Planned for final interrogation of suspect:•Management requested to stand by to place EE on administrative leaveG th d id d IG i t i f•Gathered evidence and IG interview forms

•Secured conference room for interrogation

55


18. Unannounced Interrogation (3½ hours) at EE work location

• Informational and conversational in the beginningg g• Became confrontational and accusatory• Denied, changed stories, made excuses• Implied he may have in error (did not confess)• Became concerned about job• Ended interrogation

56


19. Unannounced Interrogation (3½ hours)

•Management placed individual on paid Administrative Leave•Management placed individual on paid Administrative Leave until conclusion of investigation

•Respondent called in next day and resignedRespondent called in next day and resigned

57

LOOK AT THE WHOLE PICTUREScope Of Investigation Can Be ExpandedScope Of Investigation Can Be Expanded

58

LOOK AT THE WHOLE PICTUREScope Of Investigation Can Be ExpandedScope Of Investigation Can Be Expanded

59

#1INVESTIGATION

60

#2#2REFERRED TO PINELLAS

COUNTY SHERIFF’S OFFICEOFFICE

61

#3CONDUCTED AN INTERNAL CONTROLS REVIEW

62

Landfill Tipping Fees

IG STAFF OBSERVATION

No No Modifications

Allowed

The Abuse Of The $10 Single Axle Flat Rate Fee ByLandfill Tipping Fees

The Abuse Of The $10 Single Axle Flat Rate Fee By Commercial Haulers Is Costing Solid Waste An Estimated

$1 Million Annually In Lost Revenues.

N No Modifications

Allowed

Landfill Tipping Fees

Standard Single Axle

Tandem (double) Axle

Landfill Tipping Fees#4

OBSERVATIONOF FLAT RATE FEE OF FLAT RATE FEE

PROCESS

RAISED A RED FLAG

ISSUE ADDED TO

No

ISSUE ADDED TO ANNUAL AUDIT PLAN

No Modifications

Allowed

Community Service Call (Clerk)

68

1. Judge upset that he was being contacted by a Clerk employee regarding


g p g y p y g gsubmission of documents for community service (late). Clerk management reviewed and noticed records (Clerk EE) in system had been changed.

2. Requested management preserve the records and summarize the events.q g p

3. Determine what changes occurred in the system.

4. Assessment:• Developed timeline of events• Pull all the records related to Clerk EE and Community Service

5. Unannounced informational interviews of community service provider:y p• Reviewed application requirements• Reviewed copied forms used

6. Pulled traffic history of Clerk EE.y

7. Unannounced informational interviews of Clerk EEs involved with Respondent’scase.

69

8. Regrouped and planned for interrogation of suspect:


g p p g p• Management stand by to place EE on administrative leave• Gathered evidence and IG interview forms• Secured conference room for interrogation

9. Unannounced onsite visit (first impressions are very important).

10. Unannounced interrogation (20 minutes):• Interrogation at EE work locationg• Informational and conversational in the beginning• Became accusatory• Confused (no excuses)• Lied when asked about community service two years earliery y• Confused again (no excuses)• Signed confession• Concerned about what management will do• Requested if she could resign then and there to IGq g• Ended interrogation• Escorted• Office impression of events

72

• Employees are concerned about what management will dowill do

• Regularly request to resign on the spot andresign on the spot and only to IG

Y d t b dYou need to be prepared to accept on the spot p p

resignations!

76

Interrogations

It’s OK to FeelSador

C fli t dConflictedIt’s Normal!It s Normal!

Document All Interrogations & Interviews


WHY WHY, YOU YOU ASK?ASK?


P&Ps Require ItAnd

You Need To Be Prepared For Legal orAdministrative Action, Administrative Action, Records Requests, etc.

#1INVESTIGATIONINVESTIGATION

82

#2Referred To State Attorney’s Office For A Review Of The Office For A Review Of The

Facts For Potential Prosecution

83

Credit Card Call (BCC)

85

1 Th R d t’ d i k d b th Pi ll C t A i l S i


1. The Respondent’s dog was picked up by the Pinellas County Animal Services Department because Respondent had been arrested. The officer was dispatched to pick up the dog; he scanned and confirmed the dog had a microchip and belonged to the Respondent.

A few weeks later, the Respondent was released from the Pinellas County Jail.

The Respondent went to Animal Services to retrieve his dog, paying the $210 bill for the dog’s care with a credit card. The Administrative Support Specialist processed the g pp p pRespondent’s payment. Animal Services had boarded the Respondent’s dog for 18 days because there was no one else available to pick up and care for the dog.

The Respondent provided his credit card and his driver’s license to verify that we were making a credit card transaction to whom the credit card was made out to by verifying both signatures on the driver’s license and credit card, which both matched the Respondent’s signature and name. At that time, they rang up the transaction with the three (3) digit code on the back of the credit card.

2. Management preserved all the records and summarized the events.

87

Fraudulent Transaction Card Absent Environment

88


3. Conducted an analysis of transactions and records to determine accuracy.

4. Identified current residence of Respondent (Spring Hill, Hernando County).

5. Unannounced visit to Respondent’s home.

6. Informational Interviews:

• Two of the Respondent’s neighbors stated the Respondent was living there, and that he had a dog. The neighbors thought that the Respondent was unemployed because he rarely went out of the house. They could not identify the dog’s breedthe dog s breed.

• We rang the doorbell three times at the house where the Respondent was living. A large sounding dog barked each time from within. Through the heavily tinted front door glass we could see an image of a man standing inheavily tinted front door glass, we could see an image of a man standing in the hallway looking at the front door, but he did not come within 25 feet of the door.

89

#2Referred To State Attorney’s Offi F A R i Of Th Office For A Review Of The


93

IRS Tax RefundDiversion Fraud

(Clerk)

96

IRS Tax RefundDiversion Fraud

(Clerk)

97

QQuick RResponse IInvestigative TTeam1 Hotline Call (11 a.m.)1. Hotline Call (11 a.m.)

An Internal Revenue Service (IRS) Form 1040 preparer, the Respondent (Clerk EE), attempted to divert $750 due the Victim (Clerk EE) for a Federal Income Tax (FIT) refund for tax year 2013. The Respondent and Victim’s financial institution, the Pinellas Federal Credit Union (PFCU), contacted the Victim and rejected the $750 diversion attempt. PFCU confirmed that the $750 was identified as the Victim’s but had the Respondent’s accountthe $750 was identified as the Victim s, but had the Respondent s account number for the 2013 FIT refund.

An IRS Form 1040 preparer, the Respondent, diverted $580 due the Victim from the Victim’s FIT refund for tax year 2012 through the falsification of the direct deposit bank account information submitted to the IRS on the Victim’s Form 1040 for tax year 2012.

Copies of the Forms 1040 for tax years 2012 and 2013 given to the Victim differed from the Forms 1040 filed electronically with the IRS by the Respondent.

QQuick RResponse IInvestigative TTeam

“Personnel Rules / Policies / Procedures / Guidelines, Rule 24 Discipline, Section B-Rule XXIV – Page 10 (29).” “That the employee has been guilty of conduct unbecoming an employee of the County whether on or off duty.”

QQuick RResponse IInvestigative TTeam1 Hotline Call (11 a.m.)1. Hotline Call (11 a.m.)

2. Interview Supervisor (Complainant) at IG Office

3. Interview Victim at IG Office

4. Analysis/Planning at IG Office

5. Fieldwork Assignments•Credit Union C d t d R ti (A l A dit Pl ) U d•Conducted Routine (Annual Audit Plan) Unannounced Surprise Cash Count and Close Out of EE Work Location (Respondent Targeted )

•Routine Close Out Conducted with IG Staff and Clerk•Routine Close Out Conducted with IG Staff and Clerk Supervisor (per policies)

6. Unannounced onsite visit (first impressions are very important)

QQuick RResponse IInvestigative TTeam( p y p )

7. IG staff meets with Site Manager

8 Reviews Respondent’s onsite personnel file8. Reviews Respondent s onsite personnel file

9. Gathers general information of the Respondent from Site Manager

10. Plans interrogation of Respondent

11. Interviews Respondent

12. Signed Confession• Resigned Position• Escorted From Premises (2 p.m.)( p )

13. IG regrouped and started paperwork

QQuick RResponse RResponse

IInvestigative TTeamTTeam

#1INVESTIGATION

“P l R l / P li i / P d /

INVESTIGATION

“Personnel Rules / Policies / Procedures / Guidelines, Rule 24 Discipline, Section B-Rule XXIV – Page 10 (29).” “That the employee has been guilty of conduct

b i l f th C tunbecoming an employee of the County whether on or off duty.”

105

#2Referred To State Attorney’s Office For A Review Of The Office For A Review Of The


106

The Perfect InvestigationW P ibl B Of Was Possible Because Of

PoliciesAnd Procedures & Cross-

Training Of The StaffTraining Of The Staff

107

Overtime Abuse (UPS)

109


The County’s overtime policy is wasteful; the County shouldis wasteful; the County should follow Federal law and pay overtime once an employee has physicallyonce an employee has physically worked 40 hours within a week, not after eight hours Currently you canafter eight hours. Currently, you can take three days of leave, work two days come in on the weekend anddays, come in on the weekend, and get overtime.

110


INVESTIGATION

BECAME AN BECAME AN INVESTIGATIVE

STUDY

111

Computer Hard Drives (IAD/IG Staff)

113


114


115


116

Hard Drive Call (IAD/IG Staff)

•Court Records•A Variety of County Memos•A Variety of Legal Records (Trial Preparations Related Attorney Work Product)A Variety of Legal Records (Trial Preparations, Related Attorney Work Product)•Emails•Contracts•Personal Information

Social Security NumbersHome addressesDriver’s LicensesProfessional License NumbersProfessional License Numbers

•Inappropriate Video Clips•Inappropriate Adult Orientated Pictures•County LogosE l S l R i•Employee Salary Reviews

•Performance Evaluations•Resumes

117

Hard Drive Call (IAD/IG Staff)

Motor Vehicle Driver Records

118

AUDITAUDIT

Official Clerk Stamps & Seals (IAD/IG Staff)

Confiscated & Secured Stamps & Seals

Witnessed Destruction of Official Stamps & Seals

#1INVESTIGATION

NEXT SESSION

INVESTIGATIVE INVESTIGATIVE REPORTSREPORTS

126

how to conduct an investigation · • certified information technology professional (citp) ......

Documents