Good Times in Forensic Accounting

So what, exactly, is the fun all about? According to one formal description, forensic accounting “… does not merely look at the numbers but rather looks behind the numbers.”  

“The forensic accountants really do the number crunching," Moody said.  "But with changes in the way information is now being stored, we (as forensic accounting technicians) work side by side with them in gathering the information and then making sense of it.  Probably the biggest thing we bring to the table is in our data mining skill-set.”

Berenfeld, Spritzer, Shechter & Sheer brought their forensic technology practice online in January 2006.  After just six months, Moody employs eleven computer forensic technicians who work side by side with an equal number of forensic accountants on cases in seven states.  And he is experiencing thirty to forty percent growth each month.

What’s fueling the growth?

“A really big need,” laughs Moody.

Following the tracks

“We work on a lot of employee related cases, and those are always pretty interesting,” explains Moody. “My favorite cases are probably the employee—and especially the IT employee—gone bad cases.”

“Most people don’t understand that if you’re using a computer, there’s a record of your behavior somewhere. In other words, you’re never going to cover up your tracks.  Our job is to go out there and find them.”

Berenfeld, Spritzer, Shechter & Sheer’s state-of-the-art computer forensic software allows the firm to provide data acquisitions either on site or in its laboratory for large volume processing.

“We recover deleted files, we recover deleted e-mails, and we recover instant messaging. We have the ability to search through and process temp files and caches.  We’ve had cases where people have used file scrubbing programs where not only have they deleted the information, but they’ve overwritten the information.  And we’ve worked in establishing that those patterns exist.”

“We’ll do Internet based investigations identifying who the bad guy was and where he was working from—whether it’s a hacking case, a harassment case, or whatever the subject matter is.  It’s really broad, and we deal with a lot of different types of material and subject matter.  Like I said, it’s a lot of fun.”

The forensic accounting process

Forensic technicians typically open a case by meeting with a forensic accountant, attorney and any other vital personnel. Together they devise a data profile that serves as a character sketch for the data in question.

“And then we go on a hunt for the information,” Moody said.  “Once we’ve extracted it, we have a forensic accountant test specific data a specific way to see if a certain kind of inappropriate behavior has been performed.”

“What you used to do is just download tons of data and start shaping it and modeling it within Excel.  Since we can isolate the fields that forensic accountants would normally be pumping into their spreadsheets, we can leave it in its native form so we can ensure the integrity of the data and that there hasn’t been any transposition errors. This is literally saving hundreds and hundreds of hours and thousands and thousands of dollars.”

“We’re working with the accountant in developing the model and testing the model to insure that it’s accurate, and then we’re applying it to 100% of the data instead of just a sample.  Anything that could possibly be questionable is going to rise right to the top.”

Risk Management Consulting

Law firms and corporations are among Moody’s most common clients. Though about ninety percent of his current business is in computer forensic services, Moody hopes to build the technology risk management service, which comprises the remaining ten percent of the firm’s business.

“In all aspects of our practice we’re usually hired once things go wrong,” Moody said.  “We think it would be great if people involved us earlier.”

“Everyone understands the importance of IT consulting, but they don’t yet understand the importance of IT risk management consulting.  The industry was in its infancy five years ago, but it has grown exponentially with changes to state and federal laws.”

Independent validation saves money

While it may cost a few dollars up front, Moody believes risk management can save a significant amount of money in the long-term.

“The old term used to be IVV, Independent Validation and Verification of the project,” he said.  “And that is a missed art or skill that’s really needed.  For example, you’re a month into a project and you just ask some basic questions like, ‘Are we on budget?  Are we on time?  The plan says we should be at X.  Show me that we’re up to X already.’ And if you start getting answers that you don’t like—that’s probably the best time to bring somebody in.”

Not mainstream yet

Breaking into this line of business does not come cheaply.

“The development of a lab could cost you a quarter of a million dollars,” Moody said.  “That’s a lot of money to bet to see whether you’re going to get any kind of return in your first two years.  And the other problem you have is that you have to have somebody that’s a stakeholder in the practice that can help sell it, because we’re not mainstream yet.”

The training investment

Ongoing formal and informal training ensures everyone involved in the forensics process is up-to-date and informed.

“Right now I’m teaching a class for Northwestern University, and the best guinea pigs for the material that I’m teaching happen to be my own staff,” Moody said.  “So my own staff is required to go through this material that I’m teaching.  From a CLE or CPE standpoint my average team member probably completes about a hundred hours of CPE credit a year.”

Moody is also writing a book about computer forensics and digital investigations which he hopes to publish this spring.  It won’t, however, contain the juicy details of his most interesting cases.

“I can’t tell you about them,” said Moody.

(If you would like an opportunity to pick his brain, consider joining the Boomer Technology Circles™.  Moody is a member of Circle #7.)

How does one get started in this business?

Moody first began working in forensic accounting about eight years ago.

“I got started on a dare,” Moody explained.  “I was working with a law firm, and a partner in the firm had a case on which he wasn’t getting very far.  No one else could get the information, and they had had weeks to do it.  But I recovered the information in a matter of hours.  A short time later I read an article about how there was a huge need in the civil side of computer forensics and how it really wasn’t being done properly.  The combination of the two factors got me started.”

For the record, Moody is highly qualified for his job.  In addition to holding certifications in the areas of information systems auditing, technology security, and computer forensics, he has ten years experience working as an accountant for a health care group.  He has additionally served as the IT Manager, the IT Director and the Chief Information Officer for various businesses.  He earned a law degree in 1993.

Berenfeld, Spritzer, Shechter & Sheer was founded in 1971 and operates with a professional staff of over 150 from offices in Coral Gables and Ft. Lauderdale, Florida.  They provide a full range of accounting, auditing, tax and consulting services. In addition, they offer litigation support in domestic cases, business valuations, economic damages and forensic services.  Moody says that his practice works about ninety percent in computer forensics and about ten percent in technology risk management.