Chapter 40. Accounting Systems and Financial Software
Information in this chapter:
• Accounting and money management programs
• Personal money management software
• Business accounting software
• Getting the evidence
• Types of evidence from financial software
• Batch files as evidence
• Other sources of financial evidence
You have probably heard the term, “follow the money.” This is true in all kinds of cases, from domestic disputes to Ponzi schemes and murder cases. Since so many people and businesses manage their money electronically today, there is a wealth of potential electronic evidence available residing anywhere from the Internet cache on a computer, to an e-mail attachment, inside an accounting program database, and even on a person’s phone.
In this chapter we will look at some of the places and ways that financial information is stored, some of the analysis techniques and some cases where financial information has played a factor.
Keywords
Accounting, QuickBooks, Money Management Software, Peachtree, Online Accounting, Financial Records, Audit Logs
Introduction
You have probably heard the phrase, “follow the money.” This is true in all kinds of cases, from domestic disputes to Ponzi schemes and murder cases. Since so many people and businesses manage their money electronically today, there is a wealth of potential electronic evidence available residing anywhere from the Internet cache on a computer, to an e-mail attachment, inside an accounting program database, and even on a person’s phone.
In this chapter we will look at some of the places and ways that financial information is stored, some of the analysis techniques, and some cases where financial information has played a factor.
40.1. Accounting and money management programs
Both individuals and businesses use accounting programs to track and manage their money. Accounting software ranges from packages designed for the home office business like QuickBooks, Peachtree, and DAC Easy, to mid-sized and enterprise-level business solutions like Microsoft Dynamics, SAP, and others.
Personal money management software is widely used by individuals to keep up with their home finances. Many of the major players in the small office/home office market for financial software also offer packages for personal money management that individuals and families use to record their expenses, track their credit card accounts, track their bank accounts, plan for their taxes, and plan for retirement. There are even free services on the web for financial and personal money management like Mint.com (www.mint.com).
40.2. Personal money management software
Personal money management programs contain a lot of information about someone’s personal financial habits. One of the things that make personal money management software very attractive from an evidence standpoint is the ability of the software to synchronize with the person’s bank, downloading and storing all of the transactions made via the linked account to their online banking profile.
When this is the case, even if the records are no longer available via the bank, there is a chance these records can be retrieved from the individual’s computer. Bear in mind that if the individual is using the account synchronization feature, these transactions can be obtained from the individual’s computer without having to go through the process of obtaining the information from the third party via a subpoena.
The fact that personal money management software is an off-the-shelf type of application means that getting access to the software to analyze the data from a person’s computer is normally easy to do.
40.3. Business accounting software
One of the principles of good accounting practices in a business is to always have an audit trail that can be used to go back and see who did what in a transaction. This gives the accountant a way to check for transactions that are created by mistake, users who are making mistakes that have been corrected too many times, and also to look for potentially fraudulent transactions.
This is one of the most important features a software package can provide to forensic accountants. A forensic accountant is a specially trained person who performs an analysis of accounting transactions, processes, and procedures and audits the financial data to discover and document fraud or other potential issues. It is important to note that performing computer forensics on accounting software is not the same as the work of a forensic accountant. Where a computer forensic examiner who also knows accounting can be of assistance using transaction logs will be covered later in this chapter.
40.3.1. Small business accounting software
Depending on the version of the accounting software purchased, the audit trail feature may not be available.
For example, in Peachtree Accounting, the audit trail feature is only available in the Peachtree Complete Accounting versions and higher. If the user is not using one of the packages that support this feature, then the audit logs will not be available for analysis.
The other thing to bear in mind is that the audit-tracking feature in many of the programs can be turned off, rendering the feature useless.
40.3.2. Mid-level to enterprise accounting software
Accounting software packages used by larger companies and organizations will always have excellent auditing capabilities. This of course cannot account for whether or not an in-house developed solution would have such features. Unless the developer of an in-house or custom application is required to ensure compliance with regulatory requirements like Sarbanes-Oxley, it is possible that even a large company can be caught without proper safeguards in place. However, few businesses of any size would want to operate without such safeguards available to protect themselves against internal and external fraud.
40.4. Getting the evidence
As with any application that uses a database for storage—and all financial packages do—the simplest way to get the evidence is by using the software itself for the forensic analysis, not by digging it out via a forensic tool.
In many cases, making a copy of the databases for the accounting for financial software is an option, while getting the application that is used by the person or persons is not. One option in this case to make sure that the evidence is properly preserved is to either make a backup of the accounting database and forensically acquire the backup, or to forensically image the entire hard drive of the accounting computer or server that contains the database.
If this is the case and it is a commercially available package that is within a reasonable cost range, simply purchasing the exact product will allow the examiner to extract the data and provide it to a forensic accountant or to the person requesting the information.
However, if it is a large accounting package that would be prohibitive to reproduce by simply purchasing a copy of the software, then either the work may have to be done on site, or an examiner may have to extract data from the databases herself. Extracting financial information from databases where the examiner does not have the application is fraught with peril and can be extremely costly.
The peril in going forward with extracting data directly from the database for the accounting software is that the structure of the database may not be easy to plot out to make sure the correct tables and records are connected in the right way to accurately reflect the actual data.
In other words, if the examiner or expert cannot determine if the table of accounts is properly connected to the table of transactions, then it is possible to generate erroneous reports.
The good news is that electronic accounting systems operate in a manner very close to that of their paper predecessors. There will be a general ledger that has numbers for different types of account buckets and transactions, a general journal that keeps a record of the changes made, along with the typical information a bookkeeper would enter into the system for accounting purposes.
So even if you do not have an audit trail, it is not impossible to reconstruct historical information from an accounting system database. It may be difficult and expensive, but it’s possible.
Where such reconstruction starts to get weird, for lack of a better term, is when the database for the accounting software is written in one of the older formats that does not support a single file for the database. When this is the case, attempting to sort out how the data connects together can be a real challenge.
40.5. Types of evidence from financial software
Depending on the goal of the case, the evidence needed will vary. The type of evidence can be the database file itself, the file system metadata (the computer file system’s recorded changes to the created, accessed, or modified times of the file itself), and even documents residing on the computer or server that holds printouts of reports in some other format.
The depth of the examination involves not only the accounting software, but other evidence, as we will discuss in the next section.
In this case, an employee was accused of stealing an account away from his employer when he left the company to work independently. A complete forensic image of the employee’s personal computer was made for preservation and analysis. Also requested and received was a copy of the client’s accounting software, in this case, QuickBooks Professional.
Since QuickBooks Professional has the audit log feature, it was used to extract the evidence needed. However, prior to viewing the audit logs in the company file (QuickBooks, like many small business packages, keeps a file for each company individually), an analysis of the hard drive was performed to make sure that previous copies of the company file were not present on the hard drive in other locations or that they hadn’t been deleted to attempt to hide them from discovery.
Once it was determined that the company file present on the computer hard drive was the one in question based on the file system metadata, the company file was opened in the program and the audit log was reviewed.
The audit log completely supported the ex-employee’s claim that he had received the new account after leaving the company and having been approached by the accounting client to contract with him for this service. The employee stated that he had gone back and manually entered historical transactions to bring the company file up to date, making the manual entries over a two-week period of work, after he had been contracted by the client.
This was simple to determine since the audit log keeps track of the transaction, the accounting date (the accounting date is the historical date for the transaction and is entered by the user), and the time stamp from the audit log. The time stamp in the audit log is entered automatically and cannot be changed by the user.
Further analysis to make sure that the dates and times on the computer had not been manipulated to distort the audit trail were performed to further authenticate the accuracy of the audit trail. The case was settled.
In another case, the client suspected that the seller of the business (who immediately started a new business in the same line of work) was using the information from the business he sold to take employees and accounts away from the client’s business.
In this case, the software being used was Peachtree Complete. Since Peachtree Complete also has the audit tracking feature, after getting forensic copies of the defendant’s computers, the company file for the seller’s current business was opened and reviewed.
The audit log contained entries showing the date and times when information from the business sold to the client was imported into the seller’s company file. This was in direct contradiction to the seller’s claims that he had not used any information from the business sold to the client.
40.6. Batch files as evidence
The good news about older accounting software that does not support audit trails, single-file databases, or some other features of more modern accounting software is that they typically keep batch files.
Much like its paper equivalents, accounting software may not permanently commit transactions to the general journal and various account buckets until the transactions are “posted.” This allows bookkeepers and accountants to run a “trial balance” to make sure that everything is correct, prior to committing the transactions to the ledgers. Posting usually occurs at the end of an account day or at the end of an accounting period.
Depending on how the accounting software is constructed from a database standpoint, the batch files may be an internal table in the database, or stored on the hard drive as individual files.
One reason batch files can be important is that they contain transactions of what was to be posted to the permanent accounting ledgers. In a case where you have older software that does not have an audit trail, such as some vertical market accounting packages, the system may still have all of the batch files for the system going back to the very first time the business “posted” any transactions.
Even if you cannot read the batch files, they can provide a record of when the accounting system first went into use by the company, and the last time the user posted their transactions. This can be important when you are faced with a case where a company claims to have started using the software after a certain date of interest or they claim that they stopped using the software after a certain date of interest.
40.7. Other sources of financial evidence
While accounting, personal money management, and financial systems all yield evidence in various forms, they are not all-inclusive when it comes to looking for evidence. Other forms of evidence that can be of interest in a case can be located in the Internet cache on the computer hard drive. This kind of evidence can contain bank transactions, purchases, payments, phone bills, money transfers, statements of money market accounts, and virtually anything you can do online to manage money.
Other items that can contain financial evidence are backup tapes, old floppy disks, USB sticks, online-only accounting systems, cell phones, and e-mail.
Finally, document types come into play as well. Electronic spreadsheets are an obvious choice for potential evidence. However, PDF documents, word processing documents, tax software data files, HTML files (web pages), and spreadsheets, stored on the hard drive, are all sources of evidence for cases.
There are a lot of software applications out in the marketplace for different purposes relating to money management, check writing, invoicing, and so forth. These types of programs can also produce data that can be recovered and used as evidence. Some of these programs are used only to write and print checks, to create invoices, to produce mailing and shipping labels, or other single-purpose uses.
In a case where the client was accused of first-degree murder and was facing life imprisonment, his computer hard drives were sent in for analysis. The client along with another person was accused of plotting to kill the victim in this case. The client claimed that he never planned to kill the victim, but was only scamming him for money and that the evidence of the scam was on his personal computer in the program Versa Check.
When the police examined the computer, they were unable to locate any evidence of the Versa Check program. However, when the computer was examined by the defense expert, he found the Versa Check database. Based on his testing, the defense expert was able to determine that that version of Versa Check used the same database file as a Microsoft Access database. When he opened the database in Microsoft Access, he was able to produce all of the checks written by the defendant. The Versa Check evidence led to a plea bargain where the client pled to over one hundred counts of check fraud. The murder charge against the client was dropped.
Summary
In this chapter we discussed accounting and financial software along with the various issues associated with them. We also looked at how the software works from the standpoint of evidence creation that can be recovered and analyzed in cases.
From single file–based systems to older vertical market applications using multiple file database storage, accounting and financial systems can be a challenge for an examiner.
We also looked at several cases where different kinds of evidence played a part in the case, both civil and criminal.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.