Coffee & Conversation - Internal Investigations: Starting Off on the Right Foot with the Auditor

Michael Stockham: Morning, glad everybody could get together for Coffee & Conversation this morning. We're happy to have you here, Jeff, talk about internal investigations, relationship with the auditor and dealing with the shadow audit or forensic team as part of going forward. This has been a good series, Coffee & Conversation. Joining us also is Jessica Magee. And I think we'll kick it off a little bit by just sort of an overview that one of the biggest things I see in internal investigations, or one of the biggest worries, is they get off on the wrong foot, that they don't have a strong foundation. So let me throw out just a quick little hypothetical, and maybe you can help us understand a little bit better some of the things that people need to do to get off on the right foot. So let's think about a tip that comes in from ethics point, comes into the audit to general counsel, gets elevated to the audit chair. Deals with financials. And it also deals with someone in management fairly high up, your Senior VP, your CFO, etc. So what are some of the initial concerns or questions you're going have for the investigation team or about the investigation itself when you come in to analyze it from the start?

What Do Forensic Accountants Do?

Jeff Ferguson: Well, I think like any investigation, one of the first things you need to do is consider your constituents. Who is going to be, needs to be informed by the results of the investigation? And a lot of times, there's a lot of obvious constituents. You've got management, you've got the board, you may have regulators, you may have the government. A lot of times, though, the investigative teams don't think of the audit firms. And especially if you're dealing with something that could impact the financial statements or management integrity, the auditors are going to be interested in the results of the investigation. So in those instances, what's likely to occur is the audit team will pull in their forensics group to perform what's called a shadow investigation. And as part of that, we in the forensics group become part of the audit team. And so, what we're there to do is to help the audit team through the investigative process, but also to make a determination as to the reasonableness of the investigation. We're there to help the audit team be able to rely on those results, and so they look to us and our judgment as to whether or not it's a reasonable investigation. There's a lot that goes into that, but that's what the shadow team is there to do. Initially at the onset what we're there, what we do, is we look at, we look at the actual investigative team itself. We look at do they have the right competency, the right expertise? Are they independent? Do they need to be independent? And then we look at their judgment that they use throughout the investigation. So those are kind of the things that we, that's our starting point, I guess, and we ask a lot of questions around those three areas. Judgment's something that you kind of evaluate throughout the investigative process, but that's kind of where we start.

Michael Stockham: OK, well — go ahead, Jessica.

Jessica Magee: You know, a lot of people know, they haven't met Michael and me, they sort of know what we do. We're lawyers, we help companies, we help individuals, whether we're investigating something or working on another engagement. But for people that haven't had a chance to work with you and your team, sort of level set the viewers for what it is you guys really do and when you come in. And I'm going to make this an annoying two-part question, because after you do that, I'd like you to go back to something you said a minute ago about does it even need to be independent. Help us think about the two worlds of where there's something that needs to be investigated. Maybe it can be handled in-house. Maybe it really does need to be outsourced to independent groups, which is what Michael was getting at earlier. So if you tell us sort of who you are and what does your team really do, because a lot of people may not have had reason to intersect with you guys at this point, and then that sort of bifurcation of independence versus not necessarily needing to have independence in an investigation.

Jeff Ferguson: Sure. So what we do, we are the basically the forensic accountants that when we, when there is an investigation that needs to be done, maybe not for one of our audit clients, but for a non-audit client, we work with attorneys and perform forensic accounting around financial statement fraud, bribery and corruption, things like that. We also have forensic technology professionals that help us out. And so when we're doing the investigations, that's kind of our day job, I would say, we go out and we perform those investigations. When we have an audit client, we can't perform those investigations in certain instances. But what we then are brought in to do is to evaluate the reasonableness of the investigation. We're there to use our expertise, our judgment, to help the audit team understand and know what to expect. Most of our auditors haven't gone through these types of things with their clients — and thankfully so. So it's new to them a lot of times. So we're there to kind of help the audit team through the investigative process, but then at the end of an investigation, they will look to me as the forensics partner to conclude one way or the other as to whether or not the investigation was a reasonable one. And reasonableness is the standard that we're looking for. We're not looking for an investigation run the exact way we would have run it, or it gets an A plus or a B plus. It just has to be reasonable so that we can, as an audit firm, rely on those conclusions. Because often you're looking into accounting matters, you're looking into management, integrity matters and things of that nature, and we have to be able to rely on that investigation as part of our audit evidence. So that's what we do in a shadow investigation setting. Does that make sense?

Jessica Magee: It makes a lot of sense, and it's really helpful because I think you're right. There are, and it's good when people don't — they may have heard of that, but they've not dealt with it directly in their work. And so if they do, now they know who your team is and what you do, or sort of how that function might feather into an investigation. And so then talk about — and I want to circle back to Michael's fact pattern in a little bit because I think that's one where you would see the need for independence, but where, and that's really what we're going to talk about today — but there are lots of things that come up through companies, either through their compliance hotline or their own surveillance and analytics, where investigation is needed. A lot of times it can be handled internally by management. A lot of times it needs to be sort of outsourced for independence. Do you have any sort of, and Michael, I know, has views on this that have really helped me to think about it, rules of thumb, guideposts, for helping clients think through when independence really is the better course?

Deciding Whether an Independent Investigation Is Necessary

Jeff Ferguson: Yeah, that can be a sticking point right off the bat. A lot of times, a lot of times companies will have an issue and realize they need to investigate it, and they will go out and they'll hire whomever they think should investigate it. Maybe it's corporate counsel. Maybe it's some attorneys they've worked with in the past that they trust or knows the company very well. Maybe they do it internally through their general counsel's office. When, what they, what they oftentimes don't do is contact the auditors and let them know that the problem has arisen. And they kind of start down the investigative process and then they think, wait a second, we should tell the auditors about this. This independence question in those instances can be problematic because we have views as to whether or not it should be an independent investigation as an audit firm, and if those don't align with kind of where it's currently going, we can start off in a rocky way. Typically, what the audit firms like to see is if there are allegations or suspicions about something that could impact the financial statements, or some allegations or concerns about management integrity at a certain level, the audit firms would prefer an independent investigation. We don't really want management, the general counsel, investigating the CFO. Management investigating itself is not an independent investigation. And so one of the kind of rules of thumb is if you don't know whether or not you needed an independent investigation, you probably should just have one. There's really no downside to it. I guess some would argue that, well, I could I can hire corporate counsel, they know our systems, they know our people, they know how we do our business, there's not as steep of a learning curve. But you know, and I understand that, but if you go down the road and then it's something, you learn something that now the C Suite is involved in and you're not performing an independent investigation, it can bite you in the end. So management integrity issues or financial statement issues, a pretty good rule of thumb is to win, you probably need an independent investigation.

Jessica Magee: Michael, how have you seen that play out or guidance you give, because I know you've been doing this for years and seen lots of different fact patterns?

Michael Stockham: I think one of the knee jerk reactions right away most folks have is to try to get their normal counsel involved. They worry about cost, of course. Everybody does on these things. I think some of that's been tempered down a little bit by new technologies that have come along for data recovery and review and some of the AI and machine learning and other stuff take some of that cost off. But I do think that a lot of times, companies, especially on the financial side, because a lot of these situations, the company itself is already in trouble somehow. And so they're watching cash and they want to do it efficiently, and so they get spooked and try to either pigeonhole it or shoehorn it into something that internal audit can do or something that they're current outside counsel's doing. And I do think that's a foot fault at the beginning because you have to start answering or asking questions at the end of the investigation about independence. And I've been involved in a couple of stories where it wasn't done correctly or maybe outside general counsel or outside counsel didn't exactly look in all the right places, and at that point, it puts the auditor in a really tough spot. Now they, now they have to, to a certain extent, I think what I've seen, is ratchet up their professional skepticism one extra level. And it can prolong an investigation. It can push things very close to filing deadlines. It just increases the tension overall, that wasn't really necessary if people just thought about it at the beginning of kicking off independence. And then you can, you can mitigate costs, you can ask for estimates, you can see exactly what needs to be done. There are ways to keep investigations in the rails as far as cost without sacrificing independence.

Jeff Ferguson: Yeah Michael, I think you make a good point. If you think back to one of the, to the three things we look for at the onset of an investigation, competency, independence and judgment of the investigative team, the independence and the judgment kind of go hand in hand, right? If you hire your corporate counsel that you've had a long relationship with, in the judgment of that investigative team, you kind of don't necessarily get the benefit of the doubt sometime. If it's a truly independent team that hasn't, that has no prior relationships with the company, you kind of start off in a place of thinking, OK, their judgment is going to be, I don't want to say unquestioned, but you kind of get the benefit of the doubt because they're an independent team. They don't have a go forward relationship with this company that they've got to be concerned about. So those two things go hand in hand. And you are right, if it's a non-independent team, the shadow investigation procedures are probably going to be enhanced. And while a shadow investigation is not meant to slow anybody down, the more shadow investigative procedures that have to be done, you do risk that affecting the timeline.

Michael Stockham: Well and it adds, I think it adds some of the cost, too. I think some investigative teams sort of lose sight of all of the stakeholders that are going to be involved in an investigation, and if not done right, what you're going to do is accidentally, as you mentioned, blow up the enhanced procedures that other professionals have to do in order to get comfortable. And that, all in the big bucket, becomes cost-related to whatever is being investigated.

Jeff Ferguson: Yeah, in the stakeholder point you make, one of the common pitfalls I see by company general counsel, or maybe if it's the audit committee running the investigation, if we're dealing with allegations or concerns about management, but they're not really concerns that impact the financial statements, those are the situations where it just doesn't occur to the company, "We need to tell our auditors about it." It has nothing to do with accounting, it has nothing to do with financial reporting, but it's a management integrity issue. So let's investigate it. They kind of sometimes might even treat it like an HR issue and investigate it that way. Where that can lead, though, is if you don't get the auditors involved in at least assessing things early on, we've had situations where something like that occurs. I get a call: The investigation is complete, there's a readout tomorrow, we want you to come hear the results. And at that point, we have to go back and evaluate an investigation that's substantially complete, and that puts us all in a bad position.

The reason companies should go to the auditors and at least notify them in those instances is because the audits are predicated on management's representations that the financial statements are materially accurate.

Those representations are made to the audit firms. The audit firms' ability to trust those representations is hallmark to the investigation, or to the audit. And so when we have management integrity issues, even if it doesn't relate to the financial statements, that cause us to question whether or not we can trust those reps, that's a big problem for the auditors. And so we've had investigations into some pretty wild things that have been, surrounded management, but they had nothing to do with the financial statements. You still got to at least let your auditors know about those. Maybe a shadow investigation is not required in those instances, but maybe they are. You just need to, you need to notify the auditors timely.

Communicating with the Investigative Team

Jessica Magee: It sounds like one of the things that we are talking about is, when you talk about the three hallmarks, competency, independence, judgment, those all sort of also relate or are connected by transparency and communication. And transparency can be hard because you can't say what a thing is before you know what the thing is, which is what you're doing in the investigation. And I'm sure management often struggle with a desire to absolutely do the right thing the right way at the right time, but also not prematurely bubble up an issue that's not really fully thought through or understood yet. So, to me that's a balancing act between what I think is probably not the right outcome which you described where, "OK, we are complete with an investigation. You need to come listen to a report out," versus early and frequent engagement where, to the extent possible, the team doing the investigative work is able to at least put touch on the shadow team, let them know what they're doing. I think also to the extent you can talk about your high-level thinking in terms of how you're designing your procedures, how you're finding comfort as an investigative team that you are preserving the right data, talking to the right people, so that the shadow team has a chance to assess that judgment, competency and independence sort of real time as you go and hopefully, but I'd like your thoughts on this, give feedback. I know it's not your work to do. You're not there to do the investigation, but is there an opportunity for your team to be able to say, have you thought about this or what about that? So that it can almost organically move on a more efficient place toward comprehensive resolution?

Jeff Ferguson: Absolutely. I that's the ideal world. From an independent standpoint, because we become part of the audit team, we cannot direct an investigation. We have to remain independent as the auditors. But we can provide feedback. We can provide suggestions along the way such that there's no second guessing at the end. A lot of times when we are pulled in at the end, you may have the right team, they may have the right competency and maybe they are independent, but we've had instances where we get pulled in at the end and you hit on a common pitfall that we run into, is one of the first things that you do, as you know, in an investigation is you preserve the data. And so when we evaluate the data preservation, if we don't believe that was done in a reasonable way or in a complete way, you're starting off in a really bad place. Because if you don't, haven't preserved all the data and then you've run an investigation, how do we know that some of the data hasn't walked out the building or been changed or deleted? And so that could, you could do everything else in a perfect way or a very reasonable way, but if you've messed that up, we've got real problems. And so your point, Jessica, about kind of being able to talk to the shadow team, get their expectations, their feedback on your scope and what your data preservation and your interview plans are and things like that, if you constant, or not constantly, but frequently, have interaction with the shadow team, those discussions can take place. And then when we get to the end, there's no second guessing, there's no, we got to go back and do this differently, nothing like that can be expensive, but more importantly, as you know, most of it, a lot of these are done on a very tight timeframe. You've got reporting deadlines and whatnot, and a lot of companies don't think about, when they're doing this, depending on the outcome, there may need to be enhanced audit procedures or testing done. You've got to give the auditors some time to test whatever maybe was impacted by the wrongdoing. And so you really don't have that luxury at the end to, let's go back and redo steps one and five, and still meet your filing deadlines.

Jessica Magee: So what about in a situation where it's not necessarily an issue that impacts the financial statements, but there is a concern around the integrity, the character, of a person in that rep chain? It seems to me that — and I think we've all had experiences where if you've got that engagement, if you've got that appropriate level of engagement and transparency, that the investigative team can be getting feedback, getting a sense and providing counsel to the client, if they're going to need to be considerations given at management about making changes, about potentially addressing who is in the rep chain, so that you don't extend your timelines. I mean, sometimes it's unavoidable, but I think that can be a positive byproduct and an efficiency just to avoid surprises, like you say.

Jeff Ferguson: No, I think that's right. I think when we're dealing with management integrity, as the audit firm, we're evaluating whether or not we think we can take reps from the individuals involved. And providing that feedback to the company in a timely manner is important because, for example, if we're dealing with someone like a CFO or a controller or somebody that's in the control environment that the financial statements rely upon, even if we're not necessarily taking reps from that person, if they're a big part of the controls of the company and now we can't trust them, that feedback from the auditors to the company is important because if they've got to make changes, especially if someone's repping to the financials, the accuracy of the financials, you can't just walk in at the end and say, "So-and-so is going to replace our CFO, and they'll rep to the accuracy of the financials" to the auditors because we expect that they've got to take time to go through the financials and the accounting and the records and come to that conclusion. You're not just signing a piece of paper saying, I'm representing it. You've got to go do that work to be able to show us that. And that can be a time consuming process. So, that feedback from the audit firm throughout an investigation, I think, can be really important.

What Is a Shadow Investigation?

Michael Stockham: Jeff, one point. You referred to a couple of times shadow investigation, and sometimes folks call it a shadow audit, but I think it's important to point out what that distinction is because sometimes I think the company thinks that there's a secondary audit going on or that the investigators are going to be ticking and tying numbers. And it's a different approach or a different set of skills that's going on. So I think illuminating some of that confusion could be helpful.

Jeff Ferguson: Yeah, that's a good point, Michael. I think it's, an easy way to explain it is to explain what a shadow investigation isn't. It is not the audit team bringing in their forensics team to go in and do their own investigation. It is not the audit team or the shadow team to go in and perform its own interviews or read email trying to come to their own conclusions. As I mentioned earlier, the audit team will need to rely on the investigative findings, and so what the shadow team's really trying to do is they're evaluating the investigative process. They're really asking more questions about how did you collect data? What data did you collect? Does that seem reasonable to us? Who are you interviewing? Are you looking at email? How are you looking at email? It's more about evaluating the investigative process so that we can, if we already believe we have an adequate or the right investigative team, now, it's just having conversations about the process, understanding the process, understanding what the investigative team is finding along the way and then what are they doing about it. When you do one of these investigations, it's an iterative process. Depending on what you find will inform you as to what your next steps are. And so if we're brought along and we're understanding the process, we're understanding what the investigative team is seen and then how they're reacting to that, it allows us to make determinations on that kind of judgment that I was talking about earlier. So, really for the most part, these shadow investigations are meetings and conversations with the investigative team and providing feedback so that when we do get a readout at the end, we can say whatever the investigative team found — right, wrong, indifferent — we can rely upon that because we think they have the right team in there and we think the process was reasonable.

Involving the Audit Committee

Jessica Magee: Michael, that response from Jeff brings to mind sort of the other side of it. We've talked about investigative team, we've talked about the shadow investigative team. Put us at the company. Is there any special magic for the company to figure out who's overseeing the investigation, whose mandate, who launches it, who's in charge of it? A lot of times I know it's audit committee. Sometimes you see general counsel involved. Talk about that a little bit. And also your views on scoping and sort of adjusting scope sometimes as you go.

Michael Stockham: Yeah, sure. So, I mean, oftentimes these are going to come in directly to ethics point or some other whistleblower complaint or be, we've seen complaints typed out anonymously and left on somebody's desk as part of the reporting of the event. At that point, really, it needs to be elevated to the audit committee, and they make the decision whether or not to go independent. Now it's not, I don't think, efficient for the audit committee in whole to meet every time there's an update — unless they want. It's really their investigation, so if they want to be informed as a group every step of the way, that's fine. I think efficiently, typically, if they'll meet to initiate or kick off the investigation and then delegate some authority to the chair to run it day to day and keep them updated and then update the chair as often as possible. Even if there's not really much going on, it good to pass that information on. Trying to get into the company and the logistics of scheduling interviews or getting hard drives, all of that requires somebody that's boots on the ground. So you do need to find those people in the company that can help you get that. One thing I try, or we try, to do pretty early on is see if we can't clear the general counsel or somebody in their office that would have the authority to go ask for these things from individuals — documents or we need the image, your laptop, that kind of thing. And I think that sort of greases the skids a little bit. If you can get someone cleared early on and have a logistics person inside the company, that helps, that really does help move it along at a quick pace or as quickly as possible. And again, keeping the audit chair up to date regularly, I think, is not only good for the investigation, but — and Jeff may have some opinions on this — but I think when you're looking from his side at what's reasonable, that communication and engagement from the audit committee itself is a big, big A plus, if you can get it into an investigation.

Jeff Ferguson: Yeah, I agree with that, Michael. Not only is it an A plus, what I'm seeing more of these days is the auditors are asking the sponsor of the investigation — so if it's an audit committee investigation, they're asking the audit committee to sign representation letters about the completeness of the investigation. And so if they're not being regularly updated and involved in the decision making of the scope and whatnot of the investigation, it's going to be really hard for them to sign those rep letters to their auditors at the end. And I think we've all been in situations in an audit committee chair, or an audit committee investigation, where the audit committee hires outside counsel, they kick it off and then there's really not much back and forth with the audit committee until we get to the end. I think those days are pretty much behind us. I think most audit committees are much more involved now. But they really should be, and not just involved from getting updates, but they should be involved in the decision making. It's their investigation. And so they should be active throughout, and the auditors do look at that. We ask questions about that. How often did you update the audit committee? Were they involved in the decisions? And we may go talk to those individuals and assess it from that standpoint as well from a shadow perspective.

Jessica Magee: I think we also have seen and will continue to see and hear more and more questions about the level of support and sort of clearing path, making sure that the investigative team has what it needs, to use Michael's term, with boots on the ground, to get into the company, to prompt access to people, to places, to things. Just one practice point that I think about any time this kind of work rolls across our desk, is sort of principles, sort of understand the governance environment you're going into. So companies need to understand, audit committee members need to understand, what does their charter look like. Presumably, they have the mandate, and not only the mandate, the responsibility, of engaging in good governance over those kinds of investigations and the resources to, financially to be able to do that the right way. And so I think it's important to have trust-based relationship with your audit team, if that's your point of contact, for the investigation so that they feel supported and empowered because sometimes they're going to be put in positions where they have to go out to the board or go to management and say, "You have to get out of the investigation," or, "You need it be making people more readily available," what have you. So I think, first principles, it's important to understand what does your audit committee charter say, and then, when we're hitting the ground, we're also, often before first calls, it's what are the company's stated values? What's their code of conduct? What's the code of conduct for their senior financial officers? Do they have employee handbooks? Are there guideposts and milestones at this company that, based on what entry-level facts we're getting, sort of indicate the framework or the fences within which we're going to be working? And so I think it's important for members of committees and management to know what their company's rules of the road already are, so that when facts come along, they know what environment they're working in. So that they're not wasting time or that they don't get halfway into an investigation and realize, "Oh, we're not doing this thing we were supposed to be doing based on our own stated principles." Michael, what about scopes? Jeff earlier was talking about scope. Is there any requirement for a formal scoping document? Do you see scoping documents? And scope can certainly change based on the facts you find during the work. What thoughts do you have there?

Scope of an Investigation

Michael Stockham: Yeah, so we tend to work from a position of, almost the physician's position of first do no harm. So we take the position of looking exactly what the complaint is and try to come up with something that will do what needs to be done to get to the right answer without boiling the ocean. And part of that is communicating to the audit committee that we're going to work essentially what we call concentric circles, almost like a rock in a pond. We're only going to go to that next concentric circle out if it's necessary to answer the questions that the auditor needs, that Jeff needs, and, quite frankly, when we're trying to forecast and see whether or not there's going to be an SEC issue, we need to have that question, too. It's not a good thing to have to go back and redo something or answer something for the regulators later on. And so, a scoping document can be negotiated, essentially, with the audit chair as a starting point. Estimates are a good place to do that. This is what we need to do. That could even be an informal scoping document, if you will. And then, touching on something Jeff said about the constant communication, if you dovetail that with the issue of management integrity, if you're keeping your audit chair up to date and you're talking about things, you're able to alert them early on if there's going to be a concern. And oftentimes it's not uncommon in the very first half of an investigation to sort of discuss with the auditor, look, we don't know that this is going to happen, we don't know that there's going to be a problem with management integrity. There could be, but this is, you might want to grab a glass of wine or a cup of coffee and sit on the back porch and start thinking about who could, if you have to come up with an ultimate rep chain, how are you going to put that together? Who's got the skills to do it? So that they could get in early, very early, as early as possible. Because Jeff's right, they're going to have to, they themselves are going to have to get comfortable with the financials, and they should, they have a right to spend the requisite amount of time they feel necessary to get there. So surprising everybody at the end with, "Uh oh, our CFO is being changed," or something else is difficult.

Jessica Magee: Jeff, any concern from your end if you see scope, or to the extent you would see, scope change or grow, or even constrict, if you think you're going in to look at some big problem and you realize maybe it's a much smaller concern, does that create any, just concerns or questions on your end?

Jeff Ferguson: It may cause questions. I don't think it necessarily causes concerns. I think if, I think what the investigative teams should realize is that the shadow investigative teams for the audit firms, like I mentioned, we do these types of investigations every day. And so we understand that your scope on the onset of an investigation may be one thing. Where you end up may be something very different. It could have gotten quite larger. It could have constricted. And that's OK because we've seen it. And so, there has to be some trust that, as the investigative team, you can put into the shadow team that they're going to kind of get it, because this is what we do every day, too. And so it may cause questions, it doesn't necessarily cause concerns. Where it does cause concerns is when we're not brought up to speed throughout and we're not being informed as to why the scope is changing. If the scope is expanding or constricting and we're notified and we have a discussion about that as it's occurring, we can get comfortable with that. We can ask our questions. We may, on the onset, not agree with that, but then we ask questions and the investigative team can tell us, "Well, here's why we're doing it," and if that makes sense, then great, we're all on the same page and we march, we're marching down the field together. If we have to come back at the tail end of one of these, it's a lot harder to convince us as to why something may have constricted because we don't know what you knew at the time and why you made the decisions at the time. And in a way, we're second guessing, and we don't want to be in that position. So I think scope change occurs naturally throughout many investigations, and allowing the auditors, through their shadow team, to understand that as you're learning information, I think, is the best practice. That way, you don't, you're not getting second guessed at the end.

Building the Right Investigative Team

Jessica Magee: We've talked about the different teams, and I'd like to, if you guys don't mind just for a minute, to circle back on the investigative team and making sure you all, that the shadow investigative team, the audit firm, thinking about the competency skill set, the independence, the judgment of the investigators. I think that means when an engagement is being structured, lawyers need to be thinking about who they are putting on the bench for that work. And of course, we often work with specialists, whether it's accounting specialists or other forensic specialists. But, you know, I certainly am not a master of all things as much as I might like to be, but what are you looking for in a team? How do you sort of — and maybe the answer is how have you seen it done wrong — but what do you need to have on a team? To my mind, you need to make sure you've got someone who pretty fluent in state of the art data preservation issues, things of that nature, but also just in terms of like the basic skill sets of being an investigator. Talking to, talking to witnesses, gathering facts and organizing facts. What are you all looking for to say, "We think that they've benched the right team here, we think they've got the right kind of people doing it?"

Jeff Ferguson: Yeah, the last sentence you just said is really what's key. Do they have the right people doing it? A lot of times we hear that there's been an issue at an audit client, they notify us early on, they want to have a call with the audit committee chair to kind of get us up to speed, they've gone out and hired a law firm to do the work that is independent. And so, you go through that scenario, and they're checking all the boxes. You're happy as a lark as the audit, as the shadow team. But some of the things that I've seen in those instances when that fact pattern is played out — and it doesn't happen that often, but I have seen where a big name law firm is brought in, they're independent, and then they staffed the investigation with people who really don't have the requisite experience. They may have some law partner that's a big name and has done hundreds of these things, but that person kind of farms it out to his or her associates and other partners that really don't have the requisite skillset. And I've seen those instances where we think we're starting off with the right team, we're going down the road, and then it's just as painful as it can be because these people can't investigate themselves out of a box. And so it is not always about the firm, it's about the people doing the investigation and their experience, their skillset. One thing you touched on is it's not just the attorneys. Depending on the issue, you have to have the right specialist on the investigation. Whether it's e-discovery folks, forensic accounting folks, it could be could be engineers, it could be all kinds of things that an investigative team needs. And again, it's, it does give you some comfort when those individuals are with a reputable firm, but you do have to pay attention to who's doing the work and not just the firm name.

Jessica Magee: I think also you have to, on the other side, when the investigative team gets it right and they say, "OK, we've got a good bench. It's the right people doing the right work" — presumably that's going to be at some different levels — that you're also communicating on the client side of why we've constructed that team. Sometimes you just have to throw bodies at it. If you've got a bunch of documents and you just have to get them reviewed, you can use contract reviewers. Sometimes you got to, there's a lot of different ways you can skin the cat. But I think, Michael and I have to think, when we're doing that work, of how do we also explain that to the client to help them understand this is why this is the right team, this is why we've slotted these people to do this work. We've got a person who's going to run the data show. This person or these people are going to run interviews. And for an investigation to be, in my opinion, working smoothly, it's very dynamic, right? So to Michael's point, you're working in concentric circles to get to clean margins, so to speak, but you're also working several processes in parallel. Michael, any thoughts you have on building that bench and making sure you've got the right people in the right place at the right time?

Michael Stockham: I mean, it does, I think, traditionally we always try to find some forensic accounting group that's independent as well to partner with us and help us understand, especially when there are financials. This understanding of one, how the accounting works, because we're not accountants, so while familiar with GAAP, we're not experts in it. And two, to help, one of the best things they can do is help you understand how the auditors might react to certain information. They give you kind of a preview of what to expect on the other side. I think going back to something you said earlier, alerting the auditors early in the investigations, I think some of the foot dragging sometimes happens on the part of maybe not so much the audit committee or the audit chair, but maybe management. Another is that they think that the auditor's going to get spooked or freaked out or be upset at a particular time, and that's going to create additional friction towards closing the books and getting their filings. But my experience is that once alerted of a problem, the auditors and the shadow team essentially go into listening mode. I mean, it's not a big overreaction. It's always just OK, there's a concern, there's an issue, we have the right people in place, let's see what they find and we'll hear what it is and deal with it at the time. One question I have for Jeff is, I think a lot of people misunderstand or don't quite understand that you guys have some governing principles, GAAP and other stuff, that relate to what you actually need to close out an investigation, an audit, papers. I know that you do a FAS memo or a closing memo on the forensic stuff, and so some of those, and not in great detail, but give a sort of a high-level view of what exactly is needed. Because I think some attorneys can accidentally become antagonistic with the forensic group or with the accountants, thinking that they're asking for too much or they're prying into it, but really a list of things that you guys have to have. And I think it's helpful for people to understand that.

Closing out the Investigation and Resolving Privilege Issues

Jeff Ferguson: Yeah, I think sometimes I question whether it's accidental that the attorneys become antagonistic, but you're right. At the end of shadow investigation, when we're part of the audit team — and I think most audit firms do this — there's documentation of the process and of the shadow investigative process. So we write a memo to our audit files, typically, that describes the event, the concerns or allegations, how the investigative team was put together, what the investigative process entailed and then the conclusions of the investigation. And so we document all that, but then we also document what our observations were and our conclusions around reasonableness, around competency, things of that nature. And so all of that's kind of documented in our audit files such that we can say, this is the work that we did to conclude whether or not this was a reasonable investigative process and team. That whatever the results are, we feel that we can, we can rely on them. And so that's what we need. We need information about the allegation, how it came up, how the company reacted, what the investigative process was. And it's not, it's not just generally a high-level deal. I mean, we'll have discussions about, whose email are you looking at? How did you grab the email? What's the date ranges? What are your search terms, or what other kind of new technology are you using to review that kind of thing? That's the kind of level of information that we require.

But the reason for that is there are auditing standards that dictate what kind of audit evidence we have to obtain to come to an audit conclusion. And so those are the standards by which we're living, trying to get sufficient audit evidence.

That "audit evidence need" kind of creates a tension with the investigative teams because there are times when we're going to ask questions and we want to see something or hear about what somebody said, and when you mention antagonistic attorneys, it comes up when we talk about privilege. A lot of times we're asking questions that, for whatever reasons and under the investigative team's legal analysis, that's privileged information, and they don't want to share with us. And so that's a common kind of hurdle that both teams, the investigative team and the shadow team, have to get over. So that at the end of the day, we do feel like we have sufficient audit evidence to reach a conclusion.

Michael Stockham: Yeah, I agree that the privilege conversation is always something that is had. My experience is that generally it can be worked around. Most of the teams we worked with on the audit side respect that's a ticky tack subject, that it's difficult to deal with, but there's usually generally a way to get them the information, sufficient information, for them to decide whether it's reasonable or not without turning over privileged information in total or in whole to a place where, if you're looking down the line to regulators or plaintiffs' attorneys or other things, that those don't, that privilege material doesn't get at risk as much. I mean, part of it is a very fine line. I think one of the things you're talking about as far as skillset with attorneys doing these investigations relates to exactly how much to give and when to give it, when to walk into fact a bad fact and acknowledge it, when to — and I'm not saying when not to tell the truth or tell the truth, but the integrity and reputation of an investigative team, a lot of time, relies on the fact whether or not they'll walk into a bad fact. And they may be able to explain it or color around it, but if you try to avoid those things, I think it kind of taints the investigation a little bit as well. So there's, I liken it sometimes to learn how to drive a stick shift, which my children will never understand or be able to relate to, but it's a clutch in a lot of ways. You need to know exactly where the fine points are to make it run exactly right. And that's something that I think a quality investigator will have.

Jessica Magee: Well, in talking about antagonism, I mean, there are ways — and I'm going to be a broken record here — to mitigate or even altogether avoid antagonism. And I'm going to go back to our point about earnest and complete conversation and engagement with the shadow team as early and often as possible. Obviously, with your client's authority and being judicious about what you can say and when you can say it, and certainly dogged about protecting privilege, but if you are, if you are having communications and you're building a relationship during the investigation with the shadow team where they know, to your point, Michael, that you're going to deal with the facts. That there are good facts, bad facts, neutral facts, but at the end of the day, they're all facts that all have to be dealt with. That if you're building trust on candor and engagement, hopefully when you get to those harder issues down the line where you might have to fight a little bit or tussle a little bit over privilege, you can find ways through where everybody can be satisfied, where the shadow team get what it needs and absolutely has to have to fulfill its obligations, while the investigating team can also continue to adhere to its obligations and duties and best practices for its client. So I agree that those are, can be tough issues, but it also are issues that are going to come up no matter what down the road, so you might as well have a good foundation built to deal with them all along.

Jeff Ferguson: And Jessica, what, I just want to echo what you just said. It's the building of that relationship between the investigative team and the shadow team. If there is a trust there, and it's not, it's a two-way street, right? It's not just the auditors trusting the investigative team. It's the investigative team trusting the shadow team and the auditors that we're not going to overreact, that we're not going to ask for unreasonable evidence or be unreasonable as it relates to things like privilege. This isn't our first rodeo, either, and so, we get the privilege issue. At the end of the day, we need what we need, is sufficient audit evidence, but there's always more than one way to skin a cat. And I agree with what you and Michael are both saying, there are ways to get there, to get us that audit evidence that we need without damaging privilege. And obviously privilege is a legal issue. As forensic accountants, we don't make those determinations. We don't have that ability, and so we work, the two teams will work together, and a lot of times have that conversation on the outset. We know we're going to run into privilege issues at some point. Let's just talk about how we might get around them. That can be a very quick conversation if you have an experienced investigative team working with the shadow team.

How COVID Has Affected Fraud and How the Investigators Are Preparing for It

Michael Stockham: Yeah, I think we may be coming a little bit close to the end of our time here, but I did want — I know we had some conversations offline earlier in the month, a little bit about what we see, just sort of prognosticating about how the dislocation from COVID-19 and other things might impact some of this activity that usually bubbles up to kick off an internal investigation. I was wondering if we could get just a few insights from you, Jeff, about what you guys are seeing on your side or thinking about how this might impact things going forward in the third and fourth quarter.

Jeff Ferguson: Well, I mean, obviously, it's a tough time for everyone right now, I think there's somewhat of, I don't want to call it a perfect storm, but there's a lot of factors kind of coming together right now that could lead to some concerns down the road. I think any time you have large-scale government funding going on like we do which is going to result in new government regulation, I think any time we see that, there's concerns that people are going to do something inappropriate in those areas. So that's something that we've got to be watching closely. I also think, everyone's business is taking a hit right now. And so I think as people get back to work and start trying to recover from this, I think some concern has to be, whether or not, are companies going to do the right thing as it relates to their financial reporting? Are they going to try to mitigate some of the problems that they're having by doing something untoward? So I think those types of things kind of coming together, kind of at the same time, I think, we as the forensic accounting profession, as well as the audit profession, have to be thinking about that. I know at EY we've had discussions with our audit teams about, if you think about, not to geek out on the fraud triangle or anything, but you've got opportunity, rationalization and pressure. I think there could be a lot of pressure on people to report sound financial results. Whether or not they have the opportunity to do, I don't know. But I think that pressure is going to be ratcheted up on people, and so we've got to be, from the audit profession, we've got to be planning our audits and doing our risk assessments in a way that considers that. From the forensic accounting standpoint, we've got to be ready, when allegations or concerns do occur, we've got to be able to react to that because I do think we're going to see a wave of that. When it's going to hit, I don't know. I'm certain we're going to start seeing some of it pretty soon. I would think that a year end, we're going to see a wave of it. But how big a wave, I don't know yet.

Michael Stockham: Yeah, Jessica, with all your time at the SEC, do you have a couple of thoughts on how they're gearing up for — I think it's right, Jeff is right, there's going to be a lot of pressure in the system, so we are going to have a lot of opportunity for issues. And issues bubble up, so it's going to be a time of great vigilance for internal audit, control function people, your CFO. The audit committee needs to be very engaged in questioning, poking, prodding, to see what's going on. But the regulators are always going outside edge of this, and I know there's been some stuff in the list servs and newsletters about it, if you want to give a few thoughts on that.

Jessica Magee: Listen, I think that my former colleagues and still friends and people I respect tremendously at SEC, DOJ, state agencies and others really have their hands full right now. I mean, fraud is always happening. Pressure to perform always exists. To Jeff's point, the environment right now is really ratcheting that up. And so if you followed, just looking at SEC, for instance, if you follow the work they've been doing right now, it is a tremendous amount of work considering that they're also remote. Starting with trading suspensions, and you're now starting to see enforcement actions coming down the pike, particular to companies making claims or material omissions about what they are doing or claiming to be doing or preparing to be doing relating to COVID. As I think of it, they have to get their arms around that work first, and then I think there's going to be a continuation, as we move forward into time, where you're sort of dealing with just outright fraud. And then also dealing with more — and I don't mean to say nuanced — but more challenging, harder to plumb work of accounting irregularities at companies, choices that people make within that fraud triangle.

They may not be getting direct pressure from a superior to do this wrong thing that you know is wrong, but atmospheric pressure that, "I'm going to be a good soldier in my company and help get us through this time," so I'm going to make choices that are unnatural that I might not have made but for.

So I do think you're going to see, over the arc of time in the next several months, I don't think this is going to be a short-lived touch. I think it's reasonable to think that there could be sweeps from law enforcement, from SEC, looking at how companies tested their controls, modified their controls, disclosed control issues if they needed to. And also things around like, to Jeff's point, we're seeing guidance from the staff on recipients of PPP lending. Disclosures around that, fiduciary duties for advisors. So I think you're going to see the SEC bring its entire arsenal of expertise across the staff, all of their specialty units. I think you're going to see the same at DOJ in terms of what I would loosely call smash and grab fraud, you know, just flat out scheming, but also harder to plumb. But really important to suss out fraud or irregularities that could ultimately result in misstatements across public companies and private companies across industries.

Jeff Ferguson: Yeah Jessica, you hit on something that I think is important, and I'm just going to go ahead and geek out on the fraud triangle. We were talking about the opportunities that the environment may be, or I'm sorry, the pressure that the environment may be creating. Something you mentioned is somebody who would make, wouldn't otherwise make choices may have the mindset that I need to help the company through this. That's the rationalization part of the triangle, right? One thing — and so those things kind of make sense. One thing a lot of people I don't think are thinking about, and you touched on this with the SEC working from home, think about the opportunities around the control system and in an accounting department when nobody's in the office. Everyone's dialed in, certain controls are going to be easier to bypass. So now you have, because everyone is working from home, they're going to no doubt be opportunities to fudge the numbers or to do something by that person who's just trying to help the company out. And so there are new opportunities that we really haven't dealt with in the past as much that is also coming out of it. And so that gets all three sides of the fraud triangle. And Michael, to your point, audit committee chairs, CFOs, controllers, it's not just the regulators and the auditors that need to be concerned about it. General counsel, everyone needs to be looking at it through that prism because, again I don't want to call it a perfect storm, but that triangle is getting hit from all three sides right now, and it's going to continue for a while.

Jessica Magee: It is, and it's a time, and I know a lot of us have been talking about this, for companies to just redouble efforts to ensure cultures of compliance, to really reinforce a good tone at the top that we do the right thing the right way, even when it's hard. And so we are in an, and this is an overused term, but unprecedented time. And so I think a lot of companies are fearful that they're in a new frontier. They've never had an entirely at home or nearly entire at home workforce. Maybe their payrolls weren't set for a pandemic. That's not reasonable. And so are they, if they're taking what they think are reasonable steps now trying to do the right thing, are they still going to be snared at the end because, DOJ or SEC or plaintiffs are looking in hindsight as a hammer and just saying, I'm going to find the nail. From a regulatory perspective, bringing it all the way back to one of your guiding principles, Jeff, of reasonableness, for companies right now that are on the front line dealing with issues they've never had to deal with before and trying to get it right, I think cultures of compliance, good tone at the top, good governance and documentation, judicious and careful and thoughtful documentation, is a good choice because everyone's having to make choices right now. And if, I think you mitigate some of that concern, if you can demonstrate while someone after the fact might disagree with that choice, or they may have made a different choice, if you can sort of show your math on why it was the right choice, why it was reasonable and why it was sensible at the time you made it, you're going to be in better, at least in better footing, at the onset.

Jeff Ferguson: Totally agree.

Jessica Magee: My cup is once again empty.

Michael Stockham: Yeah, I think we're at the end of time. But Jeff, we greatly appreciate you taking an hour out of your day. I know you got a full slate of other things to do, and I appreciate you geeking out on the fraud triangle. That's always fun. Good stuff.

Jessica Magee: Yeah, when you geek out, it makes Michael and me look so cool.

Jeff Ferguson: Yeah, that's what we're here for. No, it was fun. I appreciate you guys having me. It was a good time. Appreciate it.

Jessica Magee: Well, stay well and healthy, and we'll talk to you really soon.

Jeff Ferguson: Same to you all.