Continuing to focus on evidence associated with the act, concealment, and conversion, use the evidentiary material to continue the examination. In addition, the examiner also starts to think of terms of who, what (did the person(s) do), when (during what period?), where (physical place, location in books and records), and how (perpetrated, hidden, and did the perpetrator benefit). Your primary assignment is to examine the information and activity in the invoice and emails in terms of what (scheme), how was the act be perpetrated, and what benefits are there, if any. As with any data, consider patterns, breaks in patterns, and anomalies. Your focus is what you can conclude from the evidence, understanding that cases are solved, not with an all-telling piece of evidence, the “smoking gun,” but rather by assembling small pieces of evidence into a coherent picture.

Do the payroll disbursement hours comply with Benford’s Law?